search

f5devcentral / f5-waf-policy-editor

Apache License 2.0
25 stars 14 forks source link

Nginx service not coming up with downloaded policy file #31

Open shubhammishra9 opened 2 years ago

shubhammishra9 commented 2 years ago

Observed if we download and keep same policy file in app protect config path and use it, nginx service will not come up. Tried Work arounds:

  1. Create a file in the ec2 instance, copy and paste the policy directly from WAFFLER site to the file created, nginx service will come up.
  2. Download the policy file from WAFFLER and instead using 'mv' command use 'cp' command to create a duplicate file in app protect config path, nginx service will come up.

Error Message:

Sep 21 04:32:30 ip-172-31-21-251.ap-south-1.compute.internal nginx[9246]: { Sep 21 04:32:30 ip-172-31-21-251.ap-south-1.compute.internal nginx[9246]: "completed_successfully" : false, Sep 21 04:32:30 ip-172-31-21-251.ap-south-1.compute.internal nginx[9246]: "error_message" : "Failed to read /etc/app_protect/conf/waf-1632197961021.json (Permission denied) at /opt/app_protect/bin/../lib/perl/F5/Utils/File.pm line 238.\n", Sep 21 04:32:30 ip-172-31-21-251.ap-south-1.compute.internal nginx[9246]: "error_line_number" : 23 Sep 21 04:32:30 ip-172-31-21-251.ap-south-1.compute.internal nginx[9246]: } Sep 21 04:32:30 ip-172-31-21-251.ap-south-1.compute.internal nginx[9246]: nginx: [error] APP_PROTECT { "event": "configuration_load_failure", "software_version": "3.639.0", "error_message":"Failed to read /etc/app_protect/conf/waf-1632197961021.json (Permission denied) at /opt/app_protect/bin/../lib/perl/F5/Utils/File.pm line 238.\n","completed_successfully":false,"error_line_number":23} Sep 21 04:32:30 ip-172-31-21-251.ap-south-1.compute.internal systemd[1]: nginx.service: control process exited, code=exited status=1 Sep 21 04:32:30 ip-172-31-21-251.ap-south-1.compute.internal systemd[1]: Failed to start NGINX Plus - high performance web server.

waf1 waf2 waf3 waf4

464d41 commented 2 years ago

Please check SElinux config or disable it temporary.

shubhammishra9 commented 2 years ago

Issue resolved after disabling SELinux

janibashamd commented 2 years ago

We may have to add this step as prerequisite in documentation.

janibashamd commented 2 years ago

@464d41 and @yoctoserge please check and close this if no action needed.