secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 18:36:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
master
secubox-deb/wiki/FAQ-Troubleshooting.md
CyberMind-FR 526f5bc234 docs(faq): document the login-loop root cause + Authelia decommission 
- Endless 'Session révoquée' login loop: hub-proxied /auth/login never records
  the session (no set_session_callback in the hub) — fixed by posting to the
  canonical /api/v1/auth/login. Explains why it surfaced after Authelia was
  disabled.
- Authelia SSO marked as failed/half-baked PoC, being removed; do not re-enable.
2026-07-02 07:59:19 +02:00

6.6 KiB
Raw Permalink Blame History

SecuBox FAQ & Troubleshooting

Quick solutions to common issues. For the latest fixes, always check GitHub Issues - community-reported problems often have solutions there before documentation is updated.

Quick Links

VirtualBox Issues

Kiosk doesn't start / "No usable sandbox" error

Symptom: Chromium fails with sandbox error, kiosk service keeps restarting.

Solution: The VirtualBox image includes a fix for this. If using an older image:

# SSH into VM
ssh -p 2222 root@localhost   # password: secubox

# Add --no-sandbox flag
echo '--disable-gpu --disable-gpu-compositing --disable-software-rasterizer --no-sandbox' > /home/secubox-kiosk/.chromium-gpu-flags
chown secubox-kiosk:secubox-kiosk /home/secubox-kiosk/.chromium-gpu-flags
systemctl restart secubox-kiosk

Related Issue: #34

VM tries PXE boot instead of disk

Symptom: VirtualBox attempts network boot.

Solution: Disable network boot or ensure disk is first in boot order:

VBoxManage modifyvm "SecuBox" --boot1 disk --boot2 none --boot3 none --boot4 none

WebUI not accessible via port forward

Symptom: https://localhost:9443 doesn't connect.

Solution: nginx listens on port 443, not 9443. Fix port forwarding:

VBoxManage controlvm "SecuBox" natpf1 delete https 2>/dev/null
VBoxManage controlvm "SecuBox" natpf1 "https,tcp,,9443,,443"

Authentication Issues

Login fails with "Invalid credentials"

Default credentials:

  • WebUI: admin / secubox (NOT root)
  • SSH: root / secubox

Menu/Sidebar fails to load ("Invalid menu data")

Symptom: After login, sidebar shows error, pages don't load.

Cause: The menu endpoint required JWT authentication, but the sidebar loads before user login.

Status: ✅ FIXED in v1.7.1+ (commit b2c9f01)

Resolution:

  1. Added public menu endpoint at /api/v1/hub/public/menu (no auth required)
  2. Fixed Pydantic 1.x compatibility: changed HTTPAuthorizationCredentials = Depends() to Optional[HTTPAuthorizationCredentials] = Depends()
  3. Updated sidebar.js to use the public menu endpoint

If running older version, update packages:

apt update && apt install secubox-hub secubox-core
systemctl restart secubox-hub

See #34 for full discussion.

GitHub Issue #34 Status: ✅ RESOLVED (Session 73-74, 2026-04-29)

Endless login loop — "Session révoquée" on every module (metablogizer, publish, service-catalog, device-intel…)

Symptom: A module loads its public widgets (metrics), then bounces back to the login page. Logging in appears to succeed but you land right back on the login form — forever, on every box. Auth-required endpoints return 401 {"detail":"Session révoquée"}.

Root cause: login.html posted to /api/v1/hub/auth/login (its API const was /api/v1/hub). The hub includes secubox_core.auth's router (include_router(auth_router, prefix="/auth")) but never registers set_session_callback, so a login routed through the hub mints a JWT whose jti is never written to sessions.json. Every later request then fails require_jwt's jti-in-sessions check → 401 "Session révoquée" → bounce to login.

Status: ✅ FIXED — login.html now posts straight to the canonical auth service /api/v1/auth/login (→ auth.sock), which records the session.

Why it surfaced "after Authelia was disabled": the Authelia auth_request gate used to satisfy auth at the nginx layer before require_jwt ever saw the token. Disabling Authelia exposed the strict jti validation, revealing the long-latent hub-login defect. After the fix, force one hard-refresh (Ctrl-Shift-R) on the login page so the browser picks up the corrected JS.

Authelia SSO — decommissioned (⚠️ failed / half-baked PoC)

Verdict: the secubox-authelia SSO IdP layer (auth-bridge, #239) was more trouble than value and is being removed. It was masked as a service but its mounted module + nginx auth_request /__sbx_auth_verify gate lingered, and its partial teardown is what masked (then unmasked) the login-loop bug above.

Guidance:

  • Do not re-enable secubox-authelia. Auth is handled by secubox-auth (JWT + sessions.json + SSO-lite cookie), not by an external IdP.
  • The nginx gate (/__sbx_auth_verify) already short-circuits to return 200 for LAN clients; remaining WAN-gated vhosts must move to app-native auth or a simple allow-list, not Authelia.
  • If you see an "auth bridge" / Authelia reference in a vhost, treat it as dead weight to strip.

Network Issues

No IP address after boot

Check DHCP:

# Inside SecuBox
ip addr show
dhclient -v enp0s3    # or appropriate interface

Check NetworkManager vs systemd-networkd:

systemctl status NetworkManager
systemctl status systemd-networkd

Bridged mode shows wrong subnet

Symptom: VM gets IP from different network (e.g., 10.x instead of 192.168.x).

Solution: Verify bridge adapter in VirtualBox settings matches your host interface.

Service Issues

coturn.service keeps failing

Symptom: Boot shows repeated coturn failures.

Solution: Disable if not using TURN/STUN:

systemctl disable coturn
systemctl mask coturn

secubox-hub socket not created

Symptom: API returns 502 Bad Gateway, /run/secubox/hub.sock missing.

Workaround: Service was switched to TCP binding. If you have an old image:

# Update service to use TCP
sed -i 's/--uds.*sock/--host 127.0.0.1 --port 8001/' /lib/systemd/system/secubox-hub.service
systemctl daemon-reload
systemctl restart secubox-hub

Hardware-Specific Issues

ESPRESSObin / MOCHAbin

See Board-Specific-Notes.md

AMD64 / Bare Metal

  • Ensure UEFI boot mode (GPT partition table)
  • For kiosk: verify X11/DRM drivers are loaded

Getting Help

  1. Check GitHub Issues first: https://github.com/CyberMind-FR/secubox-deb/issues
  2. Search closed issues for solutions already found
  3. Create new issue with:
    • SecuBox version (cat /etc/secubox/version)
    • Board type
    • Full error messages
    • Steps to reproduce

See Also