Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove references to wazuh.yml file and adapt to the new configuration system #7050

Open
wants to merge 22 commits into
base: 4.9.0
Choose a base branch
from

Conversation

Desvelao
Copy link
Member

Description

This pull request removes the references to the configuration of the Wazuh plugins using the wazuh.yml file and adapt to the new system.

Changes:

  • Remove references to wazuh.yml
  • Add documentation about the new system
  • Add new Wazuh dashboard settings:
    • wazuh_core.configuration.encryption_key
    • wazuh_core.instance

Checks

Docs building

  • Compiles without warnings.

Code formatting and web optimization

  • Uses three spaces indentation.
  • Adds or updates meta descriptions accordingly.
  • Updates the redirects.js script if necessary (check this guide).

Writing style

  • Uses present tense, active voice, and semi-formal registry.
  • Uses short, simple sentences.
  • Uses bold for user interface elements, italics for key terms or emphasis, and code font for Bash commands, file names, REST paths, and code.

…ction

- Remove references to wazuh.yml
- Add documentation about the new system
- Add platform settings
@Desvelao Desvelao self-assigned this Feb 21, 2024
@Desvelao Desvelao linked an issue Feb 21, 2024 that may be closed by this pull request
23 tasks
@Desvelao
Copy link
Member Author

Desvelao commented Feb 21, 2024

Consider the changes related to the administrator user according to wazuh/wazuh-dashboard-plugins#6201 (comment) for the guides related to the creation of an administrator user.

Update 2024/02/27: the guides to creating an admin user, give the all_access role to the user that by default should give access to the rest API of Wazuh indexer and be able to manage the plugin settings and other actions as manage the sample data. We could leave it as it is or add some type of clarification.

This decision is on hold until we concrete the details taking into account the compatibility with the cloud deployments. wazuh/wazuh-dashboard-plugins#6201 (comment)

@Desvelao Desvelao marked this pull request as ready for review February 27, 2024 08:10
@Desvelao Desvelao requested a review from javimed March 12, 2024 07:17
@javimed javimed added level/task Task issue type/enhancement Enhancement issue labels Mar 12, 2024
@Desvelao Desvelao requested a review from a team March 13, 2024 06:58
Copy link
Member

@asteriscos asteriscos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found several references to the wazuh.yml file. We must analyze each of the following references to check if they must be deleted or changed:

All components included in this AMI are configured to work out-of-the-box without the need to modify any settings. However, all components can be fully customized. The configuration files locations are the following.
- Wazuh manager: ``/var/ossec/etc/ossec.conf``
- Wazuh indexer: ``/etc/wazuh-indexer/opensearch.yml``
- Filebeat-OSS: ``/etc/filebeat/filebeat.yml``
- Wazuh dashboard:
- ``/etc/wazuh-dashboard/opensearch_dashboards.yml``
- ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml``
To learn more about configuring Wazuh, see the :doc:`User manual </user-manual/index>`.

wazuh.dashboard:
image: wazuh/wazuh-dashboard:|WAZUH_CURRENT_KUBERNETES|
volumes:
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
- ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
- ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml

The ``wazuh-wui`` user is the user to connect with the Wazuh API by default. Follow these steps to change the password.
.. note::
The password for Wazuh API users must be between 8 and 64 characters long. It must contain at least one uppercase and one lowercase letter, a number, and a symbol.
#. Open the file ``config/wazuh_dashboard/wazuh.yml`` and modify the value of ``password`` parameter.

- Wazuh dashboard:
- ``/etc/wazuh-dashboard/opensearch_dashboards.yml``
- ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml``

#. Port your settings from ``/usr/share/kibana/data/wazuh/config/wazuh.yml`` to ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml``. It is recommended to copy the content from ``/usr/share/kibana/data/wazuh/downloads/`` as well.
#. Access the Wazuh web interface at ``https://<dashboard_ip>`` with your credentials and make sure that everything is working as expected.

Could not connect to API with id: default: 3003 - Missing param: API USERNAME
-----------------------------------------------------------------------------
Starting Wazuh 4.0 the Wazuh API username variable changed from ``user`` to ``username``. It's necessary to change the credentials (foo:bar are no longer accepted) as well as the name of the variable in the ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml`` configuration file. For example, the configuration can be:

Copy link
Member

@javimed javimed left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could add a screenshot of Dashboard management > Server APIs highlighting the Run as field in the same way we currently have a wazuh.yml sample highlighting the run_as value. It would be placed at the same location as the yaml sample (between "If Run as is set to false" and "If Run as is set to true" repeating on many of the files.

Same goes for other wazuh.yml samples this PR is removing. We could better replace them with a shot of the configuration screen.

Copy link
Member

@javimed javimed left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sections hierarchy isn't clear enough.

imagen

source/user-manual/wazuh-dashboard/config-file.rst Outdated Show resolved Hide resolved
source/user-manual/wazuh-dashboard/config-file.rst Outdated Show resolved Hide resolved
source/user-manual/wazuh-dashboard/config-file.rst Outdated Show resolved Hide resolved
@Desvelao
Copy link
Member Author

I found several references to the wazuh.yml file. We must analyze each of the following references to check if they must be deleted or changed:

All components included in this AMI are configured to work out-of-the-box without the need to modify any settings. However, all components can be fully customized. The configuration files locations are the following.
- Wazuh manager: ``/var/ossec/etc/ossec.conf``
- Wazuh indexer: ``/etc/wazuh-indexer/opensearch.yml``
- Filebeat-OSS: ``/etc/filebeat/filebeat.yml``
- Wazuh dashboard:
- ``/etc/wazuh-dashboard/opensearch_dashboards.yml``
- ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml``
To learn more about configuring Wazuh, see the :doc:`User manual </user-manual/index>`.

wazuh.dashboard:
image: wazuh/wazuh-dashboard:|WAZUH_CURRENT_KUBERNETES|
volumes:
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
- ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
- ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml

The ``wazuh-wui`` user is the user to connect with the Wazuh API by default. Follow these steps to change the password.
.. note::
The password for Wazuh API users must be between 8 and 64 characters long. It must contain at least one uppercase and one lowercase letter, a number, and a symbol.
#. Open the file ``config/wazuh_dashboard/wazuh.yml`` and modify the value of ``password`` parameter.

- Wazuh dashboard:
- ``/etc/wazuh-dashboard/opensearch_dashboards.yml``
- ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml``

#. Port your settings from ``/usr/share/kibana/data/wazuh/config/wazuh.yml`` to ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml``. It is recommended to copy the content from ``/usr/share/kibana/data/wazuh/downloads/`` as well.
#. Access the Wazuh web interface at ``https://<dashboard_ip>`` with your credentials and make sure that everything is working as expected.

Could not connect to API with id: default: 3003 - Missing param: API USERNAME
-----------------------------------------------------------------------------
Starting Wazuh 4.0 the Wazuh API username variable changed from ``user`` to ``username``. It's necessary to change the credentials (foo:bar are no longer accepted) as well as the name of the variable in the ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml`` configuration file. For example, the configuration can be:

I removed some references:

  • All components included in this AMI are configured to work out-of-the-box without the need to modify any settings. However, all components can be fully customized. The configuration files locations are the following.
    - Wazuh manager: ``/var/ossec/etc/ossec.conf``
    - Wazuh indexer: ``/etc/wazuh-indexer/opensearch.yml``
    - Filebeat-OSS: ``/etc/filebeat/filebeat.yml``
    - Wazuh dashboard:
    - ``/etc/wazuh-dashboard/opensearch_dashboards.yml``
    - ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml``
    To learn more about configuring Wazuh, see the :doc:`User manual </user-manual/index>`.
  • - Wazuh dashboard:
    - ``/etc/wazuh-dashboard/opensearch_dashboards.yml``
    - ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml``
  • Could not connect to API with id: default: 3003 - Missing param: API USERNAME
    -----------------------------------------------------------------------------
    Starting Wazuh 4.0 the Wazuh API username variable changed from ``user`` to ``username``. It's necessary to change the credentials (foo:bar are no longer accepted) as well as the name of the variable in the ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml`` configuration file. For example, the configuration can be:

    I decided to remove this entry in the troubleshooting because this error is not thrown anymore. See the details for more information.

This error was caused by the API endpoint POST /api/check-api that validated the request payload. but this validation was commented so does not apply: wazuh/wazuh-dashboard-plugins@bbeea3a

The references to the upgrade the Docker deployment depend on the Wazuh dashboard image for that version. This has to be communicated to the responsible team.

Same topic with the reference in the migration guide from the Kibana to the Wazuh dashboard.

#. Port your settings from ``/usr/share/kibana/data/wazuh/config/wazuh.yml`` to ``/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml``. It is recommended to copy the content from ``/usr/share/kibana/data/wazuh/downloads/`` as well.
#. Access the Wazuh web interface at ``https://<dashboard_ip>`` with your credentials and make sure that everything is working as expected.

@Desvelao
Copy link
Member Author

We could add a screenshot of Dashboard management > Server APIs highlighting the Run as field in the same way we currently have a wazuh.yml sample highlighting the run_as value. It would be placed at the same location as the yaml sample (between "If Run as is set to false" and "If Run as is set to true" repeating on many of the files.

Same goes for other wazuh.yml samples this PR is removing. We could better replace them with a shot of the configuration screen.

I added a screenshot to check if the run_as is enabled or not.

I will review the other references you mentioned.

…n API connection and check the Run as status
@Desvelao
Copy link
Member Author

I added more screenshots about the addition and edition of an API connection and checking the Run as status.

run_as: false

If ``run_as`` is set to ``true``, you need to add a role mapping on the Wazuh dashboard. To map the backend role to Wazuh, follow these steps:
.. image:: /images/wazuh-dashboard/api-connections/wazuh-dashboard-check-api-connection-run-as.jpg
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure which image is more appropriate to show here, if the Run as is disabled or enabled. What do you think about this @javimed ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry I overlooked this question, @Desvelao . We could put the Run as is disabled just like the code block we currently have showing false. The image would go after the "If Run as is set to false..." text but before the "If Run as is set to true..." text just like the current code block we have. I think run as false is the simplest configuration option and worth displaying.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The displayed value as Run as in the API connections table is not the same value ( false / true ) that is configured in the API hosts. The raw value of the Run as setting is not displayed. Instead, the displayed value can display a missconfiguration.

CC: @asteriscos

@Desvelao
Copy link
Member Author

Sections hierarchy isn't clear enough.

imagen

Do you have a proposal for an improvement @javimed ?

CC: @asteriscos

@javimed
Copy link
Member

javimed commented Mar 15, 2024

Do you have a proposal for an improvement @javimed ?

CC: @asteriscos

@Desvelao, the structure could reflect the alternatives and options the user has. If the configuration of the Wazuh dashboard is different to that of the plugins, then this whole Configuration section should have two clearly separated sub-sections:

  • One for configuring the dashboard
  • One for configuring the Plugins

The way it is now I'm not sure if Setup a configuration applies only to the plugins configuration. In addition I can see General options at the same level as Configuration file and I don't know what configuration file are we talking about here nor if this is useful to configure the Wazuh dashboard or the plugins. There's an Example subsection but it's not clear to me if this belongs to configuring the plugins or what. Then I can see a Configuration of the Wazuh dashboard section showing some options and it's not clear what file to edit to use them. And I even wonder if maybe there's some shared configuration for both dashboard and plugins preventing this clear separation I'm mentioning.


- **Plugins settings**: Users with privileges to manage the Wazuh indexer security REST API can manage the plugins settings from the Wazuh dashboard. Wazuh stores the custom values in a saved object.

- **Dashboard management** > **App Settings**: To customize several settings.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Several settings such as what?

- **Dashboard management** > **App Settings**: To customize several settings.
- **Dashboard management** > **Server APIs**: To customize API host entries.

This section describes all the settings available for each location.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What "location" are we talking about here?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Plugins settings and Dashboard settings.


Use the Wazuh dashboard API to setup the configuration:

#. Define a configuration file according to the settings.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is too vague. How to do this?

- ``/etc/wazuh-dashboard/opensearch_dashboards.yml`` for installations from packages.
- ``/usr/share/wazuh-dashboard/config/opensearch_dashoards.yml`` for Docker installations.

- **Plugins settings**: Users with privileges to manage the Wazuh indexer security REST API can manage the plugins settings from the Wazuh dashboard. Wazuh stores the custom values in a saved object.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we could turn privileges to manage the Wazuh indexer security REST API into a link to a section on how to grant this it would be very useful, I think.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I applied this comment as a review suggestion: cc7ec0b#r1523495979

@Desvelao
Copy link
Member Author

Desvelao commented Mar 20, 2024

We have recently a discussion about the development related to the plugin configuration and this could change. So, for now, we block this pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue type/enhancement Enhancement issue
Projects
Status: Blocked
Development

Successfully merging this pull request may close these issues.

Move the plugin configuration to stateless
3 participants