lsof: unacceptable port specification in: -i : when I am installing Wazuh dashboard with the assistant in a single node

[c-bordon]

Wazuh version	Install type	Action performed	Platform
4.6.0	unattended	Install	Centos 7

When I ran the tests for this PR I found an error message when installing Wazuh dashboard, it is a message that did not prevent the installation from progressing:

lsof: unacceptable port specification in: -i :
lsof 4.87
 latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
 latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
 latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
 usage: [-?abhKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-f[gG]] [+|-e s]
 [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s]
[+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [-Z [Z]] [--] [names]
Use the ``-h'' option to get more help information.
01/09/2023 20:08:15 INFO: Wazuh development repository added.
wazuh-dashboard

Full log

[root@centos72 unattended_installer]# bash wazuh-install.sh --wazuh-dashboard wazuh-dashboard
01/09/2023 20:08:05 INFO: Starting Wazuh installation assistant. Wazuh version: 4.6.0
01/09/2023 20:08:05 INFO: Verbose logging redirected to /var/log/wazuh-install.log
01/09/2023 20:08:13 INFO: Wazuh web interface port will be 443.
lsof: unacceptable port specification in: -i :
lsof 4.87
 latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
 latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
 latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
 usage: [-?abhKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-f[gG]] [+|-e s]
 [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s]
[+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [-Z [Z]] [--] [names]
Use the ``-h'' option to get more help information.
01/09/2023 20:08:15 INFO: Wazuh development repository added.
wazuh-dashboard
01/09/2023 20:08:15 INFO: --- Wazuh dashboard ----
01/09/2023 20:08:19 INFO: --- Dependencies ---
01/09/2023 20:08:19 INFO: Installing chromium.
01/09/2023 20:08:20 WARNING: Cannot install optional dependency: chromium.
01/09/2023 20:08:20 INFO: Installing xorg-x11-fonts-100dpi.
01/09/2023 20:08:24 INFO: Installing xorg-x11-fonts-75dpi.
01/09/2023 20:08:26 INFO: Installing xorg-x11-utils.
01/09/2023 20:08:29 INFO: Installing xorg-x11-fonts-cyrillic.
01/09/2023 20:08:30 INFO: Installing xorg-x11-fonts-Type1.
01/09/2023 20:08:33 INFO: Installing xorg-x11-fonts-misc.
01/09/2023 20:08:38 INFO: Installing fontconfig.
01/09/2023 20:08:38 WARNING: Wazuh dashboard dependencies skipped. PDF report generation may not work.
01/09/2023 20:08:38 INFO: Starting Wazuh dashboard installation.
01/09/2023 20:10:11 INFO: Wazuh dashboard installation finished.
01/09/2023 20:10:11 INFO: Wazuh dashboard post-install configuration finished.
01/09/2023 20:10:11 INFO: Starting service wazuh-dashboard.
01/09/2023 20:10:11 INFO: wazuh-dashboard service started.
01/09/2023 20:10:25 INFO: Initializing Wazuh dashboard web application.
01/09/2023 20:10:26 INFO: Wazuh dashboard web application initialized.
01/09/2023 20:10:26 INFO: --- Summary ---
01/09/2023 20:10:26 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: 0OQH2*hLP+tiAm6CnyFol+EhTaXD9*x?
01/09/2023 20:10:26 INFO: Installation finished

The process was as follows:

• The installation was generated with this configuration file:

[root@centos72 unattended_installer]# cat config_aio.yml 
nodes:
  indexer:
    - name: wazuh-indexer
      ip: 127.0.0.1
  server:
    - name: wazuh-server
      ip: 127.0.0.1
  dashboard:
    - name: wazuh-dashboard
      ip: 127.0.0.1

• Components were installed individually:

[root@centos72 unattended_installer]# bash wazuh-install.sh --generate-config-files
[root@centos72 unattended_installer]# bash wazuh-install.sh --wazuh-indexer wazuh-indexer
[root@centos72 unattended_installer]# bash wazuh-install.sh --start-cluster
[root@centos72 unattended_installer]# bash wazuh-install.sh --wazuh-server wazuh-server
[root@centos72 unattended_installer]# bash wazuh-install.sh --wazuh-dashboard wazuh-dashboard

[davidcr01]

Research

To investigate this error, the code has been debugged and the error is related to the following code of the check_ports function

04/09/2023 10:59:48 INFO: Wazuh web interface port will be 443.
+ '[' -n 1 ']'
+ checks_ports ''
+ used_port=0
+ ports=("$@")
+ command -v lsof
+ port_command='lsof -sTCP:LISTEN  -i:'
+ for i in '"${!ports[@]}"'
+ eval 'lsof -sTCP:LISTEN  -i:'
++ lsof -sTCP:LISTEN -i:
lsof: unacceptable port specification in: -i :

As the code shows, the checks_ports function is being called with no arguments, and it should receive a list of ports. This error is caused by a bad definition of the Wazuh dashboard port variable.

This is how the dashboard port is checked in the code:

if [ -n "${dashboard}" ]; then
   checks_ports "${wazuh_dashboard_port}"
fi

But the variable is not defined as wazuh_dashboard_port, but wazuh_dashboard_ports, and it is not a single variable, but a list:

readonly wazuh_dashboard_ports=( "${http_port}" )

Applying the fix

The fix is as simple as changing the variable like follows:

readonly wazuh_dashboard_port="${http_port}"

Testing

🟢 Now, the installation of the Wazuh dashboard is done as expected and no related errors or warnings are generated:

[root@centos7 vagrant]# bash wazuh-install.sh -wd wazuh-dashboard -o
04/09/2023 11:19:42 INFO: Starting Wazuh installation assistant. Wazuh version: 4.6.0
04/09/2023 11:19:42 INFO: Verbose logging redirected to /var/log/wazuh-install.log
04/09/2023 11:19:46 INFO: --- Removing existing Wazuh installation ---
04/09/2023 11:19:46 INFO: Removing Wazuh dashboard.
04/09/2023 11:19:54 INFO: Wazuh dashboard removed.
04/09/2023 11:19:54 INFO: Installation cleaned.
04/09/2023 11:19:56 INFO: Wazuh web interface port will be 443.
04/09/2023 11:19:58 INFO: Wazuh development repository added.
wazuh-dashboard
04/09/2023 11:19:58 INFO: --- Wazuh dashboard ----
04/09/2023 11:20:00 INFO: Starting Wazuh dashboard installation.
04/09/2023 11:21:41 INFO: Wazuh dashboard installation finished.
04/09/2023 11:21:41 INFO: Wazuh dashboard post-install configuration finished.
04/09/2023 11:21:41 INFO: Starting service wazuh-dashboard.
04/09/2023 11:21:41 INFO: wazuh-dashboard service started.
04/09/2023 11:21:54 INFO: Initializing Wazuh dashboard web application.
04/09/2023 11:21:54 INFO: Wazuh dashboard web application initialized.
04/09/2023 11:21:54 INFO: --- Summary ---
04/09/2023 11:21:54 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: LxPchf3UNlxGYyvU0rxQ*+SvV?dk3SOu
04/09/2023 11:21:54 INFO: Installation finished.
[root@centos7 vagrant]# 

If the code is now debugged, the function is efectively receiving the port as an argument:

04/09/2023 11:13:09 INFO: Wazuh web interface port will be 443.
+ '[' -n 1 ']'
+ checks_ports 443
+ used_port=0
+ ports=("$@")
+ command -v lsof
+ port_command='lsof -sTCP:LISTEN  -i:'
+ for i in '"${!ports[@]}"'
+ eval 'lsof -sTCP:LISTEN  -i:443'