Theseus

Appearance

Sign-in and certificates ​

The browser warns about the certificate ​

Cause. The stack uses its own CA (TLS_MODE=internal), which your computer does not trust yet. Expected with an IP address or a private DNS name.

Fix. Trust /opt/theseus/runtime/pki/ca.pem on the computers your analysts use; see Trust the CA. Restart the browser afterwards. Check which CA signed the certificate the server presents:

bash
openssl s_client -connect soc.example.com:443 -servername soc.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -subject -dates

For a publicly trusted certificate, ask us to switch the console to Let's Encrypt (needs a public DNS name and ports 80 and 443 reachable from the internet).

Let's Encrypt does not issue a certificate ​

Symptom. With TLS_MODE=acme, the browser shows a temporary or untrusted certificate long after the install.

Causes.

  • The DNS name does not resolve to the server's public address yet.
  • Port 80 or 443 is not reachable from the internet (firewall, security group, NAT).
  • Let's Encrypt's rate limits after many attempts.

Diagnose.

bash
dig +short soc.example.com                  # must be the server's public IP
sudo ./theseus logs web                     # Caddy's ACME messages: challenge failures, rate limits

From outside your network: curl -I http://soc.example.com/ must reach the server (a redirect is fine).

Fix. Correct DNS or open the ports; the gateway retries on its own. If the name is meant to be internal only, ask us to use the internal CA instead.

Login loops back to the sign-in page ​

Cause. The browser uses a different address from the console's configured address (THESEUS_HOST): for example the IP instead of the name, or another port. The sign-in service issues tokens for the configured address only.

Fix. Open exactly the address the install printed (grep PUBLIC_URL /opt/theseus/theseus.env). If the configured address is wrong, ask us to change it (it affects enrolled endpoints too; see DNS and TLS). On a stack you manage yourself, change THESEUS_HOST, then sudo ./theseus config apply.

Also check the server's clock (timedatectl) and clear the browser's cookies for the site.

The new password is refused at first sign-in ​

Cause. The password policy: at least 12 characters, at least one upper-case letter, one lower-case letter, one digit and one special character, and not equal to the username or e-mail.

Fix. Choose a password that meets all of these.

Lost the administrator password ​

bash
cd /opt/theseus && sudo ./theseus admin reset-password

It prints a new temporary password for the first administrator. Other users: an administrator resets theirs under Admin → Users.

"Forgot password" is missing on the sign-in page ​

Self-service password reset is off by default. It needs SMTP and KEYCLOAK_SELF_SERVICE_PASSWORD_RESET=true; ask us, or see Configuration settings.

A user signs in but sees few pages, or cannot open Pallas or the SIEM ​

Pages follow the user's roles; Pallas and the SIEM need application access on the account. See Users and roles.

Theseus documentation