so-allow errors

[kiaraho]

Experiencing issues adding Wazuh agent and Wazuh registration service firewall rules with so-allow on a Forward Node. Currently using the same 2.3.2 test environment from #1653. Is this a known issue?

soadmin@so2-forwardnode:~$ sudo so-allow
This program allows you to add a firewall rule to allow connections from a new IP address.

Choose the role for the IP or Range you would like to add

[a] - Analyst - ports 80/tcp and 443/tcp
[b] - Logstash Beat - port 5044/tcp
[e] - Elasticsearch REST API - port 9200/tcp
[f] - Strelka frontend - port 57314/tcp
[o] - Osquery endpoint - port 8090/tcp
[s] - Syslog device - 514/tcp/udp
[w] - Wazuh agent - port 1514/tcp/udp
[p] - Wazuh API - port 55000/tcp
[r] - Wazuh registration service - 1515/tcp

Please enter your selection:
w
Enter a single ip address or range to allow (example: 10.10.10.10 or 10.10.0.0/16):
10.0.2.0/24
Adding 10.0.2.0/24 to the wazuh_agent role. This can take a few seconds
Traceback (most recent call last):
  File "/usr/sbin/so-firewall", line 305, in <module>
    main()
  File "/usr/sbin/so-firewall", line 296, in main
    code = cmd(args[1:])
  File "/usr/sbin/so-firewall", line 246, in includehost
    result = addIp(args[0], args[1], 'insert')
  File "/usr/sbin/so-firewall", line 72, in addIp
    content = loadYaml(hostgroupsFilename)
  File "/usr/sbin/so-firewall", line 52, in loadYaml
    file = open(filename, "r")
FileNotFoundError: [Errno 2] No such file or directory: '/opt/so/saltstack/local/salt/firewall/hostgroups.local.yaml'

[TOoSmOotH]

so-allow is only used on the manager.

https://docs.securityonion.net/en/latest/firewall.html

[kiaraho]

Thanks!