search

mitre / heimdall2

Heimdall Enterprise Server 2 lets you view, store, and compare automated security control scan results.
Other
204 stars 61 forks source link

Deploy Heimdall2 Server as a Cloud.gov Application #652

Closed JJediny closed 3 years ago

JJediny commented 3 years ago

Issue to track progress for resolving https://github.com/mitre/heimdall2/pull/648

rbclark commented 3 years ago

If you would like to create a PR for the workspace change I'd be happy to at least merge that.

aaronlippold commented 3 years ago

Is this in a kubernetes deployment

On Wed, Dec 16, 2020, 6:38 PM John Jediny notifications@github.com wrote:

was able to increase the disk space qouta now getting this error:

2020-12-16T18:35:29.75-0500 [CELL/0] OUT Downloading droplet... 2020-12-16T18:35:32.27-0500 [CELL/0] OUT Cell fa780eb2-5ffe-413b-8bab-cbfed247118a successfully destroyed container for instance 37bd2e89-a5f7-4780-5da8-0ef9 2020-12-16T18:35:41.78-0500 [CELL/0] OUT Downloaded droplet (246.8M) 2020-12-16T18:35:41.78-0500 [CELL/0] OUT Starting health monitoring of container 2020-12-16T18:35:42.52-0500 [APP/PROC/WEB/0] OUT yarn run v1.22.10 2020-12-16T18:35:42.56-0500 [APP/PROC/WEB/0] OUT $ yarn backend start 2020-12-16T18:35:42.86-0500 [APP/PROC/WEB/0] OUT $ yarn workspace heimdall-server start 2020-12-16T18:35:43.44-0500 [APP/PROC/WEB/0] OUT $ node ../../dist/server/main 2020-12-16T18:35:44.11-0500 [APP/PROC/WEB/0] OUT [Nest] 171 - 12/16/2020, 11:35:44 PM [NestFactory] Starting Nest application... 2020-12-16T18:35:44.13-0500 [APP/PROC/WEB/0] OUT Attempting to read configuration file .env! 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT Unable to read configuration file .env! 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT Does the file exist and is it readable by the current user? 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT Falling back to environment or undefined values! 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT DATABASE_URL parsed into smaller components (i.e. DATABASE_USER) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT [Nest] 171 - 12/16/2020, 11:35:44 PM [InstanceLoader] SequelizeModule dependencies initialized +40ms 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT [Nest] 171 - 12/16/2020, 11:35:44 PM [InstanceLoader] ConfigModule dependencies initialized +0ms 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT [Nest] 171 - 12/16/2020, 11:35:44 PM [InstanceLoader] PassportModule dependencies initialized +0ms 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT [Nest] 171 - 12/16/2020, 11:35:44 PM [InstanceLoader] TokenModule dependencies initialized +1ms 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT [Nest] 171 - 12/16/2020, 11:35:44 PM [ExceptionHandler] JwtStrategy requires a secret or key +1ms 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT TypeError: JwtStrategy requires a secret or key 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at new JwtStrategy (/home/vcap/app/node_modules/passport-jwt/lib/strategy.js:45:15) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at new MixinStrategy (/home/vcap/app/node_modules/@nestjs/passport/dist/passport/passport.strategy.js:31:13) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at new JwtStrategy (/home/vcap/app/dist/server/authn/jwt.strategy.js:19:9) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at Injector.instantiateClass (/home/vcap/app/node_modules/@nestjs/core/injector/injector.js:290:19) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at callback (/home/vcap/app/node_modules/@nestjs/core/injector/injector.js:77:41) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async Injector.resolveConstructorParams (/home/vcap/app/node_modules/@nestjs/core/injector/injector.js:118:24) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async Injector.loadInstance (/home/vcap/app/node_modules/@nestjs/core/injector/injector.js:81:9) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async Injector.loadProvider (/home/vcap/app/node_modules/@nestjs/core/injector/injector.js:38:9) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async Promise.all (index 5) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async InstanceLoader.createInstancesOfProviders (/home/vcap/app/node_modules/@nestjs/core/injector/instance-loader.js:43:9) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async /home/vcap/app/node_modules/@nestjs/core/injector/instance-loader.js:28:13 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async Promise.all (index 11) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async InstanceLoader.createInstances (/home/vcap/app/node_modules/@nestjs/core/injector/instance-loader.js:27:9) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async InstanceLoader.createInstancesOfDependencies (/home/vcap/app/node_modules/@nestjs/core/injector/instance-loader.js:17:9) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async /home/vcap/app/node_modules/@nestjs/core/nest-factory.js:90:17 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async Function.asyncRun (/home/vcap/app/node_modules/@nestjs/core/errors/exceptions-zone.js:18:13) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async NestFactoryStatic.initialize (/home/vcap/app/node_modules/@nestjs/core/nest-factory.js:88:13) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async NestFactoryStatic.create (/home/vcap/app/node_modules/@nestjs/core/nest-factory.js:34:9) 2020-12-16T18:35:44.14-0500 [APP/PROC/WEB/0] OUT at async bootstrap (/home/vcap/app/dist/server/main.js:14:17) 2020-12-16T18:35:44.15-0500 [APP/PROC/WEB/0] ERR error Command failed with exit code 1. 2020-12-16T18:35:44.15-0500 [APP/PROC/WEB/0] OUT info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command. 2020-12-16T18:35:44.17-0500 [APP/PROC/WEB/0] ERR error Command failed. 2020-12-16T18:35:44.17-0500 [APP/PROC/WEB/0] ERR Exit code: 1 2020-12-16T18:35:44.17-0500 [APP/PROC/WEB/0] ERR Command: /home/vcap/deps/0/node/bin/node 2020-12-16T18:35:44.17-0500 [APP/PROC/WEB/0] ERR Arguments: /home/vcap/deps/0/yarn/lib/cli.js start 2020-12-16T18:35:44.17-0500 [APP/PROC/WEB/0] ERR Directory: /home/vcap/app/apps/backend 2020-12-16T18:35:44.17-0500 [APP/PROC/WEB/0] ERR Output: 2020-12-16T18:35:44.17-0500 [APP/PROC/WEB/0] OUT info Visit https://yarnpkg.com/en/docs/cli/workspace for documentation about this command. 2020-12-16T18:35:44.20-0500 [APP/PROC/WEB/0] ERR error Command failed with exit code 1. 2020-12-16T18:35:44.20-0500 [APP/PROC/WEB/0] OUT info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command. 2020-12-16T18:35:44.22-0500 [APP/PROC/WEB/0] ERR error Command failed with exit code 1. 2020-12-16T18:35:44.22-0500 [APP/PROC/WEB/0] OUT info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command. 2020-12-16T18:35:44.27-0500 [APP/PROC/WEB/0] OUT Exit status 1 2020-12-16T18:35:44.27-0500 [CELL/SSHD/0] OUT Exit status 0 2020-12-16T18:35:53.02-0500 [CELL/0] OUT Cell 7e7732c4-f516-4420-a8b9-fb94ccea7405 stopping instance 8b359b05-5208-4b05-50b5-269e 2020-12-16T18:35:53.02-0500 [CELL/0] OUT Cell 7e7732c4-f516-4420-a8b9-fb94ccea7405 destroying container for instance 8b359b05-5208-4b05-50b5-269e 2020-12-16T18:35:53.03-0500 [API/0] OUT Process has crashed with type: "web" 2020-12-16T18:35:53.05-0500 [API/0] OUT App instance exited with guid 6d2f08b3-5c63-46e9-a6a1-17b9048a4762 payload: {"instance"=>"8b359b05-5208-4b05-50b5-269e", "index"=>0, "cell_id"=>"7e7732c4-f516-4420-a8b9-fb94ccea7405", "reason"=>"CRASHED", "exit_description"=>"APP/PROC/WEB: Exited with status 1", "crash_count"=>3, "crash_timestamp"=>1608161753020575675, "version"=>"279e42be-72e8-4ac2-8a6b-c56d2bfb9486"}

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/mitre/heimdall2/issues/652#issuecomment-747106108, or unsubscribe https://github.com/notifications/unsubscribe-auth/AALK42EGN46EGI4WG3EY6ALSVFAJHANCNFSM4U6SPF4A .

JJediny commented 3 years ago

@aaronlippold no cloud.gov is a hosted deployment of cloud foundry that is FEDRAMP authorized - https://marketplace.fedramp.gov/#!/product/18f-cloudgov

It is closer to heroku than k8s, but it is a PaaS: https://cloud.gov/sign-up/

JJediny commented 3 years ago

I created a script to autocoin a JWT token, @rbclark the latest error I'm seeing is around the connection to the DB.

It shows the application is able to parse DATABASE_URL from the container environment; but is failing to connect.

Not sure if this is an issue where the codebase is parsing it first; but is not setting/exporting them back out globally and another process is trying to injectDATABASE_USER/PASS/NAME/etc assuming those are being set declaratively vs how DATABASE_URL is set - https://docs.cloudfoundry.org/devguide/deploy-apps/environment-variable.html?

2020-12-17T00:38:31.26-0500 [APP/PROC/WEB/0] OUT yarn run v1.22.10
2020-12-17T00:38:31.30-0500 [APP/PROC/WEB/0] OUT $ yarn backend start
2020-12-17T00:38:31.61-0500 [APP/PROC/WEB/0] OUT $ yarn workspace heimdall-server start
2020-12-17T00:38:32.23-0500 [APP/PROC/WEB/0] OUT $ node ../../dist/server/main
2020-12-17T00:38:33.03-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:33 AM   [NestFactory] Starting Nest application...
2020-12-17T00:38:33.05-0500 [APP/PROC/WEB/0] OUT Attempting to read configuration file `.env`!
2020-12-17T00:38:33.05-0500 [APP/PROC/WEB/0] OUT Unable to read configuration file `.env`!
2020-12-17T00:38:33.05-0500 [APP/PROC/WEB/0] OUT Does the file exist and is it readable by the current user?
2020-12-17T00:38:33.05-0500 [APP/PROC/WEB/0] OUT Falling back to environment or undefined values!
2020-12-17T00:38:33.05-0500 [APP/PROC/WEB/0] OUT DATABASE_URL parsed into smaller components (i.e. DATABASE_USER)
2020-12-17T00:38:33.05-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:33 AM   [InstanceLoader] SequelizeModule dependencies initialized +40ms
2020-12-17T00:38:33.05-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:33 AM   [InstanceLoader] ConfigModule dependencies initialized +0ms
2020-12-17T00:38:33.05-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:33 AM   [InstanceLoader] PassportModule dependencies initialized +0ms
2020-12-17T00:38:33.05-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:33 AM   [InstanceLoader] TokenModule dependencies initialized +1ms
2020-12-17T00:38:33.10-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:33 AM   [InstanceLoader] ServeStaticModule dependencies initialized +45ms
2020-12-17T00:38:33.10-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:33 AM   [InstanceLoader] AppModule dependencies initialized +0ms
2020-12-17T00:38:33.10-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:33 AM   [InstanceLoader] JwtModule dependencies initialized +1ms
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:33 AM   [SequelizeModule] Unable to connect to the database. Retrying (1)... +55ms
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT SequelizeConnectionError: self signed certificate in certificate chain
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT     at Client._connectionCallback (/home/vcap/app/node_modules/sequelize/lib/dialects/postgres/connection-manager.js:182:24)
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT     at Client._handleErrorWhileConnecting (/home/vcap/app/node_modules/pg/lib/client.js:305:19)
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT     at Client._handleErrorEvent (/home/vcap/app/node_modules/pg/lib/client.js:315:19)
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT     at Connection.emit (events.js:315:20)
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT     at TLSSocket.reportStreamError (/home/vcap/app/node_modules/pg/lib/connection.js:53:12)
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT     at TLSSocket.emit (events.js:315:20)
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT     at emitErrorNT (internal/streams/destroy.js:106:8)
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT     at emitErrorCloseNT (internal/streams/destroy.js:74:3)
2020-12-17T00:38:33.15-0500 [APP/PROC/WEB/0] OUT     at processTicksAndRejections (internal/process/task_queues.js:80:21)
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT [Nest] 176   - 12/17/2020, 5:38:36 AM   [SequelizeModule] Unable to connect to the database. Retrying (2)... +3015ms
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT SequelizeConnectionError: self signed certificate in certificate chain
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT     at Client._connectionCallback (/home/vcap/app/node_modules/sequelize/lib/dialects/postgres/connection-manager.js:182:24)
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT     at Client._handleErrorWhileConnecting (/home/vcap/app/node_modules/pg/lib/client.js:305:19)
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT     at Client._handleErrorEvent (/home/vcap/app/node_modules/pg/lib/client.js:315:19)
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT     at Connection.emit (events.js:315:20)
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT     at TLSSocket.reportStreamError (/home/vcap/app/node_modules/pg/lib/connection.js:53:12)
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT     at TLSSocket.emit (events.js:315:20)
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT     at emitErrorNT (internal/streams/destroy.js:106:8)
2020-12-17T00:38:36.17-0500 [APP/PROC/WEB/0] OUT     at emitErrorCloseNT (internal/streams/destroy.js:74:3)

specifically the .env file...

   2020-12-17T01:04:15.38-0500 [PROXY/0] OUT Exit status 137
   2020-12-17T01:04:15.76-0500 [CELL/0] OUT Cell 67a9e588-5d4e-4889-9388-b0b743f3ac5a successfully created container for instance 416ea76e-06fc-4d85-5a29-a9ee
   2020-12-17T01:04:15.96-0500 [CELL/0] OUT Downloading droplet...
   2020-12-17T01:04:18.19-0500 [CELL/0] OUT Cell fca078c1-c655-4d4e-8dde-001c634c490b successfully destroyed container for instance a5329fb8-9d8f-4c87-6ee9-feb4
   2020-12-17T01:04:40.85-0500 [CELL/0] OUT Downloaded droplet (244.4M)
   2020-12-17T01:04:40.85-0500 [CELL/0] OUT Starting health monitoring of container
   2020-12-17T01:04:41.30-0500 [APP/PROC/WEB/0] OUT .env does not exist, creating...
   2020-12-17T01:04:41.32-0500 [APP/PROC/WEB/0] OUT .env does not contain DATABASE_PASSWORD, generating secret...
   2020-12-17T01:04:41.33-0500 [APP/PROC/WEB/0] OUT .env-prod does not exist, creating...
   2020-12-17T01:05:41.59-0500 [HEALTH/0] ERR Failed to make TCP connection to port 8080: connection refused
   2020-12-17T01:05:41.59-0500 [CELL/0] ERR Failed after 1m0.738s: readiness health check never passed.
rbclark commented 3 years ago

I'm guessing that the env is being parsed fine, however the postgres instance is using SSL with a certificate that the heimdall-server cannot verify. There is a whole discussion about this on https://github.com/brianc/node-postgres/issues/2009 that may be worth a look. It was apparently a breaking change with the pg@8 package however it seems they've worked it out with Heroku so that it is no longer a problem. Unfortunately it still seems to be a problem with cloud.gov.

rbclark commented 3 years ago

Some changes were recently made to Heimdall2 that simplify the database connection information (https://github.com/mitre/heimdall2/pull/756). Could you verify if you are still having issues deploying this on Cloud.gov?

JJediny commented 3 years ago

@rbclark still getting the same error even when pushing my own .env-prod file with the backend vars for postgres:

[Nest] 178   - 02/02/2021, 3:18:01 AM   [SequelizeModule] Unable to connect to the database. Retrying (4)... +3014ms
22:18:01.582: [APP/PROC/WEB.0] SequelizeConnectionError: self signed certificate in certificate chain
22:18:01.583: [APP/PROC/WEB.0]     at Client._connectionCallback (/home/vcap/app/node_modules/sequelize/lib/dialects/postgres/connection-manager.js:182:24)
22:18:01.583: [APP/PROC/WEB.0]     at Client._handleErrorWhileConnecting (/home/vcap/app/node_modules/pg/lib/client.js:305:19)
22:18:01.583: [APP/PROC/WEB.0]     at Client._handleErrorEvent (/home/vcap/app/node_modules/pg/lib/client.js:315:19)
22:18:01.583: [APP/PROC/WEB.0]     at Connection.emit (events.js:315:20)
22:18:01.583: [APP/PROC/WEB.0]     at TLSSocket.reportStreamError (/home/vcap/app/node_modules/pg/lib/connection.js:53:12)
22:18:01.583: [APP/PROC/WEB.0]     at TLSSocket.emit (events.js:315:20)
22:18:01.583: [APP/PROC/WEB.0]     at emitErrorNT (internal/streams/destroy.js:106:8)
22:18:01.583: [APP/PROC/WEB.0]     at emitErrorCloseNT (internal/streams/destroy.js:74:3)
22:18:01.583: [APP/PROC/WEB.0]     at processTicksAndRejections (internal/process/task_queues.js:80:21)

SSL mode is turned off but is rejectUnauthorized: false set? https://stackoverflow.com/questions/58965011/sequelizeconnectionerror-self-signed-certificate

rbclark commented 3 years ago

Yes, if you are passing in DATABASE_SSL then we are automatically setting rejectUnauthorized: false:

https://github.com/mitre/heimdall2/blob/2b002122ea67932c0c7f5552ecc3d0948054de71/apps/backend/config/app_config.ts#L64-L71