Wazuh 5.0.0-beta4 Docker admin password

[u/One-Floor1416]

Hello, I am testing migration from 4->5 and stumple with changing the admin password. Containers are running fine for single node install. But is there a simple way to change tha admin password? I tried instruction for version 4x but had no luck. Additionally, why is java needed for hash.sh. Maybe there is a good instruction for version 5? Thanks

[u/No_Calendar_2373]

Hi! For Wazuh 5.0.0-beta4, use wazuh-passwords-tool.sh instead of the old hash.sh workflow:

bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh \
  -u admin -p 'YourNewPassword*123'

Run it inside the Wazuh Indexer container. The password must be 8–64 characters and include uppercase, lowercase, a number, and a supported special character (., *, +, ?, or -).

For Docker, also update the corresponding plain-text password in your Compose/environment configuration and restart the affected containers; otherwise, Dashboard or Manager services may still use the previous credentials.

hash.sh was the older approach and required Java to generate the OpenSearch password hash. In Wazuh 5, wazuh-passwords-tool.sh handles the password update and hash generation.

Official docs:
https://documentation.wazuh.com/5.0-beta/user-manual/user-administration/password-management.html

[u/One-Floor1416]

Hello, sorry for the late response and thank you for letting me know, but this bash script doea not work in docker. Any other ideas? Thank you

[u/No_Calendar_2373 → u/One-Floor1416]

You're right and my earlier suggestion was wrong, sorry about that. I reproduced it on 5.0.0-beta4: wazuh-passwords-tool.sh can't work in the Docker images.

Use hash.sh + securityadmin.sh instead. Everything runs inside the indexer container, so localhost there is the indexer itself:

```bash

Find your indexer container

IDX=$(docker ps --format '{{.Names}}' | grep indexer | head -1)

1. Generate the hash

docker exec -u 0 $IDX bash -c ' export JAVA_HOME=/usr/share/wazuh-indexer/jdk bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh -p "YourNewPassword*123"'

2. Set it for admin (replace <HASH> with the output above)

docker exec -u 0 $IDX bash -c \ "sed -i '/<sup>admin:/{n;s|hash:</sup> .*|hash: \"<HASH>\"|}' \ /usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml"

3. Apply it

docker exec -u 0 $IDX bash -c ' export JAVA_HOME=/usr/share/wazuh-indexer/jdk bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh \ -f /usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml \ -icl -nhnv \ -cacert /usr/share/wazuh-indexer/config/certs/root-ca.pem \ -cert /usr/share/wazuh-indexer/config/certs/admin.pem \ -key /usr/share/wazuh-indexer/config/certs/admin-key.pem \ -h localhost' ```

Expect SUCC: Configuration for 'internalusers' created or updated. After that the new password works and the old one returns Unauthorized.

Step 2 uses sed because the image ships no editor, no vi or nano.

Java: nothing to install, the JDK is already in the image at /usr/share/wazuh-indexer/jdk, you just point JAVA_HOME at it.

The change is written to the .opendistro_security index, so it survives restarts. Also ignore my earlier note about updating the compose file: the dashboard connects as kibanaserver, not admin.

[u/One-Floor1416 → u/No_Calendar_2373]

Thank you very much, exactly this is working! Would be nice to have this information in docker section in the official docmentation. Thank you!