Wazuh - How to change admin password for web interface

user_14868666 0
Viewed 15245

I just installed WAZUH from its OVA.

The web interface is admin/admin

When I click reset password from the web interface i get this error

Failed to reset password. {"status":"FORBIDDEN","message":"Resource 'admin' is read-only."}

enter wazug admin password reset screenshot

I've googled/scanned documentation and can't find out how to change it.

I've looked through /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/config.yml and cant see an option either?

A simple fix but its not just appearing for me via searching/reading the manual

I plan to secure the admin password then create a user account to do my work

Thanks in adavance

wazuh elasticsearch sysadmin
2 Answers

The admin and kibanaserver users are set to read-only as security measures, that is why it is not possible to change the password using the WUI and it must be changed in the configuration files.

This section of documentation talks about changing it: https://documentation.wazuh.com/4.0/user-manual/elasticsearch/elastic_tuning.html

Remember to update the new password in /etc/filebeat/filebeat.yml and /etc/kibana/kibana.yml if necessary.

I hope this information is helpful to you.

Best regards.

user_141724360

If running Wazuh on Kubernetes and you need to change the default passwords look for the following files:

  • elastic-cred-secret.yaml
  • internal_users.yaml
  • wazuh-api-cred-secret.yaml
  • wazuh-authd-pass-secret.yaml

The one caveat is you have to base64 encode the password before updating in the aforementioned files. Afterward, do kubectl patch or apply and your password will be updated.

user_179877400
Related