Cannot login to Meshcentral server

[Suncatcher]

Probably very newbie question but I cannot log in to the server, the login page is not showed

When I open the page it just shows this logo and nothing else, nothing is clickable on the page. Systemctl shows service properly started.
I tried to start another instance of meshcentral manually, but got the same result just on another port

[ec2-user@ip-XXXXXXXXX ~]$ node node_modules/meshcentral --debug web,webrelay
MeshCentral HTTP redirection server running on port 82.
MeshCentral v1.1.20, LAN mode.
Server has no users, next new account will be site administrator.
MeshCentral HTTPS server running on port 445.

Any suggestions?

[si458]

Restart ur EC2 instance and try again,
It's getting itself confused because its not running on the standard port 80/443 but port 82/445, so it thinks something else is running on the normal 80/443 ports

[si458]

Just a thought, what version of nodejs is running? node -version
You might need to update to node 18/20?

[Suncatcher]

You might need to update to node 18/20?

v21.6.1

so v21 is not supported yet? Though I believe I had the same error on the previous version and I already was recreating the EC2 instance from scratch (full reinstall).
so you are out of ideas. No single suggestion how to troubleshoot this? The problem seems to be very trivial though my node knowledge is rather limited to find it.
Why the certificate is shown as invalid? Could it be the key to the problem?

[si458]

I dont think nodejs version has any issue unless its less than 16. But u could try installing 20? In theory the ec2 script has been updated recently to install 16 but will chsnge it to install 20 later today

As for The certificate showing invalid this is because meshcentral creates a self signed one by default, but should still work.

However To use a valid one you need to uncomment the _letsencrypt section and enter ur email address and the same dns name in there, set production to true, and restart meshcentral, then wait 2 mins and refresh the web page

[Suncatcher]

wow, the problem was in the browser, lol. I just tried to open it from the mobile browser and the login page is showed normally.
I knew my Chrome desktop was cutting scripts but I didn't know it was doing it so aggressively, haha.
Many thanks for trying to help me! I am so grateful.
however your suggestion regarding the certificate didn't work. I uncommented all the attributes and filled it per your recommendation but it still throwing the error

here is my let's encrypt section config

  "letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "[email protected]",
    "names": "ec2-XX-XX-XXX-XX.us-west-1.compute.amazonaws.com",
    "skipChallengeVerification": true,
    "production": false
  }

am I missing something?

[si458]

from the looks of the screenshot, you are accessing the web panel by its IP address https://13.
you need to access it via a DNS name not an ip address!
so the DNS name in letsencrypt->names needs to match settings->cert!
you also need to set letsencrypt->production to true to get a VALID SSL,
but again YOU MUST HAVE A DNS THATS VALID AND POINTS DIRECTLY TO YOUR MESHCENTRAL SERVER!

[Suncatcher]

you need to access it via a DNS name not an ip address!

the problem is DNS access doesn't work, it's always stuck at this

and then fails

[si458]

what about typing https://ec2-XX-XX-XXX-XX.us-west-1.compute.amazonaws.com rather than ec2-XX-XX-XXX-XX.us-west-1.compute.amazonaws.com ?
it that works, you might need to check you have port 80 open
also check you have the public DNS name and not the internal one? https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-viewing

[Suncatcher]

My full config.json

  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "cert": "ec2-00-00-00-00.us-west-1.compute.amazonaws.com",
    "WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "_port": 443,
    "_aliasPort": 443,
    "_redirPort": 80,
    "_redirAliasPort": 80
  },
  "domains": {
    "": {
      "_title": "MyServer",
      "_title2": "Servername",
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true
    }
  },
  "letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "[email protected]",
    "names": "ec2-00-00-00-00.us-west-1.compute.amazonaws.com",
    "skipChallengeVerification": true,
    "production": true
  }
}

The parameters names and cert are the same and equal to ec2-00-00-00-00. I obfuscated it here but this value is real in config.
It opens the same insecure in the desktop, but desktop is a bad example for the abovementioned issues, and on the phone it is not reachable at all

[si458]

this to me screams something is blocking the dns names?
whats ur ec2 firewall rules like? port 80+443 wide open to 0.0.0.0 ?
does the ec2 have ipv6? do you have ipv6?

[Suncatcher]

what about typing https://ec2-XX-XX-XXX-XX.us-west-1.compute.amazonaws.com rather than ec2-XX-XX-XXX-XX.us-west-1.compute.amazonaws.com

okay, you were right. My mobile browser is defaulting to HTTP. When i explicitly opened HTTPS it worked by DNS.
But again insecure, certificate error

Any suggestion?

[si458]

whats ur ec2 firewall rules like? port 80+443 wide open to 0.0.0.0 ?
it would explain why the SSL is invalid because letsencrypt needs port 80 open for them to verify you for the SSL

[Suncatcher]

whats ur ec2 firewall rules like? port 80+443 wide open to 0.0.0.0 ?

yup

[si458]

check ur screenshot... you dont have port 80 open...
80=http, 443=https
you also need 4433 too BUT ONLY IF you want to use intel amt 👍

[Suncatcher]

yes, I was not completely true. Now I added the 80 port, the error is not gone. should I restart the instance and/or restart the meshcentral?
I was thinking security groups rules are applied instantly

[si458]

yes restart meshcentral, wait about 2 mins, then fresh the webpage and it should be secured now

[Suncatcher]

yes restart meshcentral, wait about 2 mins, then fresh the webpage and it should be secured now

restarted the mesh, that didn't help. Then restarted the instance, that didn't help either. The certificate error is still showing up.
Any other suggestions?

[si458]

whats the output when you run meshcentral?
sudo systemctl status meshcentral OR stop the service and run manually node node_modules/meshcentral --debug
is the any extra lines? any errors? any warnings?

[Suncatcher]

whats the output when you run meshcentral?

[ec2-user@ip-XXX-XX-XX-XX ~]$ sudo systemctl status meshcentral
● meshcentral.service - MeshCentral Server
     Loaded: loaded (/etc/systemd/system/meshcentral.service; enabled; preset: disabled)
     Active: active (running) since Thu 2024-02-15 20:05:46 UTC; 50min ago
   Main PID: 1423 (node)
      Tasks: 29 (limit: 407)
     Memory: 132.9M
        CPU: 8.210s
     CGroup: /system.slice/meshcentral.service
             ├─1423 /home/ec2-user/.nvm/versions/node/v21.6.1/bin/node /home/ec2-user/node_modules/meshcentral
             └─1482 /home/ec2-user/.nvm/versions/node/v21.6.1/bin/node /home/ec2-user/node_modules/meshcentral --launch>

Feb 15 20:05:46 ip-XXX-XX-XX-XX.us-west-1.compute.internal systemd[1]: Started meshcentral.service - MeshCentral Serve>
Feb 15 20:05:49 ip-XXX-XX-XX-XX.us-west-1.compute.internal node[1423]: MeshCentral HTTP redirection server running on >
Feb 15 20:05:49 ip-XXX-XX-XX-XX.us-west-1.compute.internal node[1423]: MeshCentral v1.1.20, WAN mode.
Feb 15 20:05:54 ip-XXX-XX-XX-XX.us-west-1.compute.internal node[1423]: MeshCentral Intel(R) AMT server running on ec2->
Feb 15 20:05:54 ip-XXX-XX-XX-XX.us-west-1.compute.internal node[1423]: MeshCentral HTTPS server running on ec2-XX-XX-2>

and run manually node node_modules/meshcentral --debug

MAIN: Core module windows-amt is 610162 bytes.
MAIN: Core module linux-amt is 556461 bytes.
MAIN: Core module linux-noamt is 455925 bytes.
MAIN: Core module windows-recovery is 137824 bytes.
MAIN: Core module linux-recovery is 82212 bytes.
MAIN: Core module windows-agentrecovery is 61977 bytes.
MAIN: Core module linux-agentrecovery is 6365 bytes.
MAIN: Core module windows-tiny is 6305 bytes.
MAIN: Core module linux-tiny is 6305 bytes.
MeshCentral HTTP redirection server running on port 80.
AUTHLOG: Server listening on 0.0.0.0 port 80.
CERT: LE: Getting certs from local store (Production)
CERT: LE: No certificate files found
MeshCentral v1.1.20, WAN mode.
DISPATCH: AddEventDispatch [ 'server-shareremove' ]
DISPATCH: AddEventDispatch [ '*' ]
DISPATCH: DispatchEvent [ '*' ]
MAIN: Server started
MeshCentral Intel(R) AMT server running on ec2-XXX-XX-XX-XX.us-west-1.compute.amazonaws.com:4433.
AUTHLOG: Server listening on 0.0.0.0 port 4433.
AUTHLOG: Server listening on 0.0.0.0 port 443.
MeshCentral HTTPS server running on ec2-XXX-XX-XX-XX.us-west-1.compute.amazonaws.com:443.
CERT: LE: Got no certificates, asking for one now.
CERT: LE: Generating private key...
CERT: LE: Setting up ACME client...
CERT: LE: Creating certificate request...
CERT: LE: Requesting certificate from Let's Encrypt...
CERT: LE: Failed to obtain certificate: Error creating new order :: Cannot issue for "ec2-XXX-XX-XX-XX.us-west-1.compute.amazonaws.com": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy

Forbidden by which policy?

[Suncatcher]

you also need 4433 too BUT ONLY IF you want to use intel amt

I see the server is running on 4433 port also, but I'm on t4g-type instance which is ARM-based, so this is not relevant to me, it is not intel. How do I disable it and why it is enabled by default?

[si458]

Your problem with the ssl is explained in the very last line!?
Letsencrypt forbid creating ssl certs with the aws domain name
So u need another dns name
Also it doesn't matter what processor u run meshcentral on, the amt is coded eith the node so its safe to use arm
You can disable by setting mpsport to 0 under settings in config.json if I remember?

[Suncatcher]

Letsencrypt forbid creating ssl certs with the aws domain name

wow, so bad. You didn't know that? We could save such a lot of time troubleshooting this, lol
anyway, many thanks for your support, I really appreciate that.
I will consider making own domain name for mesh server.

[si458]

No worries no harm, and No I didn't realise letsencrypt forbid using the aws domain!
But I guess they are right to forbid it tho as the ip addresses/Ec2 instances can be chopped and changed very quickly!
I personally use duckdns.org for a free ddns for my home stuff 👍
I think they even have scripts u can setup if ya ec2 instance ip address changes haha

[Suncatcher]

I set up a domain, linked it and changed the config like you said and no error anymore! Everything works beautifully. Kudos to you!