Crowdsec Dashboard

The Crowdsec dashboard is great. The instructions provided are simple enough that it took only minutes to setup and start viewing the data.

That was a few days and on my home desktop machine. Now I'm in a different country on my laptop and find that I didn't save the the 64 character password generated during the setup process anywhere :-(

As the dashboard is powered by Metabase I did a quick search and found this page that details how to reset the password. The only problem was how to actually issue the command and get the token given that the dashboard is normally run via the cscli app?

Cue some experimentation and looking at the cscli code and the following process allowed me to reset the password. Maybe it'll help someone else.

NB There is likely a better way of doing this but I have very limited experience with docker :-)

Stop the currently running dashboard.

$ sudo cscli dashboard stop

Check the name of the image we need to use (normally crwdsec-metabase).

$ sudo docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                        PORTS               NAMES
707fbc2647fe        metabase/metabase   "/app/run_metabase.sh"   15 minutes ago      Exited (143) 13 minutes ago                       crowdsec-metabase

The mount point and database name need to be set for thereset command to work, so next step was to verify what they should be set to by inspecting the existing container that cscli setup.

$ sudo docker inspect crowdsec-metabase
...
            "Mounts": [
                {
                    "Type": "bind",
                    "Source": "/var/lib/crowdsec/data",
                    "Target": "/metabase-data"
                }
            ],
...
"Env": [
                "MB_DB_FILE=/metabase-data/metabase.db",

With this information, I could then create the command line I needed and run it.

$ sudo docker run -d -p 3000:3000 \
--name metabase \
--mount type=bind,source=/var/lib/crowdsec/data,target=/metabase-data \
-e MB_DB_FILE=/metabase-data/metabase.db \
metabase/metabase \
"reset-password metabase@crowdsec.net"
8930a2458b89115a1d48265dededd527dbc91693be5a639bd3e37f718ca2f500

The token is shown once the command has completed and so to get the token I needed to look at the logs.

$ sudo docker logs 8930a2458b89
...
Resetting password for metabase@crowdsec.net...

OK [[[1_8f478bb5-e163-44c9-bc46-7c578391d873]]]

Armed with the token, I restarted the dashboard and went to the reset url from the Metabase article.

$ sudo cscli dashboard start

This time the credentials have been saved to 1Password :-)

Update

erenJag pointed out that it's possible to force the dashboard to be setup again, which will generate a new password via

$ sudo cscli dashboard setup -f

Of course this will also remove any customisations you have made to the dashboard, so use with care :-)

Cynics Soapbox

Update