Question regarding uwhoisid

[swiss-JF]

Hello,

I spent my whole afternoon trying to make it work, but none of my attempts was successful. It is probably something small, but I am keeping missing it.

I wanted to install the uwhoisid, but I did not make it to work.

I followed strictly the instruction on here: https://www.lookyloo.eu/docs/main/install-lookyloo.html, but I keep getting error messages and uwhoisid didn't work.

My guess is, something is wrong with the uwhoisd.service.sample file. I put the following values in there. Not sure if I should put a ~before the / or if I should put the WorkingDirectory within ""

However, I am unsure it is this, as the error message mentions a failure "to determine user credentials: No such process"
I have it installed in a Linux Mint virtual machine running on VirtualBox named: mint@mint-VirtualBox

Any ideas welcome, thank you!

Ps. I searched for uwhoisd, but did not find a previous discussion on this.

[Rafiot]

Okay that seems to fail somewhere with systemd, let's try without it at first.

From the doc, I'm assuming you went to that point:

git clone https://github.com/Lookyloo/uwhoisd
cd uwhoisd
poetry install

and then went on with systemd.

What happen if you do poetry run start from the uwhoisd directory?

If there is no error, try in another terminal on the same machine telnet localhost 4243 and if you get a telnet prompt, type a domain. If that works, you have a working uwhoisd and it is purely systemd's fault. We can investigate further.

One thing that might be an issue is that you put the WorkingDirectory to /home/mint/opt/lookyloo when it should be /home/mint/opt/uwhoisd if you're attempting to run uwhoisd.

[swiss-JF]

Thank you!

In the meantime I had deleted the uwhoisd, so I reinstalled it in /home/mint/opt/uwhoisd. There was an error after poetry run start, I put what the system wanted export UWHOISD_HOME='/home/mint/opt/uwhoisd.

Afterwards, I opened a new terminal and entered telnet localhost 4243 and then inputting a random website. So, it seems uwhoisd is working. I tried a few stuffs, but what I gut is a "No file/folder found for package lookyloo", despite being in the folder itself and having files there.

However, I went back to lookyloo, and I cannot access its web interface or run it in any way

My guess is that I am not a good poet, and it is probably an issue with poetry. I am a bit in a rush, so will have to get back to this again, but I looked in the poetry command and ran a poetry show (no lookyloo in the list) and poetry update. Maybe I corrupted something when I deleted the uwhoisd folder.

No clue where to look for lookylook... ;-)

[Rafiot]

The IP address only needs to be amended if uwhoisd is running from another machine/VM than the one lookyloo is running on (if telnet 127.0.0.1 4243 works from the machine you have lookyloo installed, all good). It should be the case after you ran poetry run start from the uwhoisd directory. The systemd script is doing the same as poetry run start, but makes it reboot-safe.

The whois information should be visible after you triggered a capture in lookyloo. From the tree, when you click on one of the node it will open a popup. In that popup, you should have links to the whois infos:

[swiss-JF]

The results I get with the public instance of lookyloo for a random public capture:

The results I get with the private instance doesn't have the link to the whois information

I tried to see if the uwhoisd was working, so I repeated the procedure you suggested above and had this:

I think I will give it a go in a fresh VM with Ubuntu and see if I get any further on a fresh install.

[Rafiot]

That's odd, but it probably means lookyloo cannot connect to uwhoisd. They're both running in the same VM, right?

And in config/modules.json > UniversalWhois, enabled is True? If yes, can you check at the logs? There should be something there with a warning.

[swiss-JF]

Yup, it is the same VM

The config/modules.json > UniversalWhois, are enabled, (set to true) [https://www.lookyloo.eu/docs/main/lookyloo-integration.html](integration with 3rd party tools), the allow_auto_trigger in config/generic.json is set to true.

I had some config files twice, one modules.json and modules.json.sample, the .sample ones were set to false, I put it to true. Then restarted both terminal for uwhoisd and lookyloo, once, it didn't work.

Surprisingly, I repeated the procedure and it works.

The logs file are in ~/lookyloo/config/log, right? If so they are https://www.swisstransfer.com/d/d0f53033-3f57-4eb4-9352-931ff33217f4 if you want to take a peak at.

It was probably an issue with those settings, but it seems it is solved now.

Thank you for your help!

[Rafiot]

The idea for the .sample config files is that if one of the config setting isn't defined in the non-sample file, lookyloo (or the relevant project) will simply pick the value from there. In theory, you shouldn't have to change them and only edit the non-sample file. down the line, it makes it possible for you to run git pull and update the project without conflicts.

when you say "restarted both terminal", do you mean you ran the stop/start commands in each poetry environment?

Glad it works. And by looking at the logs, it is pretty much all expected, not sure why you had duplicate UUIDs, but it happens when you play around and debug.