Check if you can connect to Kebina Step 4. bind [127.0.0.1]:8080: Address already in use -

[indian-summers]

Ubuntu Server is the only OS in this server, I gave up on trying to get LME to run on a VM.

Distributor ID: Ubuntu
Description: Ubuntu 24.04.1 LTS
Release: 24.04
Codename: noble

The server has two Intel Xeon 12 core processors, 40GB RAM, and 546GB HDD.

The lme-environment.env is set to: IPVAR=127.0.0.1

sudo -i podman ps --format "{{.Names}} {{.Status}}"

lme-elasticsearch Up 5 hours (healthy)
lme-elastalert2 Up 5 hours
lme-wazuh-manager Up 5 hours (healthy)
lme-kibana Up 5 hours (healthy)
lme-fleet-server Up 5 hours

I am stuck on the following steps.

Check if you can connect to Kebina Step 4
script - ssh -L 8080:localhost:5601 LME

Output:
bind [127.0.0.1]:8080: Address already in use
channel_setup_fwd_listener_tcpip: cannot listen to port: 8080
Could not request local forwarding.

System information as of Thu Jan 16 02:32:33 PM PST 2025

System load: 0.86
Usage of /: 49.4% of 65.74GB
Memory usage: 60%
Swap usage: 0%
Temperature: 41.0 C
Processes: 374
Users logged in: 1
IPv4 address for enp4s0f1: 192.xxx.xxx.xxx (The LME has a properly formatted IP address.)
IPv6 address for enp4s0f1:

I am sure the following will work once the above issue is resolved.

https://localhost:8080 and/or https://localhost:5601 from a browser:

Message:

Unable to connect

An error occurred during a connection to localhost:8080.

[cbaxley]

Try an

netstat -tpan

to see what is using 8080. Maybe node server was installed or something.
Post the results here if you can't tell what it is.

[indian-summers]

Looks like my SSH connection to the server.

I don't have a GUI installed on the computer, I use SSH because it allows me to cut and paste the scripts.
tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 421927/ssh
tcp6 0 0 ::1:8080 :::* LISTEN 421927/ssh

Any suggestions on mitigating this?

[cbaxley]

If you are connecting via ssh on port 22, you can edit /etc/ssh/sshd_conf Look for Port 8080 Port 22 You can comment out the port 8080 line by putting a # at the beginning of the line, or change it to something else. You can have multiple entries for ports, so you can add another one for 8081 if you want. Port 8081 Port 22 You can save the file, and then restart sshd. To check sshd sudo systemctl status sshd To restart it sudo systemctl restart sshd Do not disconnect your ssh session, open a new window and make a new connection on the port you have configured. If the new connection opens on the new port, you have successfully changed them. If not, edit the file again and look for errors. Clint Baxley

…

On Thu, Jan 16, 2025 at 6:44 PM indian-summers ***@***.***> wrote: Looks like my SSH connection to the server. I don't have a GUI installed on the computer, I use SSH because it allows me to cut and paste the scripts. tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 421927/ssh tcp6 0 0 ::1:8080 :::* LISTEN 421927/ssh Any suggestions on mitigating this? — Reply to this email directly, view it on GitHub <#550 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAQY33WD3FLJOSUE35DUWUD2LA75VAVCNFSM6AAAAABVKWKMCWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKOJXGEZTGMBTHA> . You are receiving this because you commented.Message ID: ***@***.***>

[indian-summers]

Hello Clint, thank you for the info.

To check sshd
sudo systemctl status sshd

result: Failed to restart sshd.service: Unit sshd.service not found.

To restart it
sudo systemctl restart sshd

result: Failed to restart sshd.service: Unit sshd.service not found.

files in /etc/ssh/ named ssh_config

-rw-r--r-- 1 root root 1649 Aug 8 19:33 ssh_config
drwxr-xr-x 2 root root 4096 Aug 8 19:33 ssh_config.d
-rw-r--r-- 1 root root 3272 Jan 17 09:58 sshd_config
drwxr-xr-x 2 root root 4096 Jan 15 14:22 sshd_config.d

I don't see Port 8080 in the file.

Contents of sshd_config referencing Port 22:
Include /etc/ssh/sshd_config.d/*.conf
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

[indian-summers]

Follow up:

Terminated all ssh connections, rebooted the server and type the commands on the server and the error persists.

ssh -L 8080:localhost:5601 LME
bind [127.0.0.1]:8080: Address already in use
channel_setup_fwd_listener_tcpip: cannot listen to port: 8080
Could not request local forwarding

sudo -i podman ps --format "{{.Names}} {{.Status}}"
lme-elasticsearch Up 13 minutes (healthy)
lme-elastalert2 Up 12 minutes
lme-wazuh-manager Up 12 minutes (healthy)
lme-kibana Up 12 minutes (healthy)
lme-fleet-server Up 11 minutes

Should I install a GUI? if YES, which would you recommend?

[cbaxley]

I don't think you need to do the ssh -L forwarding. You should be able to just connect to https://ipofmachine
That port forwarding is just for if there is a proxy and you need to connect to it on a special port.