User "malcolm_internal" was not found #847
-
|
Describe the bug To Reproduce
Expected behavior **Screenshots and/or logs ** nginx-proxy-1 | 2026/01/06 20:36:59 [error] 122#122: *2625 user "malcolm_internal" was not found in "/etc/nginx/auth/htpasswd", client: 192.168.2.3, server: , request: "HEAD / HTTP/1.1", host: "192.168.30.100:9200"
nginx-proxy-1 | 2026/01/06 20:36:59 [error] 122#122: *2626 user "malcolm_internal" was not found in "/etc/nginx/auth/htpasswd", client: 192.168.2.3, server: , request: "GET /_cluster/health HTTP/1.1", host: "192.168.30.100:9200"Error in Hedgehog logs: pcap-monitor-1 | 2026-01-06 20:45:57 CRITICAL: pcap_watcher.py: 2 connection error: AuthenticationException(401, '<html>\r\n<head><title>401 Authorization Required</title></head>\r\n<body>\r\n<center><h1>401 Authorization Required</h1></center>\r\n<hr><center>openresty/1.27.1.2</center>\r\n</body>\r\n</html>\r\n')Malcolm Version:
How are you running Malcolm?
Additional context curl -s --config ./.opensearch.primary.curlrc https://192.168.30.100:9200/arkime_stats_v30/_search?pretty=trueFrom the Malcolm instance, I receive an error as well: <html>
<head><title>401 Authorization Required</title></head>
<body>
<center><h1>401 Authorization Required</h1></center>
<hr><center>openresty/1.27.1.2</center>
</body>
</html> |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 5 replies
-
|
Just so I make sure I understand your setup, this is a Malcolm instance (which is managing its own OpenSearch) and a Hedgehog instance that is communicating with that Malcolm instance. No additional remote instances, no non-local OpenSearch/Elasticsearch, right? Here's the correct procedure: First, on Malcolm:
Then, on hedgehog:
|
Beta Was this translation helpful? Give feedback.
-
|
Just so I make sure I understand your setup, this is a Malcolm instance (which is managing its own OpenSearch) and a Hedgehog instance that is communicating with that Malcolm instance. No additional remote instances, no non-local OpenSearch/Elasticsearch, right?
The procedure looks like it dealt with that error. Thanks so much! After restarting, I am getting traffic captured from Hedgehog into Malcolm, but also I am seeing some errors I don't think I saw before: Suricata: suricata-live-1 | Info: detect: 6 rule files processed. 55868 rules successfully loaded, 0 rules failed, 0
suricata-live-1 | Info: threshold-config: Threshold config parsed: 0 rule(s) found
suricata-live-1 | Info: detect: 55871 signatures processed. 1236 are IP-only rules, 4494 are inspecting packet payload, 49908 inspect application layer, 109 are decoder event only
suricata-live-1 | Error: af-packet: ens18: failed to find interface type: No such device
suricata-live-1 | Info: runmodes: ens18: creating 2 threads
suricata-live-1 | Warning: ioctl: lo: failed to set SIOCETHTOOL ioctl: Operation not supported
suricata-live-1 | Info: runmodes: lo: creating 2 threads
suricata-live-1 | Info: unix-manager: unix socket '/var/run/suricata/suricata-command.socket'
suricata-live-1 | Error: af-packet: ens18: failed to find interface: No such device
suricata-live-1 | Error: af-packet: ens18: failed to init socket for interface
suricata-live-1 | Error: threads: thread "W#01- ens18" failed to start: flags 0423My interface is ens18. Also, is there a way to exit pgrep -af auth | awk '{print $1}' | xargs -I {} kill -9 {} |
Beta Was this translation helpful? Give feedback.
-
|
As far as exiting auth_setup, selecting As far as the interface goes, that's odd. You could check with this: $ docker compose exec suricata-live env | grep PCAP_IFACE=
PCAP_IFACE=ens18
$ docker compose exec suricata-live ip -c -br address show ens18
ens18 UP 192.168..0.110/24 ...What do those show? |
Beta Was this translation helpful? Give feedback.
-
|
I am using the Python TUI on an Ubuntu host, not the GUI. Ctrl+C just prints the characters and doesn't do anything, there is no cancel button and the esc key doesn't exit either. Here is the output of those commands: $ docker compose exec suricata-live env | grep PCAP_IFACE=PCAP_IFACE=ens18
PCAP_IFACE=lo, ens18
$ docker compose exec suricata-live ip -c -br address show ens18
ens18 UP 192.168.2.3/23 fe80::be24:11ff:fec3:4241/64 |
Beta Was this translation helpful? Give feedback.
-
|
Ah, right, I forgot that the auth_setup script still has some issues without the dialog interface. If you apt-get install For the other thing, try removing the space from |
Beta Was this translation helpful? Give feedback.
-
|
Looks like the space was the issue. Thanks! |
Beta Was this translation helpful? Give feedback.
.opensearch.primary.curlrcis only used internally, and it not what should be used by the hedgehog to connect to Malcolm.Just so I make sure I understand your setup, this is a Malcolm instance (which is managing its own OpenSearch) and a Hedgehog instance that is communicating with that Malcolm instance. No additional remote instances, no non-local OpenSearch/Elasticsearch, right?
Here's the correct procedure:
First, on Malcolm:
auth_setuplocalos("(Re)generate internal passwords for local primary...")remoteoson Malcolm, unless you are using an external opensearch/elasticsearch instance