Merge pull request #1967 from wazuh/bug/1965-remove_custom_user
Remove custom user configuration and related scripts
This commit is contained in:
Gonzalo Acuña
GitHub
commit
76b16f9a8f
@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file.
|
||||
|
||||
### Changed
|
||||
|
||||
- Remove custom user configuration and related scripts ([#1967](https://github.com/wazuh/wazuh-ansible/pull/1967))
|
||||
- Fix mismatched tags in .j2 template files ([#1930](https://github.com/wazuh/wazuh-ansible/pull/1930))
|
||||
- Address Misconfiguration of indexer_cluster_nodes Parameter ([#1929](https://github.com/wazuh/wazuh-ansible/pull/1929))
|
||||
- Remove meta yamls that prevent indexer and agent role installation from PR #1806 ([#1921](https://github.com/wazuh/wazuh-ansible/pull/1921))
|
||||
|
||||
10
README.md
10
README.md
@ -186,9 +186,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod
|
||||
nodes:
|
||||
- "{{ hostvars.manager.private_ip }}"
|
||||
hidden: 'no'
|
||||
wazuh_api_users:
|
||||
- username: custom-user
|
||||
password: SecretPassword1!
|
||||
filebeat_output_indexer_hosts:
|
||||
- "{{ hostvars.wi1.private_ip }}"
|
||||
- "{{ hostvars.wi2.private_ip }}"
|
||||
@ -236,8 +233,8 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod
|
||||
- id: default
|
||||
url: https://{{ hostvars.manager.private_ip }}
|
||||
port: 55000
|
||||
username: custom-user
|
||||
password: SecretPassword1!
|
||||
username: "wazuh-wui"
|
||||
password: "wazuh-wui"
|
||||
ansible_shell_allow_world_readable_temp: true
|
||||
```
|
||||
|
||||
@ -375,9 +372,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a Wazu
|
||||
nodes:
|
||||
- "{{ hostvars.manager.private_ip }}"
|
||||
hidden: 'no'
|
||||
wazuh_api_users:
|
||||
- username: custom-user
|
||||
password: SecretPassword1!
|
||||
|
||||
- hosts: worker01
|
||||
roles:
|
||||
|
||||
@ -22,9 +22,6 @@
|
||||
nodes:
|
||||
- "{{ hostvars.manager.private_ip }}"
|
||||
hidden: 'no'
|
||||
wazuh_api_users:
|
||||
- username: custom-user
|
||||
password: SecretPassword1!
|
||||
|
||||
- hosts: worker01
|
||||
roles:
|
||||
|
||||
@ -117,9 +117,6 @@
|
||||
nodes:
|
||||
- "{{ hostvars.manager.private_ip }}"
|
||||
hidden: 'no'
|
||||
wazuh_api_users:
|
||||
- username: custom-user
|
||||
password: SecretPassword1!
|
||||
filebeat_output_indexer_hosts:
|
||||
- "{{ hostvars.wi1.private_ip }}"
|
||||
- "{{ hostvars.wi2.private_ip }}"
|
||||
@ -171,6 +168,6 @@
|
||||
- id: default
|
||||
url: https://{{ hostvars.manager.private_ip }}
|
||||
port: 55000
|
||||
username: custom-user
|
||||
password: SecretPassword1!
|
||||
username: "wazuh-wui"
|
||||
password: "wazuh-wui"
|
||||
ansible_shell_allow_world_readable_temp: true
|
||||
|
||||
@ -1,49 +0,0 @@
|
||||
---
|
||||
kibana_node_name: node-1
|
||||
|
||||
elasticsearch_http_port: "9200"
|
||||
elasticsearch_network_host: "127.0.0.1"
|
||||
kibana_server_host: "0.0.0.0"
|
||||
kibana_server_port: "5601"
|
||||
kibana_conf_path: /etc/kibana
|
||||
elastic_stack_version: 7.10.2
|
||||
wazuh_version: 4.14.4
|
||||
wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana
|
||||
|
||||
elasticrepo:
|
||||
apt: 'https://artifacts.elastic.co/packages/7.x/apt'
|
||||
yum: 'https://artifacts.elastic.co/packages/7.x/yum'
|
||||
gpg: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch'
|
||||
key_id: '46095ACC8548582C1A2699A9D27D666CD88E42B4'
|
||||
|
||||
# API credentials
|
||||
wazuh_api_credentials:
|
||||
- id: "default"
|
||||
url: "https://localhost"
|
||||
port: 55000
|
||||
username: "wazuh"
|
||||
password: "wazuh"
|
||||
|
||||
# Xpack Security
|
||||
kibana_xpack_security: false
|
||||
kibana_ssl_verification_mode: "full"
|
||||
|
||||
elasticsearch_xpack_security_user: elastic
|
||||
elasticsearch_xpack_security_password: elastic_pass
|
||||
|
||||
node_certs_destination: /etc/kibana/certs
|
||||
|
||||
# CA Generation
|
||||
master_certs_path: "{{ playbook_dir }}/es_certs"
|
||||
generate_CA: true
|
||||
ca_cert_name: ""
|
||||
|
||||
# Nodejs
|
||||
nodejs:
|
||||
repo_dict:
|
||||
debian: "deb"
|
||||
redhat: "rpm"
|
||||
repo_url_ext: "nodesource.com/setup_10.x"
|
||||
|
||||
#Nodejs NODE_OPTIONS
|
||||
node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536
|
||||
@ -1,57 +0,0 @@
|
||||
---
|
||||
|
||||
# Kibana configuration
|
||||
elasticsearch_http_port: 9200
|
||||
elastic_api_protocol: https
|
||||
kibana_conf_path: /etc/kibana
|
||||
kibana_node_name: node-1
|
||||
kibana_server_host: "0.0.0.0"
|
||||
kibana_server_port: "5601"
|
||||
kibana_server_name: "kibana"
|
||||
kibana_max_payload_bytes: 1048576
|
||||
elastic_stack_version: 7.10.2
|
||||
wazuh_version: 4.4.1
|
||||
wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana
|
||||
|
||||
# The OpenDistro package repository
|
||||
kibana_opendistro_version: 1.13.2-1 # Version includes the - for RedHat family compatibility, replace with = for Debian hosts
|
||||
|
||||
package_repos:
|
||||
yum:
|
||||
opendistro:
|
||||
baseurl: 'https://packages.wazuh.com/4.x/yum/'
|
||||
gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH'
|
||||
apt:
|
||||
opendistro:
|
||||
baseurl: 'deb https://packages.wazuh.com/4.x/apt/ stable main'
|
||||
gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH'
|
||||
|
||||
# API credentials
|
||||
wazuh_api_credentials:
|
||||
- id: "default"
|
||||
url: "https://localhost"
|
||||
port: 55000
|
||||
username: "wazuh"
|
||||
password: "wazuh"
|
||||
|
||||
# opendistro Security
|
||||
kibana_opendistro_security: true
|
||||
kibana_newsfeed_enabled: "false"
|
||||
kibana_telemetry_optin: "false"
|
||||
kibana_telemetry_enabled: "false"
|
||||
|
||||
opendistro_admin_password: changeme
|
||||
opendistro_kibana_user: kibanaserver
|
||||
opendistro_kibana_password: changeme
|
||||
local_certs_path: "{{ playbook_dir }}/opendistro/certificates"
|
||||
|
||||
# Nodejs
|
||||
nodejs:
|
||||
repo_dict:
|
||||
debian: "deb"
|
||||
redhat: "rpm"
|
||||
repo_url_ext: "nodesource.com/setup_10.x"
|
||||
|
||||
|
||||
#Nodejs NODE_OPTIONS
|
||||
node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536
|
||||
@ -363,9 +363,6 @@ wazuh_manager_api:
|
||||
remote_commands_localfile_exceptions: []
|
||||
remote_commands_wodle: yes
|
||||
remote_commands_wodle_exceptions: []
|
||||
# wazuh_api_users:
|
||||
# - username: custom-user
|
||||
# password: .S3cur3Pa55w0rd*- # Must comply with requirements (8+ length, uppercase, lowercase, specials chars)
|
||||
|
||||
# NOTE: As wazuh_manager_config is built dynamically per playbooks and ansible.cfg provided in the repo,
|
||||
# we should also cover the case for partial settings in inventory variables overlayed on top of role's
|
||||
|
||||
@ -1,102 +0,0 @@
|
||||
import logging
|
||||
import sys
|
||||
import json
|
||||
import random
|
||||
import string
|
||||
import os
|
||||
|
||||
# Set framework path
|
||||
sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework")
|
||||
|
||||
USER_FILE_PATH = "/var/ossec/api/configuration/admin.json"
|
||||
SPECIAL_CHARS = "@$!%*?&-_"
|
||||
|
||||
|
||||
try:
|
||||
from wazuh.rbac.orm import check_database_integrity
|
||||
from wazuh.security import (
|
||||
create_user,
|
||||
get_users,
|
||||
get_roles,
|
||||
set_user_role,
|
||||
update_user,
|
||||
)
|
||||
except Exception as e:
|
||||
logging.error("No module 'wazuh' found.")
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def read_user_file(path=USER_FILE_PATH):
|
||||
with open(path) as user_file:
|
||||
data = json.load(user_file)
|
||||
return data["username"], data["password"]
|
||||
|
||||
|
||||
def db_users():
|
||||
users_result = get_users()
|
||||
return {user["username"]: user["id"] for user in users_result.affected_items}
|
||||
|
||||
|
||||
def db_roles():
|
||||
roles_result = get_roles()
|
||||
return {role["name"]: role["id"] for role in roles_result.affected_items}
|
||||
|
||||
def disable_user(uid):
|
||||
random_pass = "".join(
|
||||
random.choices(
|
||||
string.ascii_uppercase
|
||||
+ string.ascii_lowercase
|
||||
+ string.digits
|
||||
+ SPECIAL_CHARS,
|
||||
k=8,
|
||||
)
|
||||
)
|
||||
# assure there must be at least one character from each group
|
||||
random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]])
|
||||
random_pass = ''.join(random.sample(random_pass,len(random_pass)))
|
||||
update_user(
|
||||
user_id=[
|
||||
str(uid),
|
||||
],
|
||||
password=random_pass,
|
||||
)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
if not os.path.exists(USER_FILE_PATH):
|
||||
# abort if no user file detected
|
||||
sys.exit(0)
|
||||
username, password = read_user_file()
|
||||
|
||||
# create RBAC database
|
||||
check_database_integrity()
|
||||
|
||||
initial_users = db_users()
|
||||
if username not in initial_users:
|
||||
# create a new user
|
||||
create_user(username=username, password=password)
|
||||
users = db_users()
|
||||
uid = users[username]
|
||||
roles = db_roles()
|
||||
rid = roles["administrator"]
|
||||
set_user_role(
|
||||
user_id=[
|
||||
str(uid),
|
||||
],
|
||||
role_ids=[
|
||||
str(rid),
|
||||
],
|
||||
)
|
||||
else:
|
||||
# modify an existing user ("wazuh" or "wazuh-wui")
|
||||
uid = initial_users[username]
|
||||
update_user(
|
||||
user_id=[
|
||||
str(uid),
|
||||
],
|
||||
password=password,
|
||||
)
|
||||
# disable unused default users
|
||||
#for def_user in ['wazuh', 'wazuh-wui']:
|
||||
# if def_user != username:
|
||||
# disable_user(initial_users[def_user])
|
||||
@ -304,44 +304,6 @@
|
||||
tags:
|
||||
- config
|
||||
|
||||
- name: Create custom API user
|
||||
block:
|
||||
- name: Copy create_user script
|
||||
copy:
|
||||
src: create_user.py
|
||||
dest: "{{ wazuh_dir }}/framework/scripts/create_user.py"
|
||||
owner: root
|
||||
group: wazuh
|
||||
mode: 0644
|
||||
|
||||
- name: Create admin.json
|
||||
template:
|
||||
src: templates/admin.json.j2
|
||||
dest: "{{ wazuh_dir }}/api/configuration/admin.json"
|
||||
owner: wazuh
|
||||
group: wazuh
|
||||
mode: 0644
|
||||
no_log: true
|
||||
|
||||
- name: Execute create_user script
|
||||
script:
|
||||
chdir: "{{ wazuh_dir }}/framework/scripts/"
|
||||
cmd: create_user.py --username "{{ item.username }}" --password "{{ item.password }}"
|
||||
executable: "{{ wazuh_dir }}/framework/python/bin/python3"
|
||||
with_items:
|
||||
- "{{ wazuh_api_users }}"
|
||||
|
||||
- name: Delete create_user script
|
||||
file:
|
||||
path: "{{ wazuh_dir }}/framework/scripts/create_user.py"
|
||||
state: absent
|
||||
|
||||
tags:
|
||||
- config_api_users
|
||||
when:
|
||||
- wazuh_api_users is defined
|
||||
- wazuh_manager_config.cluster.node_type == "master"
|
||||
|
||||
- name: Agentless Hosts & Passwd
|
||||
template:
|
||||
src: agentless.j2
|
||||
|
||||
@ -1,4 +0,0 @@
|
||||
|
||||
{% for api in wazuh_api_users %}
|
||||
{"username":"{{ api['username'] }}", "password": "{{ api['password'] }}"}
|
||||
{% endfor %}
|
||||
Loading…
Reference in New Issue
Block a user