sigs.securityonion.net generates a server error

[Alex01000100]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

40GB

Storage for /

200

Storage for /nsm

I don't know -> permission denied

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Dear all.,

I am new to Security Onion and I tried (many times) and try to implement 2.4 in VMware Workstation Player 17 (17.5.0 build-22583795) but it always fails.

• Salt Status: Data failed to compile. The function "state.highstate" is running as PID...and started...with jid...
• Additional info: the IP of the web interface doesn't appear in ARP table.
  The 2 Networkadpaters in VM are set to NAT and Host-only as recommended in Youtube Video:
  Security Onion Essentials 2.4 - Security Onion Installation, Part 1, I used to have: bridged in both NW-Adapters.
• When it reboots, it takes extremely long, like hours: what I see is kind of a flapping port on sobridge:

1. eth0 gets renamed
2. various change the states from disable, blocking and forwarding and then
3. enters promiscuous mode
4. again various changes
5. left promiscuous mode
6. rename again (1)
   = this goes for hours and at the end: journal header limits reached.

It was running with 16.5 but then I did this update to 17. I noted that in the implementation process, there is a point where sigs.securityonion.net/ is tried to connect 5 times but can't.
Checking that URL on other devices, it generates a server error.

Bing AI meant:

The message you’ve received is a standard error message from a server.

In summary, this error message is telling you that your request was denied by the server. If you believe this is an error, you may want to contact the service provider or check your permissions.

Maybe I have just to wait for an update 2.4.1?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[cm-ops]

When you installed did it complete successfully?

[Alex01000100]

Yes on the host system and on other devices:

Non-authoritative answer:
Name: d15e1rs01gh6d2.cloudfront.net
Addresses: 2600:9000:25a2:5c00:1f:6bbb:9d80:93a1
2600:9000:25a2:3e00:1f:6bbb:9d80:93a1
2600:9000:25a2:e000:1f:6bbb:9d80:93a1
2600:9000:25a2:7400:1f:6bbb:9d80:93a1
2600:9000:25a2:d200:1f:6bbb:9d80:93a1
2600:9000:25a2:a600:1f:6bbb:9d80:93a1
2600:9000:25a2:1e00:1f:6bbb:9d80:93a1
2600:9000:25a2:1400:1f:6bbb:9d80:93a1
18.165.183.36
18.165.183.75
18.165.183.79
18.165.183.103
Aliases: sigs.securityonion.net
(Result from the Hostsystem: Win11)

I did implement the same in virtualbox, and remove AV with the same result.
I will link the NICs "somewhere else" and try again and then I plan to re-install the whole host.

[Alex01000100]

Ok, I tried it all and came to the conclusion, that the recommendation in the following video, doesn't work for me.

"The 2 Networkadpaters in VM are set to NAT and Host-only as recommended in Youtube Video:
Security Onion Essentials 2.4 - Security Onion Installation, Part 1"

I reverted to bridged on both NW-Adapters, in VM and it works now.

[Alex01000100]

Now, I can't access web-interface of my Security Onion after a reboot where I add some RAM. However, I have seen, there is already an ongoing discussion, so, I will check there.

[dougburks]

NAT should work fine for the management interface as long as you correctly configure the IP address, subnet mask, gateway, and DNS settings.

[Alex01000100]

The management interface is now also reachable, I had that port in the wrong Vlan configured. I reconfigured also the port-mirror (span) port. I am now at a level where it works and I will do an improvement second round in the future :-) Thx Doug.