Thehive: Can't connection ElasticSearch (xpack = true)

[kindsjay]

Work Environment

| Question | Answer
|---------------------------|--------------------
| OS version (server) | Ubuntu
| OS version (client) | Ubuntu
| TheHive version / git hash | thehive_3.4.0-0.1RC2_all
| Package Type | DEB
| Browser type & version

play.http.secret.key="123456"


search {
  ## Basic configuration
  # Index name.
  index = the_hive


  uri = "http://127.0.0.1:9200/"

  ## Advanced configuration
  # Scroll keepalive.
  #keepalive = 1m
  # Scroll page size.
  #pagesize = 50
  # Number of shards
  nbshards = 5
  # Number of replicas
  nbreplicas = 1
  # Arbitrary settings
  #settings {
  #  # Maximum number of nested fields
  #  mapping.nested_fields.limit = 100
  #}

  ## Authentication configuration
  search.username = "admin"
  search.password = "admin"
  ## SSL configuration
  #search.keyStore {
  #  path = "/path/to/keystore"
  #  type = "JKS" # or PKCS12
  #  password = "keystore-password"
  #}
  #search.trustStore {
  #  path = "/path/to/trustStore"
  #  type = "JKS" # or PKCS12
  #  password = "trustStore-password"
  #}
}

=====================

root@ubuntu:/opt/thehive/conf# thehive
[info] o.r.Reflections - Reflections took 321 ms to scan 4 urls, producing 118 keys and 1297 values 
[info] module - Loading model class models.AlertModel
[info] module - Loading model class connectors.cortex.models.JobModel
[info] module - Loading model class models.ArtifactModel
[info] module - Loading model class connectors.cortex.models.ReportTemplateModel
[info] module - Loading model class models.DashboardModel
[info] module - Loading model class models.LogModel
[info] module - Loading model class models.UserModel
[info] module - Loading model class models.CaseModel
[info] module - Loading model class org.elastic4play.services.DBListModel
[info] module - Loading model class org.elastic4play.services.AttachmentModel
[info] module - Loading model class connectors.cortex.models.ActionModel
[info] module - Loading model class models.AuditModel
[info] module - Loading model class models.TaskModel
[info] module - Loading model class models.CaseTemplateModel
[info] a.e.s.Slf4jLogger - Slf4jLogger started
[info] a.r.Remoting - Starting remoting
[info] a.r.Remoting - Remoting started; listening on addresses :[akka.tcp://[email protected]:2552]
[info] a.r.Remoting - Remoting now listens on addresses: [akka.tcp://[email protected]:2552]
[info] a.c.Cluster(akka://application) - Cluster Node [akka.tcp://[email protected]:2552] - Starting up, Akka version [2.5.21] ...
[info] a.c.Cluster(akka://application) - Cluster Node [akka.tcp://[email protected]:2552] - Registered cluster JMX MBean [akka:type=Cluster]
[info] a.c.Cluster(akka://application) - Cluster Node [akka.tcp://[email protected]:2552] - Started up successfully
[info] a.c.Cluster(akka://application) - Cluster Node [akka.tcp://[email protected]:2552] - No seed-nodes configured, manual cluster join required
[warn] a.u.ManifestInfo - Detected possible incompatible versions on the classpath. Please note that a given Akka version MUST be the same across all modules of Akka that you are using, e.g. if you use [2.5.21] all other modules that are released together MUST be of the same version. Make sure you're using a compatible set of libraries. Possibly conflicting versions [2.5.21, 2.5.19] in libraries [akka-protobuf:2.5.21, akka-actor:2.5.21, akka-slf4j:2.5.21, akka-remote:2.5.19, akka-cluster:2.5.19, akka-stream:2.5.21, akka-cluster-tools:2.5.19]
[info] c.s.e.h.ElasticClient$ - Creating HTTP client on http://127.0.0.1:9200
[info] play.api.Play - Application started (Prod)
[info] p.c.s.AkkaHttpServer - Enabling HTTP/2 on Akka HTTP server...
[info] p.c.s.AkkaHttpServer - Listening for HTTP on /0:0:0:0:0:0:0:0:9000
[error] o.e.d.DBConfiguration - ElasticSearch request failure: GET:/_cluster/health/the_hive_15?
 => ElasticError(security_exception,missing authentication token for REST request [/_cluster/health/the_hive_15],None,None,None,List(ElasticError(security_exception,missing authentication token for REST request [/_cluster/health/the_hive_15],None,None,None,null,None)),None)

========================================

[error] o.e.d.DBConfiguration - ElasticSearch request failure: GET:/_cluster/health/the_hive_15?
 => ElasticError(security_exception,missing authentication token for REST request [/_cluster/health/the_hive_15],None,None,None,List(ElasticError(security_exception,missing authentication token for REST request [/_cluster/health/the_hive_15],None,None,None,null,None)),None)

[JamesCullum]

Same here for Docker (see https://github.com/TheHive-Project/TheHive/issues/1051 )

[kindsjay]

This is different

[kindsjay]

Steps : updating the database --> ERROR

[error] o.e.d.DBConfiguration - ElasticSearch request failure: GET:/_cluster/health/the_hive_15?
=> ElasticError(security_exception,missing authentication token for REST request [/_cluster/health/the_hive_15],None,None,None,List(ElasticError(security_exception,missing authentication token for REST request [/_cluster/health/the_hive_15],None,None,None,null,None)),None)

[JamesCullum]

The error is exactly the same and it is caused by RC2. Try to use RC1 again and it should likely work again.

[kindsjay]

The error is exactly the same and it is caused by RC2. Try to use RC1 again and it should likely work again.

I tested (thehive_3.3.0-1_all.deb ,thehive_3.3.1-1_all.deb ,thehive_3.3.1-1_all.deb,thehive_3.4.0-0.1RC2_all.deb)
But not

[kindsjay]

ES 6.7

[josarsepi]

I can confirm the error exists with ES6.8 in both 3.4.0-0.1 RC1 and RC2. I suspect there is probably a way to accomidate the REST API token but I am not familiar enough with AKKA or the play libraries to make a suggestion here.

[josarsepi]

Here is the exact output:
[warn] a.u.ManifestInfo - Detected possible incompatible versions on the classpath. Please note that a given Akka version MUST be the same across all modules of Akka that you are using, e.g. if you use [2.5.21] all other modules that are released together MUST be of the same version. Make sure you're using a compatible set of libraries. Possibly conflicting versions [2.5.21, 2.5.19] in libraries [akka-protobuf:2.5.21, akka-actor:2.5.21, akka-slf4j:2.5.21, akka-remote:2.5.19, akka-cluster:2.5.19, akka-stream:2.5.21, akka-cluster-tools:2.5.19] [info] play.api.Play - Application started (Prod) [info] p.c.s.AkkaHttpServer - Enabling HTTP/2 on Akka HTTP server... [info] p.c.s.AkkaHttpServer - Listening for HTTP on /0:0:0:0:0:0:0:0:9000 [error] o.e.d.DBConfiguration - ElasticSearch request failure: GET:/_cluster/health/the_hive_15? => ElasticError(security_exception,missing authentication token for REST request [/_cluster/health/the_hive_15],None,None,None,List(ElasticError(security_exception,missing authentication token for REST request [/_cluster/health/the_hive_15],None,None,None,null,None)),None) [error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/the_hive_15/_search? StringEntity({"query":{"match":{"relations":{"query":"user"}}},"size":0},Some(application/json)) => ElasticError(security_exception,missing authentication token for REST request [/the_hive_15/_search],None,None,None,List(ElasticError(security_exception,missing authentication token for REST request [/the_hive_15/_search],None,None,None,null,None)),None) [error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/the_hive_15/_search? StringEntity({"query":{"match":{"relations":{"query":"user"}}},"size":0},Some(application/json)) => ElasticError(security_exception,missing authentication token for REST request [/the_hive_15/_search],None,None,None,List(ElasticError(security_exception,missing authentication token for REST request [/the_hive_15/_search],None,None,None,null,None)),None) [error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/the_hive_15/_search? StringEntity({"version":"true","query":{"ids":{"values":["init"]}},"size":1},Some(application/json)) => ElasticError(security_exception,missing authentication token for REST request [/the_hive_15/_search],None,None,None,List(ElasticError(security_exception,missing authentication token for REST request [/the_hive_15/_search],None,None,None,null,None)),None) [error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/the_hive_15/_search?scroll=60000ms StringEntity({"version":"true","query":{"bool":{"must":[{"term":{"relations":{"value":"dblist"}}},{"term":{"dblist":{"value":"ui_settings"}}}]}},"from":0,"sort":[{"_id":{"order":"desc"}}]},Some(application/json)) => ElasticError(security_exception,missing authentication token for REST request [/the_hive_15/_search?scroll=60000ms],None,None,None,List(ElasticError(security_exception,missing authentication token for REST request [/the_hive_15/_search?scroll=60000ms],None,None,None,null,None)),None)

[josarsepi]

@kindsjay @JamesCullum. Changing the application.conf key "search.username" to "user" and "search.password" to "password resolved this for me on both RC01 and RC02. Thanks to @ag-michael for pointing me towards this fix.

[sbilly]

where can I found the file application.conf?

[crakerkai]

any update for this issue, because I got the same error

[crakerkai]

2020-03-11 14:07:55,623 [ERROR] from org.elastic4play.database.DBConfiguration in application-akka.actor.default-dispatcher-392 - ElasticSearch request failure: GET:/_cluster/health/the_hive_15?
=> ElasticError(security_exception,missing authentication credentials for REST request [/_cluster/health/the_hive_15],None,None,None,List(ElasticError(security_exception,missing authentication credentials for REST request [/_cluster/health/the_hive_15],None,None,None,null,None)),None)

My elasticsearch version using be 7.5.1, my thehive version using be 3.4.0-1

[jeromeleonard]

@crakerkai TheHive only supports ES 6.

[crakerkai]

@crakerkai TheHive only supports ES 6.

tks so much