so-repo-sync issues

[Masaya-A]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32GB

Storage for /

293GB

Storage for /nsm

1.3TB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,
I have 3 issues to so-repo-sync from old versions.

1. No log rotation

All logs are in a file, so it's really hard to find results of specific date, etc...

2. Error under proxy

It seems so-repo-sync cannot connect via proxy server.
No one reports this issue, maybe it's a problem with my environment...
But I've added some lines from so-rule-update, it works.

securityonion/salt/idstools/tools/sbin_jinja/so-rule-update

Lines 11 to 19 in dfcf7a4

	{%- set proxy = salt['pillar.get']('manager:proxy') %}
	{%- set noproxy = salt['pillar.get']('manager:no_proxy', '') %}
	# Download the rules from the internet
	{%- if proxy %}
	export http_proxy={{ proxy }}
	export https_proxy={{ proxy }}
	export no_proxy="{{ noproxy }}"
	{%- endif %}

3. Not working with sudo

I'm not sure why permission is denied running with sudo(=root)...

[kinoko@yama reposync]$ sudo so-repo-sync
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
Warning: Failed to create the file /tmp/checkup: Permission denied
[kinoko@yama reposync]$ ls -lZ /tmp/checkup
-rw-r--r--. 1 socore socore unconfined_u:object_r:user_tmp_t:s0 0 Jun 15 03:00 /tmp/checkup
[kinoko@yama reposync]$

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[TOoSmOotH]

I am working on some proxy improvements in the next release.

As far as #3 you have to run the sync as the user socore.