Graylog first installation - You cannot access this resource, missing authorization header!

Graylog Central (peer support)
1

Hello everyone, i’m asking for your support, i am not able to resolve the following issue :

**1. Unable to access webadmin
The installation went wel, all service are up and ready, but when i try to access Graylog Webadmin i get the following popup :
image
Just like an .htaccess secure prompt
When i close that prompt i got the following :
“You cannot access this resource, missing authorization header!”

I’ve tried to run Graylog server behing an apache or a nginx proxy (classic or ssl).
I got always the same issue.
I think something is wrong in my graylog server.conf
I have modified http bind address according to my current setup.
For example, now, direct access to graylog from another network (without proxy) so http_bind_address = 0.0.0.0:9000
I d’on’t really understand graylog security features, so i might be missing something.

2. Environment:

  • OS Information: Debian 11

  • Package Version: Graylog 5.2, opensearch v2.11.1, mongoDB v7.0.5

Any help would be really appreciated

Thank you

Regards

2

Do you have elasticsearch_hosts configured in server.conf?

My guess is this is related to the datanode feature recently added, see Prerequisites

The username/password is in the log file of the graylog node. However, if you are not using datanode that setup process won’t be very helpful.

3

Hello and thank you,

That is the exact problem, good gess.

My graylog server don’t see any data node even if Opensearch is installed and well configured (hope so).
Any advices for graylog-server.conf for opensearch (named elasticsearch in the conf file)?
curl 127.0.0.1:9200 works well, but my graylog server doesn’t seem to see the opensearch instance…

4

“Do you have elasticsearch_hosts configured in server.conf ?”

I let default parameters

5

elasticsearch_hosts = http://127.0.0.1:9200
Correction, i have uncommented this, maybe too late. (After preflight i think)
I wanted to reinstall everything.
Do i have to set others parameters for opensearch in server.conf?
What do you think?

Thank you

6

Is this the first login after installation? If so, the access data is in the log: /var/log/graylog-server/server.log

It seems to be a similar problem like in this thread: Webinterface login refused!

7

Settings elasticsearch_hosts should be sufficient. This is no longer an optional configuration parameter if you are maintaining opensearch (as opposed to using datanode).

I believe you can update that setting to point to your OpenSearch cluster. If this does not work though you may need to:

  1. stop graylog-server
  2. remove the graylog mongodb database
  3. update server.conf to configure `elasticsearch_hosts1
  4. start graylog-server
8

Good morning Valhaim, and thank you,

Yes i found those credential, i’ve done preflight but my graylogserver was unable to find the datanode (in my case opensearch). I kindda ignore that. But then i access to the normal UI, made an input, saw log arriving on the server, but no data collection because of missing datanode

image
image1709×591 42.3 KB

9

Morning Drew,
Do you think i have to completely remove mongoDB? Are only the base that contain Graylog parameters?

10

THank you Drew,
I’ve just tried your recommandations

  1. stop graylog-server
  2. remove the graylog mongodb database
  3. update server.conf to configure `elasticsearch_hosts1
  4. start graylog-server
    Unfortunately, it didn’t work… Still node datanode found. I will try to reinstall the whole thing.
    Have a good day.
11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.