Expedition Tool - default user for WebGUI is incorrect

TRisec — Thu, 28 Dec 2023 12:29:37 GMT

Hi all,

I came across an issue which seems to exist already for some years, but I haven't found any solution for it.

I need to install Expedition, so I checked the installation guide how to do this. I exactly followed the steps described there, i.e.

- I downloaded the Ubuntu Server 20.04.* LTS (64bit AMD) ISO and installed it (using VMware Player)

- no update, no upgrade

- I downloaded expedition1_Installer_latest.tgz, unpacked it and chmod for initSetup_v2.0.sh

- I then ran the installation until the end and rebooted the VM

- From a browser I opened the Expedition GUI, but - surprise - it says "incorrect user or password" for admin/ paloalto

I've repeated the installation three times just to make sure I didn't miss anything. Anyway, result was always the same.

I checked LIVEcommunity and KB for any hints, but none of the suggestions (deleting tcc.log, (re)starting mysql, resetting default user) I've found fixed it.

I've scrolled the installation log and found these log entries:

- these ones appeared on several locations:

E: Failed to fetch from https://www.rabbitmq.com/debian/dists/testing/main/binary-amd64/Packages 404 not found [IP: 104.20.11.224 443]
E: Some index files could not be downloaded. They were ignored or old ones were used in their place.

- these ones regarding expedition-beta installation

expedition-beta (1.2.81) wird eingerichtet ...
Updating Database: pandb Applying Patch:20171017_001_alter_table_platforms_sql.pandb
Updating Database: pandb Applying Patch:20171017_002_alter_table_panos_capacity_sql.pandb
ERROR 1146 (42S02) at line 1: Table 'pandb.snippets_type' doesn't exist
Updating Database: pandb Applying Patch:20180827_001_add_snippet_spyware.pandb
Updating Database: pandbRBAC Applying Patch:20171113_001_alter_table_devices_logs.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20171128_001_create_table_security.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20171219_004_create_procedure_updateJobs.pandbRBAC
ERROR 1146 (42S02) at line 1: Table 'pandbRBAC.roles' doesn't exist
Updating Database: pandbRBAC Applying Patch:20180206_002_update_role_User.pandbRBAC
ERROR 1146 (42S02) at line 1: Table 'pandbRBAC.roles' doesn't exist
Updating Database: pandbRBAC Applying Patch:20180219_001_update_role_Admin.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20180322_001_add_table_logs.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20180327_001.replacelog_auditlog.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20180404_001_alter_table_tasks.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20180607_001_alter_devices.pandbRBAC
ERROR 1146 (42S02) at line 1: Table 'pandbRBAC.devices' doesn't exist
Updating Database: pandbRBAC Applying Patch:20180608_001_alter_devices.pandbRBAC
ERROR 1146 (42S02) at line 1: Table 'pandbRBAC.tasks' doesn't exist
Updating Database: pandbRBAC Applying Patch:20190121_001_alter_table_tasks.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20190121_002_alter_LDAP_server.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20190207_001_alter_LDAP.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20190312_001_create_table_logsPerDay.pandbRBAC
ERROR 1146 (42S02) at line 5: Table 'pandbRBAC.sparkJobs' doesn't exist
Updating Database: pandbRBAC Applying Patch:20190522_001_alter_trigger.pandbRBAC
ERROR 1146 (42S02) at line 31: Table 'pandbRBAC.devices' doesn't exist
Updating Database: pandbRBAC Applying Patch:20190523_001_alter_mlsettings.pandbRBAC
ERROR 1146 (42S02) at line 1: Table 'pandbRBAC.users' doesn't exist
Updating Database: pandbRBAC Applying Patch:20200408_001_alter_table_users.pandbRBAC
Updating Database: pandbRBAC Applying Patch:20200512_001_create_table_splunk_files.pandbRBAC
ERROR 1146 (42S02) at line 1: Table 'pandbRBAC.ml_settings' doesn't exist
Updating Database: pandbRBAC Applying Patch:20211005_001_alter_table_ml_settings.pandbRBAC
PHP Notice: Trying to get property of non-object in /var/www/html/bin/updates/updateSQL.php on line 39
DEPRECATION: distro-info 0.23ubuntu1 has a non-standard version number. pip 24.0 will enforce this behaviour change. A possible replacement is to upgrade to a newer version of distro-info or contact the author to suggest that they release a version with a conforming version number. Discussion can be found at https://github.com/pypa/pip/issues/12063
DEPRECATION: python-debian 0.1.36ubuntu1 has a non-standard version number. pip 24.0 will enforce this behaviour change. A possible replacement is to upgrade to a newer version of python-debian or contact the author to suggest that they release a version with a conforming version number. Discussion can be found at https://github.com/pypa/pip/issues/12063
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
DEPRECATION: distro-info 0.23ubuntu1 has a non-standard version number. pip 24.0 will enforce this behaviour change. A possible replacement is to upgrade to a newer version of distro-info or contact the author to suggest that they release a version with a conforming version number. Discussion can be found at https://github.com/pypa/pip/issues/12063
DEPRECATION: python-debian 0.1.36ubuntu1 has a non-standard version number. pip 24.0 will enforce this behaviour change. A possible replacement is to upgrade to a newer version of python-debian or contact the author to suggest that they release a version with a conforming version number. Discussion can be found at https://github.com/pypa/pip/issues/12063
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
DEPRECATION: distro-info 0.23ubuntu1 has a non-standard version number. pip 24.0 will enforce this behaviour change. A possible replacement is to upgrade to a newer version of distro-info or contact the author to suggest that they release a version with a conforming version number. Discussion can be found at https://github.com/pypa/pip/issues/12063
DEPRECATION: python-debian 0.1.36ubuntu1 has a non-standard version number. pip 24.0 will enforce this behaviour change. A possible replacement is to upgrade to a newer version of python-debian or contact the author to suggest that they release a version with a conforming version number. Discussion can be found at https://github.com/pypa/pip/issues/12063
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
rm: cannot remove '/opt/Spark/spar/jars/log4j-1.2.17.jar': No such file or directory
rm: cannot remove '/opt/Spark/log4j.properties': No such file or directory
Checking for old projects and Devices what are not Encrypted
PHP Fatal error: Uncaught PDOException: SQLSTATE[42S02]: Base table or view not found: 1146 Table 'pandbRBAC.devices' doesn't exist in /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:77
Stack trace:
#0 /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php(77): PDO->prepare('select * from `...', Array)
#1 /var/www/html/libs/vendor/illuminate/database/Connection.php(326): Doctrine\DBAL\Driver\PDOConnection->prepare('select * from `...')
#2 /var/www/html/libs/vendor/illuminate/database/Connection.php(657): Illuminate\Database\Connection->Illuminate\Database\{closure}('select * from `...', Array)
#3 /var/www/html/libs/vendor/illuminate/database/Connection.php(624): Illuminate\Database\Connection->runQueryCallback('select * from `...', Array, Object(Closure))
#4 /var/www/html/libs/vendor/illuminate/database/Connection.php(333): Illuminate\Database\Connection->run('select * from `...', Array, Object(Closure))
#5 /var/www/html/libs/vendor/illuminate/database/Query/Build in /var/www/html/libs/vendor/illuminate/database/Connection.php on line 664

Fatal error: Uncaught PDOException: SQLSTATE[42S02]: Base table or view not found: 1146 Table 'pandbRBAC.devices' doesn't exist in /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:77
Stack trace:
#0 /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php(77): PDO->prepare('select * from `...', Array)
#1 /var/www/html/libs/vendor/illuminate/database/Connection.php(326): Doctrine\DBAL\Driver\PDOConnection->prepare('select * from `...')
#2 /var/www/html/libs/vendor/illuminate/database/Connection.php(657): Illuminate\Database\Connection->Illuminate\Database\{closure}('select * from `...', Array)
#3 /var/www/html/libs/vendor/illuminate/database/Connection.php(624): Illuminate\Database\Connection->runQueryCallback('select * from `...', Array, Object(Closure))
#4 /var/www/html/libs/vendor/illuminate/database/Connection.php(333): Illuminate\Database\Connection->run('select * from `...', Array, Object(Closure))
#5 /var/www/html/libs/vendor/illuminate/database/Query/Build in /var/www/html/libs/vendor/illuminate/database/Connection.php on line 664

...

************************************************************
Starting Task Manager
************************************************************
ERROR 1146 (42S02) at line 1: Table 'pandbRBAC.ml_settings' doesn't exist
expedition@expedition1:~$

I'm not sure how to fix this. Is there any working solution for this?

Here are some results from my checks:

expedition@expedition1:~$ service mysql status

mariadb.service - MariaDB 10.3.38 database server

Loaded: loaded (/lib/systemd/system/mariadb.service; enabled; vendor preset: enabled)

Active: active (running) since Wed 2023-12-27 16:49:53 UTC; 4min 49s ago

Docs: man:mysqld(8)

https://mariadb.com/kb/en/library/systemd/

Process: 957 ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d /var/run/mysqld (code=exited, status=0/SUCCESS)

Process: 961 ExecStartPre=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)

Process: 972 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] && VAR= || VAR=`cd /usr/bin/..; /usr/bin/galera_recovery`; [ $? -eq 0 ] && systemctl set-environment _WSREP_START_POSITION=$VAR || exit 1 (code=exited, statu>

Process: 1139 ExecStartPost=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)

Process: 1141 ExecStartPost=/etc/mysql/debian-start (code=exited, status=0/SUCCESS)

Main PID: 1058 (mysqld)

Status: "Taking your SQL requests now..."

Tasks: 31 (limit: 9388)

Memory: 96.4M

CGroup: /system.slice/mariadb.service

└─1058 /usr/sbin/mysqld

Dez 27 16:49:53 expedition1 systemd[1]: Starting MariaDB 10.3.38 database server...

Dez 27 16:49:53 expedition1 systemd[1]: Started MariaDB 10.3.38 database server.

Dez 27 16:49:53 expedition1 /etc/mysql/debian-start[1143]: Upgrading MySQL tables if necessary.

Dez 27 16:49:53 expedition1 /etc/mysql/debian-start[1146]: Looking for 'mysql' as: /usr/bin/mysql

Dez 27 16:49:53 expedition1 /etc/mysql/debian-start[1146]: Reading datadir from the MariaDB server failed. Got the following error when executing the 'mysql' command line client

Dez 27 16:49:53 expedition1 /etc/mysql/debian-start[1146]: ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)

Dez 27 16:49:53 expedition1 /etc/mysql/debian-start[1146]: FATAL ERROR: Upgrade failed

Dez 27 16:49:53 expedition1 debian-start[1155]: ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)

lines 1-25/25 (END)

[Wed Dec 27 17:07:07.420556 2023] [:error] [pid 1340] [client 192.168.26.1:54462] PHP Fatal error: Uncaught PDOException: SQLSTATE[42S02]: Base table or view not found: 1146 Table 'pandbRBAC.users' doesn't exist in /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:77\nStack trace:\n#0 /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php(77):

expedition@expedition1:~$ php /var/www/html/OS/startup/restore/restoreAdmin.php

✓ Connected successfully to the database

PHP Notice: Trying to get property of non-object in /var/www/html/OS/startup/restore/restoreAdmin.php on line 91

❌ Default Admin user not found

Recreating the user

PHP Notice: Trying to get property of non-object in /var/www/html/OS/startup/restore/restoreAdmin.php on line 103

✓ Admin password restored to: 'paloalto'

expedition@expedition1:~$

expedition@expedition1:~$ service mysql restart

==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===

Authentication is required to restart 'mariadb.service'.

Authenticating as: Expedition (expedition)

Password:

==== AUTHENTICATION COMPLETE ===

expedition@expedition1:~$

Best regards,

Oliver

Re: Expedition Tool - default user for WebGUI is incorrect

dpuigdomenec — Fri, 29 Dec 2023 10:32:55 GMT

Hi @TRisec

Thanks for reaching out.

My assumption is that your installation fails when trying to install LAMP services, in particular php7.0.

To confirm my assumption check the installed php version "php -version" where the expected output is 7.0.33.

What to do?

Please make sure the VM has direct access to Internet, in particular to below list of repositories (including all subdomains), after the installation you can block any connection from the VM to the Internet as upgrades can be done manually.

After making sure the VM have access to the required external repositories you can remove expedition-beta and relaunch the script.

When relaunching it, make sure you are in the /tmp/ directory and you use the sudo command.

sudo apt remove expedition-beta
cd /tmp/
sudo ./initSetup*.sh

Hope this helps,

David

topic Re: Expedition Tool - default user for WebGUI is incorrect in Expedition Discussions

Expedition Tool - default user for WebGUI is incorrect

Re: Expedition Tool - default user for WebGUI is incorrect