Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using single quote ' in admin password breaks filbeat configuration (error loading config file: yaml: line 17: did not find expected key) #903

Open
AurimasNav opened this issue Nov 26, 2024 · 0 comments

Comments

@AurimasNav
Copy link

AurimasNav commented Nov 26, 2024

My randomly generated password for admin had a single quote in it, which resulted in fillebeat configuration error:

starting Filebeat
[services.d] done.
Exiting: error loading config file: yaml: line 17: did not find expected key
Filebeat exited. code=1
[cont-finish.d] executing container finish scripts...
[cont-finish.d] done.
[s6-finish] waiting for services.
[s6-finish] sending all processes the TERM signal.
[s6-finish] sending all processes the KILL signal and exiting.

this seems to happen because filebeat.yml encloses username and password values in single quotes:

filebeat.modules:
  - module: wazuh
    alerts:
      enabled: true
    archives:
      enabled: false

setup.template.json.enabled: true
setup.template.overwrite: true
setup.template.json.path: '/etc/filebeat/wazuh-template.json'
setup.template.json.name: 'wazuh'
setup.ilm.enabled: false
output.elasticsearch:
  hosts: ['https://indexer:9200']
  username: 'admin'
  password: 'some'Random'Password'
  ssl.verification_mode: 'full'
  ssl.certificate_authorities: ['/etc/ssl/root-ca.pem']
  ssl.certificate: '/etc/ssl/filebeat.pem'
  ssl.key: '/etc/ssl/filebeat.key'

logging.metrics.enabled: false

seccomp:
  default_action: allow
  syscalls:
  - action: allow
    names:
    - rseq

obvious workaround is not to use single quote in admin password, however this situation could be avoided, by not quoting password value in filebeat.yml, or documenting this caveat in password change procedure

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant