redirecting /nsm to a /media/nsm - Configuration file path changes and shutting down and restarting Security Onion 2 application

[smallboy69]

Hello

just have a action items that require some confirmation

a) /nsm - my nsm folder is filling up with only 10% disk space left

b) i would like to temporary stop SO 2 application , redirect the contents of /nsm to /media/nsm via configuration path changes and resync the folder in /media/nsm with /nsm than startup the SO 2 application

c) restart the application and verify that the data is being populated into /media/nsm

d) extend the /nsm and increase its size, than repeat steps b and step c i.e move back data from /media/nsm to /nsm

Appreciate your experience and insight feedback into carrying out the above plan

Thanks

[cm-ops]

Would look like you would be trying the following - https://docs.securityonion.net/en/latest/new-disk.html#method-2-mount-a-separate-drive-to-nsm but also after expansion, moving the data back.

[smallboy69]

thanks chris,

yes did try the 2nd configuration given the 1st one does not apply to my setup...( did not customize the storage config)

but when i tried to move the nsm to nsm.old

output from the terminal saying the device is still busy so i suspect a process or thread is still active

even after following the instructions in the link provided to suspend the application and when i check the so-status processes are still running and those that stop after awhile are starting up again...

so am researching further and trying to apply logic to my research...and if it makes sense

than i will try it out ...

the beauty of learning, implementing and validating the outcome ( doing the grind)

Regards

[smallboy69]

well some progress,

now managed to make it work on ubuntu 20.4 with downloaded Security Onion 2 but the application is now broken or in hang state

after running so-status the status of the application is just wait starting, Starting and it does not progress further..

so now i have deep dive into the source code to see where it is broken and if i can fix it..

as i have now moved the application folder /NSM onto a NAS but core application on the Appliance...so now i cater for expansion of up to 50TB for the log growth and longer retention of Logs

so will just try to understand the source code and see if i can fix it up so i can get it working properly..

Regards

[cm-ops]

Are you still having issues with this?

[smallboy69]

hi cm-ops

yes still have issues with it..as per my installation log

sosetup.log

could not work over the weekend

as i had to celebrate mother day for the 3 special ladies in my life, my wife, my mother and my mother in law so was busy prepping their lunch but have attached my installation log

as i was going through this log in notepad ++ and referencing the documentation of SO 2

only so-strelka-coordinator and so-strelka-gatekeeper and docker has status ok

all the others are saying status starting but its been over 4 days and still has not change

so-aptcacherng
so-curator
so-docker-registry
so-elastalert
so-elasticsearch
so-filebeat
so-fleet
so-grafana
so-......

is there a global configuration file for storage that i can modify so that all the services reads from it...as during the installation Security Onion 2 does not provide an alternative path for installation

as this would really help with the amount of logs/meta data needed to store to be able to get the insight over time from the logs

given the collaboration and trying to build the bigger picture for the traffic flow on the network...

as logs/meta data if not compromise can reveal the intelligence level of the threat actors intent or game plan..

[cm-ops]

These are some of the issues I see in the log:
[ERROR ] Specified target /etc/pki/registry.key is a directory
There also appears to be an issue with docker-ce package and the docker.service
[ERROR ] Container 'so-filebeat' is already configured as specified. Failed to start container 'so-filebeat': 'Error 500: error while creating mount source path '/nsm/wazuh/logs/alerts': chown /nsm/wazuh/logs/alerts: operation not permitted'.

First, check /etc/pki/ if registry,crt or registry.key are directories remove them both and run the ssl state.

Second, can you share the line in /etc/fstab for your /nsm mount? Also, what are the permissions on /nsm?

There are quite a few errors, but let's look at these first.

[smallboy69]

hi chris

please see attached..

is the command ssl state internal to security onion or do i need to download an update

also have attached permissions and fstab file content in etc..

Thanks

[Acewiza]

Wow - "actual" screenshots! -Taken with an air-gapped camera. It's been awhile since I've seen one of those. :-)

[cm-ops]

Your command to run the ssl state is salt-call state.apply ssl you run that after removing registry.crt and registry.key. Also, drill down to /nsm and let me know what the permissions are for the different directories in /nsm.

[smallboy69]

hi chris

is there a command to restart the functions as i have a error running the command as per camera shot..

[cm-ops]

If you want to stop the salt jobs, you can run salt-call saltutil.kill_all_jobs then you can run the above command.

Your permissions look off in the /nsm directory, did you change some permissions to 777?

[smallboy69]

hi chris

noted will try and advise, as for the permissions for the /nsm i installed Ubuntu, than mounted the nas onto the appliance via a soft link and changed the permissions of the nfs share than i ran the installation of security onion 2 over the / and it installed the nsm folder on /

i can change the permissions if that is the issue for starting up the services, just need to know the appropriate permissions on each folder and its inherit ant sub folders

[Acewiza]

I'd try getting /nsm properly "mounted" first, then re-do the install.

[smallboy69]

Thanks Acewiza

can please advise steps on how /nsm could be properly mounted first,

i just want to make sure i did it properly used point to point ip address to mount the NAS nfs share

than use a softlink to mount point /nsm, than ran installation

i did not want to mount to / as there are other files that Ubuntu needs to operate such as directory /etc

so mounting it on / instead of /nsm could ensure it does not affect ubuntu boot files under /etc/...

appreciate your advise

thanks

[Acewiza]

A link is not a mount. It needs to be /nsm.

[Acewiza]

A symbolic link "should" work, but I never tried it. Not sure about the NAS part. Doesn't sound like a good idea, to me. Maybe somebody else will chime in...

[smallboy69]

hi Acewiza

yes i did mount the nfs share from the NAS appliance to the Security Onion 2 appliance via point to point ip address 1Gbps NIC on

both ends and use option 3 of security onion recommendations

https://docs.securityonion.net/en/2.3/new-disk.html

[Acewiza]

sshfs? Have you re-run the install?

[smallboy69]

hi Acewiza

apologise for late reply

i ran the did the installation again and got below results,

[Acewiza]

Starting to look iike that's not gonna work.

[cm-ops]

You might have to set no_root_squash if permissions are net getting changed.

[smallboy69]

hi chris i did change the NFS permissions on the Synology NAS Squash permission map root to admin but still no changes also tried map users to admin and no mapping still no changes....notice installation taking 11hours to install

[cm-ops]

There is a reason this is in the RTD - You may be able to make remote storage work, but we do not provide any support for it. https://docs.securityonion.net/en/2.3/hardware.html#storage Setting up this way can introduce many issues.

[smallboy69]

Thanks chris for the advise, yes you are correct, manage to get remote storage working, would you know of documentation link to update security onion 2 certificate.....regards