Neo4J not working with BloodHound

[fastlorenzo]

I can't use the Neo4J instance with BloodHound (bolt port).
This works fine with the Neo4J browser.
I've tried via SSH tunneling and via direct IP access, BloodHound stays stuck in a loop.

By changing the container image from specterops/bloodhound-neo4j to neo4j:4.2, everything works fine.

Proposed patch to adapt it.

Furthermore, the mount point in the docker compose file (/var/lib/neo4j) is incorrect, it should be /data

[MarcOverIP]

This all works fine in my testing. Perhaps an issue related to another of your PRs? Or maybe not proper ports exposed in docker-compose file?

Moving to a newer branch of the neo4j is desired at some point. But it equals opening a whole new can of worms. Im not happy to do this now. Amongst others, it would require testing if Jupyter notebook docker still works.

I'll leave this PR open for future additions.

[MarcOverIP]

Did a quick check and found the issue. The used SpecterOps neo4j image is indeed very old (v3), while modern BloodHound app require a neo4j instance using a newer bolt protocol version. That is why the builtin neo4j browser does work (it uses the old v3 protocol). I did not check, but Im pretty sure the data path did work for the old image, but indeed needs to be changed for newer neo4j images.

Forcing RedELK users to an old BloodHound app is no option. We need to move to a newer neo4j image asap. I did a quick test with your proposed solution, and it works at least for neo4j data. Jupyter workbooks connectivity is to be checked.

[MarcOverIP]

Reverting your PR as it breaks access to /neo4jbrowser which redirects to ip:7473. Seems neo4j 4 needs different handling of the ssl certs.

I see three options - ranging from most to less preferred:

1. put the neo4jbrowser behind the nginx proxy
2. make the neo4j image also use the tls certificates that nginx uses
3. make the neo4jbrowser available on 7474, which would be clear text.

[fastlorenzo]

I'll check this one ;)

[MarcOverIP]

Note: when we'll update neo4j, we prolly also need a newer install of py2neo in the jupyter image. Dockerfile currently states a specific version with pip3 install py2neo==4.3.0. Possibly this can/needs to be upgraded to later.

[fastlorenzo]

I've worked on a fix, which I tested to be working: it uses nginx to listen on port 7687, and proxies the requests to the neo4j container. Adds back the neo4j container behind nginx as well.
This way, we don't have to touch the neo4j container.

As this touches the Nginx container config, I'll wait for #152 to be merged before making a PR