Issue with CrowdSec Registration - 404 Error on Connection

1

Hello,

I am experiencing an issue with my CrowdSec setup on a Raspberry Pi. After several attempts to register the agent using the command:

sudo cscli capi register raspberrypi --debug

The registration appears to succeed, and I receive confirmation that the Central API (CAPI) credentials are written to /etc/crowdsec/online_api_credentials.yaml. However, when I attempt to start the crowdsec service or run the command:

sudo systemctl restart crowdsec

I consistently encounter a 404 error, indicating that the requested URL is not found on the server:

unable to start crowdsec routines: authenticate watcher (your_watcher_id): API error: http code 404, response: <!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p>The requested URL was not found on this server.</p>\n</body></html>

I have confirmed that my API key is correctly entered and matches what is generated during registration. Additionally, I noticed that the API key found on the CrowdSec console page is different from the one generated during the automatic registration.

Could you please provide insight into why I am receiving a 404 error when trying to authenticate, despite successful registration? Any assistance would be greatly appreciated.

config.yaml

common:
  daemonize: true
  log_media: file
  log_level: info
  log_dir: /media/pi/kingston/logs/
  log_max_size: 20
  compress_logs: true
  log_max_files: 10
config_paths:
  config_dir: /etc/crowdsec/
  data_dir: /var/lib/crowdsec/data/
  simulation_path: /etc/crowdsec/simulation.yaml
  hub_dir: /etc/crowdsec/hub/
  index_path: /etc/crowdsec/hub/.index.json
  notification_dir: /etc/crowdsec/notifications/
  plugin_dir: /usr/lib/crowdsec/plugins/
crowdsec_service:
  console_context_path: /etc/crowdsec/console/context.yaml
  acquisition_path: /etc/crowdsec/acquis.yaml
  acquisition_dir: /etc/crowdsec/acquis.d
  parser_routines: 1
cscli:
  output: human
  color: auto
db_config:
  log_level: info
  type: sqlite
  db_path: /var/lib/crowdsec/data/crowdsec.db
  #max_open_conns: 100
  #user: 
  #password:
  #db_name:
  #host:
  #port:
  flush:
    max_items: 5000
    max_age: 7d
plugin_config:
  user: nobody # plugin process would be ran on behalf of this user
  group: nogroup # plugin process would be ran on behalf of this group
api:
  client:
    insecure_skip_verify: false
    credentials_path: /etc/crowdsec/local_api_credentials.yaml
  server:
    log_level: info
    listen_uri: 127.0.0.1:8083
    profiles_path: /etc/crowdsec/profiles.yaml
    console_path: /etc/crowdsec/console.yaml
    online_client: # Central API credentials (to push signals and receive bad IPs)
      credentials_path: /etc/crowdsec/online_api_credentials.yaml
    trusted_ips: # IP ranges, or IPs which can have admin API access
      - 127.0.0.1
      - ::1
#    tls:
#      cert_file: /etc/crowdsec/ssl/cert.pem
#      key_file: /etc/crowdsec/ssl/key.pem
prometheus:
  enabled: false
  level: full
  listen_addr: 127.0.0.1
  listen_port: 6060

Log:

okt 25 13:46:13 raspberrypi systemd[1]: crowdsec.service: Main process exited, code=exited, status=1/FAILURE

okt 25 13:46:13 raspberrypi systemd[1]: crowdsec.service: Failed with result 'exit-code'.

okt 25 13:46:13 raspberrypi systemd[1]: crowdsec.service: Consumed 9.337s CPU time.

okt 25 13:46:19 raspberrypi systemd[1]: Stopped crowdsec.service - Crowdsec agent.

okt 25 13:46:19 raspberrypi systemd[1]: crowdsec.service: Consumed 9.337s CPU time.

okt 25 13:46:19 raspberrypi systemd[1]: Starting crowdsec.service - Crowdsec agent...

okt 25 13:46:28 raspberrypi systemd[1]: Started crowdsec.service - Crowdsec agent.

Part of sudo journalctl -u crowdsec.service --no-pager | tail -n 50:
okt 25 13:46:28 raspberrypi crowdsec[47630]: time="2024-10-25T13:46:28+02:00" level=fatal msg="unable to start crowdsec routines: authenticate watcher (f1408d822b754783b20781852a6280c1XxRSwU9JDW5pM134): API error: http code 404, response: <!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p>The requested URL was not found on this server.</p>\n</body></html>\n"
2

The error looks like it could be local api instead of CAPI, Since you have updated the server to listen on a different port, did you also update the values in /etc/crowdsec/local_api_credentials.yaml to be the new port?

Just for clarity it this section by default it is 127.0.0.1:8080

api:
  server:
    listen_uri: 127.0.0.1:8083

ref: https://support.crowdsec.net/hc/en-gb/articles/10831013001234--Security-Engine-How-to-change-the-default-port

3

Thanks! Your suggestion to check the local_api_credentials.yaml file was key. I updated the port from 8080 to 8083, which I had configured for the CrowdSec server. Now, the service is running smoothly.

1 Like