Patrowl / PatrowlManager

PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
https://www.patrowl.io
GNU Affero General Public License v3.0
625 stars 112 forks source link

NMAP Oper.State Error #103

Closed pauloo18 closed 4 years ago

pauloo18 commented 4 years ago

Hi, I can't lunch a scan with NMAP because the engine is not ready. I tried with a lot of API URLs and it is still not working. What other things should I check or try to make it work? Thanks

TonyJabbour commented 4 years ago

same here , it is very weird that it is ready and in the same time Error and all tasks get 'Enqueued' https://files.gitter.im/Patrowl/Support/hT5M/image.png https://files.gitter.im/Patrowl/Support/ZQ4p/image.png

mindfunk commented 4 years ago

I am having a similar issue that may be related.

Basically, it doesn't seem as though the manager piece can talk to any of the engines. I can hit the nmap url directly, interestingly enough : http://machinename:5001/engines/nmap/status http://machinename:5001/engines/nmap/test

** note that is http, not https.

But, the Oper.Stat of ANY engine I configure, is "Error". I've tried with both http and https.

If I configure and run a scan, I get these errors under "Events":

ID Severity Message Type Timestamp
235 ERROR [EngineTasks/startscan_task/49f06647-c395-488d-b95c-0be105f4fbf3] BeforeScan - No engine 'nmap' available. Task aborted. ERROR 2020/03/06-22:48:20
234 ERROR [EngineTasks/startscan_task/49f06647-c395-488d-b95c-0be105f4fbf3] BeforeScan - Engine 'nmap-docker-001' not available (status: ERROR, enabled: True). Task aborted. ERROR 2020/03/06-22:48:20
233 INFO [EngineTasks/startscan_task/49f06647-c395-488d-b95c-0be105f4fbf3] Task started.

I've followed the install instructions, AFAIK. I am running everything in containers.

I also got a errors when running the engine build scripts. But, most of the engines built and run. The ones that could not build could not find Python.h and some system headers. Not sure if setting the include path would help, since it is in a container.

mindfunk commented 4 years ago

Just curious if there has been any traction or workarounds to this.

I cannot get any engine to work. I am guessing that, maybe some people had a working setup before, and they continue to work. But, for me, none of the recent commit sha's seem to work with any engine. I might be doing something stupid, I guess.

Polochon02100 commented 4 years ago

Same for me, all engines are in this status.

sebastien-powl commented 4 years ago

Hi, I'm looking into it. Could you please provide me with some more informations :

Thanks

webhead404 commented 4 years ago

Same here. followed the recent guide to setup Patrowl. The host can interact with the engine containers but the Patrowl Manager itself cannot

jfzw42 commented 4 years ago

Look at the dockerfile, it is exposing port 5101, not 5001 as indicated in the doc.

webhead404 commented 4 years ago

Don't have to necessarily have to be the same port. I ended up having success with using the docker0 IP.

sebastien-powl commented 4 years ago

I did not reproduce this issue.

Try reloading/refreshing the /engines URL, and status should get to "Active".

Let me know if you still have torubles.