search

SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.37k stars 162 forks source link

Issue with MongoDB #253

Closed kkamran1010 closed 8 months ago

kkamran1010 commented 8 months ago

Hello Vectr Dev!

i feel this is better under "discussion" but when i go to the discussion tab, it does not give me a "make new post" option or anything like it has in the past so apologies.

i am wondering what it looks like as far as DBs from vectr once stood up. Mongo unfortunately got upgraded and it seems it may have wiped out the DBs but i want to confirm. When i run mongosh and run show dbs i only see these 3.

admin 40.00 KiB config 72.00 KiB local 72.00 KiB

but when i go under the directory /data/db i see all of these.

collection-0-2330117463311533021.wt collection-4-2330117463311533021.wt index-1-2330117463311533021.wt index-5-2330117463311533021.wt journal mongod.lock storage.bson WiredTigerHS.wt WiredTiger.turtle collection-2-2330117463311533021.wt diagnostic.data index-3-2330117463311533021.wt index-6-2330117463311533021.wt _mdb_catalog.wt sizeStorer.wt WiredTiger WiredTiger.lock WiredTiger.wt

trying to understand what i am supposed to see here.

i also cannot get tomcat to connect it gives authentication failed errors. which leads me to believe the configs/DBs got wiped somehow when mongodb but upgraded via yum.

SRAPSpencer commented 8 months ago

What version of VECTR are you running?

To answer your question, a fresh install of VECTR CE should show DBs from the mongo shell like this. image

I did see you said Yum as your package manager. I'm not sure what linux distro you're using but using docker with RHEL is very problematic. It's likely a package update broke your install, or it wasn't correctly mounting volumes from install. Causing data loss when the containers were recreated.

kkamran1010 commented 8 months ago

yes, it is unfortunately on Rocky 8. i am running the latest version of vectr, upgraded it yesterday during troubleshooting.

it did wipe the DBs, i had to recreate the admin user and restarted docker and it has created the DBs and looks like your screenshot now.

i know my SSO config got wiped also, but the analyst work is maybe still there? is that what those .wt files under the db directory are?

SRAPSpencer commented 8 months ago

What version were you on before?

When looking at a CE install it has many files on initial stand up.

image

You need to determine if volumes are being created and used properly by Docker.

  1. Does "docker volume ls" provide any output?
  2. If you create a file in /data/db and then "docker compose down" "docker compose up -d" does the change persist?
  3. What's the user experience on the VECTR end? Can you login with default credentials?
kkamran1010 commented 8 months ago

i am not sure the version i was on before off the top of my head. i havent been downloading the new files i just change the image numbers in the yaml file and restart docker.

docker volume ls DRIVER VOLUME NAME local sandbox1-builder-runtimes local sandbox1-redis-db local sandbox1-vectr-logs local sandbox1-vectr-resources

skipping #2 for now since vectr is currently back up and i have users on the app.

  1. I had to log with default credentials which i know i changed when i previously stood it up.
SRAPSpencer commented 8 months ago

You're missing a critical volume. A fresh install looks like this,

image

You should assume whatever work you're doing now will not be saved, since there's no way of knowing where it's being written to.

My best guess would be that you upgraded from a version of VECTR that used a bind mount for data instead of a volume for data. Your existing data may still exist in a folder directory somewhere, but you would need to locate it and follow our migration steps.

https://docs.vectr.io/upgrading/non-root-migration/

kkamran1010 commented 8 months ago

apologies, the mongodb is hosted on another host not on the same host that is running docker/vectr. so using a remote mongodb instance.

i went under the /data/db folder and what i provided in the first post is what i see under there before i added the user and allowed vectr to connect and create the required DBs. But where are those DBs stored if they are not under /data/db? the newly created DBs i do not see under that directory just the .wt files.

SRAPSpencer commented 8 months ago

While we try to assist whomever we can with issues, running mongodb on another host is very out of scope what support we can offer the community. The implications of the environment configuration are too complex.

If you'd like to pursue resolving this, you can email us at vectrops @sra.io so we can discuss professional support.

kkamran1010 commented 8 months ago

understood. appreciate it!