search

OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.36k stars 939 forks source link

Can't log in to dashboard using default or custom credentials after re-initializing Docker #8219

Open aburneraccount opened 2 months ago

aburneraccount commented 2 months ago

I'm running openCTI on a local laptop (running Ubuntu) using the instructions here https://docs.opencti.io/latest/deployment/installation/ using docker swarm. I was able to get to the dashboard login page at localhost:8080 and log in using the creds I set in .env. However I had to reboot the laptop, and afterward I rebooted docker using sudo docker swarm leave --force and then restarted it. The dashboard came back up, but now the credentials in .env no longer work. It says bad username or password. I also tried the default (admin@opencti.io/changeme) and those don't work either. I tried rebooting the machine again and starting the whole process again from the "run openCTI" step where you start the docker service, but I have the same result (both custom and default credentials are rejected). I am able to see the custom creds in /etc/environment so the docker compose .yml file should be auto-populated with those, I think? But still, cannot log in.

I'm new to docker so perhaps something was messed up when I left and rejoined docker swarm but the credentials have only ever been the default and one custom pair that I put in .env myself, and neither of these work, so I'm not sure what do to here.

romain-filigran commented 2 months ago

Hello @aburneraccount, did you solve your problem?

aburneraccount commented 1 month ago

No, I haven't solved it. Actually I'm further behind - I tried starting totally from fresh on a new ubuntu install, simply following the directions as written, and now I can't even get to the login GUI. After deploying the docker stack, I can't even get anything to appear on localhost:8080 anymore. It also does not respond to curl. In docker ps, I see:


CONTAINER ID   IMAGE                                                  COMMAND                  CREATED          STATUS                            PORTS                                                                  NAMES
13d3a89b027a   opencti/worker:6.2.18                                  "python3 worker.py"      6 seconds ago    Up Less than a second                                                                                    opencti_worker.3.5fc96gklnknnwv8skd79e4gsq
9d80de3f8fe9   opencti/connector-import-document:6.2.18               "/entrypoint.sh"         8 seconds ago    Up 2 seconds                                                                                             opencti_connector-import-document.1.zhmbrw6bk52ldzq0c1qtkwib3
b753628a67db   opencti/connector-import-file-stix:6.2.18              "/entrypoint.sh"         9 seconds ago    Up 3 seconds                                                                                             opencti_connector-import-file-stix.1.w56yzyh155dmbe3vqak8wa3mr
0229e85e0053   opencti/connector-export-file-txt:6.2.18               "/entrypoint.sh"         11 seconds ago   Up 4 seconds                                                                                             opencti_connector-export-file-txt.1.0je1jod5xj03x1ckhzvy2l65k
b07ce86c594a   opencti/connector-export-file-csv:6.2.18               "/entrypoint.sh"         11 seconds ago   Up 5 seconds                                                                                             opencti_connector-export-file-csv.1.4po97ygbx8vkg9400pu1hkgvl
a6aaea0488d0   rabbitmq:3.13-management                               "docker-entrypoint.s…"   6 minutes ago    Up 6 minutes                      4369/tcp, 5671-5672/tcp, 15671-15672/tcp, 15691-15692/tcp, 25672/tcp   opencti_rabbitmq.1.yzcflmz3aajsdd39c190z55ja
5db3ead2b493   minio/minio:RELEASE.2024-05-28T17-19-04Z               "/usr/bin/docker-ent…"   6 minutes ago    Up 6 minutes                      9000/tcp                                                               opencti_minio.1.ftvj0hykgmwu1kxdm2pvx6ihv
5fb4eace586a   docker.elastic.co/elasticsearch/elasticsearch:8.15.0   "/bin/tini -- /usr/l…"   6 minutes ago    Up 6 minutes                      9200/tcp, 9300/tcp                                                     opencti_elasticsearch.1.683l4e4z1lc7oa75kjvdnhyi8
ab683e43376b   redis:7.2.5                                            "docker-entrypoint.s…"   6 minutes ago    Up 6 minutes                      6379/tcp                                                               opencti_redis.1.v86f9gjtgusxc5rembkye56d5
27d1012b5998   opencti/connector-import-document:6.2.18               "/entrypoint.sh"         8 minutes ago    Restarting (143) 26 seconds ago                                                                          docker_connector-import-document_1
5779399c35a6   opencti/connector-import-document:6.2.18               "/entrypoint.sh"         8 minutes ago    Restarting (143) 26 seconds ago                                                                          docker_connector-analysis_1
39e5a70bfc28   opencti/connector-export-file-csv:6.2.18               "/entrypoint.sh"         8 minutes ago    Up 9 seconds                                                                                             docker_connector-export-file-csv_1
057f2120b680   opencti/worker:6.2.18                                  "python3 worker.py"      8 minutes ago    Restarting (1) 38 seconds ago                                                                            docker_worker_1
6c183a8461b0   opencti/worker:6.2.18                                  "python3 worker.py"      8 minutes ago    Restarting (1) 39 seconds ago                                                                            docker_worker_3
b4ff19339e5a   opencti/worker:6.2.18                                  "python3 worker.py"      8 minutes ago    Restarting (1) 37 seconds ago                                                                            docker_worker_2
56fab96b1b98   opencti/connector-import-file-stix:6.2.18              "/entrypoint.sh"         8 minutes ago    Up 2 seconds                                                                                             docker_connector-import-file-stix_1
57831174bc99   opencti/connector-export-file-stix:6.2.18              "/entrypoint.sh"         8 minutes ago    Up 9 seconds                                                                                             docker_connector-export-file-stix_1
2d4fa21028ac   opencti/connector-export-file-txt:6.2.18               "/entrypoint.sh"         8 minutes ago    Up 13 seconds                                                                                            docker_connector-export-file-txt_1
00804d07c081   minio/minio:RELEASE.2024-05-28T17-19-04Z               "/usr/bin/docker-ent…"   8 minutes ago    Up 8 minutes                      0.0.0.0:9000->9000/tcp, :::9000->9000/tcp                              docker_minio_1
53e1a6d8af85   redis:7.2.5                                            "docker-entrypoint.s…"   8 minutes ago    Up 8 minutes                      6379/tcp                                                               docker_redis_1
f3abc86eaf60   rabbitmq:3.13-management                               "docker-entrypoint.s…"   8 minutes ago    Up 8 minutes                      4369/tcp, 5671-5672/tcp, 15671-15672/tcp, 15691-15692/tcp, 25672/tcp   docker_rabbitmq_1
91ee6dc57f5c   docker.elastic.co/elasticsearch/elasticsearch:8.15.0   "/bin/tini -- /usr/l…"   8 minutes ago    Up 8 minutes                      9200/tcp, 9300/tcp                                                     docker_elasticsearch_1

I'm running on the default port 8080, but I don't see any container mention port 8080 in the ports column. That doens't seem like it should be the case?

Also, could it be that I am acidentally causing problems by stopping opencti with:

sudo docker-compose down
sudo docker swarm leave --force
sudo service docker stop

before retrying? I'm not sure if that's an "ungraceful" way to quit that may cause issues. I don't know what the proper way to get to a fresh state where nothing is running is. Thanks!

aburneraccount commented 1 month ago

OK, I managed to resolve the issue in my previous post about not being able to get to the log-in GUI (I fully uninstalled docker, pruned all containers, and reinstalled) and am now able to run openCTI and get back to the login splash screen. But I still have the issue where it does not accept any login credentials (default, the custom ones in .env, anything).

edit: I ran docker logs (id of opencti/platform:6.2.12) and I see many entries saying {"category":"APP","inner_relation_creation":0,"level":"error","message":{},"operation":"Unspecified","query_attributes":[],"size":197,"source":"backend","time":3,"timestamp":"2024-09-06T16:36:37.380Z","type":"WRITE_ERROR","user":{"group_ids":["bf25bd5d-8e77-4b82-aadb-1fd72f86ec93"],"ip":"::ffff:10.0.1.4","organization_ids":[],"socket":"query","user_id":"88ec0c6a-13ce-5e39-b486-354fe4a7084f","user_metadata":{}},"version":"6.2.12"} I don't know if this is related or not. I don't see anything in the logs relating to logging in, even with APP__APP_LOGS__LOGS_LEVEL set to info.

aburneraccount commented 1 month ago

Update... I was able to log in by restoring the default logins OPENCTI_ADMIN_EMAIL=admin@opencti.io OPENCTI_ADMIN_PASSWORD=ChangeMePlease

in the .env file. It seems that if you change those, you cannot log in with ANY credentials. Maybe it will work if you change the password but don't change the email - I haven't tried that.