Blank page upon logging into Kibana 5.6.10

Search Guard
1

I am running ELK stack on A CentOS 7 virtualbox. I am also running sentinl plugin on Kibana:

I had ELK running beforehand. After adding the plugin, I got an unauthorized error on it, which is supposed to be fixed through search guard configurations. However, I do not know what it is that I did, that caused Kibana to give a blank page after entering the username and password on login. I cant seem to figure out what is causing Kibana to break. I understand that you are always busy and there have been cases like this before, but I couldnt find one that solves my issue. Any help is greatly appreciated. Also, please let me know if there is anything else you require me to attach, so I can help you help me :smiley:

When posting in this category, please add:

If you are using Kibana, please also add:

  • Your kibana.yml configuration file

(upload://tW99nK0uqxaFWaxok5H8zQXrfHK.txt) kibana.yml.txt (3.2 KB)

2

A blank page in Kibana after log in usually indicates that the user is not assigned to the sg_kibanauser role. This role grants the minimum permissions to use Kibana. It needs to be assigned in addition to any role(s) that grant access to the data index / indices.

3

Also, in your sg_config, can set the following property to true:

searchguard.dynamic.kibana.do_not_fail_on_forbidden

(explained here: Installing the Search Guard Kibana Plugin | Security for Elasticsearch | Search Guard)

4

thank you for your quick reply!!
When I login to Kibana, I am using an admin to login (which theoretically should have the permissions to view the contents no?)
I will modify with your suggestions and update you with results. Thanks again for your prompt reply.

5

Hey @jkressin so I’m not sure if what I did is right or not. basically what i did is that I added the

as explained in the link.
I also added the

but I am not sure I did it right, given that I still get a blank page.
I added it in sg_internal_users.yml below hash I just added:
roles:

  • sg_kibana_user # for sentinl

roles:

  • “*” # for admin.

I also added: #into sg_roles_mapping.yml

sg_kibana_user:
backendroles:
- kibanauser

and # in sg_roles.yml:
sg_kibana_user:
readonly: true
cluster:
- INDICES_MONITOR
- CLUSTER_COMPOSITE_OPS
indices:
‘?kibana’:
‘':
- MANAGE
- INDEX
- READ
- DELETE
'’:
'':
- indices:data/read/field_caps
- indices:data/read/xpack/rollup*
- indices:admin/mappings/get*
- indices:admin/get

I think all other roles for indices are already granted in my sg_roles.yml, correct? I’m sorry if I’m not making a lot of sense to you but I am pretty new to all this.
Thanks for your help and patience!

Note: In case you didn’t know or if it helps, I am running Elasticsearch, Kibana, and SearchGuard v 5.6.10. I downloaded Elasticsearch & Kibana through the elastic.co yum repository. As for the SearchGuard plugin, I downloaded them directly from the SearchGuard releases website Latest Releases | Security for Elasticsearch | Search Guard.

6

Hi again, I’m sorry for repeatedly posting without a reply, but my intentions are to provide with as much information as possible in order to help clarify the situation. While experimenting, I tried removing the kibana search-guard plugin, and disabled the elasticsearch search-guard by adding the line searchguard.disabled: true to elasticsearch.yml. after doing so and restarting kibana and elasticsearch, I STILL get the blank page, making doubt everything I’ve been doing for a while. There is still no indication of any sort in the logfiles.
Again I understand you are busy and I am not trying to be pushy just tryna help. Thanks!

7

Yes, you are right of course. If you use the built-in admin user, there is no need to map any additional roles. This user has full access to everything. So this does not seem to be the problem.

So when you say that you get a blank page even when you remove the SG plugin, it seems that you are probably facing a Kibana issue. If there is absolutely nothing in the logfiles, the next thing I would check is JavaScript errors. If you open the Chrome or Firefox Developer tools and try to log in, you will probably see either an exception on the Console or a failed HTTP call on the Network tab. Can you check?

It can also be a glitch during the Kibana internal optimization process. It’s been a while since I worked with Kibana 5, but you should see a folder called optimize at the top level directory of your Kibana installation. This is where Kibana places the webpack optimized files. Can you try to delete this folder and restart Kibana? The optimization process should kick in again. Does that make a difference?

8

Hey Jochen. I am sorry but I actually started over a couple of hours ago since I am falling way behind schedule on this.
I did the exact same steps you told me to do last, and the crash still hasn’t occurred. Currently I am running version 5.6.8 rather than 5.6.10. I will keep you posted on when it crashes (I have a good feeling that it is not over).

PS: I did try to delete the bundles in optimize, and after Kibana recreates them, I still got the same blank page. Additionally, I did try to check the Chrome Network tab for any info there, but all it showed me was the request being sent to GET /app/kibana and that it was status 200 OK. There were no other requests and that was very weird.

Currently, I am trying to keep following the guides here and there to fully configure this, and will keep you posted. Let’s keep the issue open for the time being, as I am not sure how/when it would break again.

Thank you for your help and patience.

9

This is just a shot in the dark and maybe dumb, but … if you only see a single request, are you sure you are not blocking JavaScript? Kibana is script heavy and does not run without JS enabled.

10

Given that I have no idea how to block/unblock JS, that could be an option, but not so probable. If I had been blocking JS, I am deducing that Kibana would not have run in the first place right? How exactly do you block/unblock JS on CentOS?

11 
{"type":"response","@timestamp":"2019-06-14T18:06:15Z","tags":[],"pid":32463,"method":"get","statusCode":200,"req":{"url":"/","method":"get","headers":{"host":"172.20.1.105:5601","connection":"keep-alive","upgrade-insecure-requests":"1","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"172.20.1.14","userAgent":"172.20.1.14"},"res":{"statusCode":200,"responseTime":16,"contentLength":9},"message":"GET / 200 16ms - 9.0B"}
{"type":"response","@timestamp":"2019-06-14T18:06:15Z","tags":[],"pid":32463,"method":"get","statusCode":401,"req":{"url":"/app/kibana","method":"get","headers":{"host":"172.20.1.105:5601","connection":"keep-alive","upgrade-insecure-requests":"1","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3","referer":"http://172.20.1.105:5601/","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"172.20.1.14","userAgent":"172.20.1.14","referer":"http://172.20.1.105:5601/"},"res":{"statusCode":401,"responseTime":45,"contentLength":9},"message":"GET /app/kibana 401 45ms - 9.0B"}
{"type":"log","@timestamp":"2019-06-14T18:06:15Z","tags":["plugin","debug"],"pid":32463,"message":"Checking Elasticsearch version"}
{"type":"log","@timestamp":"2019-06-14T18:06:18Z","tags":["plugin","debug"],"pid":32463,"message":"Checking Elasticsearch version"}
{"type":"response","@timestamp":"2019-06-14T18:06:17Z","tags":[],"pid":32463,"method":"get","statusCode":200,"req":{"url":"/app/kibana","method":"get","headers":{"host":"172.20.1.105:5601","connection":"keep-alive","upgrade-insecure-requests":"1","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3","referer":"http://172.20.1.105:5601/","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"172.20.1.14","userAgent":"172.20.1.14","referer":"http://172.20.1.105:5601/"},"res":{"statusCode":200,"responseTime":707,"contentLength":9},"message":"GET /app/kibana 200 707ms - 9.0B"}
{"type":"response","@timestamp":"2019-06-14T18:06:18Z","tags":[],"pid":32463,"method":"get","statusCode":200,"req":{"url":"/ui/fonts/open_sans/open_sans_v13_latin_300.woff2","method":"get","headers":{"host":"172.20.1.105:5601","connection":"keep-alive","origin":"http://172.20.1.105:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36","accept":"*/*","referer":"http://172.20.1.105:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"172.20.1.14","userAgent":"172.20.1.14","referer":"http://172.20.1.105:5601/app/kibana"},"res":{"statusCode":200,"responseTime":85,"contentLength":9},"message":"GET /ui/fonts/open_sans/open_sans_v13_latin_300.woff2 200 85ms - 9.0B"}
{"type":"response","@timestamp":"2019-06-14T18:06:18Z","tags":[],"pid":32463,"method":"get","statusCode":200,"req":{"url":"/bundles/kibana.style.css?v=15616","method":"get","headers":{"host":"172.20.1.105:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36","accept":"text/css,*/*;q=0.1","referer":"http://172.20.1.105:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"172.20.1.14","userAgent":"172.20.1.14","referer":"http://172.20.1.105:5601/app/kibana"},"res":{"statusCode":200,"responseTime":54,"contentLength":9},"message":"GET /bundles/kibana.style.css?v=15616 200 54ms - 9.0B"}
{"type":"response","@timestamp":"2019-06-14T18:06:18Z","tags":[],"pid":32463,"method":"get","statusCode":200,"req":{"url":"/bundles/commons.style.css?v=15616","method":"get","headers":{"host":"172.20.1.105:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36","accept":"text/css,*/*;q=0.1","referer":"http://172.20.1.105:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"172.20.1.14","userAgent":"172.20.1.14","referer":"http://172.20.1.105:5601/app/kibana"},"res":{"statusCode":200,"responseTime":67,"contentLength":9},"message":"GET /bundles/commons.style.css?v=15616 200 67ms - 9.0B"}
{"type":"response","@timestamp":"2019-06-14T18:06:18Z","tags":[],"pid":32463,"method":"get","statusCode":200,"req":{"url":"/bundles/commons.bundle.js?v=15616","method":"get","headers":{"host":"172.20.1.105:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36","accept":"*/*","referer":"http://172.20.1.105:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"172.20.1.14","userAgent":"172.20.1.14","referer":"http://172.20.1.105:5601/app/kibana"},"res":{"statusCode":200,"responseTime":241,"contentLength":9},"message":"GET /bundles/commons.bundle.js?v=15616 200 241ms - 9.0B"}
{"type":"response","@timestamp":"2019-06-14T18:06:18Z","tags":[],"pid":32463,"method":"get","statusCode":200,"req":{"url":"/bundles/kibana.bundle.js?v=15616","method":"get","headers":{"host":"172.20.1.105:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36","accept":"*/*","referer":"http://172.20.1.105:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"172.20.1.14","userAgent":"172.20.1.14","referer":"http://172.20.1.105:5601/app/kibana"},"res":{"statusCode":200,"responseTime":734,"contentLength":9},"message":"GET /bundles/kibana.bundle.js?v=15616 200 734ms - 9.0B"}

Right now, Kibana stopped working once again, but this time rather than having a blank screen, I get our "page loading" logo page. This is definitely an improvement that before. 
There are all the reuests that occur when I login, and then everything after is just kibana spitting out the regular debug messages (checking Elasticsearch version etc etc) 
Can you see anything wrong here? 
Literally all whats happening is its asking me to login, i do that, it loads a bunch of things and then nothing...
13

Hey @jkressin
I opened the developer tools, and I am getting this 1 error:

Uncaught SyntaxError: Unexpected token u in JSON at position 0                                               
    at JSON.parse (<anonymous>)
    at getState (:5601/bundles/commons.bundle.js?v=15616:87)
    at Object.2455 (:5601/bundles/commons.bundle.js?v=15616:87)
    at __webpack_require__ (:5601/bundles/commons.bundle.js?v=15616:1)
    at Object.2446 (:5601/bundles/commons.bundle.js?v=15616:87)
    at __webpack_require__ (:5601/bundles/commons.bundle.js?v=15616:1)
    at Object.<anonymous> (:5601/bundles/kibana.bundle.js?v=15616:1)
    at __webpack_require__ (:5601/bundles/commons.bundle.js?v=15616:1)
    at window.webpackJsonp (:5601/bundles/commons.bundle.js?v=15616:1)
    at :5601/bundles/kibana.bundle.js?v=15616:1

Unfortunately, I am too inexperienced to understand what is happening there, and would like to ask for some help understanding the error and fixing it. I am also not sure what to provide you with, so I am attaching the files mentioned in the error for now.
Error files&line.txt (76.4 KB)

I really hope this helps as I cannot think of anything else to do that can assist you with this.

Also, in case it helps, I am attaching a full Elasticsearch logfile for a full run (with logging into Kibana)
ES New log.txt (188.1 KB)

14

Hey again @jkressin , have you had the chance to review my new info?
I am currently working between 2 different virtual boxes, each with its own version (5.4.x and 5.6.x). The latter gave me the results in the last couple of comments.
On 5.4.x I just get the same old blank page after installing sentinl (always functioning normally before sentinl). I also have an issue open on their repository, but no replies so far… All help is greatly appreciated, and you guys are doing a great job!

15

Ah ok, but this means the error occurs only after installing Sentinl? If this is the case I’m afraid we’re of not much help here, since it is not our product and I am unfamiliar with it.

16

Hey I was just starting to type. I found out the glitch that’s causing this!! Installing Sentinl without changing kibana.yml seems to keep everything running the way it should be… I found it to be kinda very stupid and I’m not sure what is happening but long as its working im not complaining.
I have been getting some authentication issues though, so I will be closing this issue and opening a new one.
Once again thanks for all the help!

17

Hi again,
In case anyone is still struggling with this, I found out exactly what causes this issue (at least for my case):
Turns out using the latest release of my version of the SG-Kibana plugin was interfering with Sentinl, and the way to actually solve the issue is to downgrade the SG-Kibana plugin to a couple release before. (example of my new case: Kibana version 6.6.0 so use Search-Guard-Kibana plugin version 6.6.0-18.1 rather than 6.6.0-18.3).
Hope this helps anyone still struggling with this.

18

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.