StamusNetworks / SELKS

A Suricata based IDS/IPS/NSM distro
https://www.stamus-networks.com/open-source/#selks
GNU General Public License v3.0
1.44k stars 284 forks source link

Kibana displaying an empty page on first install - apparently my browser is not safe enough! #332

Open b-u-g-s opened 3 years ago

b-u-g-s commented 3 years ago

Hi,

It has been a while since I used SELKS and I wanted to check version 6. So it is a brand new install in a VM, followed the instructions (post install config, including the Nginx check and restart). Everything works well, everything is green too in the admin page and I can access everything from the webpage except Kibana. When I click on it, it opens a new tab, it loads something but just display an empty page. I tried on different browsers (I am on a Mac): Firefox, Safari and Chrome

If I look at the source of the page and right at the bottom it does have something: <h2 class="kbnWelcomeTitle">Please upgrade your browser<div class="kbnWelcomeText">This Elastic installation has strict security requirements enabled that your current browser does not meet.

<script src="/bootstrap.js">

so 2x things: 1) It would really help troubleshooting to have a message displayed instead of just a blank page 2) why is my browser not secured enough?! I use the latest version of Safari and Chrome with default settings...

Could someone please help me with fixing this as I'd like to try that Kibana dashboard. Thanks. Bugs.

pevma commented 3 years ago

Thank you for trying out SELKS ! And thank you for the feedback !

It seems the message comes from Kibana , or Kibana’s requirements. Which ELK stack version is that ?

-- Regards, Peter Manev

On 20 Aug 2021, at 18:17, Bugs @.***> wrote:

 Hi,

It has been a while since I used SELKS and I wanted to check version 6. So it is a brand new install in a VM, followed the instructions (post install config, including the Nginx check and restart). Everything works well, everything is green too in the admin page and I can access everything from the webpage except Kibana. When I click on it, it opens a new tab, it loads something but just display an empty page. I tried on different browsers (I am on a Mac): Firefox, Safari and Chrome

If I look at the source of the page and right at the bottom it does have something:

Please upgrade your browser
This Elastic installation has strict security requirements enabled that your current browser does not meet. so 2x things: It would really help troubleshooting to have a message displayed instead of just a blank page why is my browser not secured enough?! I use the latest version of Safari and Chrome with default settings... Could someone please help me with fixing this as I'd like to try that Kibana dashboard. Thanks. Bugs. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.

b-u-g-s commented 3 years ago

It's from a new install of Selks 6.0 desktop iso, followed by selks-first-time-setup_stamus and selks-upgrade_stamus and a reboot

done 3 days ago

D0n9 commented 3 years ago

I ran into the same problem

image

pevma commented 3 years ago

Which ELK stack version is that ?

pevma commented 3 years ago

Just tested with Chrome - seems fine here Screenshot from 2021-08-27 12-19-52

b-u-g-s commented 3 years ago

Ok, stupid question but how do I check that?

pevma commented 3 years ago

Just doing selks-health-check_stamus on the cmd will show what the Elasticsearch, Kibana and Logstash versions are at the bottom.

b-u-g-s commented 3 years ago

here is the result of the command:

selks-user@SELKS:~$ selks-health-check_stamus
● suricata.service - LSB: Next Generation IDS/IPS
   Loaded: loaded (/etc/init.d/suricata; generated)
   Active: active (running) since Sun 2021-08-29 11:20:48 +04; 5min ago
     Docs: man:systemd-sysv-generator(8)
  Process: 984 ExecStart=/etc/init.d/suricata start (code=exited, status=0/SUCCESS)
    Tasks: 10 (limit: 4915)
   Memory: 498.4M
   CGroup: /system.slice/suricata.service
           └─1067 /usr/bin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid --af-packet -D -v --user=logstash
● elasticsearch.service - Elasticsearch
   Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled)
   Active: failed (Result: timeout) since Sun 2021-08-29 11:22:05 +04; 4min 35s ago
     Docs: https://www.elastic.co
  Process: 982 ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=143)
 Main PID: 982 (code=exited, status=143)
● logstash.service - logstash
   Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2021-08-29 11:20:37 +04; 6min ago
 Main PID: 564 (java)
    Tasks: 50 (limit: 4915)
   Memory: 1.3G
   CGroup: /system.slice/logstash.service
           └─564 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupan…
● kibana.service - Kibana
   Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2021-08-29 11:20:48 +04; 5min ago
     Docs: https://www.elastic.co
 Main PID: 983 (node)
    Tasks: 18 (limit: 4915)
   Memory: 423.2M
   CGroup: /system.slice/kibana.service
           ├─ 983 /usr/share/kibana/bin/../node/bin/node /usr/share/kibana/bin/../src/cli/dist --logging.dest=/var/log/kibana/kibana.log --pid.file=/run/k…
           └─1414 /usr/share/kibana/node/bin/node --preserve-symlinks-main --preserve-symlinks /usr/share/kibana/src/cli/dist --logging.dest=/var/log/kiba…
● evebox.service - EveBox Server
   Loaded: loaded (/lib/systemd/system/evebox.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2021-08-29 11:20:37 +04; 6min ago
 Main PID: 557 (evebox)
    Tasks: 6 (limit: 4915)
   Memory: 13.1M
   CGroup: /system.slice/evebox.service
           └─557 /usr/bin/evebox server
● molochviewer-selks.service - Moloch Viewer
   Loaded: loaded (/etc/systemd/system/molochviewer-selks.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2021-08-29 11:20:43 +04; 5min ago
 Main PID: 791 (sh)
    Tasks: 12 (limit: 4915)
   Memory: 83.7M
   CGroup: /system.slice/molochviewer-selks.service
           ├─791 /bin/sh -c /data/moloch/bin/node viewer.js -c /data/moloch/etc/config.ini >> /data/moloch/logs/viewer.log 2>&1
           └─806 /data/moloch/bin/node viewer.js -c /data/moloch/etc/config.ini
● molochpcapread-selks.service - Moloch Pcap Read
   Loaded: loaded (/etc/systemd/system/molochpcapread-selks.service; enabled; vendor preset: enabled)
   Active: activating (auto-restart) (Result: exit-code) since Sun 2021-08-29 11:25:13 +04; 1min 27s ago
  Process: 1624 ExecStart=/bin/sh -c /data/moloch/bin/moloch-capture -c /data/moloch/etc/config.ini -m -s -R /data/nsm/  >> /data/moloch/logs/capture.log 2>&1 (code=exited, status=1/FAILURE)
 Main PID: 1624 (code=exited, status=1/FAILURE)
error: <class 'socket.error'>, [Errno 13] Permission denied: file: /usr/lib/python2.7/socket.py line: 228
ii  elasticsearch                         7.14.0                                  amd64        Distributed RESTful search engine built for the cloud
ii  elasticsearch-curator                 5.8.4                                   amd64        Have indices in Elasticsearch? This is the tool for you!\n\nLike a museum curator manages the exhibits and collections on display, \nElasticsearch Curator helps you curate, or manage your indices.
ii  evebox                                1:0.14.0                                amd64        no description given
ii  kibana                                7.14.0                                  amd64        Explore and visualize your Elasticsearch data
ii  kibana-dashboards-stamus              2020122001                              amd64        Kibana 6 dashboard templates.
ii  logstash                              1:7.14.0-1                              amd64        An extensible logging pipeline
ii  moloch                                3.0.0-1                                 amd64        Moloch Full Packet System
ii  scirius                               3.7.0-6                                 amd64        Django application to manage Suricata ruleset
ii  suricata                              1:2021052601-0stamus0                   amd64        Suricata open source multi-thread IDS/IPS/NSM system.
Filesystem     Type      Size  Used Avail Use% Mounted on
udev           devtmpfs  3.9G     0  3.9G   0% /dev
tmpfs          tmpfs     798M  9.0M  789M   2% /run
/dev/sda1      ext4      484G   11G  448G   3% /
tmpfs          tmpfs     3.9G     0  3.9G   0% /dev/shm
tmpfs          tmpfs     5.0M     0  5.0M   0% /run/lock
tmpfs          tmpfs     3.9G     0  3.9G   0% /sys/fs/cgroup
tmpfs          tmpfs     798M  4.0K  798M   1% /run/user/115
tmpfs          tmpfs     798M     0  798M   0% /run/user/1000
pevma commented 3 years ago

Yep, i have the same versions, but no issue with display in Kibana.
I've found a couple of threads that may help: https://discuss.elastic.co/t/this-elastic-installation-has-strict-security-requirements-enabled-that-your-current-browser-does-not-meet/259006/2

https://discuss.elastic.co/t/having-issue-bringing-accessing-kibana-ui/186545/9

b-u-g-s commented 3 years ago

Ok thanks!