Can't login after graylog setup. No password works

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
When I try to follow along with the setup here: docker-compose/open-core/docker-compose.yml at main · Graylog2/docker-compose · GitHub
I setup the certificate provisioning by letting graylog create a new certificate for me, and then come to the login-page, no password seem to work?

2. Describe your environment:

  • OS Information:
    Docker compose on ubuntu

  • Package Version: 6.0

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?
I’ve tried looking at the logs, and I’ve tried with a few different passwords in GRAYLOG_PASSWORD_SECRET and GRAYLOG_ROOT_PASSWORD_SHA2

4. How can the community help?
Is there someone who’s encountered this, and or can help me to get further along?

Here’s my configs

services:
  mongodb:
    image: "mongo:7-jammy"
    container_name: "graylog_mongo"
    volumes:
      - "mongodb_data:/data/db"
    restart: "on-failure"
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 20s
      start_period: 2s

    # For DataNode setup, graylog starts with a preflight UI, this is a change from just using OpenSearch/Elasticsearch.
    # Please take a look at the README at the top of this repo or the regular docs for more info.
  datanode:
    image: "${DATANODE_IMAGE:-graylog/graylog-datanode:6.0}"
    container_name: "graylog-datanode"
    hostname: "graylog-datanode"
    environment:
      GRAYLOG_DATANODE_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:-superduperpasswordsuperduperpasswordsuperduperpasswordsuperduperpassword}"
      GRAYLOG_DATANODE_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:-7be037e46a431f16c79bcb32a9c1bdda13b504868139d7f4bec6776301a7c088}"
      GRAYLOG_DATANODE_MONGODB_URI: "mongodb://graylog_mongo:27017/graylog"
      GRAYLOG_ROOT_TIMEZONE: "Europe/Stockholm"
    depends_on:
      mongodb:
        condition: "service_healthy"
    ulimits:
      memlock:
        hard: -1
        soft: -1
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "8999:8999/tcp"   # DataNode API
      - "9200:9200/tcp"
      - "9300:9300/tcp"
    volumes:
      - "graylog-datanode:/var/lib/graylog-datanode"
    restart: "on-failure"

  graylog:
    container_name: "graylog"
    image: "${GRAYLOG_IMAGE:-graylog/graylog:6.0}"
    hostname: "graylog"
    depends_on:
      mongodb:
        condition: "service_healthy"
    entrypoint: "/usr/bin/tini --  /docker-entrypoint.sh"
    environment:
      GRAYLOG_NODE_ID_FILE: "/usr/share/graylog/data/data/node-id"
      GRAYLOG_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:-superduperpasswordsuperduperpasswordsuperduperpasswordsuperduperpassword}"
      GRAYLOG_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:-7be037e46a431f16c79bcb32a9c1bdda13b504868139d7f4bec6776301a7c088}"
      GRAYLOG_HTTP_BIND_ADDRESS: "0.0.0.0:9000"
      GRAYLOG_HTTP_EXTERNAL_URI: "http://localhost:9000/"
      GRAYLOG_MONGODB_URI: "mongodb://graylog_mongo:27017/graylog"
      GRAYLOG_TRUSTED_PROXIES: "127.0.0.1/32, 192.168.0.0/24"
      GRAYLOG_ROOT_TIMEZONE: "Europe/Stockholm"
    ports:
      - "5044:5044/tcp"   # Beats
      - "5140:5140/udp"   # Syslog
      - "5140:5140/tcp"   # Syslog
      - "5555:5555/tcp"   # RAW TCP
      - "5555:5555/udp"   # RAW UDP
      - "9000:9000/tcp"   # Server API
      - "12201:12201/tcp" # GELF TCP
      - "12201:12201/udp" # GELF UDP
      #- "10000:10000/tcp" # Custom TCP port
      #- "10000:10000/udp" # Custom UDP port
      - "13301:13301/tcp" # Forwarder data
      - "13302:13302/tcp" # Forwarder config
    volumes:
      - "graylog_data:/usr/share/graylog/data/data"
      - "graylog_journal:/usr/share/graylog/data/journal"
      #- ./data/monitor/graylog/graylog.conf:/usr/share/graylog/data/config/graylog.conf
      #- ./data/monitor/graylog/cert.pem:/usr/share/graylog/data/cert.pem:ro
      #- ./data/monitor/graylog/keyStore.p12:/usr/share/graylog/data/key.pem:ro
    restart: "on-failure"

volumes:
  mongodb_data:
    name: monitor_mongo
  graylog-datanode:
    name: monitor_datanode
  graylog_data:
    name: monitor_data
  graylog_journal:
    name: monitor_journal

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

What kind of login do you get, a login page with a nice background, or the built in browser pop up to enter a password?

3

If you dont get the image page then your connection to opensearch isnt properly setup.

4

No I get the nice background login-page. The initial setup to datanode is successful :slight_smile:
I wonder if the GRAYLOG_PASSWORD_SECRET and GRAYLOG_ROOT_PASSWORD_SHA2 doesn’t get correctly transferred in docker or something?
There’s a graylog.config (don’t remember the actual name) in the container, and it looks like some of my environment settings have modified values in there, but the password and sha2 is blank?

5

@seppaleinen within you config you have listed the below

  GRAYLOG_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:-superduperpasswordsuperduperpasswordsuperduperpasswordsuperduperpassword}"
  GRAYLOG_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:-7be037e46a431f16c79bcb32a9c1bdda13b504868139d7f4bec6776301a7c088}"

It looks like you are calling variables from the .env file and attempting to set the password within the compose file simultaneously. Assuming you have set the secret and password within a .env file in the same directory as as you compose file the formatting would be

  GRAYLOG_DATANODE_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET}"
  GRAYLOG_DATANODE_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2}"

If you are not the using environment variables file then the format would be

GRAYLOG_PASSWORD_SECRET: "superduperpasswordsuperduperpasswordsuperduperpasswordsuperduperpassword"
GRAYLOG_ROOT_PASSWORD_SHA2: "7be037e46a431f16c79bcb32a9c1bdda13b504868139d7f4bec6776301a7c088"
6

Thanks for the reply!

I think I’ve tried setting the values specifically as per your example, but it resulted the same. I will try again, and see if it goes better.
The syntax

"${GRAYLOG_PASSWORD_SECRET:-default}"

is just a way to try and get an environment variable, and if unsuccessful, use the default value. So in my case a bit redundant :slight_smile:

7

No, just tried it again to the same result.
I’ve tried with

superduperpasswordsuperduperpasswordsuperduperpasswordsuperduperpassword

and
7be037e46a431f16c79bcb32a9c1bdda13b504868139d7f4bec6776301a7c088
for the admin user

8

@seppaleinen

Are you generating the secret with the below?

pwgen -N 1 -s 96

9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.