search

cisagov / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
https://cisagov.github.io/Malcolm/
Other
1.91k stars 319 forks source link

Start Script Changing Permissions #259

Closed redbaroncon86 closed 1 year ago

redbaroncon86 commented 1 year ago

I am testing out Malcolm for possible usage. I am following the setup here to my test install: https://github.com/cisagov/Malcolm/blob/main/docs/ubuntu-install-example.md#InstallationExample.

The system is virtual machine running Ubuntu 22.04 with 4 CPU cores and 16 GB or RAM. It has a static IP address running on on a bridged port.

The install seems to go great (reference pictures 1,2) until I run the start script. My initial run changes permissions on the opensearch directory from the current user and stops (pictures 3,4). I can take ownership back and it seems to run (picture 5). However, when I attempt to go to Arkime and opensearch I get 502 Bad Gateway error (picture 6). I am able to get to the upload and auth pages, however. I also noted a change in the permissions (picture 7).

Any assistance or insight you can provide is apprecaited.

1-Install_Results 2-DockerImages 3-ScriptStart 4-NewPermissions 5-ScriptStart_RunAfterCHOWN 6-Arkime 7-NewPermissions

mmguero commented 1 year ago

My guess is the PUID and PGID environment variables were not set correctly during the configuration questions (Malcolm processes will run as UID 1000 and GID 1000. Is this OK? (Y/n)).

You'll likely be able to get things right again by doing:

  1. ./scripts/wipe to stop things and clear what you can out
  2. sudo chown -R cnorton:cnorton /opt/Malcolm to recursively set permissions for the Malcolm directory to your user
  3. id -u and id -g to get your actual user's UID and GID
  4. edit config/process.env and fix the PUID and PGID values
  5. ./scripts/wipe to clear out what we couldn't clear out before
redbaroncon86 commented 1 year ago

The ./scripts/wipe didn't seem to so I reloaded from a snapshot and restarted the Malcolm installation. Replacing the default values with the non-root UID and GID did the trick.

Thanks for the quick reply and the assistance!