New install cannot authenticate, Compose keeps quotes in passwords read from the .env file
#677
Comments
|
@mAineAc- I see that the In the logs you provided, it seems like Elasticsearch hasn't finished initializing yet. My first recommendation would be to tail the logs of both Elasticsearch and Kibana, and ensure that everything is really up and running before trying to log in. Please also note that changing the passwords in the Users are only initialized from the |
|
Yes, I have brought it up and down repeatedly. It never works. I was limited on how much I can put in for logs so I cut it short. I have left it up for over a day and it still has a log in failure. |
|
It could be a browser issue then (privacy add-ons?), in which case it might come in handy to try in private mode, or with a different browser. Opening the dev console might reveal errors too. I see no evidence that the stack components themselves aren't working at least. Kibana is connected to Elasticsearch since it shows a login screen, and the setup container completed. We have automated tests to ensure that we don't break the stack when we push changes, so I'm confident Kibana is working with the aforementioned user. |
|
I will test and get back to you. |
|
Tested in new browser and in incognito mode |
|
This is the browser console after a login attempt |
|
password is 'changeme' |
|
@VNPT-HCM wow I think you're right. From the docs:
I was going to say that I swear I managed to log in with "changeme" (no quotes), but I think I know why: I typically export my variables in the shell ( @mAineAc- could you please confirm that this was indeed the issue before I push the fix? |
|
Actually, I have a feeling that the fact I did not catch this might be related to Compose V2. I'm using Compose V2, and the quotes are definitely not part of the password. Without quotes: $ curl -D- http://localhost:9200 -u "elastic:changeme"
HTTP/1.1 200 OK
...With quotes: $ curl -D- http://localhost:9200 -u "elastic:'changeme'"
HTTP/1.1 401 Unauthorized
... |
|
Update: same result with Compose V1 (1.29) 🤔 $ docker-compose-v1 version
docker-compose version 1.29.2, build 5becea4c
docker-py version: 5.0.0
CPython version: 3.7.10
OpenSSL version: OpenSSL 1.1.0l 10 Sep 2019$ docker-compose-v1 exec elasticsearch printenv ELASTIC_PASSWORD
changemeWithout quotes: $ curl -D- http://localhost:9200 -u "elastic:changeme"
HTTP/1.1 200 OK
...With quotes: $ curl -D- http://localhost:9200 -u "elastic:'changeme'"
HTTP/1.1 401 Unauthorized
...I see that @mAineAc- is using Compose 1.25.0.
The introduction of this library may have had an influence on the handling of quotes. (edit: apparently it did: docker/compose#2854) However, it is unclear to me why to documentation mentions there is no special handling of quotation marks, when obviously there is. We might want to report this to Docker. edit: I just opened docker/docs#14318 |
|
@VNPT-HCM and @mAineAc-, I'd be curious to see what the output of |
|
Using the quotes did work. I got logged in with that. |
maineac@elastiflow:~/docker/docker-elk$ docker-compose confignetworks:
elk:
driver: bridge
services:
elasticsearch:
build:
args:
ELK_VERSION: 8.0.0
context: /home/maineac/docker/docker-elk/elasticsearch
environment:
ELASTIC_PASSWORD: '''changeme'''
ES_JAVA_OPTS: -Xmx256m -Xms256m
discovery.type: single-node
networks:
elk: null
ports:
- published: 9200
target: 9200
- published: 9300
target: 9300
volumes:
- /home/maineac/docker/docker-elk/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro,z
- elasticsearch:/usr/share/elasticsearch/data:z
kibana:
build:
args:
ELK_VERSION: 8.0.0
context: /home/maineac/docker/docker-elk/kibana
depends_on:
- elasticsearch
environment:
KIBANA_SYSTEM_PASSWORD: '''changeme'''
networks:
elk: null
ports:
- published: 5601
target: 5601
volumes:
- /home/maineac/docker/docker-elk/kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml:ro,Z
logstash:
build:
args:
ELK_VERSION: 8.0.0
context: /home/maineac/docker/docker-elk/logstash
depends_on:
- elasticsearch
environment:
LOGSTASH_INTERNAL_PASSWORD: '''changeme'''
LS_JAVA_OPTS: -Xmx256m -Xms256m
networks:
elk: null
ports:
- published: 5044
target: 5044
- protocol: tcp
published: 5000
target: 5000
- protocol: udp
published: 5000
target: 5000
- published: 9600
target: 9600
volumes:
- /home/maineac/docker/docker-elk/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro,Z
- /home/maineac/docker/docker-elk/logstash/pipeline:/usr/share/logstash/pipeline:ro,Z
setup:
build:
args:
ELK_VERSION: 8.0.0
context: /home/maineac/docker/docker-elk/setup
environment:
ELASTIC_PASSWORD: '''changeme'''
KIBANA_SYSTEM_PASSWORD: '''changeme'''
LOGSTASH_INTERNAL_PASSWORD: '''changeme'''
networks:
elk: null
volumes:
- setup:/state:Z
version: '3.2'
volumes:
elasticsearch: {}
setup: {} |
|
@mAineAc- thanks for checking! Compose indeed did the wrong thing here: ELASTIC_PASSWORD: '''changeme'''I believe the conclusion is that we want to recommend users to use Compose ≥ 1.26.0, because we do recommend people to use quotes in order to avoid issues with passwords containing special characters, as seen in #667. For people using Compose 1.22.0 to 1.25.5, the setup should be considered "unsupported but known to be working", with the recommendation to remove surrounding quotes from values in the # .env
ELASTIC_VERSION=8.0.0
ELASTIC_PASSWORD=changeme
LOGSTASH_INTERNAL_PASSWORD=changeme
KIBANA_SYSTEM_PASSWORD=changeme |
antoineco
changed the title
.env file
This comment was marked as off-topic.
This comment was marked as off-topic.
|
@asgharkhan I converted your comment into a new issue (#680) because
|
Prior to this version, surrounding quotes (single and double) were preserved in values coming from the '.env' file, which is counter intuitive and goes against the recommended practice of quoting values containing special characters, such as passwords. Closes deviantony#677
Problem description
I run docker compose everything completes. I check the logs to verify set up is complete. I can go to the ,env files and see the password for elastic is changeme and when I go to log in on the page it tells me the password is invalid. I have cleaned out all images for all docker sessions and started right from scratch and still get the same thing. I can go into the elastic config and change to no security and it brings it up so that i can do stuff but I don't see a way to create new users when I do this. I have tried changing the default password to other passwords to no avail. I still get an authentication failed when trying to log in.
Extra information
Stack configuration
maineac@elastiflow:~/docker/docker-elk$ git diff
diff --git a/elasticsearch/config/elasticsearch.yml b/elasticsearch/config/elasticsearch.yml
index 3e82379..f03613b 100644
--- a/elasticsearch/config/elasticsearch.yml
+++ b/elasticsearch/config/elasticsearch.yml
@@ -8,5 +8,5 @@ network.host: 0.0.0.0
X-Pack settings
see https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html
-xpack.license.self_generated.type: trial
+xpack.license.self_generated.type: basic
xpack.security.enabled: true
maineac@elastiflow:~/docker/docker-elk$
Docker setup
Container logs
The text was updated successfully, but these errors were encountered: