Prompted for soremote SSH password several times during setup

[chuglo]

Hi,

SO v2.3.1

I have a manager node stoop up, trying to install a search node now. I'm being prompted for the soremote password on what appears to be each "beginning step" of the installation. I'm currently at Copying minion pillars to manager and decided to stop there, to ask about this.

Is this intended? If not, how can I tell what went wrong in the setup log?

Thank you!

[TOoSmOotH]

That typically signifies that the password is incorrect.

[chuglo]

Sorry, I should clarify. I know the password is correct because setup is moving onto the next step each time.

I'm trying to install 2.3.2 on that same node now. After entering the SSH password for soremote, for the first time, the setup gets interrupted because of the "Unauthorized Access Banner". TTY1 just shows the standard CentOS setup screen on the step "Configuring Firewall". I wouldn't have known the setup was stuck if I didn't go into another TTY and check the sosetup.log.

Is this intended behavior?

Additionally, I can see in the log where the SSH pub key is copied over to the master but I'm still being prompted for soremote credentials on each step that involves SSH into the master during setup.

[capitangiaco]

I'm trying to install 2.3.2 on that same node now. After entering the SSH password for soremote, for the first time, the setup gets interrupted because of the "Unauthorized Access Banner"

I had to remove the banner from sshd

[chuglo]

Hmm, I could be way off but I'm actually thinking the root issue here is DNS, or lack thereof? There is no DNS server on my lab network where I'm attempting to stand up this distributed install and it looks like DNS is used a lot during setup judging by the setup log? I tried to work around this by adding the Manager's hostname/IP into /etc/hosts and re-running the network setup, however, during setup, that looks to be overwritten by the Manager's hostname but no IP address.

Edit: I found the function where it looks like setup is supposed to add the hostname and IP to /etc/hosts but that doesn't appear to be happening in my case.

add_manager_hostfile() {

	[ -n "$TESTING" ] && return

	echo "Checking if I can resolve manager. If not add to hosts file" >> "$setup_log" 2>&1
	# Pop up an input to get the IP address
	MSRVIP=$(whiptail --title "Security Onion Setup" --inputbox \
	"Enter your Manager Server IP Address:" 10 60 X.X.X.X 3>&1 1>&2 2>&3)

	local exitstatus=$?
	whiptail_check_exitstatus $exitstatus
}

https://github.com/Security-Onion-Solutions/securityonion/blob/master/setup/so-functions

Now that I know what should happen, I'm going to try re-running setup on the node again - to see if I can catch what is not going right for me.

---

** Edit2:**

Attempted setup again with so-setup-network script after manually adding the Manager's hostname/IP into /etc/hosts. Something about the script is overwriting my manual entry with just the hostname of the Manager and no IP address. I can't confirm that this happens on a fresh setup attempt though, just with the so-setup-network script.