Unable to update security onion to version 2.4.12

[lucabett]

Version

2.4.111

Installation Method

Security Onion ISO image

Description

upgrading

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

6

RAM

24

Storage for /

105

Storage for /nsm

205

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

[manager@so-manager pillar]$ sudo soup

SOUP - Security Onion UPdater

Please review the following for more information about the update process and recent updates:
https://docs.securityonion.net/en/2.4/soup.html
https://blog.securityonion.net

WARNING: If you run soup via an SSH session and that SSH session terminates, then any processes running in that session would terminate. You should avoid leaving soup unattended especially if the machine you are SSHing from is configured to sleep after a period of time. You might also consider using something like screen or tmux so that if your SSH session terminates, the processes will continue running on the server.

Press Enter to continue or Ctrl-C to cancel.

Preparing soup at Mon Mar 3 08:30:32 AM UTC 2025

Checking if we can access the salt master and that it is ready at: Mar 03 08:30:32

Successfully accessed and salt master ready at: Mar 03 08:30:55
Checking to see if this is a manager.

This is a manager, so we can proceed.
Enabling highstate.
local:
----------
msg:
Info: highstate state already enabled.
res:
True

Salt Master does not need unlocked.

The manager's pillars can be rendered. We can proceed with SOUP.

Checking to see if this is an airgap install.

Found that Security Onion 2.4.111 is currently installed.

Cloning Security Onion github repo into /tmp/sogh/securityonion.
Removing previous upgrade sources.
Cloning the Security Onion Repo.
Cloning into 'securityonion'...
remote: Enumerating objects: 97208, done.
remote: Counting objects: 100% (496/496), done.
remote: Compressing objects: 100% (171/171), done.
remote: Total 97208 (delta 419), reused 348 (delta 312), pack-reused 96712 (from 2)
Receiving objects: 100% (97208/97208), 53.05 MiB | 4.73 MiB/s, done.
Resolving deltas: 100% (65295/65295), done.
Verifying we have the latest soup script.
This version of the soup script is up to date. Proceeding.
Let's see if we need to update Security Onion.
You have enough space for upgrade. Proceeding with soup.
Checking for Salt Master and Minion updates.
You are already running the correct version of Salt for Security Onion.
Sync the local repo.
ls: cannot access '/opt/so/saltstack/local/pillar/minions/*.sls': Permission denied
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
Config error: Config file "/opt/so/conf/reposync/repodownload.conf" does not exist
ERROR: Unable to complete so-repo-sync.
Exiting.
Enabling highstate.
local:
----------
msg:
Info: highstate state already enabled.
res:
True

Salt Master does not need unlocked.
Soup failed with error 1: Unhandled error
Unhandled error occured, please check /root/soup.log for details.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

ls: cannot access '/opt/so/saltstack/local/pillar/minions/*.sls': Permission denied

What is the output of the following?

sudo ls -alh /opt/so/saltstack/local/pillar/minions/

Config error: Config file "/opt/so/conf/reposync/repodownload.conf" does not exist

What is the output of the following?

sudo ls -alh /opt/so/conf/reposync/

[lucabett]

[root@so-manager ~]# sudo ls -alh /opt/so/saltstack/local/pillar/minions/
total 20K
drwxr-xr-x. 2 socore socore 4.0K Mar 3 08:28 .
drwxr-xr-x. 35 socore socore 4.0K Feb 5 07:37 ..
-rwxr-xr-x. 1 socore socore 0 Feb 5 10:20 adv_so-forward_sensor.sls
-rwxr-xr-x. 1 socore socore 0 Feb 5 07:37 adv_so-manager_manager.sls
-rwxr-xr-x. 1 socore socore 0 Feb 5 10:31 adv_so-search_searchnode.sls
-rwxr-xr-x. 1 socore socore 663 Feb 19 10:44 so-forward_sensor.sls
-rwxr-xr-x. 1 socore socore 1.1K Feb 5 08:45 so-manager_manager.sls
-rwxr-xr-x. 1 socore socore 292 Feb 5 10:31 so-search_searchnode.sls

[root@so-manager ~]# sudo ls -alh /opt/so/conf/reposync/
total 12K
drwxr-xr-x. 3 socore socore 62 Mar 3 08:08 .
drwxrwx---. 26 socore socore 4.0K Feb 5 08:17 ..
drwxrwxrwx. 3 socore socore 145 Feb 7 03:00 cache
-rwxrwxrwx. 1 socore socore 114 Feb 5 07:57 mirror.txt
-rwxrwxrwx. 1 socore socore 278 Feb 5 07:57 repodownload.conf

[dougburks]

Those permissions do not look correct. Have you modified permissions or made any other changes to your system?

[lucabett]

After 2 failed update attempts, i tried setting the involved files with 777 permissions

[dougburks]

You could try installing Security Onion in a VM and then comparing it side-by-side with your broken system to fix permissions or other issues. Ultimately, it may be quicker and easier just to reinstall.