Permission denied for Maxmind database

ElastiFlow Community
1

Hi,

I’m trying to run the flow-collector (v7.0.2) in docker, and while trying to run it, I got the error message below.

"msg": "failed to instantiate config", "code":"flowprocessor/conf-error", "reason": "open /etc/elastiflow/maxmind/GeoLite2-City.mmdb: permission denied"

The 2 GeoLite files are

-rw-r--r--. 1 root root  <filesize> <date> GeoLite2-ASN.mmdb
-rw-r--r--. 1 root root  <filesize> <date> GeoLite2-City.mmdb

What permissions should I change for the Maxmind files?

Thank you.

2

Those are the same permissions/ownership I have on my maxmind files.

The permissions on the maxmind directory are:
drwxr-xr-x 2 root root 4096 Jul 17 13:38 maxmind

Are there any other error messages in the logs?

3

No other error that I can see. If I set the option to false, the start-up process continues.

Does it need to access the Elasticsearch cluster at this point? I’m wondering if it might not be able to access ES and that is causing the issue.

4

Could you please show a screenshot of the permissions for both the /etc/elastiflow and /etc/elastiflow/maxmind directories ?

5

I have both directories set to drwxrwxrwx., but am still getting the permission denied error.

6

Hi there,

Would you be able to please provide a screenshot of the following command and output from a shell inside the docker container -

ls -al /etc/elastiflow/maxmind

7

This is the output I got after running docker run -v /etc/elastiflow:/etc/elastiflow -it --entrypoint /bin/sh <image id> -s.

$ ls -al /etc/elastiflow/maxmind
ls: cannot access '/etc/elastiflow/maxmind/GeoLite2-ASN.mmdb': Permission denied
ls: cannot access '/etc/elastiflow/maxmind/GeoLite2-City.mmdb': Permission denied
total 8
drwxrwxrwx. 2 root       root        4096 Jun 16 08:52 .
drwxrwxrwx. 4 root       root        4096 Jul 23 02:17 ..
-?????????? ? ?          ?              ?            ?  GeoLite2-ASN.mmdb   
-?????????? ? ?          ?              ?            ?  GeoLite2-City.mmdb

I’m not sure why there’s all the question marks.

If I try to access /etc/elastiflow instead

$ ls -al /etc/elastiflow
total 20
drwxrwxrwx. 4 root       root        4096 Jul 23 02:17 .
drwxr-xr-x. 1 root       root        4096 Jul 24 02:59 ..
drwxr-xr-x. 4 root       root        4096 Jul 23 02:17 certs
drwxrwxrwx. 2 root       root        4096 Jul 16 08:52 maxmind

The beginning part of my docker-compose.yml file is

version: '2.2'
services:
  fc-1:
    image: elastiflow/flow-collector:7.0.2
    cpuset: '0,2,4,6,8,10'
    container_name: 'fc-1'
    restart: 'unless-stopped'
    network_mode: 'host'
    security_opt:
      - seccomp=unconfined
    volumes:
      - /etc/elastiflow:/etc/elastiflow
    environment:
      ...
  fc-2:
    image: elastiflow/flow-collector:7.0.2
    cpuset: '1,3,5,7,9,11'
    container_name: 'fc-2'
    restart: 'unless-stopped'
    network_mode: 'host'
    security_opt:
      - seccomp=unconfined
    volumes:
      - /etc/elastiflow:/etc/elastiflow
    environment:
      ...

I’m using docker version 1.13.1 and docker-compose version 1.18.0.

I restarted docker (systemctl restart docker), and still have the same issue with the question marks.

8

Initially when I restarted my docker service, I still got the question marks. Then I tried to mount the /etc/elastiflow volume with the :z flag as well, and the permissions were correctly displayed. The strange thing is now when I tried to mount the volume without the :z flag, the permissions are still correctly displayed. Not sure what happened here, and if it was the restarting of the docker that solved the issue, or the :z flag that kickstarted something.

9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.