mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
Prageeth Panicker
ff189e79f0
Per Kevin's review: replaced hardcoded usernames (wazuh-wui, kibanaserver,
admin) across wazuh.yml.j2, compose.yml.j2, internal_users.yml.j2,
roles_mapping.yml.j2, config.yml.j2 and 00_core.yml with
lookup('users', ...) references, following the same pattern already
used by web-svc-coturn and web-app-semaphore. New meta/users.yml
declares web-app-wazuh-dashboard (kibanaserver) and web-app-wazuh-api
(wazuh-wui) as service accounts, and references the existing shared
admin key as a dependency (admin: {}), matching the same pattern used
by openbao, pgadmin, checkmk, semaphore and openldap.
Per CodeRabbit's security finding (CWE-269): scoped readonly_auditor's
index_patterns from '*' to 'wazuh-*', matching the role's own stated
'all Wazuh indices' description. The wildcard previously granted read
access to every index on the cluster, including other users' saved
objects and plugin state, beyond what the role needs or describes.
11 lines
313 B
YAML
11 lines
313 B
YAML
---
|
|
admin: {}
|
|
web-app-wazuh-dashboard:
|
|
username: kibanaserver
|
|
accounts: []
|
|
description: Service account wazuh.dashboard uses for its backend calls to wazuh.indexer
|
|
web-app-wazuh-api:
|
|
username: wazuh-wui
|
|
accounts: []
|
|
description: Wazuh API account the dashboard connects with; created by wazuh.manager
|