Cuckoo: Cuckoo, nginx, uswgi 502 Bad Gateway

Created on 6 Jun 2018  路  18Comments  路  Source: cuckoosandbox/cuckoo

I am receiving a 502 Bad Gateway error when trying to access the cuckoo web interface from another system through chrome. I followed the documentation here when installing nginx and uwsgi: https://cuckoo.sh/docs/usage/web.html

I have tried different configurations with the "server" part of the nginx config for non localhost or 0.0.0.0 with no luck. Also, from the nginx error.log, the file "unix:/run/uwsgi/app/cuckoo-web/socket" is present on the system.

I have posted nginx and uwsgi conf files below, as well as nginx error.log

/etc/nginx/sites-available/cuckoo-web:

upstream _uwsgi_cuckoo_web {
    server unix:/run/uwsgi/app/cuckoo-web/socket;
}

server {
    listen localhost:8000;

    # Cuckoo Web Interface
    location / {
        client_max_body_size 1G;
        proxy_redirect off;
        proxy_set_header X-Forwarded-Proto $scheme;
        uwsgi_pass  _uwsgi_cuckoo_web;
        include     uwsgi_params;
    }
}

/etc/uwsgi/apps-available/cuckoo-web.ini

[uwsgi]
plugins = python
module = cuckoo.web.web.wsgi
uid = d878314
gid = d878314
static-map = /static=/usr/local/lib/python2.7/dist-packages/cuckoo/web/static
# If you're getting errors about the PYTHON_EGG_CACHE, then
# uncomment the following line and add some path that is
# writable from the defined user.
# env = PYTHON_EGG_CACHE=
env = CUCKOO_APP=web
env = CUCKOO_CWD=/home/d878314/.cuckoo

/var/log/nginx/error.log

2018/06/06 10:27:14 [crit] 11804#11804: *1 connect() to unix:/run/uwsgi/app/cuckoo-web/socket failed (2: No such file or directory) while connecting to upstream, client: 10.209.12.91, server: , request: "GET /favicon.ico HTTP/1.1", upstream: "uwsgi://unix:/run/uwsgi/app/cuckoo-web/socket:", host: "10.201.4.165:8000", referrer: "http://10.201.4.165:8000/"
2018/06/06 10:27:51 [crit] 11804#11804: *12 connect() to unix:/run/uwsgi/app/cuckoo-web/socket failed (2: No such file or directory) while connecting to upstream, client: 10.201.4.165, server: , request: "GET / HTTP/1.1", upstream: "uwsgi://unix:/run/uwsgi/app/cuckoo-web/socket:", host: "127.0.0.1:8000"
2018/06/06 10:27:57 [crit] 11804#11804: *14 connect() to unix:/run/uwsgi/app/cuckoo-web/socket failed (2: No such file or directory) while connecting to upstream, client: 10.201.4.165, server: , request: "GET / HTTP/1.1", upstream: "uwsgi://unix:/run/uwsgi/app/cuckoo-web/socket:", host: "localhost:8000"
2018/06/06 10:32:41 [crit] 11914#11914: *2 connect() to unix:/run/uwsgi/app/cuckoo-web/socket failed (2: No such file or directory) while connecting to upstream, client: 10.209.12.91, server: , request: "GET / HTTP/1.1", upstream: "uwsgi://unix:/run/uwsgi/app/cuckoo-web/socket:", host: "10.201.4.165:8080"
2018/06/06 10:32:42 [crit] 11914#11914: *2 connect() to unix:/run/uwsgi/app/cuckoo-web/socket failed (2: No such file or directory) while connecting to upstream, client: 10.209.12.91, server: , request: "GET /favicon.ico HTTP/1.1", upstream: "uwsgi://unix:/run/uwsgi/app/cuckoo-web/socket:", host: "10.201.4.165:8080", referrer: "http://10.201.4.165:8080/"
2018/06/06 10:33:25 [alert] 11914#11914: *1 open socket #9 left in connection 2
2018/06/06 10:33:25 [alert] 11914#11914: aborting
2018/06/06 10:42:38 [crit] 12130#12130: *1 connect() to unix:/run/uwsgi/app/cuckoo-web/socket failed (2: No such file or directory) while connecting to upstream, client: 10.209.12.91, server: , request: "GET / HTTP/1.1", upstream: "uwsgi://unix:/run/uwsgi/app/cuckoo-web/socket:", host: "10.201.4.165:8000"
2018/06/06 10:42:39 [crit] 12130#12130: *1 connect() to unix:/run/uwsgi/app/cuckoo-web/socket failed (2: No such file or directory) while connecting to upstream, client: 10.209.12.91, server: , request: "GET /favicon.ico HTTP/1.1", upstream: "uwsgi://unix:/run/uwsgi/app/cuckoo-web/socket:", host: "10.201.4.165:8000", referrer: "http://10.201.4.165:8000/"
2018/06/06 10:49:18 [emerg] 12173#12173: invalid URL prefix in /etc/nginx/sites-enabled/cuckoo-web:11

Thanks in advance

picture k3nd0r

Most helpful comment

Working now.

Changed the owner of the socket file to the nginx (www-data) user, which worked with the original permissions. I wonder if this may have been solved through the use of the cuckoo group, mentioned in the documentation. I did not have this group created from my original install though.

Thank you for your help!

picture k3nd0r on 7 Jun 2018
👍3

All 18 comments

Hi kendonemmons,

Thanks for posting an issue.

It looks like the uwsgi unix socket is missing. Did you enable the UWSGI app?

$ sudo ln -s /etc/uwsgi/apps-available/cuckoo-web.ini /etc/uwsgi/apps-enabled/
$ sudo service uwsgi start cuckoo-web

After this, can you try restarting UWSGI? (or still do if you did enable the app before).

RicoVZ picture RicoVZ on 6 Jun 2018

Thanks for the response,

So basically I am trying to serve the cuckoo web application to systems on my network with nginx, so that I can restrict user access. I have since changed in cuckoo nginx config the line:

listen localhost:8000;

To:

listen 8000;

Yes, I do have the cuckoo-web.ini file linked to the apps-enabled dir and have restarted the uwsgi and nginx services. Still receiving the same 502 gateway error. The cuckoo host is able to connect out to the internet as well as ping back and forth between the system I attempting to access the web interface with.

An nmap scan reveals that 8000/tcp is open, using the http-alt service.

Thanks

k3nd0r picture k3nd0r on 7 Jun 2018

i would suggest first start do this

ps aux | grep uwsgi
ps aux | grep nginx

then restart uwsgi/nginx, first you need to start uwsgi and than nginx, as if no nginx will fail and not see if you start app later, at least that was before, no idea if they changed it

  • if still fails, provide log for uwsgi, as nginx tries to connect to uwsgi and uwsgi not listening in that socket
doomedraven picture doomedraven on 7 Jun 2018

Did not have any luck with that. Checked and both appear to be running as processes

d878314   2716  5.2  0.4 614804 161316 ?       Sl   09:42   0:02 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/cucko-web.ini --daemonize /var/log/uwsgi/app/cucko-web.log
d878314   2760  0.0  0.4 614804 142372 ?       S    09:42   0:00 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/cucko-web.ini --daemonize /var/log/uwsgi/app/cucko-web.log
d878314   2761  0.0  0.4 614804 142372 ?       S    09:42   0:00 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/cucko-web.ini --daemonize /var/log/uwsgi/app/cucko-web.log
d878314   2772  0.0  0.0  14224   928 pts/0    S+   09:43   0:00 grep --color=auto uwsgi

root      2750  0.0  0.0 124976  1456 ?        Ss   09:42   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data  2751  0.0  0.0 125352  3128 ?        S    09:42   0:00 nginx: worker process
www-data  2752  0.0  0.0 125352  3128 ?        S    09:42   0:00 nginx: worker process
www-data  2753  0.0  0.0 125352  3128 ?        S    09:42   0:00 nginx: worker process
www-data  2754  0.0  0.0 125352  3128 ?        S    09:42   0:00 nginx: worker process
d878314   2775  0.0  0.0  14224   972 pts/0    S+   09:43   0:00 grep --color=auto nginx

I stopped and disabled both services then rebooted. Then started uwsgi, and then nginx, still no luck.

uwsgi log:

Thu Jun  7 09:39:36 2018 - SIGINT/SIGQUIT received...killing workers...
Thu Jun  7 09:39:39 2018 - worker 1 buried after 3 seconds
Thu Jun  7 09:39:39 2018 - worker 2 buried after 3 seconds
Thu Jun  7 09:39:39 2018 - goodbye to uWSGI.
Thu Jun  7 09:40:00 2018 - *** Starting uWSGI 2.0.12-debian (64bit) on [Thu Jun  7 09:40:00 2018] ***
Thu Jun  7 09:40:00 2018 - compiled with version: 5.4.0 20160609 on 31 August 2017 21:02:04
Thu Jun  7 09:40:00 2018 - os: Linux-4.4.0-127-generic #153-Ubuntu SMP Sat May 19 10:58:46 UTC 2018
Thu Jun  7 09:40:00 2018 - nodename: SPMASV-CUCKOO
Thu Jun  7 09:40:00 2018 - machine: x86_64
Thu Jun  7 09:40:00 2018 - clock source: unix
Thu Jun  7 09:40:00 2018 - pcre jit disabled
Thu Jun  7 09:40:00 2018 - detected number of CPU cores: 4
Thu Jun  7 09:40:00 2018 - current working directory: /
Thu Jun  7 09:40:00 2018 - writing pidfile to /run/uwsgi/app/cucko-web/pid
Thu Jun  7 09:40:00 2018 - detected binary path: /usr/bin/uwsgi-core
Thu Jun  7 09:40:00 2018 - setgid() to 1001
Thu Jun  7 09:40:00 2018 - set additional group 27 (sudo)
Thu Jun  7 09:40:00 2018 - set additional group 110 (lxd)
Thu Jun  7 09:40:00 2018 - set additional group 133 (libvirtd)
Thu Jun  7 09:40:00 2018 - set additional group 1002 (cuckoo)
Thu Jun  7 09:40:00 2018 - setuid() to 1001
Thu Jun  7 09:40:00 2018 - your processes number limit is 128527
Thu Jun  7 09:40:00 2018 - your memory page size is 4096 bytes
Thu Jun  7 09:40:00 2018 - detected max file descriptor number: 1024
Thu Jun  7 09:40:00 2018 - building mime-types dictionary from file /etc/mime.types...Thu Jun  7 09:40:00 2018 - 552 entry found
Thu Jun  7 09:40:00 2018 - lock engine: pthread robust mutexes
Thu Jun  7 09:40:00 2018 - thunder lock: disabled (you can enable it with --thunder-lock)
Thu Jun  7 09:40:00 2018 - uwsgi socket 0 bound to UNIX address /run/uwsgi/app/cucko-web/socket fd 3
Thu Jun  7 09:40:00 2018 - Python version: 2.7.12 (default, Dec  4 2017, 14:50:18)  [GCC 5.4.0 20160609]
Thu Jun  7 09:40:01 2018 - *** Python threads support is disabled. You can enable it with --enable-threads ***
Thu Jun  7 09:40:01 2018 - Python main interpreter initialized at 0x1e39d40
Thu Jun  7 09:40:01 2018 - your server socket listen backlog is limited to 100 connections
Thu Jun  7 09:40:01 2018 - your mercy for graceful operations on workers is 60 seconds
Thu Jun  7 09:40:01 2018 - mapped 218304 bytes (213 KB) for 2 cores
Thu Jun  7 09:40:01 2018 - *** Operational MODE: preforking ***
Thu Jun  7 09:40:12 2018 - WSGI app 0 (mountpoint='') ready in 11 seconds on interpreter 0x1e39d40 pid: 2378 (default app)
Thu Jun  7 09:40:12 2018 - *** uWSGI is running in multiple interpreter mode ***
Thu Jun  7 09:40:12 2018 - spawned uWSGI master process (pid: 2378)
Thu Jun  7 09:40:12 2018 - spawned uWSGI worker 1 (pid: 2623, cores: 1)
Thu Jun  7 09:40:12 2018 - spawned uWSGI worker 2 (pid: 2624, cores: 1)
Thu Jun  7 09:41:16 2018 - SIGINT/SIGQUIT received...killing workers...
Thu Jun  7 09:41:19 2018 - worker 1 buried after 3 seconds
Thu Jun  7 09:41:19 2018 - worker 2 buried after 3 seconds
Thu Jun  7 09:41:19 2018 - goodbye to uWSGI.
Thu Jun  7 09:42:19 2018 - *** Starting uWSGI 2.0.12-debian (64bit) on [Thu Jun  7 09:42:19 2018] ***
Thu Jun  7 09:42:19 2018 - compiled with version: 5.4.0 20160609 on 31 August 2017 21:02:04
Thu Jun  7 09:42:19 2018 - os: Linux-4.4.0-127-generic #153-Ubuntu SMP Sat May 19 10:58:46 UTC 2018
Thu Jun  7 09:42:19 2018 - nodename: SPMASV-CUCKOO
Thu Jun  7 09:42:19 2018 - machine: x86_64
Thu Jun  7 09:42:19 2018 - clock source: unix
Thu Jun  7 09:42:19 2018 - pcre jit disabled
Thu Jun  7 09:42:19 2018 - detected number of CPU cores: 4
Thu Jun  7 09:42:19 2018 - current working directory: /
Thu Jun  7 09:42:19 2018 - writing pidfile to /run/uwsgi/app/cucko-web/pid
Thu Jun  7 09:42:19 2018 - detected binary path: /usr/bin/uwsgi-core
Thu Jun  7 09:42:19 2018 - setgid() to 1001
Thu Jun  7 09:42:19 2018 - set additional group 27 (sudo)
Thu Jun  7 09:42:19 2018 - set additional group 110 (lxd)
Thu Jun  7 09:42:19 2018 - set additional group 133 (libvirtd)
Thu Jun  7 09:42:19 2018 - set additional group 1002 (cuckoo)
Thu Jun  7 09:42:19 2018 - setuid() to 1001
Thu Jun  7 09:42:19 2018 - your processes number limit is 128527
Thu Jun  7 09:42:19 2018 - your memory page size is 4096 bytes
Thu Jun  7 09:42:19 2018 - detected max file descriptor number: 1024
Thu Jun  7 09:42:19 2018 - building mime-types dictionary from file /etc/mime.types...Thu Jun  7 09:42:19 2018 - 552 entry found
Thu Jun  7 09:42:19 2018 - lock engine: pthread robust mutexes
Thu Jun  7 09:42:19 2018 - thunder lock: disabled (you can enable it with --thunder-lock)
Thu Jun  7 09:42:19 2018 - uwsgi socket 0 bound to UNIX address /run/uwsgi/app/cucko-web/socket fd 3
Thu Jun  7 09:42:19 2018 - Python version: 2.7.12 (default, Dec  4 2017, 14:50:18)  [GCC 5.4.0 20160609]
Thu Jun  7 09:42:20 2018 - *** Python threads support is disabled. You can enable it with --enable-threads ***
Thu Jun  7 09:42:20 2018 - Python main interpreter initialized at 0x1741d40
Thu Jun  7 09:42:20 2018 - your server socket listen backlog is limited to 100 connections
Thu Jun  7 09:42:20 2018 - your mercy for graceful operations on workers is 60 seconds
Thu Jun  7 09:42:20 2018 - mapped 218304 bytes (213 KB) for 2 cores
Thu Jun  7 09:42:20 2018 - *** Operational MODE: preforking ***
Thu Jun  7 09:42:28 2018 - WSGI app 0 (mountpoint='') ready in 8 seconds on interpreter 0x1741d40 pid: 2716 (default app)
Thu Jun  7 09:42:28 2018 - *** uWSGI is running in multiple interpreter mode ***
Thu Jun  7 09:42:28 2018 - spawned uWSGI master process (pid: 2716)
Thu Jun  7 09:42:28 2018 - spawned uWSGI worker 1 (pid: 2760, cores: 1)
Thu Jun  7 09:42:28 2018 - spawned uWSGI worker 2 (pid: 2761, cores: 1)

Thanks

P.S. I am not sure how to minimize line for long output like that, sorry in advance

k3nd0r picture k3nd0r on 7 Jun 2018

what about this?

*ls -lah /run/uwsgi/app/cuckoo-web/socket
if it exists but with another rights/owner

  • chown d878314:d878314 /run/uwsgi/app/cuckoo-web/socket

or very __ugly but bad practice__ but as test can try chmod 777 /run/uwsgi/app/cuckoo-web/socket

  • sudo service nginx restart

open in browser
let us know if that works, i saw this cases in past

doomedraven picture doomedraven on 7 Jun 2018

No luck. The socket file was already under ownership of that account (which is also the owner of the cuckoo installation directory). Tried restarting the services and rebooting with no luck.

k3nd0r picture k3nd0r on 7 Jun 2018

try 777 on socket, i had cuckoo under another user and had that kind of problems

doomedraven picture doomedraven on 7 Jun 2018

Reading through logs, noticed something must have been named cucko-web rather than cuckoo-web with 2 o's. Trying to find where I went wrong with this

k3nd0r picture k3nd0r on 7 Jun 2018

Yep, I messed up the cuckoo-web filename in the uwsgi apps-available directory.

Everything is working correctly now (using 777 for socket file) and the interface is accessible from then network.

Any ideas on a workaround for the 777 permissions?

Thanks

k3nd0r picture k3nd0r on 7 Jun 2018
😄2

Working now.

Changed the owner of the socket file to the nginx (www-data) user, which worked with the original permissions. I wonder if this may have been solved through the use of the cuckoo group, mentioned in the documentation. I did not have this group created from my original install though.

Thank you for your help!

k3nd0r picture k3nd0r on 7 Jun 2018
👍3

Hey guys,

Did the version update to the 2.0.6 this morning and am experiencing some issues again. I am getting Connection Refused errors this time around, rather than Permission denied as before.

Both the nginx and uwsgi service are running with the same permissions that were working correctly before the version update.

/var/log/nginx/error.log:

2018/06/08 09:46:57 [error] 8861#8861: *1 connect() to unix:/run/uwsgi/app/cuckoo-web/socket failed (111: Connection refused) while connecting to upstream, client: 10.209.12.91, server: , request: "GET /dashboard/ HTTP/1.1", upstream: "uwsgi://unix:/run/uwsgi/app/cuckoo-web/socket:", host: "10.201.4.165:8000", referrer: "http://10.201.4.165:8000/analysis/"

Thanks

k3nd0r picture k3nd0r on 8 Jun 2018

did you restart the uwsgi?

doomedraven picture doomedraven on 8 Jun 2018

Yes, this changes the permissions on the socket, causing Permission denied errors. Changing the ownership to allow the www-data user access fixes that but still leaves me with the Connection refused error.

/var/log/uwsgi/app/cuckoo-web.log:

Fri Jun  8 10:19:27 2018 - *** Starting uWSGI 2.0.12-debian (64bit) on [Fri Jun  8 10:19:27 2018] ***
Fri Jun  8 10:19:27 2018 - compiled with version: 5.4.0 20160609 on 31 August 2017 21:02:04
Fri Jun  8 10:19:27 2018 - os: Linux-4.4.0-127-generic #153-Ubuntu SMP Sat May 19 10:58:46 UTC 2018
Fri Jun  8 10:19:27 2018 - nodename: SPMASV-CUCKOO
Fri Jun  8 10:19:27 2018 - machine: x86_64
Fri Jun  8 10:19:27 2018 - clock source: unix
Fri Jun  8 10:19:27 2018 - pcre jit disabled
Fri Jun  8 10:19:27 2018 - detected number of CPU cores: 4
Fri Jun  8 10:19:27 2018 - current working directory: /
Fri Jun  8 10:19:27 2018 - writing pidfile to /run/uwsgi/app/cuckoo-web/pid
Fri Jun  8 10:19:27 2018 - detected binary path: /usr/bin/uwsgi-core
Fri Jun  8 10:19:27 2018 - setgid() to 1001
Fri Jun  8 10:19:27 2018 - set additional group 27 (sudo)
Fri Jun  8 10:19:27 2018 - set additional group 110 (lxd)
Fri Jun  8 10:19:27 2018 - set additional group 133 (libvirtd)
Fri Jun  8 10:19:27 2018 - set additional group 1002 (cuckoo)
Fri Jun  8 10:19:27 2018 - setuid() to 1001
Fri Jun  8 10:19:27 2018 - your processes number limit is 128527
Fri Jun  8 10:19:27 2018 - your memory page size is 4096 bytes
Fri Jun  8 10:19:27 2018 - detected max file descriptor number: 1024
Fri Jun  8 10:19:27 2018 - building mime-types dictionary from file /etc/mime.types...Fri Jun  8 10:19:27 2018 - 552 entry found
Fri Jun  8 10:19:27 2018 - lock engine: pthread robust mutexes
Fri Jun  8 10:19:27 2018 - thunder lock: disabled (you can enable it with --thunder-lock)
Fri Jun  8 10:19:27 2018 - uwsgi socket 0 bound to UNIX address /run/uwsgi/app/cuckoo-web/socket fd 3
Fri Jun  8 10:19:27 2018 - Python version: 2.7.12 (default, Dec  4 2017, 14:50:18)  [GCC 5.4.0 20160609]
Fri Jun  8 10:19:27 2018 - *** Python threads support is disabled. You can enable it with --enable-threads ***
Fri Jun  8 10:19:27 2018 - Python main interpreter initialized at 0x145fd40
Fri Jun  8 10:19:27 2018 - your server socket listen backlog is limited to 100 connections
Fri Jun  8 10:19:27 2018 - your mercy for graceful operations on workers is 60 seconds
Fri Jun  8 10:19:27 2018 - mapped 218304 bytes (213 KB) for 2 cores
Fri Jun  8 10:19:27 2018 - *** Operational MODE: preforking ***
No handlers could be found for logger "cuckoo.core.database"
k3nd0r picture k3nd0r on 8 Jun 2018

Just updated from 2.0.5 to 2.0.6 by running pip install -U cuckoo and I'm running into the same issue. uwsgi logs for the cuckoo app show a No handlers could be found for logger "cuckoo.core.database" error.

crahan picture crahan on 21 Jun 2018

@crahan @kendonemmons

I cannot seem to reproduce this. Can you tell me what happens when you start Cuckoo web
using cuckoo web?

@crahan
Can you also post your UWSGI conf?

RicoVZ picture RicoVZ on 21 Jun 2018

Thanks @RicoVZ, that was actually the perfect hint. Looks like I still had to migrate the DB to a new schema. I ran cuckoo migrate and now everything works again.

Thanks again for the quick response!

crahan picture crahan on 21 Jun 2018
👍1

@kendonemmons See @crahan solution. Can you also try this?

RicoVZ picture RicoVZ on 21 Jun 2018

Sorry about the delay. I have since reconstructed the cuckoo system and in the process installed the newest version rather than upgrading. Closing issue

k3nd0r picture k3nd0r on 14 Aug 2018
Was this page helpful?
0 / 5 - 0 ratings

Related issues

adricnet picture adricnet  路  7Comments
rodkinal picture rodkinal  路  6Comments
rayenmessaoudi picture rayenmessaoudi  路  4Comments
shafaqat1 picture shafaqat1  路  6Comments
myhsu picture myhsu  路  5Comments