Install Error

[serghdz]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Eval

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

5

RAM

12

Storage for /

200gb

Storage for /nsm

0

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I've tried installing seconion about 5 times now, and keep running into the same issue, i've tried giving it more storage, and cpu but the outcome is the same. I keep getting the same errors everytime.

seconds after beginning installation, i get this first error.

Then i get this error message

I then restart, and attempt to view logs but I cannot cd into root to view files.

I am fairly new, and currently learning. Thanks in advance!

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

The first screenshot shows that it couldn't resolve the hostname sigs.securityonion.net.

Have you verified that your VM has Internet access and valid DNS settings?

For more information, please see:
https://docs.securityonion.net/en/2.4/firewall.html#internet-communication

[serghdz]

I set up 2 network adapters, both host only and allowing all in promiscuous mode. Not sure how to check Dns settings, I'll look into that. Thanks for the feedback 🙏

[dougburks]

You probably want your management interface to be set to NAT or bridged so that it can access the Internet.

[serghdz]

So I'm following a course module and the guy sets both as host only adapters, and the same set up is used in several other installing tutorials I've seen and it seems to work for them. I will attempt to set one as NAT, to see if that works. Also I'll have to check my firewall rules to see if it's allowing DNS traffic.

[dougburks]

If you don't have Internet access, then you can choose our Airgap option:
https://docs.securityonion.net/en/2.4/airgap.html

However, in most cases, you'll want to figure out your network issue so that you can have Internet access and do a standard installation.

[serghdz]

I was watching the install video on security onion, and noticed that It prompts them to install the following tools, but It never prompted me this.

After setting the email, it goes straight to the install overview.

My question is, does Security Onion 2.4 automatically install them?

[t-myers-2024]

Fortunately, but unfortunately, I was able to install Security Onion successfully, but the final screen told me to visit the URL where the interface should be. There is no interface on my VM where I can access a web browser. Can we access the URL directly from the terminal?

When I rebooted my VM, it now does something that it's done in the past... a lot of "entered blocking state," "entered forwarding state," entered disabled state" regarding sobridge ports.

So frustrating!!! I have no clue what I'm supposed to do.

[bumfighter]

If you're on the same network you just plug that SO ip address into the web browser and you should get the SOC page.

[t-myers-2024]

Thanks, but I've tried that. It gives me the "Cannot reach page error / timeout" When I say, "I've tried that" meaning I open a web browser on my host computer, because my virtual machine does not have a web browser when I install SO from their ISO file. My host machine is on the same network as my VM.

In one of the last steps regarding the install of SO it asks for something like "allowed IP address or range for web." For that, I have been putting in the range of my host computers IP address.

[bumfighter]

Can you successfully ping the SO ip from your host computer?

[AsadVathare]

I found a solution for @t-myers-2024 problem
I faced the same problem, and the solution was in configuring your firewall to allow a certain ip address for management node.
What I did was,
sudo so-firewall includehost analyst 192.168.x.x(your ip addr in the same subnet as securityonion)
sudo so-firewall apply

and then logged in my ubuntu vm and typed in IP address of security onion in browser and it opened.

[t-myers-2024]

Yes, I can ping both the NAT and Host-Only addresses from my Host computer. I can also successfully ping my host computer from a terminal within my VM. Just for further context, I am using VMWare to set up my virtual instances. I would love to be able to get on the phone with someone at some point to try and figure this out. I’ve exhausted the number of videos and resources used to try and figure this out. Unfortunately, I do not know where else to turn. I am assuming I’m doing something wrong, or there is a firewall setting somewhere… but again, I’m a student still in the learning process. I’m much more limited in my knowledge vs. someone who has been in the industry for years. From: bumfighter ***@***.***> Sent: Saturday, January 27, 2024 7:40 PM To: Security-Onion-Solutions/securityonion ***@***.***> Cc: t-myers-2024 ***@***.***>; Comment ***@***.***> Subject: Re: [Security-Onion-Solutions/securityonion] Install Error (Discussion #11395) Can you successfully ping the SO ip from your host computer? — Reply to this email directly, view it on GitHub <#11395 (reply in thread)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/BFSUDAL5E7J2Y7XAYO7VKNTYQWM5LAVCNFSM6AAAAAA5IHV2M6VHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DENRYGMYDS> . You are receiving this because you commented.Message ID: ***@***.***>