2.4.20 ISO "Fail to enroll could... message authentication failure"

[JMH-Infosec-Forge]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

32mb

Storage for /

64gb

Storage for /nsm

126gb

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

After the account was built, I received that attached error message:

ERROR: fail to enroll: could not save enrollment information: failed to ensure key: could not get agent key: Cipher: message authentication failed.

I am current using VMware workstation pro 17 on a windows 11 os. The above specs are for the SO server itself (32gb ram, 200gb storage, adapters are VMnet8 = NAT and VMnet1 = host only.

Can someone point me in the right direction to get this issue resolved. I think I'm close to (FINALLY) spinning up a SO instance on VM after almost a week of troubleshooting and hands on learning.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[magnoliasock]

Hi, is the VMnet1 = host only your monitor port?

[JMH-Infosec-Forge]

I did [email protected]

Would it really not recognize that?

[magnoliasock]

I'll try adding a user at root.com in my active server, then I can just delete. But I can tell by adding them and if the server is not accessible with that user name-email combo it won't work.

[magnoliasock]

@root.com works. That's not it.

[dougburks]

Still installing, remembered while doing so some SOC email addresses can cause errors for example [email protected] ; I don't know why but they seem to dislike clowns.com, example.com is safe.

@magnoliasock I tried installing with [email protected] and it worked fine for me.

[magnoliasock]

Hey @dougburks , I tried again and it worked. About a month ago I added a user with @clowns.com email and he couldn't log in and then changed it to example.com and he could log in no problem. Perhaps it was an issue unrelated to the email address. I thought you just didn't like clowns which is understandable.

[magnoliasock]

I had a smooth installation. Did you click

before

Trying to think of potential issues.

[JMH-Infosec-Forge]

I can try that again and see what happens.

[dougburks]

@JMH-Infosec-Forge Did you verify the ISO image as shown at https://securityonion.net/download?

We just released 2.4.30 yesterday, so you might want to download it, verify the download, and then try again.

Have you tried a simple IMPORT installation as shown at https://docs.securityonion.net/en/2.4/first-time-users.html?

How much RAM does your host machine have and is it able to allocate the full 32GB RAM to the VM?

What kind of storage does your host machine have (NVME, SSD, or rotational)?

Is the VM able to connect to the Internet? If not, you might try selecting the airgap option since that will pull everything it needs from the ISO image.

[JMH-Infosec-Forge]

I managed to get 2.4.20 to work yesterday.... now I am going back and tracing my steps to see if I can figure out what the disconnect was...

Have not tried Import as that's not really what I'm looking to do with it.

My host machine has 128gb RAM, I have a SSD for the OS and basic stuff, but the VMs are housed on a 4TB HDD.

What ended up working as doing the "double NAT" approach. I'm not a big fan of this as I wanted to do a closed network, but for the sake of this project I'm doing it might work for now.

[dougburks]

I have a SSD for the OS and basic stuff, but the VMs are housed on a 4TB HDD.

Disk IO could cause problems with Elasticsearch since they typically recommend SSD, so if possible you might want to try a new installation with the VM on the SSD:
https://docs.securityonion.net/en/2.4/hardware.html#elastic-stack