STAXX (Free) Webserver missing? or not included?


#1

Hi

Sorry if this has been asked before - I’ve downloaded the Staxx software from Anomali.com. Extracted the files and Imported Appliance in Virtualbox.

We can boot the vm. Carried out the set up according to PDF documentation included with the zip file.

We are not able to connect to the service via any web browser (Chrome, IE, or firefox). Says site could not be reached.

We ran :
sudo systemctl enable sshd
sudo systemctl start sshd

We also ran:
/opt/staxx/bin/xlink status

confirmed service is running.

Can you please confirm if this free version has the web interface? We can ssh to the box. but not able to connect via a web browser.

Many thanks in advance

Regards,
Peter


#2

Hi,

yes, staxx has a web server interface. Are you sure that the port 8080 is not filtered out by some firewall.

You can also check STAXX ports using, on the STAXX vm:

netstat -tapn | grep 8080

The url to reach your vm guy should be:

https://your_vm_ip:8080

You should also see this information in your vm motd,


#3

Hi

Thanks for replying back. Its strange - we tried your netstat command and it returned nothing. So i assume something went wrong with the staxx service?

Screenshot:
https://drive.google.com/file/d/0B61axKCGev0WWWRzc2x3M2cweU0/view?usp=sharing

We literally downloaded staxx and imported into virtualbox and set up using default settings following the manual.

Ran these commands:
sudo systemctl enable sshd
sudo systemctl start sshd

We are also running a fresh windows 10 64Bit installation, firewall has been disabled, and no Antivirus. Only running virtualbox and the Staxx vm. Yet we can’t connect to it (not even locally on the same host). Starting to think i’ve done something stupid and is totally obvious to someone else.

-Pete


#4

A quick test. Install telnet

sudo yum install telnet

then telnet to localhost and if the web server is listening you should see something like this:


#5

Hey!

Thanks so much for the reply!! :slight_smile:

i tried telnet. Got the same output as your screenshot.

After a bit more digging and experimenting today. I believe i found the problem.

Today i connected our vm host the our guest internet connection (this has no company proxy). Essentially a direct connection out, and it worked! I can connect to the webserver page without issues! (Really cool design btw)

Now my new concern is why the webserver is not reachable when the host system is behind a proxy server. I tried setting the proxy setting via the webserver options pages. I then rebooted the vm system behind the proxy server again. The web server is no longer accessible.

Is there anyway to fix this? Perhaps a server setting or white listing?

Regards,
Pete


#6

Hi,

great to know that you can reach the gui now with a direct connection. The proxy settings inside STAXX config pages is for STAXX reaching OUT, not for reaching STAXX itself.

If you are behind a proxy and cannot reach STAXX is then a proxy issue, most likely your company proxy does not allow connections to the 8080 port. I would advice to have a chat with your network guys and see if your proxy is able to proxy connection on the port 8080


#7

Hi,

Just want to say thanks! We managed to get Staxx working in the end. It was our own proxy server (which blocked 8080) that was causing the issue. Our infra team managed to resolve this for us. We are now able to access the staxx web server. :slight_smile:

Many thanks!

Regards,
Pete


#8

Cool! Great to know that everything works now. Do not miss the new STAXX 2.5! It’s out!


#9

Similar issue only I’ve had STAXX up and running for a few months now. I typically have no issues accessing the web UI. However, there are times when the browser returns the “site can’t be reached” message. According to the systemd status, everything is fine. The only thing that seems to resolve the issue is restarting the STAXX service as outlined in the documentation. This continues to be a problem because it hinders my analysts’ investigations and often results in late night calls for me to “hit reset”.


#10

What version of Staxx are you currently on ?
If the problem pervades, can you open a support ticket so we can help you further ?


#11

Version 2.6.0
Build 487

But I’ve experienced this as far back as at least 2.3


#12

I have a fresh install of Staxx 3.0 but unable to reach https://IPaddress:8080.
I then restarted services with xlink restart. Says services started successfully but unable to telnet to localhost 8080, says connection refused. is there an iptables statement missing?


#13

I am having the exact same issue.