Installation assistant Wazuh API default password change

unattended_installer/passwords_tool/passwordsFunctions.sh

@@ -417,16 +417,34 @@ function passwords_createPasswordAPI() {
 
 function passwords_changePasswordAPI() {
 
-    password_wazuh=$(< /tmp/wazuh-install-files/passwords.wazuh awk '$2 == "wazuh" {getline;print;}' | awk -F': ' '{print $2}')
-    password_wazuh_wui=$(< /tmp/wazuh-install-files/passwords.wazuh awk '$2 == "wazuh_wui" {getline;print;}' | awk -F': ' '{print $2}')
-    WAZUH_PASS='{"password":"'"$password_wazuh"'"}'
-    WAZUH_WUI_PASS='{"password":"'"$password_wazuh_wui"'"}'
+    #Change API password tool
+
+    if [[ -n "${nuser}" ]] && [[ -n "${password}" ]] && [[ -n "${currentPassword}" ]]; then
+        if [[ -n "${adminUser}" ]] && [[ -n "${adminPassword}" ]]; then
+        password_api="${password}"
+        WAZUH_PASS_API='{"password":"'"$password_api"'"}'
+        TOKEN_API=$(curl -s -u "${adminUser}":"${adminPassword}" -k -X GET "https://localhost:55000/security/user/authenticate?raw=true")
+        eval 'curl -s -k -X PUT -H "Authorization: Bearer $TOKEN_API" -H "Content-Type: application/json" -d "$WAZUH_PASS_API" "https://localhost:55000/security/users/${id}" -o /dev/null'
+        common_logger -nl $'\nThe new password for user '${nuser}' is '${password}''
+        else
+        password_api="${password}"
+        WAZUH_PASS_API='{"password":"'"$password_api"'"}'
+        TOKEN_API=$(curl -s -u "${nuser}":"${currentPassword}" -k -X GET "https://localhost:55000/security/user/authenticate?raw=true")
+        eval 'curl -s -k -X PUT -H "Authorization: Bearer $TOKEN_API" -H "Content-Type: application/json" -d "$WAZUH_PASS_API" "https://localhost:55000/security/users/${id}" -o /dev/null'
+        common_logger -nl $'\nThe new password for user '${nuser}' is '${password}''
+        fi
+    else
+        password_wazuh=$(< /tmp/wazuh-install-files/passwords.wazuh awk '$2 == "wazuh" {getline;print;}' | awk -F': ' '{print $2}')
+        password_wazuh_wui=$(< /tmp/wazuh-install-files/passwords.wazuh awk '$2 == "wazuh_wui" {getline;print;}' | awk -F': ' '{print $2}')
+        WAZUH_PASS='{"password":"'"$password_wazuh"'"}'
+        WAZUH_WUI_PASS='{"password":"'"$password_wazuh_wui"'"}'
 
-    TOKEN=$(curl -s -u wazuh:wazuh -k -X GET "https://localhost:55000/security/user/authenticate?raw=true")
-    eval 'curl -s -k -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d "$WAZUH_PASS" "https://localhost:55000/security/users/1" -o /dev/null'
+        TOKEN=$(curl -s -u wazuh:wazuh -k -X GET "https://localhost:55000/security/user/authenticate?raw=true")
+        eval 'curl -s -k -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d "$WAZUH_PASS" "https://localhost:55000/security/users/1" -o /dev/null'
 
-    TOKEN_WUI=$(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://localhost:55000/security/user/authenticate?raw=true")
-    eval 'curl -s -k -X PUT -H "Authorization: Bearer $TOKEN_WUI" -H "Content-Type: application/json" -d "$WAZUH_WUI_PASS" "https://localhost:55000/security/users/2" -o /dev/null'
+        TOKEN_WUI=$(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://localhost:55000/security/user/authenticate?raw=true")
+        eval 'curl -s -k -X PUT -H "Authorization: Bearer $TOKEN_WUI" -H "Content-Type: application/json" -d "$WAZUH_WUI_PASS" "https://localhost:55000/security/users/2" -o /dev/null'
+    fi
 
 }
 

unattended_installer/passwords_tool/passwordsMain.sh

@@ -19,6 +19,12 @@ function getHelp() {
     echo -e "        -a,  --change-all"
     echo -e "                Changes all the Wazuh indexer user passwords and prints them on screen."
     echo -e ""
+    echo -e "        -ai,  --api-id <currentPassword> <id>"
+    echo -e "                Change the Wazuh API password given the current password and id, it needs --user and --password"
+    echo -e ""
+    echo -e "        -ad,  --admin <adminUser> <adminPassword>"
+    echo -e "                Admin credentials for Wazuh API it is needed when the user given it is not an administrator"
+    echo -e ""
     echo -e "        -u,  --user <user>"
     echo -e "                Indicates the name of the user whose password will be changed."
     echo -e "                If no password specified it will generate a random one."
@@ -71,6 +77,42 @@ function main() {
                 changeall=1
                 shift 1
                 ;;
+            "-ai"|"--api-id")
+                api=1
+                if [ -z ${2} ]; then
+                    echo "Argument --api-id needs a second argument"
+                    getHelp
+                    exit 1
+                fi
+                if [ -z ${3} ]; then
+                    echo "Argument --api-id needs a third argument"
+                    getHelp
+                    exit 1
+                fi
+                currentPassword=${2}
+                id=${3}
+                shift
+                shift
+                shift
+                ;;
+            "-ad"|"--admin")
+                api=1
+                if [ -z ${2} ]; then
+                    echo "Argument --admin needs a second argument"
+                    getHelp
+                    exit 1
+                fi
+                if [ -z ${3} ]; then
+                    echo "Argument --admin needs a third argument"
+                    getHelp
+                    exit 1
+                fi
+                adminUser=${2}
+                adminPassword=${3}
+                shift
+                shift
+                shift
+                ;;
             "-u"|"--user")
                 if [ -z ${2} ]; then
                     echo "Argument --user needs a second argument"
@@ -155,6 +197,8 @@ function main() {
         common_checkSystem
         common_checkInstalled
 
+        if [ -z "${api}" ]; then
+
         if [ -n "${p_file}" ] && [ ! -f "${p_file}" ]; then
             getHelp
         fi
@@ -212,10 +256,15 @@ function main() {
         passwords_changePassword
         passwords_runSecurityAdmin
 
-    else
+        else
+            if [ -z "${nuser}" ] && [ -n "${password}" ]; then
+            getHelp
+            fi
 
+            passwords_changePasswordAPI
+        fi
+    else
         getHelp
-
     fi
 
 }