According to the doc : https://documentation.wazuh.com/current/user-manual/user-administration/password-management.html only the "kibanaserver" user seems to be required. Does this mean that we can safely delete the other users ? If no, how can we change these password in the context of this docker containers ?

Hello @daweedm

The admin and kibanaserver users have a utility within the system, the first as the main user of the deployment and the second as the communication user between Wazuh indexer and Wazuh dashboard.

To modify the password of admin user you must also modify the INDEXER_PASSWORD variable within the docker_compose.yml that you use to deploy.
To modify the password of kibanaserver user you must add the parameters DASHBOARD_USERNAME and DASHBOARD_PASSWORD inside docker_compose.yml file, in the declaration of wazuh.dashboard service.
If you want to delete the others, there is no problem, these users are examples and you can delete them or change their password to use them. You can also modify their permissions by mounting the role_mapping.yml file in the same directory where we mounted the internal_users.yml file, in order to assign roles to the users that you create new ones within the internal_users.yml file.

- ./config/wazuh_indexer/roles_mapping.yml:/usr/share/wazuh-indexer/opensearch-security/roles_mapping.yml

@vcerenu thanks a lot for your response.

I have a last question about the communication between the indexer and the dashboard for the kibanaserver user:

I see in the docker-compose.yml file that the indexer has a mapped port to the host :

   # indexer
    ports:
      - "9200:9200"

My question is : is the kibanaserver user (1) used by the dashboard's front-end to communicate with the indexer through the port 9200 in the "public network" or (2) is that kibanaserver user used by the dashboard's backend to to authenticate in the "private network" that is created using the links below ?

# dashboard
links:
      - wazuh.indexer:wazuh.indexer
      - wazuh.manager:wazuh.manager

I'm asking because if (2), I guess there is no need to change the kibanaserver (in that case I'm wondering why the port 9200 is mapped to the host) while if (1), everyone should change the password for kibanaserver if the dashboard is publicly exposed.