Unable to install via bash so-setup-network

[rserio]

Version

2.4.50

Installation Method

Network installation on Red Hat derivative like Oracle, Rocky, Alma, etc.

Description

installation

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

2

RAM

768

Storage for /

150G

Storage for /nsm

1TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

I am trying to deploy a distributed, sensor on this physical box which is attached to the taps of our network. I have an install txt from /opt/so, I also provided some logs I hope helps. Here is my full install logs (from terminal scrollback)

[root@remoteonion securityonion]# bash so-setup-network
Getting started...
2024-02-20T18:21:10Z | INFO | Executing command: timedatectl set-timezone Etc/UTC
2024-02-20T18:21:10Z | INFO | Found OS: rocky 9
2024-02-20T18:24:19Z | INFO | Old setup detected. Preparing for reinstallation.
2024-02-20T18:24:19Z | INFO | Putting system in state to run setup again
2024-02-20T18:24:20Z | INFO | System reinstall init has been completed.
2024-02-20T18:24:20Z | INFO | Installing as the root user
2024-02-20T18:24:20Z | INFO | Executing command: uptime
18:24:20 up 6 min, 2 users, load average: 0.00, 0.07, 0.06
2024-02-20T18:24:20Z | INFO | Executing command: uname -a
Linux remoteonion 5.14.0-362.18.1.el9_3.0.1.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Feb 11 13:49:23 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
2024-02-20T18:24:20Z | INFO | Executing command: free -h
total used free shared buff/cache available
Mem: 754Gi 4.1Gi 752Gi 13Mi 241Mi 750Gi
Swap: 8.0Gi 0B 8.0Gi
2024-02-20T18:24:20Z | INFO | Executing command: lscpu
Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Address sizes: 46 bits physical, 48 bits virtual
Byte Order: Little Endian
CPU(s): 88
On-line CPU(s) list: 0-87
Vendor ID: GenuineIntel
BIOS Vendor ID: Intel(R) Corporation
Model name: Intel(R) Xeon(R) CPU E5-2699 v4 @ 2.20GHz
BIOS Model name: Intel(R) Xeon(R) CPU E5-2699 v4 @ 2.20GHz
CPU family: 6
Model: 79
Thread(s) per core: 2
Core(s) per socket: 22
Socket(s): 2
Stepping: 1
CPU max MHz: 3600.0000
CPU min MHz: 1200.0000
BogoMIPS: 4399.84
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l3 cdp_l3 invpcid_single pti intel_ppin ssbd ibrs ibpb stibp tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdt_a rdseed adx smap intel_pt xsaveopt cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts vnmi md_clear flush_l1d
Virtualization: VT-x
L1d cache: 1.4 MiB (44 instances)
L1i cache: 1.4 MiB (44 instances)
L2 cache: 11 MiB (44 instances)
L3 cache: 110 MiB (2 instances)
NUMA node(s): 2
NUMA node0 CPU(s): 0-21,44-65
NUMA node1 CPU(s): 22-43,66-87
Vulnerability Gather data sampling: Not affected
Vulnerability Itlb multihit: KVM: Mitigation: VMX disabled
Vulnerability L1tf: Mitigation; PTE Inversion; VMX conditional cache flushes, SMT vulnerable
Vulnerability Mds: Mitigation; Clear CPU buffers; SMT vulnerable
Vulnerability Meltdown: Mitigation; PTI
Vulnerability Mmio stale data: Mitigation; Clear CPU buffers; SMT vulnerable
Vulnerability Retbleed: Not affected
Vulnerability Spec rstack overflow: Not affected
Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl
Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2: Mitigation; Retpolines, IBPB conditional, IBRS_FW, STIBP conditional, RSB filling, PBRSB-eIBRS Not affected
Vulnerability Srbds: Not affected
Vulnerability Tsx async abort: Mitigation; Clear CPU buffers; SMT vulnerable
2024-02-20T18:24:20Z | INFO | Executing command: df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 4.0M 0 4.0M 0% /dev
tmpfs 378G 0 378G 0% /dev/shm
tmpfs 151G 9.9M 151G 1% /run
/dev/mapper/rootvg-root 150G 2.4G 148G 2% /
/dev/sda2 960M 302M 659M 32% /boot
/dev/sda1 599M 7.0M 592M 2% /boot/efi
/dev/mapper/rootvg-tmp 960M 40M 921M 5% /tmp
/dev/mapper/rootvg-home 960M 40M 921M 5% /home
/dev/mapper/rootvg-var 960M 154M 807M 17% /var
/dev/mapper/rootvg-var_cache 2.5G 73M 2.4G 3% /var/cache
/dev/mapper/rootvg-var_tmp 960M 40M 921M 5% /var/tmp
/dev/mapper/rootvg-var_log 960M 54M 907M 6% /var/log
/dev/mapper/onionvg-onion--nsmlv 1007G 28K 956G 1% /nsm
/dev/mapper/onionvg-onion--dockerlv 98G 24K 93G 1% /var/lib/docker
/dev/mapper/rootvg-var_log_audit 960M 40M 921M 5% /var/log/audit
tmpfs 76G 0 76G 0% /run/user/0
2024-02-20T18:24:20Z | INFO | Executing command: ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 08:94:ef:3c:42:35 brd ff:ff:ff:ff:ff:ff
altname enp22s0f0
inet 10.42.1.200/24 brd 10.42.1.255 scope global noprefixroute eno1
valid_lft forever preferred_lft forever
inet6 fe80::a94:efff:fe3c:4235/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: eno2: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 9000 qdisc mq master bond0 state UP group default qlen 1000
link/ether 08:94:ef:3c:42:37 brd ff:ff:ff:ff:ff:ff permaddr 08:94:ef:3c:42:36
altname enp22s0f1
4: eno3: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 9000 qdisc mq master bond0 state UP group default qlen 1000
link/ether 08:94:ef:3c:42:37 brd ff:ff:ff:ff:ff:ff
altname enp22s0f2
5: eno4: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 08:94:ef:3c:42:38 brd ff:ff:ff:ff:ff:ff
altname enp22s0f3
6: enp0s20u1u5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
link/ether 0a:94:ef:3c:42:3c brd ff:ff:ff:ff:ff:ff
inet 169.254.95.120/24 brd 169.254.95.255 scope link dynamic noprefixroute enp0s20u1u5
valid_lft 502sec preferred_lft 502sec
inet6 fe80::894:efff:fe3c:423c/64 scope link noprefixroute
valid_lft forever preferred_lft forever
7: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 9000 qdisc noqueue state UP group default qlen 1000
link/ether 08:94:ef:3c:42:37 brd ff:ff:ff:ff:ff:ff
2024-02-20T18:24:20Z | INFO | Beginning Security Onion network install
2024-02-20T18:24:20Z | INFO | Setup is running on TTY /dev/pts/0
2024-02-20T18:24:27Z | INFO | Setting up as node type sensor
2024-02-20T18:25:09Z | INFO | Executing command: hostnamectl set-hostname --static remoteonion
2024-02-20T18:25:09Z | INFO | Executing command: hostname -F /etc/hostname
2024-02-20T18:25:09Z | INFO | Gathering the management IP.
2024-02-20T18:25:16Z | INFO | Removing securityonion from /etc/hosts if present.
10.42.1.199 securityonion.infra.openfox.com securityonion.openfox.com
2024-02-20T18:25:17Z | INFO | Adding securityonion to /etc/hosts with IP: 10.42.1.199
2024-02-20T18:25:17Z | INFO | Checking manager connectivity
2024-02-20T18:25:17Z | INFO | Testing if setup is running on a cloud instance...
2024-02-20T18:25:17Z | INFO | This does not appear to be a cloud installation.
2024-02-20T18:25:26Z | INFO | MINION_ID = remoteonion_sensor
2024-02-20T18:25:41Z | INFO | Interface set to bond0
2024-02-20T18:25:41Z | INFO | Setting up sensor interface
2024-02-20T18:25:41Z | INFO | Configuring bond interface settings, since this is a not a cloud installation...
2024-02-20T18:25:42Z | INFO | Reserving ephemeral ports used by Security Onion components to avoid collisions
net.ipv4.ip_local_reserved_ports = 55000,57314
2024-02-20T18:25:42Z | INFO | Clearing the old manager
Importing the security onion GPG key
2024-02-20T18:25:42Z | INFO | Executing command: dnf repolist all
repo id repo name status
appstream Rocky Linux 9 - AppStream enabled
appstream-debuginfo Rocky Linux 9 - AppStream - Debug disabled
appstream-source Rocky Linux 9 - AppStream - Source disabled
baseos Rocky Linux 9 - BaseOS enabled
baseos-debuginfo Rocky Linux 9 - BaseOS - Debug disabled
baseos-source Rocky Linux 9 - BaseOS - Source disabled
crb Rocky Linux 9 - CRB disabled
crb-debuginfo Rocky Linux 9 - CRB - Debug disabled
crb-source Rocky Linux 9 - CRB - Source disabled
devel Rocky Linux 9 - Devel WARNING! FOR BUILDROOT disabled
devel-debuginfo Rocky Linux 9 - Devel Debug WARNING! FOR BUI disabled
devel-source Rocky Linux 9 - Devel Source WARNING! FOR BU disabled
extras Rocky Linux 9 - Extras enabled
extras-debuginfo Rocky Linux 9 - Extras Debug disabled
extras-source Rocky Linux 9 - Extras Source disabled
highavailability Rocky Linux 9 - High Availability disabled
highavailability-debuginfo Rocky Linux 9 - High Availability - Debug disabled
highavailability-source Rocky Linux 9 - High Availability - Source disabled
nfv Rocky Linux 9 - NFV disabled
nfv-debuginfo Rocky Linux 9 - NFV Debug disabled
nfv-source Rocky Linux 9 - NFV Source disabled
plus Rocky Linux 9 - Plus disabled
plus-debuginfo Rocky Linux 9 - Plus - Debug disabled
plus-source Rocky Linux 9 - Plus - Source disabled
resilientstorage Rocky Linux 9 - Resilient Storage disabled
resilientstorage-debuginfo Rocky Linux 9 - Resilient Storage - Debug disabled
resilientstorage-source Rocky Linux 9 - Resilient Storage - Source disabled
rt Rocky Linux 9 - Realtime disabled
rt-debuginfo Rocky Linux 9 - Realtime Debug disabled
rt-source Rocky Linux 9 - Realtime Source disabled
sap Rocky Linux 9 - SAP disabled
sap-debuginfo Rocky Linux 9 - SAP Debug disabled
sap-source Rocky Linux 9 - SAP Source disabled
saphana Rocky Linux 9 - SAPHANA disabled
saphana-debuginfo Rocky Linux 9 - SAPHANA Debug disabled
saphana-source Rocky Linux 9 - SAPHANA Source disabled
2024-02-20T18:25:42Z | INFO | Installing Salt
2024-02-20T18:25:42Z | INFO | Executing command: dnf -y install salt-3006.6 salt-minion-3006.6
Last metadata expiration check: 0:53:24 ago on Tue 20 Feb 2024 05:32:19 PM UTC.
No match for argument: salt-3006.6
No match for argument: salt-minion-3006.6
Error: Unable to find a match: salt-3006.6 salt-minion-3006.6
2024-02-20T18:25:43Z | INFO | Executing command: mkdir -p /etc/salt/minion.d
2024-02-20T18:25:43Z | INFO | Executing command: salt-pip install docker --no-index --only-binary=:all: --find-links files/salt_module_deps/docker/
./so-functions: line 40: salt-pip: command not found
2024-02-20T18:25:43Z | INFO | Executing command: salt-pip install pymysql --no-index --only-binary=:all: --find-links files/salt_module_deps/pymysql/
./so-functions: line 40: salt-pip: command not found
2024-02-20T18:25:43Z | INFO | Configuring minion type as sensor
2024-02-20T18:25:43Z | INFO | Running: salt-call state.apply salt.mine_functions --local --file-root=../salt/ -l info pillar='{host: {mainint: eno1}}'
./so-functions: line 538: salt-call: command not found
2024-02-20T18:25:43Z | INFO | Not an appliance
2024-02-20T18:25:43Z | INFO | Executing command: salt-call state.apply setup.highstate_cron --local --file-root=../salt/
./so-functions: line 40: salt-call: command not found
2024-02-20T18:25:43Z | INFO | Verifying setup
WARNING: Errors detected during setup.
--------- ERRORS ---------
Failed to stop salt-minion.service: Unit salt-minion.service not loaded.
Failed to enable unit: Unit file salt-minion.service does not exist.
Failed to enable unit: Unit file salt-minion.service does not exist.
Failed to restart salt-minion.service: Unit salt-minion.service not found.
Failed to restart salt-minion.service: Unit salt-minion.service not found.
install.txt
sosetup.log

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[rserio]

Forgot to mention I did run the command to add this device as an ip to the firewall.

soc-root@securityonion ~]$ sudo so-firewall-minion --role=SENSOR --ip=10.42.1.200
[sudo] password for soc-root:
[INFO ] Creating module dir '/var/cache/salt/minion/extmods/grains'
[INFO ] Syncing grains for environment 'base'
[INFO ] Loading cache from salt://_grains, for base
[INFO ] Caching directory '_grains/' for environment 'base'
[INFO ] Loading fresh modules for state activity
[INFO ] Running state [iptables-nft] at time 18:11:56.529031
[INFO ] Executing state pkg.installed for [iptables-nft]
[INFO ] Executing command rpm in directory '/root'
[INFO ] All specified packages are already installed
[INFO ] Completed state [iptables-nft] at time 18:11:56.919489 (duration_in_ms=390.459)
[INFO ] Running state [iptables-nft-services] at time 18:11:56.919770
[INFO ] Executing state pkg.installed for [iptables-nft-services]
[INFO ] All specified packages are already installed
[INFO ] Completed state [iptables-nft-services] at time 18:11:56.934953 (duration_in_ms=15.183)
[INFO ] Running state [iptables] at time 18:11:56.936051
[INFO ] Executing state service.running for [iptables]
[INFO ] Executing command /bin/systemctl in directory '/root'
[INFO ] Executing command /bin/systemctl in directory '/root'
[INFO ] Executing command /bin/systemctl in directory '/root'
[INFO ] The service iptables is already running
[INFO ] Completed state [iptables] at time 18:11:56.977775 (duration_in_ms=41.724)
[INFO ] Running state [/etc/sysconfig/iptables] at time 18:11:56.980168
[INFO ] Executing state file.touch for [/etc/sysconfig/iptables]
[INFO ] Executing command git in directory '/root'
[INFO ] Executing command 'ls' in directory '/root'
[INFO ] ['unless condition is true']
[INFO ] Completed state [/etc/sysconfig/iptables] at time 18:11:57.419297 (duration_in_ms=439.129)
[INFO ] Running state [/etc/sysconfig/iptables] at time 18:11:57.419579
[INFO ] Executing state file.managed for [/etc/sysconfig/iptables]
[INFO ] File changed:

+++
@@ -97,6 +97,15 @@
-A DOCKER-USER -s 10.42.1.199 -p tcp -m tcp --dport 8443 -j ACCEPT
-A DOCKER-USER -s 10.42.1.199 -p tcp -m tcp --dport 7788 -j ACCEPT
-A DOCKER-USER -s 10.42.1.199 -p tcp -m tcp --dport 443 -j ACCEPT
+-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 5044 -j ACCEPT
+-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 5644 -j ACCEPT
+-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 8220 -j ACCEPT
+-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 5055 -j ACCEPT
+-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 8443 -j ACCEPT
+-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 443 -j ACCEPT
+-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 5000 -j ACCEPT
+-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 8086 -j ACCEPT
+-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER-USER -s 172.30.139.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER-USER -s 172.30.139.0/24 -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER-USER -s 172.30.136.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
@@ -113,6 +122,8 @@
-A INPUT -s 172.17.1.0/24 -p udp -m udp --dport 0:65535 -j ACCEPT
-A INPUT -s 127.0.0.1 -p tcp -m tcp --dport 0:65535 -j ACCEPT
-A INPUT -s 127.0.0.1 -p udp -m udp --dport 0:65535 -j ACCEPT
+-A INPUT -s 10.42.1.200 -p tcp -m tcp --dport 4505 -j ACCEPT
+-A INPUT -s 10.42.1.200 -p tcp -m tcp --dport 4506 -j ACCEPT
-A INPUT -s 172.30.136.0/24 -p tcp -m tcp --dport 4505 -j ACCEPT
-A INPUT -s 172.30.136.0/24 -p tcp -m tcp --dport 4506 -j ACCEPT
-A INPUT -s 10.42.1.199 -p tcp -m tcp --dport 514 -j ACCEPT

[INFO ] Completed state [/etc/sysconfig/iptables] at time 18:11:57.766640 (duration_in_ms=347.061)
[INFO ] Running state [firewalld] at time 18:11:57.767170
[INFO ] Executing state service.dead for [firewalld]
[INFO ] Executing command /bin/systemctl in directory '/root'
[INFO ] Executing command /bin/systemctl in directory '/root'
[INFO ] Executing command /bin/systemctl in directory '/root'
[INFO ] The service firewalld is already dead
[INFO ] Completed state [firewalld] at time 18:11:57.801152 (duration_in_ms=33.982)
[INFO ] Running state [iptables-restore < /etc/sysconfig/iptables] at time 18:11:57.801422
[INFO ] Executing state cmd.run for [iptables-restore < /etc/sysconfig/iptables]
[INFO ] Executing command 'iptables-restore' in directory '/root'
[INFO ] Executing command 'iptables-restore' in directory '/root'
[INFO ] {'pid': 204886, 'retcode': 0, 'stdout': '', 'stderr': ''}
[INFO ] Completed state [iptables-restore < /etc/sysconfig/iptables] at time 18:11:57.850558 (duration_in_ms=49.135)
local:

      ID: install_iptables
Function: pkg.installed
    Name: iptables-nft
  Result: True
 Comment: All specified packages are already installed
 Started: 18:11:56.529030
Duration: 390.459 ms
 Changes:   

---

      ID: iptables_persist
Function: pkg.installed
    Name: iptables-nft-services
  Result: True
 Comment: All specified packages are already installed
 Started: 18:11:56.919770
Duration: 15.183 ms
 Changes:   

---

      ID: iptables_service
Function: service.running
    Name: iptables
  Result: True
 Comment: The service iptables is already running
 Started: 18:11:56.936051
Duration: 41.724 ms
 Changes:   

---

      ID: create_sysconfig_iptables
Function: file.touch
    Name: /etc/sysconfig/iptables
  Result: True
 Comment: unless condition is true
 Started: 18:11:56.980168
Duration: 439.129 ms
 Changes:   

---

      ID: iptables_config
Function: file.managed
    Name: /etc/sysconfig/iptables
  Result: True
 Comment: File /etc/sysconfig/iptables updated
 Started: 18:11:57.419579
Duration: 347.061 ms
 Changes:   
          ----------
          diff:
              --- 
              +++ 
              @@ -97,6 +97,15 @@
               -A DOCKER-USER -s 10.42.1.199 -p tcp -m tcp --dport 8443 -j ACCEPT
               -A DOCKER-USER -s 10.42.1.199 -p tcp -m tcp --dport 7788 -j ACCEPT
               -A DOCKER-USER -s 10.42.1.199 -p tcp -m tcp --dport 443 -j ACCEPT
              +-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 5044 -j ACCEPT
              +-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 5644 -j ACCEPT
              +-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 8220 -j ACCEPT
              +-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 5055 -j ACCEPT
              +-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 8443 -j ACCEPT
              +-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 443 -j ACCEPT
              +-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 5000 -j ACCEPT
              +-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 8086 -j ACCEPT
              +-A DOCKER-USER -s 10.42.1.200 -p tcp -m tcp --dport 443 -j ACCEPT
               -A DOCKER-USER -s 172.30.139.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
               -A DOCKER-USER -s 172.30.139.0/24 -p tcp -m tcp --dport 443 -j ACCEPT
               -A DOCKER-USER -s 172.30.136.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
              @@ -113,6 +122,8 @@
               -A INPUT -s 172.17.1.0/24 -p udp -m udp --dport 0:65535 -j ACCEPT
               -A INPUT -s 127.0.0.1 -p tcp -m tcp --dport 0:65535 -j ACCEPT
               -A INPUT -s 127.0.0.1 -p udp -m udp --dport 0:65535 -j ACCEPT
              +-A INPUT -s 10.42.1.200 -p tcp -m tcp --dport 4505 -j ACCEPT
              +-A INPUT -s 10.42.1.200 -p tcp -m tcp --dport 4506 -j ACCEPT
               -A INPUT -s 172.30.136.0/24 -p tcp -m tcp --dport 4505 -j ACCEPT
               -A INPUT -s 172.30.136.0/24 -p tcp -m tcp --dport 4506 -j ACCEPT
               -A INPUT -s 10.42.1.199 -p tcp -m tcp --dport 514 -j ACCEPT

---

      ID: disable_firewalld
Function: service.dead
    Name: firewalld
  Result: True
 Comment: The service firewalld is already dead
 Started: 18:11:57.767170
Duration: 33.982 ms
 Changes:   

---

      ID: iptables_restore
Function: cmd.run
    Name: iptables-restore < /etc/sysconfig/iptables
  Result: True
 Comment: Command "iptables-restore < /etc/sysconfig/iptables" run
 Started: 18:11:57.801423
Duration: 49.135 ms
 Changes:   
          ----------
          pid:
              204886
          retcode:
              0
          stderr:
          stdout:

---

      ID: enable_firewalld
Function: service.running
    Name: firewalld
  Result: True
 Comment: State was not run because onfail req did not change
 Started: 18:11:57.851078
Duration: 0.003 ms
 Changes:   

Summary for local

Succeeded: 8 (changed=2)
Failed: 0

Total states run: 8
Total run time: 1.317 s
[soc-root@securityonion ~]$

[reyesj2]

It looks like it just couldn't install the salt packages, so everything that requires salt for setup fails.

Can you run
dnf repolist && cat /etc/yum.repos.d/salt.repo
Want to see if the salt repo is there / what it's pointing to.

Then you can try manually adding the salt repo key + repo.

rpm --import https://repo.saltproject.io/salt/py3/redhat/9/x86_64/SALT-PROJECT-GPG-PUBKEY-2023.pub && curl -fsSL "https://repo.saltproject.io/salt/py3/redhat/9/x86_64/minor/3006.6.repo" | tee /etc/yum.repos.d/salt.repo

After rerun so-setup-network.
Hopefully that resolves the issues you had during install.

[rserio]

It looks like that did it, when I first ran it I had another error:

WARNING: Errors detected during setup.
--------- ERRORS ---------
Failed to stop salt-minion.service: Unit salt-minion.service not loaded.

So I clear out all the logs and tmp and tried once more and it looks successful.

Total run time: 10.285 ms
2024-02-21T14:54:19Z | INFO | Verifying setup
Successfully completed setup!

thanks!