Issue with installation

[luks-m]

Hi,

I am currently trying to install Security Onion on my laptop.
I followed the instructions given on the youtube chanel. But I had an error "the so-preflight script failed checking one or more URLs required by setup." When I checked the /root/sosetup.log", the error was an issue with the URL "mirrorlist.centos.org".
I kept following the installation trhought the end where there was a warning saying that the installation wasn't successfull.
In fact, all the so-status are green, but I can't ping google on the VM so I think that it is not connected with internet and I do not understand why.

Does anyone have an idea ?

Btw, I also tryied to install SO directly on my ubuntu distribution but I had IP management issue so I switched to the VM version.

Thanks
Luks

[xfaith]

How is your NIC setup in the VM Settings? NAT/Bridged/Host? I am not an expert in this area, as I usually just move it to bridge from NAT (or I assign it to my sniffing interface directly in the VM settings (Custom).
--Here is a quick explanation--
Host-only only permits network operations with the Host OS.

NAT mode will mask all network activity as if it came from your Host OS, although the VM can access external resources.

Bridged mode replicates another node on the physical network and your VM will receive it's own IP address if DHCP is enabled in the network.

---

If you are not getting internet, then it would not be able to get out to mirrorlist.centos.org.

I dont know how much of the install requires internet access or if that is only for checking for updates. (That I will also leave up to the Developers to respond)

[luks-m]

As explained in the video tutorial, I configured two NIC, one NAT for the general interface of the VM, and one internal network to work with security onion on the VM.
Maybe I should try the bridged and see if it works even if NAT should work too.

And yes, I think the access to mirrorlist.centos.org is imposible because of this internet issue.

Thanks for the answer

[luks-m]

Update :
After some other tries, always the same problem. The issue is in the repo I think. I tried to install some packages with yum and I had the same error than the log in sosetup.log. It says "Timeout on http://mirror.centos.org/?release=7&arch=x86_64&repo=os&infra=stock". Then I have the message "One of the configured repositories failes (Unkonwn), and yum doesn't have enough cached data to continue." And also "Cannot find a valid baseurl for repo: base/7/x86_64

[luks-m]

I cannot ping my gateway, maybe the network issue is in the network configuration during the installation of Security Onion as a VM. I did not know what to put in gateway and IP so I put adresses from the host network for the IP and the same gateway than the gateway of host. Is that a mistake ?

[isaacgolding]

If you cant ping your gateway then it is likely a config issue between your VM Manager and the VM you are trying to get working. Different VM systems use different configurations. And that is going to be beyond the scope of what most people here can help you with. I would suggest going back to the site of your VM system and start with figuring out how you are supposed to configure VM Clients for that system.

I can also tell you that many people that use VMs in testing environments use what is called bridged mode. For my network I used bridged mode and when I scan my entire network I can see all of the VMs I have setup and turned on as if they were real computers.

Once you get the networking issue cleared up you should be able to return to where you left off with your original problem.

[luks-m]

I uninstalled everything and created a new VM with only Ubuntu to start and see how to configure it. After configuration, I can ping my gateway, I can ping 8.8.8.8, but when I try to ping google.com or other services using DNS, I can't have any response. But I don't have error, it is just bloqued trying to get response.

I already checked /etc/resolv.conf, nslookup and dig, and everything seems ok with the DNS server which is 8.8.8.8.

Do you have any idea ?

[dougburks]

From #1720:

Stay on topic
In order to keep the signal-to-noise ratio as high as possible, this discussion forum should only be used for questions directly relating to Security Onion itself. If you have generic questions about operating systems or networking, you should search the Internet for other forums or relevant information.

[hamads007]

Me too, setting up IP address to access security onion is one of the most difficult things I have experienced, it is not clear at all, is it IP add from VMware LAN or your PC LAN, I have installed it 10 times now, no luck yet to access it.
I will not recommend working with security onion :(

[Maltovic]

Is there a list containing all the URLs that the pre-flight check needs to access? Looking at potentially whitelisting them.

[cm-ops]

Have you looked at https://docs.securityonion.net/en/latest/firewall.html#internet-communication

[VicTee]

I had same issue and got it resolved after changing my adapter setting. I set the first adapter to "Bridged adapter" and the second adapter set to "Host only adapter".

[vanh20]

If you have a firewall or IPS or pfBlocker upstream, then that might be the cause. Check your logs. Try to reach mirrorlist.centos.org using your standard network tools. You most-likely have a network issue and that is not covered here.

[saifamrkhail]

I had the same issue with installing SecurityOnion on Oracle VirtualBox 7.0. I found the solution in this VirtualBox Documentation (https://www.virtualbox.org/manual/ch06.html). SecurityOnion has a great Tutorial on installation (https://www.youtube.com/watch?v=KMH7cII3mpA), unfortunately configuring the network for Oracle VirtualBox does not work the same as shown in the video.

I did the following to get internet access in SecurityOnion with NAT Network.

1. Create a new NAT Network: File -> Tools -> Network Manager (CTRL + H)
2. Now you should see a new NAT Network called NatNetwork. Keep note of the IPv4 address (in my case it is 10.0.2.0/24) and disable DHCP. We want to keep everything static.
3. Klick Apply
4. Klick on the Security Onion VirtualBox and go to Settings.
5. Set the first Adapter to NAT Network (not NAT), now in the Name dropdown your NatNetwork should be available. Pick this one.
6. During the SecurityOnion installation when asked for an IPv4 address you must pick an IPv4 adress in the range of 10.0.2.2-254. I picked 10.0.2.10/24.
7. When asked for a gateway, you must pick one that matches your NatNetwork. In my case the gateway is 10.0.2.1
8. For allowed IP addresses I choose 10.0.2.0/24, since I want to access the SecurityOnion Dashboard from the host machine.

Hopefully now you have internet access in SecurityOnion.

[Acewiza]

This is all that comes to mind after reading that: Virtualization squares the danger AI by six orders of magnitude.