Secrets not complete

[danielo37]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

32

Storage for /

293G

Storage for /nsm

924G

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello team,

I installed Security Onion as in the documentation and official videos but at the end I got a problem which is: I am not able to authenticate to playbook with anonymous authentication, after a quick research I found that I miss a key in my secrets playbook_automation_api_key when I type sudo salt-call pillar.get secrets I get the following:
"""
local:

import_pass:
h6yYnaNk8ZEtgoWfs9MT
influx_pass:
R0Rfomj7FoVQ83Z9Xpy3
mysql:
V9UymEqolgjr0iByNNWQ
playbook_admin:
CnD2jWWkIpFTn3K106zx
playbook_automation:
Es7iMTHiVYd7aoo7T3JU
playbook_automation_api_key:
None
playbook_db:
EgR6LirmWOu4ns9OLPQ5
"""
is there a way to create that without reintalling the instance "it is a standalone deployment"

Thank you for your answers.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[Mav1814]

Hi!
The anonymous is not an "account", no login is required.
You only login in playbook as admin with the password "CnD2jWWkIpFTn3K106zx"

[danielo37]

Hello!
Yes I know anonymous is an authentication method without explicitly provid creds, my question is, is there any chance I can work with that method again? cuz when I launch playbook from Security Onion dashboard it shows the playbook dashboard but with no authentication so no playbooks shown there, and I want that for all users and also to avoid creating users again manually on playbook (redmine).
Thank you.

[Mav1814]

I don't know if I understood correctly. Is anonymous disabled? If so, just go to Administration -> Projects -> Detection Playbooks. Select the Public checkbox.

With the admin authentication it shows the playbooks on the dashboard?

[danielo37]

the anonymous is not disabled I entered with admin creds to redmine and I can see playbooks, but when I try to go directly to playbook dashboard from security onion it s not showing me playbooks either authentication me with that anonymous method you said.
I think the problem is with that key that was not generated dueing installation playbook_automation_api_key:
None if that is the one responsible for the anonymous authentications under the hood.
I hope you get the idea.
and thank you for the interaction already.

[defensivedepth]

@danielo37 Please run sudo so-playbook-reset - That will reinstall Playbook & re-import all the Plays. That should fix your problem.