login to SOC fails

[jpl33]

Hi all, I've installed ver. 2.3.10 as a virtualbox guest so I could get to know it. I used Vbox's port forwarding feature to access my management interface on port 443, and I AM able to reach the SOC login page. However, when I try to login, SOC hangs, to the extent that I have to reset the VM. Bummer...
I've created both users with so-user.
Has anyone seen this happen?
does SOC/nginx open more ports with the browser. other than 443?
thanks,
johnatan

[rwwiv]

SOC depends on you accessing it at whatever url_base is set to in the global pillar ( /opt/so/saltstack/local/pillar/global.sls ). It sounds like this might not be the case if you're accessing it through a forwarded port. Typically when running Security Onion inside a vm you'd want to used bridged networking for the management interface.

[jpl33]

it works now. didn't change my setup. just re-ran setup scripts untill it was 100% successfull.

[jpl33]

to successfully access SOC:

1. successfully complete SETUP. run it as many times as you need. don't worry about jinja errors, they sort themselves out when you re-run SETUP.
2. SETUP asks how you want to access SOC: IP, url, or FQDN. The answer determines how SETUP prepares the SOC certificate for https. so you can't choose one option, and then change your mind. The certificate won't match. best practice: url
3. use static IP for the manager
4. allow yourself https 443 access with so-allow
5. when running on VirtualBox:
   1. setup your management interface as NAT
   2. in your HOSTS file, define the SOC base_url as 127.0.0.1
   3. use Vbox 'Port Forwarding' feature on management interface to redirect 127.0.0.1 port 443 to management interface IP port 443.
   4. Vbox will redirect your IP address as an IP address on the management IP subnet's , so you need to so-allow your entire management interface subnet as 'analyst' .
      1. i.e.: if your management interface address is 10.0.2.3, Vbox will redirect your requests as coming from an IP on that subnet 10.0.2.0/24. you need to so-allow the entire subnet, as you can't know what address Vbox will choose.

[JDMcCADD]

Your instructions here helped me.
I am attempting to setup SO in eval mode on a MacBook Pro using Virtualbox and struggling a bit. I've managed to install so-eval and it appears to be functioning as so-status returns all O.K. I accepted the defaults when creating the VM for so-eval, so have NAT for my mgmt interface. I determined the subnet for the so-eval mgmt if to be 10.0.2.0/24, so following your instructions here got me one step further. However, I still get no response when attempting to contact so-eval on 443, so I tried changing the port forwarding to 127.0.0.1:8443 -> 127.0.0.1:443. If I open Firefox on my Mac and use a url of https:so-eval:8443 I at least get the so-eval certificate (self-signed) error, allow the exception, but then nothing. A packet capture on my Mac loopback if shows two conversations 127.0.0.1:5xxxx -> 127.0.0.1:8443 with the initial client hello/server hello, but that's immediately followed by 127.0.0.1:5xxxx -> 127.0.0.1:443 with an immediate RST response.

Is there any way to configure port forwarding in Virtuallbox leavng the source port empty? Virtualbox throws an error every time I've tried indicating no fields can be empty or 0.

[JDMcCADD]

Progress. I found if I repeatedly change the destination port of the url in Firefox to 8443 I can successfully login to SOC and access all the tools. However a message at the top indicates it's unable to communicate with manager. After appending ':8443' to the 'https://so-eval' url in firefox several times I find it finally takes and continues to access at :8443.