access to /opt/so/saltstack denied

[benesch1]

Hi all,

sorry if this is a stupid question maybe, but I can not access the /opt/so/saltstack folder to add local suricata rules as described in
Security Onion 2.3 - Adding local rules.
I am using Security Onion 2.3.160-20220829 ISO installation on a VM and the administrative user I created during installation.

I can execute commands that need admin privileges like "so-status, so-allow".

And how can I find out the version of suricata? Due to their docu it´s just a simple command "suricata -V" but if i use this command in the so-suricata docker container, the command is not found.

Any help is appreciated.

Thanks in advance.

Best regards,

benesch

[dougburks]

I can not access the /opt/so/saltstack folder

Have you tried becoming root?

sudo -i

I am using Security Onion 2.3.160-20220829 ISO installation

You might want to migrate to the new 2.4 which allows you to do common administrative tasks from the web interface rather than the command line:
https://blog.securityonion.net/2023/08/security-onion-24-has-reached-general.html

how can I find out the version of suricata?

sudo docker exec so-suricata /opt/suricata/bin/suricata -V

[benesch1]

Hi,

thanks for the fast reply and sorry for the delay. Unfrotunately accessing the dir was still not successfull. Don´t know what was messed up there so I reinstalled the actual SO version mentioned before because we have this version running in another network. (BTW what do you mean with migrating? I couldn´t find a description for migration from 2.3 to 2.4)

Thanks for the docker command to find the suricata version!

The thing is that I run into another error now if I run the "so-rule-update" command.

A TypeError "TypeError: '>' not supported between instances of 'int' and 'NoneType'" is triggered in line 555 of the rulecat.py file.

Anyone who had this problem before?

Thanks in advance.

Best regards.

[dougburks]

Unfrotunately accessing the dir was still not successfull.

If running sudo -i didn't work, then most likely your user account did not have sudo privileges.

The thing is that I run into another error now if I run the "so-rule-update" command.
A TypeError "TypeError: '>' not supported between instances of 'int' and 'NoneType'" is triggered in line 555 of the rulecat.py file.

Since this problem is separate from the topic of access to /opt/so/saltstack denied, please start a new discussion.