mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
Prageeth Panicker
ff189e79f0
Per Kevin's review: replaced hardcoded usernames (wazuh-wui, kibanaserver,
admin) across wazuh.yml.j2, compose.yml.j2, internal_users.yml.j2,
roles_mapping.yml.j2, config.yml.j2 and 00_core.yml with
lookup('users', ...) references, following the same pattern already
used by web-svc-coturn and web-app-semaphore. New meta/users.yml
declares web-app-wazuh-dashboard (kibanaserver) and web-app-wazuh-api
(wazuh-wui) as service accounts, and references the existing shared
admin key as a dependency (admin: {}), matching the same pattern used
by openbao, pgadmin, checkmk, semaphore and openldap.
Per CodeRabbit's security finding (CWE-269): scoped readonly_auditor's
index_patterns from '*' to 'wazuh-*', matching the role's own stated
'all Wazuh indices' description. The wildcard previously granted read
access to every index on the cluster, including other users' saved
objects and plugin state, beyond what the role needs or describes.
42 lines
1.1 KiB
YAML
42 lines
1.1 KiB
YAML
---
|
|
_meta:
|
|
type: "roles"
|
|
config_version: 2
|
|
|
|
security_analyst:
|
|
reserved: false
|
|
description: "Security Analyst: read alerts/logs/dashboards, no security-config or RBAC-management access."
|
|
cluster_permissions:
|
|
- "cluster_composite_ops_ro"
|
|
index_permissions:
|
|
- index_patterns:
|
|
- "wazuh-alerts-*"
|
|
- "wazuh-archives-*"
|
|
- "wazuh-monitoring-*"
|
|
- "wazuh-statistics-*"
|
|
allowed_actions:
|
|
- "read"
|
|
- "indices:admin/mappings/get"
|
|
- "indices:admin/get"
|
|
tenant_permissions:
|
|
- tenant_patterns:
|
|
- "global_tenant"
|
|
allowed_actions:
|
|
- "kibana_all_read"
|
|
|
|
readonly_auditor:
|
|
reserved: false
|
|
description: "Read-only Auditor: read-only access to dashboards and alerts across all Wazuh indices, no agent/rule/configuration actions."
|
|
cluster_permissions:
|
|
- "cluster_composite_ops_ro"
|
|
index_permissions:
|
|
- index_patterns:
|
|
- "wazuh-*"
|
|
allowed_actions:
|
|
- "read"
|
|
tenant_permissions:
|
|
- tenant_patterns:
|
|
- "global_tenant"
|
|
allowed_actions:
|
|
- "kibana_all_read"
|