Changing the admin password in docker deployment (ver. 4.3)

[Sandeep Renjith]

WIth Wazuh 4.3 it is quite difficult to change the admin password of Opensearch. 

I understand that this is more of an Opensearch issue than a Wazuh issue.

However, I am commenting on the usage of the wazuh-opendistro-passwords-tool.sh and the documentation on Wazuh docs (4.3) linked below.

https://documentation.wazuh.com/current/user-manual/securing-wazuh/opendistro.html

The issue is that the tool doesn't currently seem to work with Opensearch. 

Outside of the tool, the method I was using for password reset on Opendistro (pre 4.3 Wazuh) was the one linked below. 

https://github.com/opendistro/for-elasticsearch-docs/issues/5

This method seems to come with its own set of issues on Opensearch (on docker). 

Requested resolution
Update wazuh-opendistro-passwords-tool.sh to include opensearch
Update documentation on this specific to opensearch

Only sane solution which worked for me

- Change value of reserved to false for the user 'admin' in internal_users.yml in /wazuh-docker/single-node/config/wazuh_indexer before bringing up the cluster. 

 admin:

  hash: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  reserved: false (this was true)
  backend_roles:
  - "admin"
  description: "Demo admin user"

I am not sure if this is the best solution to change the admin user from read-only mode. Please let me know if there is a better way of doing this. 

[Pablo Ariel Gonzalez]

Hi Sandeep, it's a pleasure to discuss this topic with you.

Thank you very much for the time you have taken to explain the problem and the solution you have applied to solve it. We are going to analyze it in detail and then we will share an answer with you.

For this I ask if you could tell us, have you deployed the new version 4.3 of Wazuh in docker following the installation guide? Since this version has the new Wazuh-indexer and Wazuh-dashboard components, this information would be very useful for the analysis.

Thanks,

[Kompromittiert]

Same problem for me, fresh docker install, no documentation will fit.

hash.sh:
not executable inside wazuh.indexer, because it lacks of jre.

./wazuh-passwords-tool.sh: 

grep: /etc/wazuh-indexer/opensearch.yml: No such file or directory
./wazuh-passwords-tool.sh: line 468: [: ==: unary operator expected
21/06/2022 10:24:25 ERROR: Cannot find Wazuh indexer, Wazuh dashboard or Filebeat on the system.

So this script will only fit for non-docker instances.

Manually changing interal_user.yml by use a custom bcrypt hash tool and finally make the changes available with securityadmin.sh, also fails:

WARNING: JAVA_HOME not set, will use

[Daniel D'Angeli]

For the java problem, add the following environment variable to the docker compose:

environment:

- "JAVA_HOME=/usr/share/wazuh-indexer/jdk"

[Daniel D'Angeli]

For anyone looking for a fix, i have found the solution.

Check the issue on GitHub here: https://github.com/wazuh/wazuh-docker/issues/677

[Pablo Ariel Gonzalez]

Hi Everyone,

Daniel, thanks for the information and detail. We are looking into what you comment earlier about the environment variable not being generated properly. 

As soon as we have news we will share it with you.

Thanks,