ZupIT/horusec

Problems when sent a analisis to web manager in a another host.

Closed this issue · 16 comments

dschacon288 commented

What happened:
I install the web manager in another host i am trying run a analysis and sent it, but the analysis dont show in web manager
How to reproduce it (as minimally and precisely as possible):
install horusec manager in another host.
Run a analisis and put the flag -u whit the ip where manager are located and the token
Web manager dont show the analisys
Anything else we need to know?:
How to know what is the error, because, the anlysis dont show if the conection was succesfull
Environment:

  • Horusec version : V2.0
  • Operating System: kali linux
  • Network plugin / Tool and version (if this is a network-related / tool bug):
  • Others: instalation whit docker and docker compose
wiliansilvazup commented

Hello @dschacon288 tnks for report.

Is not clear for me the Version. Do you can sent again what is version:

  • Horusec-CLI
  • Horusec-Platform micro services
dschacon288 commented

version is Horusec-Platform micro services, but i dont know if the cli sent the analysis because never lauch a confirmacion, when the cli have a issue to sent the analisis have a alert

wiliansilvazup commented

Ok.
Horusec-Platform service is in v2.0.0, correct ?

Now, run horusec version in your terminal and sent me what is your version of the Horusec-CLI.

Show me prints or errors when you sent analysis too, this help me to understand the problem :)

dschacon288 commented

The version:
image
There is no error message or confirmation that the analysis has been sent, but the analysis does not appear on the web.
image

wiliansilvazup commented

okay. I need more details!
1º - Run horusec with the flag --log-level debug too. And sent to me the log file your path is showed in first lines of the analysis, something like this:
image
or sent to me all output of the analysis

2º Sent to me if your services is running with versions, something like this: docker ps

3º Sent to me Logs of the micro service Horusec-API, something like this: docker logs horusec-api

dschacon288 commented
  1. Log file
    image
  2. Sevices runing
    image
  3. logs docker horusec-api
    image
dschacon288 commented

image

this is the horusec start log

wiliansilvazup commented

OK. Your Horusec-CLI is in v2.7.1 and Horusec-Platform is in v2.17.4 both in latest version.

Now, in your project you have config file with name horusec-config.json
Check if exist this fields and clear them:

{
...
"horusecCliPrintOutputType": "",
"horusecCliJsonOutputFilepath": "",
"horusecCliRepositoryAuthorization": "",
"horusecCliHorusecApiUri": ""
...
}

For best security use environment variable to pass URI and Authorization token, somenthing like this:

> export HORUSEC_CLI_HORUSEC_API_URI="http://HOST:8000"
> export HORUSEC_CLI_REPOSITORY_AUTHORIZATION="YOUR_TOKEN"

If this works, remember to set this environments variables in safe place!

> sudo horusec start -p . --log-level debug
dschacon288 commented

Well, i clean the horuseg-confif.json and use the variable enviroment, so the result was this:
image
in this image, show de id of analisis
image
and finally the result of analisis
image

so, I think that the problem is in the database of web manager, because in logs of docker horusec-api show that he send a analysys to host and recive a 201 status code. but I dont undertstand why make a get
image

wiliansilvazup commented

The GET has necessary in Horusec-CLI to merge all false-positives in web application and show in your analysis locally.

Well, your analysis is being saved successfully. And when you go into your browser and access the Horusec-Manager application, it doesn't show any vulnerability on the Dashboard screen or on the Vulnerability Manager screen?

wiliansilvazup commented

Try access Dashboard screen in your browser and show me logs of the Horusec-Analytic service.

dschacon288 commented

This is the log of analytic services
image

In the browser the dashboard are empty but the vulnerability no
image

Vulnerabilities
image

wiliansilvazup commented

This is really strange.

You can access the analytic database and check if there is recorded data in any table?

dschacon288 commented

Well, we have these db
image

we are only interested in the first two

the analytic db have records
image

consulting data
image

and in horusec_db too

image

In the web, appear a error in the dashboard network

image

wiliansilvazup commented

wow i think i found the problem :)

Your Configuration in Horusec-Manager micro-service is wrong. The port correct of the horusec-analytic is 8005.

Change this environment variable in Horusec-Manager to:
HORUSEC_ENDPOINT_ANALYTIC = https:\\/\\/:192.168.145.129:8005

and try again

dschacon288 commented

In effect, there is the problem. Now is all correct

I have a last question, when i try to run a analisis into pipeline of azure devops. I have this error, maybe you know how to fix it
image