Open Source Security Blogs

Anonymous Authentication Wazuh

USE CASE:

Allow a team to access your Wazuh SIEM with read only privileges and without providing credentials.

Wazuh Dashboard Configuration:

Navigate to Server management > Security, and then Roles mapping, then create a Create Role mapping and complete the empty fields with the following parameters:

  • Role mapping name: Assign a name to the role mapping.
  • Roles: Select readonly.
  • Custom rules: Click Add new rule to expand this field.
  • User field: backend_roles
  • Search operation: FIND
  • Value: opendistro_security_anonymous_backendrole . then save the role mapping

For the role mapping to take effect, make sure that run_as is set to true in the /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml configuration file. Restart the Wazuh dashboard service and clear your browser cache and cookies.

Wazuh Indexer Configuration:

Access the Wazuh indexer server and perform the following:

  • Set “anonymous_auth_enabled” to true in /etc/wazuh-indexer/opensearch-security/config.yml. Then apply the change: 
 export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h 127.0.0.1 -nhnv
  • Add opensearch_security.auth.anonymous_auth_enabled: true to /etc/wazuh-dashboard/opensearch_dashboards.yml then restart the Wazuh dashboard systemctl restart wazuh-dashboard.service
  • In the /etc/wazuh-indexer/opensearch-security/roles.yml set the following role: 
wazuh_read_anonymous:
  cluster_permissions:
  - "cluster_composite_ops_ro"
  index_permissions:
  - index_patterns:
    - "*"
    allowed_actions:
    - "read"
  tenant_permissions:
  - tenant_patterns:
    - "global_tenant"
    allowed_actions:
    - "kibana_all_read"

Applying the change: 

export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h 127.0.0.1 -nhnv
  • Within the /etc/wazuh-indexer/opensearch-security/roles_mapping.yml configure the mapping of the anonymous backend role: 
wazuh_read_anonymous:
  backend_roles:
  - "opendistro_security_anonymous_backendrole"

Applying the change: 

export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h 127.0.0.1 -nhnv

Demo:

EL WALI KARKOUB

32 responses to “Anonymous Authentication Wazuh”

  7. Hello there, I found your website via Google while searching for a related topic, your website came up, it looks great. I have bookmarked it in my google bookmarks.

Leave a Reply

Your email address will not be published. Required fields are marked *