The-Stuke
commented
1 month ago Spent more time troubleshooting this from my end. Decided to try spinning up a brand new instance of 6.1.3 since it was just released and with roughly the same configuration in my compose file I got the same issue on a complete new installation. After adjusting some variable I found out I am able to get it to work when I am not using the built in SSL. With the following variables and having the external ports setup to 443.
- APP__HTTPS_CERT__KEY=key_file.key
- APP__HTTPS_CERT__CRT=cert_file.crt
- APP__HTTPS_CERT__REJECT_UNAUTHORIZED=falseTested this with the broken instance as well by removing the above variables and changing my reference port from 443 back to 80. In the past few versions of OpenCTI does anything break the SSL functionality and prevents the application from booting?
Below is the working docker-compose.yaml showing the commented out fields.
version: '3'
services:
redis:
image: redis:7.2.4
restart: always
volumes:
- redisdata:/data
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:8.13.4
volumes:
- esdata:/usr/share/elasticsearch/data
environment:
# Comment out the line below for single-node
- discovery.type=single-node
# Uncomment line below below for a cluster of multiple nodes
# - cluster.name=docker-cluster
- xpack.ml.enabled=false
- xpack.security.enabled=false
- thread_pool.search.queue_size=10000 # add queue_size (default 1000)
- thread_pool.search.size=30 # add size (default 13)
- logger.org.elasticsearch.discovery="ERROR"
- "ES_JAVA_OPTS=-Xms${ELASTIC_MEMORY_SIZE} -Xmx${ELASTIC_MEMORY_SIZE}"
restart: always
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536
hard: 65536
minio:
image: minio/minio:RELEASE.2024-01-16T16-07-38Z
volumes:
- s3data:/data
ports:
- "9000:9000"
environment:
MINIO_ROOT_USER: ${MINIO_ROOT_USER}
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
command: server /data
restart: always
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
rabbitmq:
image: rabbitmq:3.13-management
environment:
- RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}
- RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS}
- RABBITMQ_NODENAME=rabbit01@localhost
volumes:
- amqpdata:/var/lib/rabbitmq
restart: always
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
opencti:
image: opencti/platform:6.1.3
environment:
- NODE_OPTIONS=--max-old-space-size=8096
- APP__PORT=8080
- APP__BASE_URL=${OPENCTI_BASE_URL}
- APP__ADMIN__EMAIL=${OPENCTI_ADMIN_EMAIL}
- APP__ADMIN__PASSWORD=${OPENCTI_ADMIN_PASSWORD}
- APP__ADMIN__TOKEN=${OPENCTI_ADMIN_TOKEN}
- APP__APP_LOGS__LOGS_LEVEL=error
#- APP__HTTPS_CERT__KEY=key_file.key
#- APP__HTTPS_CERT__CRT=cert_file.crt
#- APP__HTTPS_CERT__REJECT_UNAUTHORIZED=false
- APP__SESSION_TIMEOUT=28800000
- APP__SESSION_IDLE_TIMEOUT=3600000
- REDIS__HOSTNAME=redis
- REDIS__PORT=6379
- REDIS__TRIMMING=500000
- ELASTICSEARCH__URL=http://elasticsearch:9200
- MINIO__ENDPOINT=minio
- MINIO__PORT=9000
- MINIO__USE_SSL=false
- MINIO__ACCESS_KEY=${MINIO_ROOT_USER}
- MINIO__SECRET_KEY=${MINIO_ROOT_PASSWORD}
- RABBITMQ__HOSTNAME=rabbitmq
- RABBITMQ__PORT=5672
- RABBITMQ__PORT_MANAGEMENT=15672
- RABBITMQ__MANAGEMENT_SSL=false
- RABBITMQ__USERNAME=${RABBITMQ_DEFAULT_USER}
- RABBITMQ__PASSWORD=${RABBITMQ_DEFAULT_PASS}
- SMTP__HOSTNAME=${SMTP_HOSTNAME}
- SMTP__PORT=25
- PROVIDERS__SAML__CONFIG__CERT=${CONFIG_CERT}
- PROVIDERS__SAML__CONFIG__LOGOUT_REMOTE=false
- PROVIDERS__LOCAL__STRATEGY=LocalStrategy
ports:
- "80:8080"
volumes:
- /opt/opencti/ssl:/etc/ssl/certs
depends_on:
- redis
- elasticsearch
- minio
- rabbitmq
restart: always
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
worker:
image: opencti/worker:6.1.3
mem_limit: 2048m
environment:
- OPENCTI_URL=http://opencti:8080
- OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
- WORKER_LOG_LEVEL=info
volumes:
- /opt/opencti/ssl:/etc/ssl/certs:ro
deploy:
mode: replicated
replicas: 3
restart: always
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
depends_on:
- opencti
connector-export-file-stix:
image: opencti/connector-export-file-stix:6.1.3
environment:
- OPENCTI_URL=http://opencti:8080
- OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
- CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_STIX_ID} # Valid UUIDv4
- CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
- CONNECTOR_NAME=ExportFileStix2
- CONNECTOR_SCOPE=application/json
- CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
- CONNECTOR_LOG_LEVEL=info
restart: always
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
depends_on:
- opencti
connector-export-file-csv:
image: opencti/connector-export-file-csv:6.1.3
environment:
- OPENCTI_URL=http://opencti:8080
- OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
- CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_CSV_ID} # Valid UUIDv4
- CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
- CONNECTOR_NAME=ExportFileCsv
- CONNECTOR_SCOPE=text/csv
- CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
- CONNECTOR_LOG_LEVEL=info
restart: always
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
depends_on:
- opencti
connector-export-file-txt:
image: opencti/connector-export-file-txt:6.1.3
environment:
- OPENCTI_URL=http://opencti:8080
- OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
- CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_TXT_ID} # Valid UUIDv4
- CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
- CONNECTOR_NAME=ExportFileTxt
- CONNECTOR_SCOPE=text/plain
- CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
- CONNECTOR_LOG_LEVEL=info
restart: always
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
depends_on:
- opencti
connector-import-file-stix:
image: opencti/connector-import-file-stix:6.1.3
environment:
- OPENCTI_URL=http://opencti:8080
- OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
- CONNECTOR_ID=${CONNECTOR_IMPORT_FILE_STIX_ID} # Valid UUIDv4
- CONNECTOR_TYPE=INTERNAL_IMPORT_FILE
- CONNECTOR_NAME=ImportFileStix
- CONNECTOR_VALIDATE_BEFORE_IMPORT=true # Validate any bundle before import
- CONNECTOR_SCOPE=application/json,text/xml
- CONNECTOR_AUTO=true # Enable/disable auto-import of file
- CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
- CONNECTOR_LOG_LEVEL=info
restart: always
logging:
driver: "local"
options:
max-size: "10m" # Limit log size to 10 MB
max-file: "1" # Retain up to 1 log files
compress: "false"
depends_on:
- opencti
volumes:
esdata:
s3data:
redisdata:
amqpdata:
richard-julien
Kedae
MaxwellDPS
Description
I upgraded from 6.0.7 to 6.1.2. After updating OpenCTI never launched. Tried to isolate troubleshooting this with just Elasticsearch, Redis, RabbitMQ, Minio, and main OpenCTI app running. The OpenCTI logs look to point to a few things "System dependencies check failed", "Search engine seems down", and "Engine unhandled rejection". I am unable to revert back to any older version of OpenCTI when attempting to.
I am able to wget http://elasticsearch:9200/_cluster/health and see the health status so it looks like OpenCTI should be able to connect to elasticsearch still and from Elasticsearch logs it looks to be running still.
Environment
Reproducible Steps
Steps to create the smallest reproducible scenario:
Expected Output
OpenCTI to boot successfully.
Actual Output
opencti-opencti-1_logs.txt opencti-elasticsearch-1_logs.txt
Additional information
Docker compose of the main services.
Screenshots (optional)