search

opnsense / plugins

OPNsense plugin collection
https://opnsense.org/
BSD 2-Clause "Simplified" License
849 stars 644 forks source link

Crowdsec 'Stop' Button Not Indicating Crowdsec Stopped After Pressed #4280

Closed daygle closed 1 month ago

daygle commented 1 month ago

Describe the bug When pressing the 'Stop' button for Crowdsec OPNsense still reports Crowdsec is running (Play Button).

To Reproduce Steps to reproduce the behavior:

  1. Go to 'Dashboard'
  2. Locate 'Services' and find 'Crowdsec'
  3. Click on 'Stop Button'

Expected behavior A red button should replace the green play button indicating that Crowdsec is stopped.

Screenshots image

Relevant log files N/A

Additional context N/A

Environment OPNsense 24.7.5_3-amd64 Intel(R) Celeron(R) N5105 @ 2.00GHz (4 cores, 4 threads)

mmetc commented 1 month ago

Hi,

could you test this

# fetch -o /usr/local/etc/rc.d/crowdsec https://github.com/crowdsecurity/plugins/releases/download/crowdsec-1.6.3-2-hotfix/crowdsec

and try start/stop.

Thanks

daygle commented 1 month ago

@mmetc sorry this patch did not correct the issue. I have emailed support with support dump.

mmetc commented 1 month ago

@mmetc sorry this patch did not correct the issue. I have emailed support with support dump.

As you can see from /var/log/crowdsec/crowdsec.log, a crowdsec instance is in a restart loop because the port 8080 is already in use by another process. The green/red button detects the "daemon" process that is hopelessly restarting it, so the button is green.

Run "killall -9 crowdsec" to remove any leftover process. See if the button works and the logs don't show the error anymore.

In case it's another application, you can change the port in the settings and re-apply them to update the configuration. This will update config.yaml, local_api_credentials.yaml and crowdsec-firewall-bouncer.yaml (names from memory) and restart the processes.

daygle commented 1 month ago

@mmetc weird. I couldn't actually see anything using 8080 except Crowdsec. That said I changed the port to 8085 and killed the Crowdsec service and now it is working. Perhaps an OPNsense process/service uses port 8080 that I am unaware of?

Thanks again for your help.

mmetc commented 1 month ago

no, it's just that at a time you had two crowdsec processes.

daygle commented 1 month ago

@mmetc Oh ok, I'll leave on port 8085 to be safe :)