diff --git a/README.md b/README.md index 27fcfb42..27c7e751 100644 --- a/README.md +++ b/README.md @@ -186,9 +186,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! filebeat_output_indexer_hosts: - "{{ hostvars.wi1.private_ip }}" - "{{ hostvars.wi2.private_ip }}" @@ -232,12 +229,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod vars: indexer_network_host: "{{ hostvars.wi1.private_ip }}" dashboard_node_name: node-6 - wazuh_api_credentials: - - id: default - url: https://{{ hostvars.manager.private_ip }} - port: 55000 - username: custom-user - password: SecretPassword1! ansible_shell_allow_world_readable_temp: true ``` @@ -375,9 +366,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a Wazu nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! - hosts: worker01 roles: diff --git a/playbooks/wazuh-manager-oss-cluster.yml b/playbooks/wazuh-manager-oss-cluster.yml index 57109581..93fffa3d 100644 --- a/playbooks/wazuh-manager-oss-cluster.yml +++ b/playbooks/wazuh-manager-oss-cluster.yml @@ -22,9 +22,6 @@ nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! - hosts: worker01 roles: diff --git a/playbooks/wazuh-production-ready.yml b/playbooks/wazuh-production-ready.yml index da866cfa..5d939c29 100644 --- a/playbooks/wazuh-production-ready.yml +++ b/playbooks/wazuh-production-ready.yml @@ -117,9 +117,6 @@ nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! filebeat_output_indexer_hosts: - "{{ hostvars.wi1.private_ip }}" - "{{ hostvars.wi2.private_ip }}" @@ -167,10 +164,4 @@ - "{{ hostvars.wi2.private_ip }}" - "{{ hostvars.wi3.private_ip }}" dashboard_node_name: node-6 - wazuh_api_credentials: - - id: default - url: https://{{ hostvars.manager.private_ip }} - port: 55000 - username: custom-user - password: SecretPassword1! ansible_shell_allow_world_readable_temp: true diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index 06d1a67b..c66a3894 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -363,9 +363,6 @@ wazuh_manager_api: remote_commands_localfile_exceptions: [] remote_commands_wodle: yes remote_commands_wodle_exceptions: [] -# wazuh_api_users: -# - username: custom-user -# password: .S3cur3Pa55w0rd*- # Must comply with requirements (8+ length, uppercase, lowercase, specials chars) # NOTE: As wazuh_manager_config is built dynamically per playbooks and ansible.cfg provided in the repo, # we should also cover the case for partial settings in inventory variables overlayed on top of role's diff --git a/roles/wazuh/ansible-wazuh-manager/files/create_user.py b/roles/wazuh/ansible-wazuh-manager/files/create_user.py deleted file mode 100644 index 0216d58d..00000000 --- a/roles/wazuh/ansible-wazuh-manager/files/create_user.py +++ /dev/null @@ -1,102 +0,0 @@ -import logging -import sys -import json -import random -import string -import os - -# Set framework path -sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework") - -USER_FILE_PATH = "/var/ossec/api/configuration/admin.json" -SPECIAL_CHARS = "@$!%*?&-_" - - -try: - from wazuh.rbac.orm import check_database_integrity - from wazuh.security import ( - create_user, - get_users, - get_roles, - set_user_role, - update_user, - ) -except Exception as e: - logging.error("No module 'wazuh' found.") - sys.exit(1) - - -def read_user_file(path=USER_FILE_PATH): - with open(path) as user_file: - data = json.load(user_file) - return data["username"], data["password"] - - -def db_users(): - users_result = get_users() - return {user["username"]: user["id"] for user in users_result.affected_items} - - -def db_roles(): - roles_result = get_roles() - return {role["name"]: role["id"] for role in roles_result.affected_items} - -def disable_user(uid): - random_pass = "".join( - random.choices( - string.ascii_uppercase - + string.ascii_lowercase - + string.digits - + SPECIAL_CHARS, - k=8, - ) - ) - # assure there must be at least one character from each group - random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]]) - random_pass = ''.join(random.sample(random_pass,len(random_pass))) - update_user( - user_id=[ - str(uid), - ], - password=random_pass, - ) - - -if __name__ == "__main__": - if not os.path.exists(USER_FILE_PATH): - # abort if no user file detected - sys.exit(0) - username, password = read_user_file() - - # create RBAC database - check_database_integrity() - - initial_users = db_users() - if username not in initial_users: - # create a new user - create_user(username=username, password=password) - users = db_users() - uid = users[username] - roles = db_roles() - rid = roles["administrator"] - set_user_role( - user_id=[ - str(uid), - ], - role_ids=[ - str(rid), - ], - ) - else: - # modify an existing user ("wazuh" or "wazuh-wui") - uid = initial_users[username] - update_user( - user_id=[ - str(uid), - ], - password=password, - ) - # disable unused default users - #for def_user in ['wazuh', 'wazuh-wui']: - # if def_user != username: - # disable_user(initial_users[def_user]) \ No newline at end of file diff --git a/roles/wazuh/ansible-wazuh-manager/tasks/main.yml b/roles/wazuh/ansible-wazuh-manager/tasks/main.yml index 6bbd5b33..4a533e13 100644 --- a/roles/wazuh/ansible-wazuh-manager/tasks/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/tasks/main.yml @@ -304,44 +304,6 @@ tags: - config -- name: Create custom API user - block: - - name: Copy create_user script - copy: - src: create_user.py - dest: "{{ wazuh_dir }}/framework/scripts/create_user.py" - owner: root - group: wazuh - mode: 0644 - - - name: Create admin.json - template: - src: templates/admin.json.j2 - dest: "{{ wazuh_dir }}/api/configuration/admin.json" - owner: wazuh - group: wazuh - mode: 0644 - no_log: true - - - name: Execute create_user script - script: - chdir: "{{ wazuh_dir }}/framework/scripts/" - cmd: create_user.py --username "{{ item.username }}" --password "{{ item.password }}" - executable: "{{ wazuh_dir }}/framework/python/bin/python3" - with_items: - - "{{ wazuh_api_users }}" - - - name: Delete create_user script - file: - path: "{{ wazuh_dir }}/framework/scripts/create_user.py" - state: absent - - tags: - - config_api_users - when: - - wazuh_api_users is defined - - wazuh_manager_config.cluster.node_type == "master" - - name: Agentless Hosts & Passwd template: src: agentless.j2 diff --git a/roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 b/roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 deleted file mode 100644 index 6522f530..00000000 --- a/roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 +++ /dev/null @@ -1,4 +0,0 @@ - -{% for api in wazuh_api_users %} -{"username":"{{ api['username'] }}", "password": "{{ api['password'] }}"} -{% endfor %} \ No newline at end of file