mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
Prageeth Panicker
ff189e79f0
Per Kevin's review: replaced hardcoded usernames (wazuh-wui, kibanaserver,
admin) across wazuh.yml.j2, compose.yml.j2, internal_users.yml.j2,
roles_mapping.yml.j2, config.yml.j2 and 00_core.yml with
lookup('users', ...) references, following the same pattern already
used by web-svc-coturn and web-app-semaphore. New meta/users.yml
declares web-app-wazuh-dashboard (kibanaserver) and web-app-wazuh-api
(wazuh-wui) as service accounts, and references the existing shared
admin key as a dependency (admin: {}), matching the same pattern used
by openbao, pgadmin, checkmk, semaphore and openldap.
Per CodeRabbit's security finding (CWE-269): scoped readonly_auditor's
index_patterns from '*' to 'wazuh-*', matching the role's own stated
'all Wazuh indices' description. The wildcard previously granted read
access to every index on the cluster, including other users' saved
objects and plugin state, beyond what the role needs or describes.
17 lines
510 B
Django/Jinja
17 lines
510 B
Django/Jinja
---
|
|
_meta:
|
|
type: "internalusers"
|
|
config_version: 2
|
|
|
|
"{{ WAZUH_INDEXER_ADMIN_USERNAME }}":
|
|
hash: "{{ WAZUH_INDEXER_ADMIN_HASH }}"
|
|
reserved: true
|
|
backend_roles:
|
|
- "admin"
|
|
description: "Bootstrap/service account used by securityadmin.sh, health checks, and manager/dashboard INDEXER_PASSWORD."
|
|
|
|
"{{ WAZUH_DASHBOARD_SERVICE_USERNAME }}":
|
|
hash: "{{ WAZUH_DASHBOARD_SERVICE_HASH }}"
|
|
reserved: true
|
|
description: "Service account wazuh.dashboard uses for its own backend calls to wazuh.indexer."
|