Shrinking Security Onion ISO for Remote Deployment

[SliuzasLukas]

Hi,

I'm currently working with Security Onion and facing a challenge with its ISO file, which is around 12GB. I need to deploy this ISO to several remote locations, but due to slow and unstable network connections, mounting the ISO remotely isn't a viable option. Additionally, these sites are airgapped, making network-based solutions impractical.

I'm looking for a method to shrink the size of the Security Onion ISO to make it more manageable for transfer and deployment. Ideally, I'd like to remove unnecessary packages and files, clean up any temporary data, and optimize the file system. Could you provide a detailed process or any tools that can help me achieve this?

Thank you!

[reyesj2]

The ISO is large due to containing everything needed for a full deployment of Security Onion.

If these are minions intended to join your existing Security Onion grid one option is to just install Oracle 9 using the Oracle ISO and copy the Security Onion github repo to the remote host. You will then run the so-setup-network installer and join your existing grid. Where it can pull everything down from the manager.

Below is an idea of what you may be able to do. It isn't intended as a guide, this is NOT a supported installation method. Your best bet is to have access to a jump box that does have a stable connection to your remote host so you can image the server using the official Security Onion ISO.

• Install Oracle 9 using the Oracle 9 iso (keep in mind partitioning)
  • https://docs.securityonion.net/en/2.4/network-installation.html#partitioning
• Review the default kickstart included on the Security Onion ISO
  • Copy necessary files from the official Security Onion ISO -> remote deployment in their respective locations
• Run Security Onion installer and resolve any dependency issues
  • sudo bash so-setup iso

[SliuzasLukas]

Hello,

Thank you for your answer. That is the idea I was doing it right now.