zotac/graylog-deploy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix real root cause: password-extraction regex matched a second "password: "

Browse source 
Introduced by an earlier edit to .admin_credentials_ONE_TIME's own
instructional text ("...you've stored the password: rm <path>"), which
itself contains "password: " - the same substring resolve_admin_password()
greps for. grep -oP matched BOTH occurrences; command substitution joined
them with a real newline, producing a corrupted two-line "password" that
never matched .env's GRAYLOG_ROOT_PASSWORD_SHA2, causing every gcurl call
to silently 401 and wait_for_api_ready to time out no matter how generous
the timeout was (confirmed by re-verifying live: the real password,
extracted correctly, hashes to exactly what .env already has).

Fixed both ends: reworded the instructional text to not repeat "password:",
and hardened the regex itself (^Graylog admin password: anchor, grep -m1)
so a future wording change can't reintroduce the same class of bug.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
byrsapty 2026-07-22 23:13:09 +03:00
parent 9cdef5d521
commit 5316136eb6
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
install-graylog.sh
View file

@ -143,9 +143,9 @@ EOF
Graylog admin user: $ADMIN_USER
Graylog admin password: $admin_pass
(This file is only written once, at first install. install-graylog.sh prints
this password and deletes this file automatically once the run finishes
successfully. If the script dies before that, delete it yourself once
you've stored the password: rm $INSTALL_DIR/.admin_credentials_ONE_TIME)
the password above and deletes this file automatically once the run
finishes successfully. If the script dies before that, store it yourself,
then remove the file: rm $INSTALL_DIR/.admin_credentials_ONE_TIME)
EOF
chmod 600 "$INSTALL_DIR/.admin_credentials_ONE_TIME"
ok "Admin password generated (shown and deleted at the end of this run if the whole script succeeds)."
@ -188,7 +188,7 @@ ADMIN_PASSWORD=""
resolve_admin_password() {
[ -n "$ADMIN_PASSWORD" ] && return
if [ -f "$INSTALL_DIR/.admin_credentials_ONE_TIME" ]; then
ADMIN_PASSWORD="$(grep -oP '(?<=password: ).*' "$INSTALL_DIR/.admin_credentials_ONE_TIME")"
ADMIN_PASSWORD="$(grep -m1 -oP '(?<=^Graylog admin password: ).*' "$INSTALL_DIR/.admin_credentials_ONE_TIME")"
elif [ -n "${GRAYLOG_ADMIN_PASSWORD:-}" ]; then
ADMIN_PASSWORD="$GRAYLOG_ADMIN_PASSWORD"
else