search

Velocidex / velociraptor

Digging Deeper....
https://docs.velociraptor.app/
Other
2.92k stars 484 forks source link

cant get into velociraptor web interface and getting "This site can’t be reached" #3610

Closed NKXK26 closed 3 months ago

NKXK26 commented 3 months ago

Hi creator of velociraptor, I am learning velociraptor for digital forensic. I have an issue which is i keep getting "This site can’t be reached" when typing "myipaddress:8889".

I followed the steps here https://www.atlantic.net/dedicated-server-hosting/how-to-install-and-configure-velociraptor-on-ubuntu/#conclusion

I can see my velociraptor is running after running systemctl status velociraptor, and change "bind_address" in nano /etc/velociraptor.config.yaml to my ip. What could be causing this issue, please help me. Thank you!

scudette commented 3 months ago

Please follow the troubleshooting steps https://docs.velociraptor.app/docs/deployment/troubleshooting/

NKXK26 commented 3 months ago

Hi thank you for the reply, i have change my file permission to velociraptor.

i am really confused now, what should i do. Please help me.

scudette commented 3 months ago

By default the GUI only listens on 127.0.0.1 for self signed certs .you need to change the bind address to 0.0.0.0 if you want to expose it externally.

NKXK26 commented 3 months ago

i would like to use my own ipaddress:8889, i not sure which ip adress should i change inside server.config.yaml

scudette commented 3 months ago

https://docs.velociraptor.app/docs/deployment/references/#GUI.bind_address

https://docs.velociraptor.app/docs/deployment/self-signed/#self-signed-certificates

NKXK26 commented 3 months ago

[INFO] 2024-07-13T11:45:03Z CryptoServerManager: Watching for events from Server.Internal.ClientDelete [INFO] 2024-07-13T11:45:03Z Throttling connections to 100 QPS [INFO] 2024-07-13T11:45:03Z Starting gRPC API server on 127.0.0.1:8001 [INFO] 2024-07-13T11:45:03Z Launched Prometheus monitoring server on 127.0.0.1:8003 [INFO] 2024-07-13T11:45:03Z Compiled all artifacts. [INFO] 2024-07-13T11:45:03Z GUI will use the Basic authenticator [INFO] 2024-07-13T11:45:03Z GUI is ready to handle TLS requests on https://127.0.0.1:8889/ [INFO] 2024-07-13T11:45:03Z Frontend is ready to handle client TLS requests at https://localhost:8000/ i literally see that gui is ready to handle , but i just cannot get inside.....

scudette commented 3 months ago

Please read the reference above from the docs:

Self-signed SSL certificates trigger SSL warnings in all web browsers. When accessing the Admin GUI you will receive a certificate warning about the possibility of a MITM attack.

As a precaution, Velociraptor only exports the GUI port on the loopback interface. You may change the GUI.bind_address setting to “0.0.0.0” to receive external connections on this port, but this is not recommended. Instead, you should use SSH tunneling to connect to the local loopback interface.