Kibana Error in distributed

[dods attack]

Hi There,

I'm facing problem when i'm tring to start kibana. 

I'm attaching the log kindly check and let me know how i can fix this, I'm using Centos7 already tested on ubuntu but facing same error.

Kibana - Logs

 cat /var/log/kibana/kibana.log

{"type":"log","@timestamp":"2023-04-05T09:02:09+00:00","tags":["info","plugins-service"],"pid":10707,"message":"Plugin \"metricsEntities\" is disabled."}
{"type":"log","@timestamp":"2023-04-05T09:02:10+00:00","tags":["info","http","server","Preboot"],"pid":10707,"message":"http server running at https://0.0.0.0:443"}
{"type":"log","@timestamp":"2023-04-05T09:02:10+00:00","tags":["fatal","root"],"pid":10707,"message":"Error: EACCES: permission denied, open '/etc/kibana/certs/ca/ca.crt'\n    at Object.openSync (node:fs:590:3)\n    at readFileSync (node:fs:458:35)\n    at readFile (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_config.js:474:31)\n    at readKeyAndCerts (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_config.js:458:21)\n    at new ElasticsearchConfig (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_config.js:393:9)\n    at MapSubscriber.project (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_service.js:52:108)\n    at MapSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/map.js:49:35)\n    at MapSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at MapSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/map.js:55:26)\n    at MapSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at DistinctUntilChangedSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/distinctUntilChanged.js:69:30)\n    at DistinctUntilChangedSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at MapSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/map.js:55:26)\n    at MapSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at ReplaySubject._subscribe (/usr/share/kibana/node_modules/rxjs/internal/ReplaySubject.js:80:28)\n    at ReplaySubject.Observable._trySubscribe (/usr/share/kibana/node_modules/rxjs/internal/Observable.js:44:25) {\n  errno: -13,\n  syscall: 'open',\n  code: 'EACCES',\n  path: '/etc/kibana/certs/ca/ca.crt'\n}"}
{"type":"log","@timestamp":"2023-04-05T09:02:27+00:00","tags":["info","plugins-service"],"pid":10727,"message":"Plugin \"metricsEntities\" is disabled."}
{"type":"log","@timestamp":"2023-04-05T09:02:27+00:00","tags":["info","http","server","Preboot"],"pid":10727,"message":"http server running at https://0.0.0.0:443"}
{"type":"log","@timestamp":"2023-04-05T09:02:27+00:00","tags":["fatal","root"],"pid":10727,"message":"Error: EACCES: permission denied, open '/etc/kibana/certs/ca/ca.crt'\n    at Object.openSync (node:fs:590:3)\n    at readFileSync (node:fs:458:35)\n    at readFile (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_config.js:474:31)\n    at readKeyAndCerts (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_config.js:458:21)\n    at new ElasticsearchConfig (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_config.js:393:9)\n    at MapSubscriber.project (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_service.js:52:108)\n    at MapSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/map.js:49:35)\n    at MapSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at MapSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/map.js:55:26)\n    at MapSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at DistinctUntilChangedSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/distinctUntilChanged.js:69:30)\n    at DistinctUntilChangedSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at MapSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/map.js:55:26)\n    at MapSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at ReplaySubject._subscribe (/usr/share/kibana/node_modules/rxjs/internal/ReplaySubject.js:80:28)\n    at ReplaySubject.Observable._trySubscribe (/usr/share/kibana/node_modules/rxjs/internal/Observable.js:44:25) {\n  errno: -13,\n  syscall: 'open',\n  code: 'EACCES',\n  path: '/etc/kibana/certs/ca/ca.crt'\n}"}
{"type":"log","@timestamp":"2023-04-05T09:02:44+00:00","tags":["info","plugins-service"],"pid":10744,"message":"Plugin \"metricsEntities\" is disabled."}
{"type":"log","@timestamp":"2023-04-05T09:02:45+00:00","tags":["info","http","server","Preboot"],"pid":10744,"message":"http server running at https://0.0.0.0:443"}
{"type":"log","@timestamp":"2023-04-05T09:02:45+00:00","tags":["fatal","root"],"pid":10744,"message":"Error: EACCES: permission denied, open '/etc/kibana/certs/ca/ca.crt'\n    at Object.openSync (node:fs:590:3)\n    at readFileSync (node:fs:458:35)\n    at readFile (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_config.js:474:31)\n    at readKeyAndCerts (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_config.js:458:21)\n    at new ElasticsearchConfig (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_config.js:393:9)\n    at MapSubscriber.project (/usr/share/kibana/src/core/server/elasticsearch/elasticsearch_service.js:52:108)\n    at MapSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/map.js:49:35)\n    at MapSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at MapSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/map.js:55:26)\n    at MapSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at DistinctUntilChangedSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/distinctUntilChanged.js:69:30)\n    at DistinctUntilChangedSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at MapSubscriber._next (/usr/share/kibana/node_modules/rxjs/internal/operators/map.js:55:26)\n    at MapSubscriber.Subscriber.next (/usr/share/kibana/node_modules/rxjs/internal/Subscriber.js:66:18)\n    at ReplaySubject._subscribe (/usr/share/kibana/node_modules/rxjs/internal/ReplaySubject.js:80:28)\n    at ReplaySubject.Observable._trySubscribe (/usr/share/kibana/node_modules/rxjs/internal/Observable.js:44:25) {\n  errno: -13,\n  syscall: 'open',\n  code: 'EACCES',\n  path: '/etc/kibana/certs/ca/ca.crt'\n}"}
{"type":"log","@timestamp":"2023-04-05T09:05:53+00:00","tags":["fatal","root"],"pid":10802,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:05:59+00:00","tags":["fatal","root"],"pid":10820,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:06:07+00:00","tags":["fatal","root"],"pid":10838,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:17:58+00:00","tags":["fatal","root"],"pid":10971,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:18:05+00:00","tags":["fatal","root"],"pid":10988,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:18:12+00:00","tags":["fatal","root"],"pid":11006,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:20:06+00:00","tags":["fatal","root"],"pid":11037,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:20:13+00:00","tags":["fatal","root"],"pid":11054,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:20:20+00:00","tags":["fatal","root"],"pid":11072,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:21:24+00:00","tags":["fatal","root"],"pid":11098,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:21:31+00:00","tags":["fatal","root"],"pid":11116,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}
{"type":"log","@timestamp":"2023-04-05T09:21:38+00:00","tags":["fatal","root"],"pid":11133,"message":"Error: Plugin with id \"wazuh\" is already registered!\n    at MergeMapSubscriber.project (/usr/share/kibana/src/core/server/plugins/plugins_service.js:201:15)"}

[Marcelo Hamra]

Hi!

Thanks for using wazuh.

Reading the posted log, it seems there is a permission access problem in the ca.crt file.

In this link to the documentation you can see the script to install certificates in 

https://documentation.wazuh.com/current/deployment-options/elastic-stack/distributed-deployment/kibana/index.html?highlight=kibana

unzip ~/certs.zip -d ~/certs
rm -f ~/certs/ca/ca.key
mkdir /etc/kibana/certs/ca -p
cp ~/certs/ca/ca.crt /etc/kibana/certs/ca
cp ~/certs/kibana/* /etc/kibana/certs/
chown -R kibana: /etc/kibana/certs
chmod -R 500 /etc/kibana/certs
chmod 400 /etc/kibana/certs/ca/ca.* /etc/kibana/certs/kibana.*
rm -rf ~/certs ~/certs.zip

Could you please check using 'ls -l' that the correct permissions for Kibana's Linux user are set?