SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.39k stars 164 forks source link

Failed with status code 404 - #62

Closed sc00tlad closed 4 years ago

sc00tlad commented 4 years ago

Unable to login after installing vectr.

Getting Invalid service ticket. It was either unrecognized or has expired. followed by Failed with status code 404 -

thebleucheese commented 4 years ago

Hi, Can you provide some more detail about how you installed VECTR? What OS, what version of VECTR, how did you modify the .env file, did you modify the docker-compose file at all, and did you follow the installation video or the written documentation?

That error usually only occurs in scenarios where the authentication solution is misconfigured or not running at all so we'll need to understand what combination of configuration settings and/or environment differences could have caused that to occur.

SolAngelus commented 4 years ago

Hello, I am also having the same issue. How it was installed: Installed VECTR without using the how-to videos but followed the docs. OS: Ubuntu 18.04 VECTR version: 5.5.7 How did you modify the .env: using sudo nano as the docs say, initially encountered a cert issue with CAS due to the hostname not being properly set in the .env file. brought the containers down, edited the .env and brought them back up, which fixed the issue but now I am unable to login with the default creds and am encountering the same "Invalid service ticket..." message as the OP. Did you modify Docker-compose file: No Would be happy to supply any additional details if needed.

carlvonderheid commented 4 years ago

Is your browser you're using to try to connect to VECTR running on the same host that you started the Docker containers on?

SolAngelus commented 4 years ago

No, I have vectr running on a ubuntu vm server and I'm connecting internally via the internal IP address

carlvonderheid commented 4 years ago

Can you try putting the hostname (instead of IP Address) for your VECTR_HOSTNAME in the .env file, then using that hostname in your browser?

SolAngelus commented 4 years ago

Added the hostname to the .env file instead of the IP address.

Logged in, app gives me back "Failed with status code 404" which I believe the OP was referring to in his question

carlvonderheid commented 4 years ago

Just to confirm, in your .env you have this:

VECTR_HOSTNAME=your.host VECTR_PORT=8081

Then in your browser, you're going to: https://your.host:8081

And you're initially getting a login screen, you enter your username/password, then you get a 404?

SolAngelus commented 4 years ago

This is correct.

The first time I got some verbage about verifying credentials and then the

  1. Now it goes directly to 404 when trying to login.

On Thu, May 21, 2020, 3:50 PM Carl Vonderheid notifications@github.com wrote:

Just to confirm, in your .env you have this:

VECTR_HOSTNAME=your.host VECTR_PORT=8081

Then in your browser, you're going to: https://your.host:8081

And you're initially getting a login screen, you enter your username/password, then you get a 404?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/SecurityRiskAdvisors/VECTR/issues/62#issuecomment-632308766, or unsubscribe https://github.com/notifications/unsubscribe-auth/AF3KB34BPCTPG2OW5O5EP7TRSWAX7ANCNFSM4NBMJSRA .

carlvonderheid commented 4 years ago

It sounds like something is not coming up correctly, and we would need to check your logs. You can contact vectr@securityriskadvisors.com and set up a support call.

SolAngelus commented 4 years ago

done, thanks.

thebleucheese commented 4 years ago

This issue has been identified. For now, we'll need to note in our documentation that setting the environment variable MONGO_INITDB_ROOT_PASSWORD with non-alphanumeric symbols can cause a startup failure due to the authentication system.

That workaround will be necessary for now. As a possible future solution, we'll investigate if encoding the value differently will allow the auth solution to startup with symbols in the MongoDB password.

carlvonderheid commented 4 years ago

Fixed in version 5.5.8, MONGO_INITDB_ROOT_PASSWORD now allows non-alphanumeric values.