New 2.3.61 sensor install repocache.securityonion.net timeout

[stevehoffer71]

I am installing a new sensor node in my existing securityonion 2.3.61 environment and it will not proceed past "Updating packages" in the Security Onion Setup. The sosetup.log file has these entries:

http://repocache.securityonion.net/file/securityonion-repo/base... Timeout on .... Connection timed out after 30001 milliseconds)
Trying other mirror.

I have tried to resolve the repocache.securityonion.net address through our local DNS and through Google DNS. Both DNS services return NXDOMAIN.

[ranguli]

Having the same issue here as well. @stevehoffer71 did you ever get a workaround for this?

[TOoSmOotH]

How ACNG works is that it can't cache SSL content. Since the repo uses SSL you have to use a fake domain so that ACNG can intercept it and save the packages to disk for cache purposes. If you are having issues its most likely ACNG on the manager is having issues or there is a connectivity issue between the sensor and the manager.

https://blog.packagecloud.io/eng/2015/05/05/using-apt-cacher-ng-with-ssl-tls/

[ranguli]

Thanks for the reply. I'm fairly certain the sensor and manager can connect as I resolved any failures in the logs that mentioned failed SSH authentication attempts. How would I go about identifying issues with ACNG on the manager?

[TOoSmOotH]

if you run yum update and tcpdump is it completing the connection?

[ranguli]

I'll give that a shot and let you know. I can see however that there are no ACNG configuration files in the usual directories that they should be in on the manager. I'm doing a fairly standard automated install based off of the examples in the repo. Any ideas why ACNG wouldn't get installed?

I also tried re-installing Security Onion on the sensor with NODEUPDATES=OPEN set in the config file, to bypass the caching altogether, but it still tries (and fails) to reach out to the manager for some reason despite being instructed to reach out to the internet directly.