Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wazuh reverse proxy apache shibboleth #891

Open
cerny2022 opened this issue Jul 16, 2023 · 8 comments
Open

wazuh reverse proxy apache shibboleth #891

cerny2022 opened this issue Jul 16, 2023 · 8 comments

Comments

@cerny2022
Copy link

Hello, I hope I have configured proxy authentication/authorization in wazuh according to the documentation, but I am still receiving the same error (in the wazuh-cluster.log) although I am successfully authorized in my IDP: [WARN ][o.o.s.a.BackendRegistry ] [node-1] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'. What header is expected, please help. Regards. Martin Cerny

@Maleksafi
Copy link

can share the Apache config for that, and the dashboard config.

@cerny2022
Copy link
Author

Yes I can - see the attachments
config.yml.txt
opensearch_dashboards.yml.txt
shib.conf.txt
wazuh.conf.txt

@Maleksafi
Copy link

can try to edit your opensearch_dashboards to be http insted of https , since i see this error indicate that your request is send by http and trying to reach https , so
1- on opensearch_dashboards edit
opensearch.hosts: http://127.0.0.1:9200

2- on opensearch_dashboards add
server.basePath: "/wazuh"
server.rewriteBasePath: false
and comment below
#uiSettings.overrides.defaultRoute: "/wazuh"
edit this also
opensearch.ssl.verificationMode: none // you will not use SSL now

since you install the wazuh with Docker , your getway will be server IP not localhost

After fix the issue you can start with SSL
opensearch.ssl.verificationMode: certificate
opensearch.hosts: https://127.0.0.1:9200
server.ssl.enabled: true

try and update

@cerny2022
Copy link
Author

Still without success - either without SSL. Message: "Wazuh dashboard server is not ready yet" is now displayed in the internet browser window and in the log is large java message: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: ...

@Maleksafi
Copy link

@cerny2022
As i see here
https://forum.opensearch.org/t/opensearch-dashboards-server-is-not-ready-yet/12970/4
can check for username and password on opensearch-dashboards

@cerny2022
Copy link
Author

I am trying to setup proxy authentication as written in: https://opensearch.org/docs/latest/security/authentication-backends/proxy/, but I dont know if this is applicable to wazuh or not (mentioned link is for opensearch ...). I dont use Docker images. I added one additonal user before trying to implement Apache/Shibboleth proxy. So far as I know proxy IDP should only confirm to wazuh that user is authenticated (password is not send to wazuh).

@Maleksafi
Copy link

@cerny2022
It seems Dashboard failed to auth with Wazuh indexer , enable the username and password on Dashboard.
and check for SSL

Could you check for the logs?

@cerny2022
Copy link
Author

Hello, I have attached anonymized syslog log.

Regards

M. Cerny
wazuh-log.txt

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants