Dashboard Not Starting - FATAL Error: listen EACCES:

[Khul Sat]

Hello & Greetings!

My /usr/share/wazuh-dashboard is growing gradually as the PDF reports keep on getting generated as and when required. Currently /usr/share/wazuh-dashboard resides under / partition hence though of creating a separate partition on a disk which would be mounted on /usr/share/wazuh-dashboard. This will not hinder the OS partition.

I created the new volume mounted it on /usr/share/wazuh-dashboard and when I restarted the wazuh-dashboard service, it gave me following error -

● wazuh-dashboard.service - wazuh-dashboard Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Thu 2024-04-25 16:39:39 IST; 2s ago Process: 7896 ExecStart=/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /etc/wazuh-dashboard/opensearch_dashboards.yml (code=exited, status=1/FAILURE) Main PID: 7896 (code=exited, status=1/FAILURE) Apr 25 16:39:10 wazuh-dash-vm-01 systemd[1]: Started wazuh-dashboard. Apr 25 16:39:39 wazuh-dash-vm-01 opensearch-dashboards[7896]: FATAL Error: listen EACCES: permission denied 0.0.0.0:443 Apr 25 16:39:39 wazuh-dash-vm-01 systemd[1]: wazuh-dashboard.service: main process exited, code=exited, status=1/FAILURE Apr 25 16:39:39 wazuh-dash-vm-01 systemd[1]: Unit wazuh-dashboard.service entered failed state. Apr 25 16:39:39 wazuh-dash-vm-01 systemd[1]: wazuh-dashboard.service failed.

I made sure that the permissions are intact. Here are the details:

[root@wazuh-dash-vm-01 ~]# df /usr/share/wazuh-dashboard Filesystem 1K-blocks Used Available Use% Mounted on /dev/mapper/vg1-root 4509344 3519000 738236 83% / [root@wazuh-dash-vm-01 ~]# df /usr/share/wazuh-dashboard2 Filesystem 1K-blocks Used Available Use% Mounted on /dev/mapper/vg1-wzdsh 5029504 1166604 3584372 25% /usr/share/wazuh-dashboard2 [root@wazuh-dash-vm-01 ~]# mount /dev/mapper/vg1-wzdsh /usr/share/wazuh-dashboard2/^C [root@wazuh-dash-vm-01 ~]# ls -ld /usr/share/wazuh-dashboard* drwxr-x--- 9 wazuh-dashboard wazuh-dashboard 4096 Apr 20 2023 /usr/share/wazuh-dashboard drwxr-x--- 9 wazuh-dashboard wazuh-dashboard 4096 Apr 25 16:15 /usr/share/wazuh-dashboard2 [root@wazuh-dash-vm-01 ~]# ll /usr/share/wazuh-dashboard* /usr/share/wazuh-dashboard: total 1412 drwxr-x--- 2 wazuh-dashboard wazuh-dashboard 4096 Apr 20 2023 bin drwxr-x--- 2 wazuh-dashboard wazuh-dashboard 4096 Apr 11 2023 config drwxr-x--- 3 wazuh-dashboard wazuh-dashboard 4096 Feb 24 2023 data -rw-r----- 1 wazuh-dashboard wazuh-dashboard 11358 Feb 24 2023 LICENSE.txt -rw-r----- 1 wazuh-dashboard wazuh-dashboard 6293 Feb 24 2023 manifest.yml drwxr-x--- 6 wazuh-dashboard wazuh-dashboard 4096 Apr 20 2023 node drwxr-x--- 694 wazuh-dashboard wazuh-dashboard 28672 Apr 20 2023 node_modules -rw-r----- 1 wazuh-dashboard wazuh-dashboard 1352202 Feb 24 2023 NOTICE.txt -rw-r----- 1 wazuh-dashboard wazuh-dashboard 831 Apr 11 2023 package.json drwxr-x--- 11 wazuh-dashboard wazuh-dashboard 4096 Apr 20 2023 plugins -rw-r----- 1 wazuh-dashboard wazuh-dashboard 1933 Feb 24 2023 README.txt drwxr-x--- 11 wazuh-dashboard wazuh-dashboard 4096 Apr 20 2023 src -r--r----- 1 wazuh-dashboard wazuh-dashboard 6 Apr 11 2023 VERSION /usr/share/wazuh-dashboard2: total 1400 drwxr-x--- 2 wazuh-dashboard wazuh-dashboard 4096 Apr 20 2023 bin drwxr-x--- 2 wazuh-dashboard wazuh-dashboard 4096 Apr 11 2023 config drwxr-x--- 3 wazuh-dashboard wazuh-dashboard 4096 Feb 24 2023 data -rw-r----- 1 wazuh-dashboard wazuh-dashboard 11358 Feb 24 2023 LICENSE.txt -rw-r----- 1 wazuh-dashboard wazuh-dashboard 6293 Feb 24 2023 manifest.yml drwxr-x--- 6 wazuh-dashboard wazuh-dashboard 4096 Apr 20 2023 node drwxr-x--- 694 wazuh-dashboard wazuh-dashboard 20480 Apr 20 2023 node_modules -rw-r----- 1 wazuh-dashboard wazuh-dashboard 1352202 Feb 24 2023 NOTICE.txt -rw-r----- 1 wazuh-dashboard wazuh-dashboard 831 Apr 11 2023 package.json drwxr-x--- 11 wazuh-dashboard wazuh-dashboard 4096 Apr 20 2023 plugins -rw-r----- 1 wazuh-dashboard wazuh-dashboard 1933 Feb 24 2023 README.txt drwxr-x--- 11 wazuh-dashboard wazuh-dashboard 4096 Apr 20 2023 src -r--r----- 1 wazuh-dashboard wazuh-dashboard 6 Apr 11 2023 VERSION

Could you please help me identify what exactly is going wrong?

/usr/share/wazuh-dashboard/bin/opensearch-dashboards "-c /etc/wazuh-dashboard/opensearch_dashboards.yml" --allow-root this works perfectly file when checked manually.

Thnks,KS

​

[Nicolas Stefani]

Hi Khul

The ports below 1024 are protected for non-root users, so you can't bind them. Wazuh dashboard runs with the user wazuh-dashboard if you don't use the --allow-root.
Perhaps you have been misconfigured that the user wazuh-dashboard cannot bind port 443.

Assuming you are using 4.7.3, maybe you can try something like this:

setcap 'cap_net_bind_service=+ep' <INSTALLATION_DIR>/node/bin/node

where <INSTALLATION_DIR> is the Wazuh dashboard installation path.

Wazuh dashboard deb and rpm packages do this in the post-installation.

[Khul Sat]

Hi Nicolas, Thanks for the inputs! :)

Apologies for not mentioning the Wazuh version. Its 4.4.
(1) About the misconfiguration part, I have only moved /usr/share/wazuh-dashboard path from one disk to another. Nothing else. If I start the service with new path, it gives me an error. If rolled back and started with old path, it works fine! Any idea why?
(2) If I add --allow-root in systemd unit file, will it harm in any way? Or it is not advisable?
(3) Could it be possible for you to share a KB link for this setcap command? I would like to understand more about it as I did not see this command as part of the standard installation process.

rgds,ks

​

[Nicolas Stefani]

(1) Sorry here, I didn't mean to say that you made a mistake, by just moving the installation to the new place where something got lost. But, I can't say for sure what it was.

(2) Isn't recommended to run the dashboard with the root user. This can be problematic in the future.

(3) Yes I miss the links. Here you have:

* DEB: https://github.com/wazuh/wazuh-packages/blob/v4.4.5/stack/dashboard/deb/debian/postinst#L29

* RPM: https://github.com/wazuh/wazuh-packages/blob/v4.4.5/stack/dashboard/rpm/wazuh-dashboard.spec#L131

Let me know if you have any other related questions, regards.

[Khul Sat]

Thanks for the details!
I shall check with setcap command which you have given and update you if that works. Aside, do I need to enable any kind of debug for further troubleshooting?

Regds,KS

​

[Khul Sat]

Hi Nicolas Stefani!
setcap 'cap_net_bind_service=+ep' <INSTALLATION_DIR>/node/bin/node this worked well.
Though the mount path was same, may be the change in disk resulted the failure. Executing above command fixed the failure.

Thanks a ton!

​