Two installs, two configuration failure messages

[oSquat]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16GB

Storage for /

293GB

Storage for /nsm

5.2TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

I'm exploring Security Onion and installed a single-node, standalone instance version 2.4.60 from ISO twice and received two different sets of errors during config. I found some advice here suggesting reinstallation fixed a similar issue to what I encountered the first time so I ran through install a second time. On the second install I only changed how SO would be accessed: via FQDN rather than hostname. I received a totally different error the second time.

Both times the grid and so-status report everything looks OK, but I don't want evaluate an incomplete instance.

Below are my /root/errors.log from the first installation followed by the files I feel are pertinent to errors in my second installation. Is there a way to run a full check on config, pick up where it left off and fix things or are there any manual actions I can take?

First instance /root/error.log

      Result: False
     Comment: One or more requisite failed: ssl.influxdb_crt
      Result: False
      Result: False
     Comment: One or more requisite failed: ssl.influxdb_crt
      Result: False
      Result: False
     Comment: One or more requisite failed: ssl.redis_crt
      Result: False
      Result: False
     Comment: One or more requisite failed: ssl.etc_elasticfleet_crt
      Result: False
      Result: False
     Comment: One or more requisite failed: ssl.etc_elasticfleet_logstash_crt
      Result: False
      Result: False
     Comment: One or more requisite failed: ssl.etc_elasticfleet_logstash_key
      Result: False
     Comment: One or more requisite failed: ssl.etc_elasticfleetlumberjack_crt
      Result: False
      Result: False
     Comment: One or more requisite failed: ssl.etc_elasticfleetlumberjack_key

Current instance log files

/root/errors.log:

Error: Failed to download metadata for repo 'securityonionsync': Yum repo downloading error: Downloading error(s): repodata/1ec17eeaee571e373080289246d538159893c3314d724b09610eabdab180d5d8-primary.xml.gz - Cannot download, all mirrors were already tried without success; repodata/af41a5154ae1b3c958a70e51e130e9157b657d5660c8e0592cc7b97fc7964c4e-filelists.xml.gz - Cannot download, all mirrors were already tried without success
      Result: False
     Comment: One or more requisite failed: ssl.influxdb_crt
      Result: False

/opt/so/log/influxdb/setup.log

Mon Apr 15 20:15:27 UTC 2024 | so-influxdb-manage | Server does not appear to be running or fully initialized - will try again in 10 seconds (1 / 30)
Mon Apr 15 20:15:37 UTC 2024 | so-influxdb-manage | Ensuring organization is setup correctly
Mon Apr 15 20:15:37 UTC 2024 | so-influxdb-manage | Updating templates
Mon Apr 15 20:15:41 UTC 2024 | so-influxdb-manage | Updating buckets and retention periods
Mon Apr 15 20:15:41 UTC 2024 | so-influxdb-manage | Ensuring bucket is created and configured; bucket=telegraf/so_short_term
Mon Apr 15 20:15:41 UTC 2024 | so-influxdb-manage | Ensuring bucket is created and configured; bucket=telegraf/so_long_term
Mon Apr 15 20:16:44 UTC 2024 | so-influxdb-manage | Ensuring organization is setup correctly
Mon Apr 15 20:16:44 UTC 2024 | so-influxdb-manage | Templates have not been modified since last setup
Mon Apr 15 20:16:44 UTC 2024 | so-influxdb-manage | Buckets have not been modified since last setup
Tue Apr 16 12:42:33 UTC 2024 | so-influxdb-manage | Server does not appear to be running or fully initialized - will try again in 10 seconds (1 / 30)
Tue Apr 16 12:42:43 UTC 2024 | so-influxdb-manage | Ensuring organization is setup correctly
Tue Apr 16 12:42:43 UTC 2024 | so-influxdb-manage | Templates have not been modified since last setup
Tue Apr 16 12:42:43 UTC 2024 | so-influxdb-manage | Buckets have not been modified since last setup
Tue Apr 16 12:57:55 UTC 2024 | so-influxdb-manage | Ensuring organization is setup correctly
Tue Apr 16 12:57:55 UTC 2024 | so-influxdb-manage | Templates have not been modified since last setup
Tue Apr 16 12:57:55 UTC 2024 | so-influxdb-manage | Buckets have not been modified since last setup
Tue Apr 16 13:01:11 UTC 2024 | so-influxdb-manage | Ensuring organization is setup correctly
Tue Apr 16 13:01:11 UTC 2024 | so-influxdb-manage | Templates have not been modified since last setup
Tue Apr 16 13:01:11 UTC 2024 | so-influxdb-manage | Buckets have not been modified since last setup

The last 15 lines of /opt/so/log/influxdb/influxdb.log

ts=2024-04-16T12:54:02.817564Z lvl=info msg="saving field index changes (end)" log_id=0oajjKbl000 service=storage-engine engine=tsm1 op_name=MeasurementFieldSet op_event=end op_elapsed=199.771ms
ts=2024-04-16T12:54:32.619810Z lvl=info msg="saving field index changes (start)" log_id=0oajjKbl000 service=storage-engine engine=tsm1 op_name=MeasurementFieldSet op_event=start
ts=2024-04-16T12:54:32.679609Z lvl=info msg="saving field index changes (end)" log_id=0oajjKbl000 service=storage-engine engine=tsm1 op_name=MeasurementFieldSet op_event=end op_elapsed=59.822ms
ts=2024-04-16T12:54:36.887876Z lvl=info msg="http: TLS handshake error from 127.0.0.1:34328: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T12:55:02.620671Z lvl=info msg="saving field index changes (start)" log_id=0oajjKbl000 service=storage-engine engine=tsm1 op_name=MeasurementFieldSet op_event=start
ts=2024-04-16T12:55:02.968165Z lvl=info msg="saving field index changes (end)" log_id=0oajjKbl000 service=storage-engine engine=tsm1 op_name=MeasurementFieldSet op_event=end op_elapsed=347.510ms
ts=2024-04-16T12:55:37.080222Z lvl=info msg="http: TLS handshake error from 127.0.0.1:38360: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T12:56:37.440672Z lvl=info msg="http: TLS handshake error from 127.0.0.1:39326: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T12:57:37.766453Z lvl=info msg="http: TLS handshake error from 127.0.0.1:47484: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T12:58:37.963361Z lvl=info msg="http: TLS handshake error from 127.0.0.1:59488: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T12:59:38.238208Z lvl=info msg="http: TLS handshake error from 127.0.0.1:52572: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T13:00:38.503779Z lvl=info msg="http: TLS handshake error from 127.0.0.1:59270: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T13:01:38.905237Z lvl=info msg="http: TLS handshake error from 127.0.0.1:52764: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T13:02:39.087439Z lvl=info msg="http: TLS handshake error from 127.0.0.1:44280: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T13:03:39.222093Z lvl=info msg="http: TLS handshake error from 127.0.0.1:50580: EOF" log_id=0oajjKbl000 service=http
ts=2024-04-16T13:04:39.316099Z lvl=info msg="http: TLS handshake error from 127.0.0.1:50698: EOF" log_id=0oajjKbl000 service=http

Extra relevant bits from /root/sostatus.log:

[...snip...]
[INFO    ] Running state [/etc/pki/influxdb.crt] at time 21:35:43.471928
[INFO    ] Loading fresh modules for state activity
[INFO    ] Running state [/etc/pki/influxdb.crt] at time 21:35:43.519562
[INFO    ] Executing state file.managed for [/etc/pki/influxdb.crt]
[INFO    ] File /etc/pki/influxdb.crt not updated
[INFO    ] Completed state [/etc/pki/influxdb.crt] at time 21:35:43.522830 (duration_in_ms=3.269)
[INFO    ] Publishing 'x509.sign_remote_certificate' to tcp://127.0.0.1:4506
[INFO    ] Running state [/etc/pki/influxdb.key] at time 21:35:50.030304
[INFO    ] Executing state file.managed for [/etc/pki/influxdb.key]
[INFO    ] File /etc/pki/influxdb.key exists with proper permissions. No changes made.
[INFO    ] Completed state [/etc/pki/influxdb.key] at time 21:35:50.032152 (duration_in_ms=1.848)
[...snip...]
----------
          ID: influxdb_key
    Function: x509.private_key_managed
        Name: /etc/pki/influxdb.key
      Result: False
     Comment: One or more requisite failed: ssl.influxdb_crt
     Started: 21:35:50.029932
    Duration: 0.004 ms
     Changes:   
----------
          ID: influxdb_crt
    Function: x509.certificate_managed
        Name: /etc/pki/influxdb.crt
      Result: False
     Comment: ca_server did not respond. Salt master must permit peers to call the sign_remote_certificate function.
     Changes:   
----------
[...snip...]
2024-04-15T21:36:14Z | INFO | Verifying setup
WARNING: Errors detected during setup.
--------- ERRORS ---------
Error: Failed to download metadata for repo 'securityonionsync': Yum repo downloading error: Downloading error(s): repodata/1ec17eeaee571e373080289246d538159893c3314d724b09610eabdab180d5d8-primary.xml.gz - Cannot download, all mirrors were already tried without success; repodata/af41a5154ae1b3c958a70e51e130e9157b657d5660c8e0592cc7b97fc7964c4e-filelists.xml.gz - Cannot download, all mirrors were already tried without success
      Result: False
     Comment: One or more requisite failed: ssl.influxdb_crt
      Result: False
--------------------------

### Guidelines

- [X] I have read the discussion guidelines at https://github.com/Security-Onion-Solutions/securityonion/discussions/1720 and assert that I have followed the guidelines.

[cm-ops]

If you run sudo so-checkin, do you see any errors?

[oSquat]

Thank you for the response. Yes, I get the following output indicating failure:

[INFO] Creating module dir '/var/cache/salt/minion/extmods/grains'
[INFO] Syncing grains for environment 'base'
[INFO] Loading cache frmo salt://_grains, for base
[INFO] Caching director '_grains/' for environment 'base'
local:
    Data failed to compile:
----------
    The function "state.highstate" is running as PID 1165548 and was started at 2024, Apr 17 14:10:56.640876 with jid 20240417141056640876

[oSquat]

Ok, so I checked back in here to see if there were any more replies, and seeing none I got curious what so-checkin was so I ran "so-checkin --help" and it didn't print any help output but it ran past the immediate failure point I reached twice earlier. This time it completed and I don't see any indication of failure. Then I ran "so-checkin" again but without --help with similar, positive results.

Meanwhile, I've installed some elastic agents and have been exploring the very cool results.

But, what do you suppose that means; am I good; what next?

[cm-ops]

The function "state.highstate" is running as PID 1165548 that just means a highstate was running when you issued the so-checkin command. If the command completed without error, you should be good.

[oSquat]

Thanks again for your assistance!