4 containers are missing! urgent! how to revert the configuration in cli, i'm not able acces the GUI due to missconfiguration

[sandraimmaculate]

hi, all was going good, but i don't what configuration change had made this issues

even i'm not getting the GUI
kindly help

[witekenea]

have you tried checking it again after some time maybe the highstate is not completed yet

[sandraimmaculate]

yes i have tried still those containers are missing

[sandraimmaculate]

i thing that is because of the above reason, i have added the ports in. At the top of the page, click the Options menu and then enable the Show all configurable settings, including advanced settings. option.

On the left side, go to firewall, select portgroups, and those ports in all and customgroup0 in tcp and udp.

to revert that i'm not able to access the GUI it showing 500 internal server error

[Acewiza]

I had some weird elasticsearch failure last week, didn't feel like troubleshooting it - first time ANYTHING really went wrong with the box for like a year. Took 3 runs through the network-setup to get it re-installed, lost 8 month's worth of PCAPs. I wasn't planning on doing anything with that stuff anyway. ;-)

[sandraimmaculate]

oh! Is there any option like: to revert the configuration in cli, if i'm not able to access the GUI

if it is there please suggest!

[Acewiza]

Dunno. I usually don't spend time trying to figure out software problems that can be easily solved with a re-install. YMMV. v/r

…

On Mon, Apr 8, 2024 at 7:07 AM sandraimmaculate ***@***.***> wrote: oh! so there is no option like to revert the configuration in cli, if i'm not able to access the GUI if it is there please suggest! — Reply to this email directly, view it on GitHub <#12758 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASJEPQSJ5TIO4XQGNAINASTY4KJA7AVCNFSM6AAAAABFY66TTSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TANBVHE4DQ> . You are receiving this because you commented.Message ID: <Security-Onion-Solutions/securityonion/repo-discussions/12758/comments/9045988 @github.com>

-- Paul D. Shaffer, MSgt, USAF (ret.)

[sandraimmaculate]

like i have created 2 to 3 dashboards for audit logs and etc, if we re-install it do we get those or it is very fresh machine
by running the command sudo bash so-setup-network

[Acewiza]

Dunno, considering that might be ur only option, you might want to try and find out. Practice makes perfect!

[cm-ops]

What does this return: sudo salt-call pillar.get firewall? Looking at the code for portgroups https://github.com/Security-Onion-Solutions/securityonion/blob/2.3/main/salt/firewall/portgroups.yaml I see you changed the all to those two ports, default looks to be the below:

      all:
        tcp:
          - '0:65535'
        udp:
          - '0:65535'

[sandraimmaculate]

sudo salt-call pillar.get firewall: this command gives the below output
[INFO ] Creating module dir '/var/cache/salt/minion/extmods/grains'
[INFO ] Syncing grains for environment 'base'
[INFO ] Loading cache from salt://_grains, for base
[INFO ] Caching directory '_grains/' for environment 'base'
local:
----------
hostgroups:
----------
analyst:
- ip/32
- ip
- ip
beats_endpoint:
- ip
- ip
elastic_agent_endpoint:
- ip
- ip
- ip
- ip
- ip
idh:
- ip
- ip
import:
- ip
manager:
- ip
managersearch:
- ip
- ip
receiver:
-ip
- ip
searchnode:
- ip
- ip
sensor:
- ip
- ip
standalone:
- ip
portgroups:
----------
all:
----------
tcp:
- 10050
- 10051
udp:
- 10050
- 10051
customportgroup0:
----------
tcp:
- 10050
- 10051
udp:
- 10050

how to change it to default in cli i'm not able to access the web GUI
is re-installation is only way ???

[sandraimmaculate]

can get ans for this!

[cm-ops]

Have you tried removing the entry for all in /opt/so/saltstack/local/pillar/firewall/soc_firewall.sls the applying the firwall state?

all:
----------
tcp:
- 10050
- 10051
udp:
- 10050
- 10051

[sandraimmaculate]

thank you actually its working if we want to change it default configuration in cli.

[Acewiza]

I remember that one time years ago I hit -return- watching the screen scroll thinking "UNDO - UNDO - UNDO!!!!!" suddenly realizing I was logged into the wrong box.

There's no "un"do button. ...or command, I know of. ;-)