ES not working in scirius ,the status light is gray

[RonnieNiu]

HI guys:

I am from china , I have an issue which i cannit solved ,thanks for help! my scirius is SCIRIUS_VERSION="3.2.0,ES verison is Version: 6.6.2. my scirius setting.py is : the error info in elasticsearch.log is

[pevma]

Is that SELKS 5.0 ? It seem like an auth err - have you done any changes to the default config - i see http auth adjustments ?

[RonnieNiu]

ELK is 6.6.2 ,suricata is 4.1.0, I changed default config in scirius setting.py with add "http auth".

[RonnieNiu]

my ELK installed on 10.104.131.4, my scirius and suricata installed on 192.168.13.128. I don't know if it has anything to do with this. thanks!

[pevma]

Why did you do the change , what was needed? In SELKS authentication is done via Scirius by default and it works that way - hence my question - is it a diff auth mechanism you are using or ?

[RonnieNiu]

Because my es is configured with authentication，I find nothing with authentication in scirius setting.py. When starting with the default configuration。I got error is :：

[RonnieNiu]

Now I am talking about my use environment. I have distributed several suricata distributed at various network boundaries, and then ES and kibana are deployed at 10.104.116.212 to display the alarm events. Logstash is deployed at 10.3.4.79, and the event is played. Into the ES, since the previous rules were managed by oinkmaster, now I want to deploy the scirius management rules and deploy the scirius at 10.104.116.212. Thank you very much for helping

[pevma]

What authentication is used on es , do you have Xpack enabled ?

[RonnieNiu]

Yes ,use Xpack on es, the elasticsearch.yml is:

[pevma]

Currently Scirius is in charge of authentication and uses a proxy so it is not fully compatible yet with Xpack. To confirm that - can you disable Xpack security / auth, adjust the settings accordingly in /etc/scirius/local_settings.py and restart the machine and try again ?

[RonnieNiu]

Yes ,disable Xpack on ES ,then ok . but scirius still no eve data and kibana still error:

[pevma]

It seems it could be a proxy issue - prohibiting the page display

[RonnieNiu]

But I didn't set up the proxy, it's really strange, I don't know how to solve it. 😂😭😭😭😭😭😭

[pevma]

I think you could try in a test setup - fresh install without xpack enabled - to see if you will get the same err?