Splunk Enterprise Security

Why am I receiving a '500 Internal server Error' when attempting to configure Rapid7 Nexpose Technology Add-On for Splunk?

horanman01
Explorer

splunkd logs:
04-17-2018 16:19:12.876 +0000 ERROR UserManagerPro - Failed to get LDAP user="nobody" from any configured servers
04-17-2018 16:24:48.235 +0000 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 129, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 591, in execute\n if self.requestedAction == ACTION_EDIT: self.handleEdit(confInfo)\n File "/opt/splunk/etc/apps/rapid7/bin/nexpose_setup.py", line 146, in handleEdit\n entity.deleteEntity('/storage/passwords/', c.name, namespace=APPNAME, owner='nobody', sessionKey=sessionKey)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 442, in deleteEntity\n serverResponse, serverContent = rest.simpleRequest(uri, sessionKey=sessionKey, method='DELETE', raiseAllErrors=True)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 583, in simpleRequest\n raise splunk.InternalServerError, (None, serverResponse.messages)\nInternalServerError: [HTTP 500] Splunkd internal error; [{'code': None, 'type': 'ERROR', 'text': "\n In handler 'passwords': Does not exist: /nobody/rapid7/passwords/credential::splunk:"}]\n
04-17-2018 16:24:48.235 +0000 ERROR AdminManagerExternal - Unexpected error "" from python handler: "[HTTP 500] Splunkd internal error; [{'code': None, 'type': 'ERROR', 'text': "\n In handler 'passwords': Does not exist: /nobody/rapid7/passwords/credential::splunk:"}]". See splunkd.log for more details.

My thoughts are that "owner='nobody'" probably needs to be something like owner='admin' but having a hard time tracking down where the config issue lies.

0 Karma

masonmorales
Influencer

Did you follow the setup process? https://splunkbase.splunk.com/app/3457/#/details

0 Karma

horanman01
Explorer

I am a newer employee, this was built prior to my arrival. Bash history indicates the individual did follow the setup process however as far as I can tell. Also the documentation is pretty brief, not sure what I could have possibly missed other than click a button and install from GUI, there is no HF or anything even required. If I didn't follow the six total steps of pointing and clicking, the nexpose-setup.py would not even exist also. There was no error information in the rapid7 log.

0 Karma

starcher
Influencer

That implies the stored login is not setup.

0 Karma

horanman01
Explorer

To backtrack, the failure happens when attempting to configure the rapid7 TA from the UI, the IP, username and pass are all correct when I plug them in, are you implying that a default login is hard coded somewhere?

0 Karma

horanman01
Explorer

Pretty sure I found the issue. thanks

0 Karma

rfjohns1
Observer

I'm also having this error.

What was your solution?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...