Modifying the SID error running salt in manager #2629
Replies: 5 comments 6 replies
-
|
@jlaboy71 If it isn't running, start it with: If it is running, restart it with: Check the status again: Rerun: Thanks, |
Beta Was this translation helpful? Give feedback.
-
|
Josh, Thank you for responding and providing some tips. I am not an expert guru but I followed along and below are the outputs I got back: (Still not working). I did try: salt securityonion_standalone.sls state.apply idstools [netadmin@securityonion minions]$ sudo systemctl status salt-master Jan 14 19:10:07 securityonion salt-master[1648]: During handling of the above exception, another exception occurred: [netadmin@securityonion minions]$ sudo systemctl restart salt-master [netadmin@securityonion minions]$ sudo systemctl status salt-master Jan 14 19:15:06 securityonion salt-master[10684]: During handling of the above exception, another exception occurred: [netadmin@securityonion minions]$ salt securityonion_standalone.sls state.apply idstools [netadmin@securityonion minions]$ salt * test.ping [netadmin@securityonion minions]$ salt * test.ping --async |
Beta Was this translation helpful? Give feedback.
-
|
idstools only run on the manager. What happen when you run sudo salt-call state.apply idstools on the manager? |
Beta Was this translation helpful? Give feedback.
-
|
Hi, thanks for responding. this is the output: [netadmin@securityonion /]$ sudo salt-call state.apply
|
Beta Was this translation helpful? Give feedback.
-
|
There is some formatting issue with your minion file located at
/opt/so/saltstack/local/minions/securityonion_standalone.sls
…On Thu, Jan 14, 2021 at 4:44 PM jlaboy71 ***@***.***> wrote:
Hi, thanks for responding.
this is the output:
***@***.*** /]$ sudo salt-call state.apply
local:
Data failed to compile:
Pillar failed to render with the following messages:
------------------------------
Rendering SLS 'minions.securityonion_standalone' failed. Please see master log for details.
***@***.*** /]$
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#2629 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AECMD4FBUX45XDIBVGYHLQLSZ5QUDANCNFSM4WCZSQNA>
.
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks for all the responses. It seems that something isn't right. I tried to revert my only two lines that I added under the idstools: section under the subfield disabled: I figured that there might have been something about what you said as I had used a tab to type in both SIDs - 2016149 and - 2016150 so I removed those lines and added space bar spaces then saved and attempted the command: salt securityonion_standalone.sls state.apply idstools So I then tried to just removed those two disabled SIDs and reverted back to the original file. I am still getting the same sad results. I do have a question. Say I added those disabled SIDs, saved the file, and then rebooted the entire server, would that work or is there any other way to restart the services that process this file and applies the new changes other than the command recommended? BTW, when I do add the --async it still outputs the error: An un-handled exception was caught by salt's global exception handler: AuthenticationError: Authentication error occurred. Thank you very much for taking the time to read this and for offering your knowledge. I really do appreciate it. Background: The Security Onion install was done so using all the default settings during the installation process menu prompts and is currently running on its own independent physical box. Jose |
Beta Was this translation helpful? Give feedback.
-
|
@jlaboy71 When you run Now, when you run that, if you still receive the error -Josh |
Beta Was this translation helpful? Give feedback.
-
|
Josh, Many thanks for your guidance! I believe that did it. I'll just have to give it a bit to make sure I don't see those specific SIDs being reported. For technical information for the next guy who might run into this, I will include below the output of my attempt. It reported that the PID was in Queue so I had to end that task. Technical Details: [netadmin@securityonion /]$ sudo salt securityonion_standalone state.apply idstools
|
Beta Was this translation helpful? Give feedback.
-
|
@jlaboy71 |
Beta Was this translation helpful? Give feedback.
-
|
@jlaboy71 #!/bin/bash
. /usr/sbin/so-common
# Surround double curly braces in any minion pillar in single quotes so the pillars can be parsed as regular yaml
readarray -t minion_pillars <<< "$(find /opt/so/saltstack/local/pillar/minions -type f -name '*.sls')"
for pillar in "${minion_pillars[@]}"; do
sed -i -r "s/ (\{\{.*}})$/ '\1'/g" "$pillar"
doneThe tool has built in help with |
Beta Was this translation helpful? Give feedback.
-
|
Thanks RWWIV, I am currently following up on this as time has lapsed in business on other things. I tried to click the link provided but it doesn't go anywhere. Jose |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi all,
Following the instructions from the documentation
After modifying the file: /opt/so/saltstack/local/pillar/minions/securityonion_standalone.sls
and adding the following disabled SIDs under the idstools section:
dstools:
config:
ruleset: 'ETOPEN'
oinkcode: ''
urls:
sids:
enabled:
disabled:
- 2016149
- 2016150
modify:
I am told to run this command to apply: salt $SENSORNAME_$ROLE state.apply idstools
When I do this, I get this:
[ERROR ]
Salt request timed out. The master is not responding. You may need to run your command with
--asyncin order to bypass the congested event bus. With--async, the CLI tool will print the job id (jid) and exit immediately without listening for responses. You can then usesalt-run jobs.lookup_jidto look up the results of the job in the job cache later.When I try to use the --async this is what I get:
[netadmin@securityonion minions]$ salt * test.ping
[ERROR ]
Salt request timed out. The master is not responding. You may need to run your command with
--asyncin order to bypass the congested event bus. With--async, the CLI tool will print the job id (jid) and exit immediately without listening for responses. You can then usesalt-run jobs.lookup_jidto look up the results of the job in the job cache later.[netadmin@securityonion minions]$ salt * test.ping --async
[ERROR ] An un-handled exception was caught by salt's global exception handler:
AuthenticationError: Authentication error occurred.
Traceback (most recent call last):
File "/usr/bin/salt", line 11, in
load_entry_point('salt==3002.2', 'console_scripts', 'salt')()
File "/usr/lib/python3.6/site-packages/salt/scripts.py", line 539, in salt_main
client.run()
File "/usr/lib/python3.6/site-packages/salt/cli/salt.py", line 151, in run
jid = self.local_client.cmd_async(**kwargs)
File "/usr/lib/python3.6/site-packages/salt/client/init.py", line 447, in cmd_async
tgt, fun, arg, tgt_type, ret, jid=jid, kwarg=kwarg, listen=False, **kwargs
File "/usr/lib/python3.6/site-packages/salt/client/init.py", line 348, in run_job
**kwargs
File "/usr/lib/python3.6/site-packages/salt/client/init.py", line 1873, in pub
raise AuthenticationError(err_msg)
salt.exceptions.AuthenticationError: Authentication error occurred.
Traceback (most recent call last):
File "/usr/bin/salt", line 11, in
load_entry_point('salt==3002.2', 'console_scripts', 'salt')()
File "/usr/lib/python3.6/site-packages/salt/scripts.py", line 539, in salt_main
client.run()
File "/usr/lib/python3.6/site-packages/salt/cli/salt.py", line 151, in run
jid = self.local_client.cmd_async(**kwargs)
File "/usr/lib/python3.6/site-packages/salt/client/init.py", line 447, in cmd_async
tgt, fun, arg, tgt_type, ret, jid=jid, kwarg=kwarg, listen=False, **kwargs
File "/usr/lib/python3.6/site-packages/salt/client/init.py", line 348, in run_job
**kwargs
File "/usr/lib/python3.6/site-packages/salt/client/init.py", line 1873, in pub
raise AuthenticationError(err_msg)
salt.exceptions.AuthenticationError: Authentication error occurred.
[netadmin@securityonion minions]$
Can I get some advice?
Thanks,
Jose
Beta Was this translation helpful? Give feedback.
All reactions