3

I just installed WAZUH from its OVA.

The web interface is admin/admin

When I click reset password from the web interface i get this error

Failed to reset password. {"status":"FORBIDDEN","message":"Resource 'admin' is read-only."}

enter wazug admin password reset screenshot

I've googled/scanned documentation and can't find out how to change it.

I've looked through /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/config.yml and cant see an option either?

A simple fix but its not just appearing for me via searching/reading the manual

I plan to secure the admin password then create a user account to do my work

Thanks in adavance

Joshua
  • 1,128
  • 3
  • 17
  • 31
TXC
  • 31
  • 1
  • 1
  • 2

4 Answers4

1

For changing the password, first you have to download the wazuh-passwords-tool.sh script:

$ curl -so wazuh-passwords-tool.sh https://packages.wazuh.com/4.4/wazuh-passwords-tool.sh

Then, run the following command:

sudo bash wazuh-passwords-tool.sh -u admin -p <mypassword>

Please replace with your expected password for the user admin.

Alexandre Juma
  • 3,128
  • 1
  • 20
  • 46
CDprotector
  • 11
  • 2
1

run this command: curl -so wazuh-passwords-tool.sh https://packages.wazuh.com/4.5/wazuh-passwords-tool.sh

then run this after: bash wazuh-passwords-tool.sh -a #this command will change all wazuh services that need password plus the admin, note the password and use the admin one to login again.

WARNING: Wazuh indexer passwords changed. Remember to update the password in the Wazuh dashboard and Filebeat nodes if necessary, and restart the services. hope it helps anyone struggling.

kobs20
  • 11
  • 1
0

The admin and kibanaserver users are set to read-only as security measures, that is why it is not possible to change the password using the WUI and it must be changed in the configuration files.

This section of documentation talks about changing it: https://documentation.wazuh.com/4.0/user-manual/elasticsearch/elastic_tuning.html

Remember to update the new password in /etc/filebeat/filebeat.yml and /etc/kibana/kibana.yml if necessary.

I hope this information is helpful to you.

Best regards.

Juan Nicolas Asselle
  • 9
  • 2
  • "I hope this information is helpful to you." No it isn't. The actual answer you gave is a link-only-answer and that is basically no answer since from your post alone the question is not answered. Even if it can be answered with the link the link may rot in future. This is why this kind of answer is discouraged here at stack overflow: https://meta.stackoverflow.com/tags/link-only-answers/info – Jey DWork Jun 25 '22 at 15:19
0

If running Wazuh on Kubernetes and you need to change the default passwords look for the following files:

  • elastic-cred-secret.yaml
  • internal_users.yaml
  • wazuh-api-cred-secret.yaml
  • wazuh-authd-pass-secret.yaml

The one caveat is you have to base64 encode the password before updating in the aforementioned files. Afterward, do kubectl patch or apply and your password will be updated.

Jeremy Caney
  • 7,102
  • 69
  • 48
  • 77
Angel R
  • 1