Ubuntu release upgrade

[petiepooo]

Has anyone developed a procedure for upgrading a Security Onion install from Ubuntu 18.04 to Ubuntu 20.04 without loss of history and with minimal downtime/reboots? It's a short 8 months before the end of mainline support for Ubuntu 18.04; it would be great to have a bit of time between when an OS upgrade is officially supported by SOS and when 18.04 updates stop.

I'm about to try it in my lab, but wanted to know if anyone has gone through the process yet. If so, please feel free to post your procedure or any tips and tricks here. I'll also post updates here with anything I learn along the way.

I would imagine that do-release-upgrade will disable the non-canonical repositories, including docker and saltstack, so after the release upgrade, those will have to be manually reinstalled. There will also be some updating of release-specific versions and links and other stuff in the saltstack directories. I wouldn't expect any of the core so-* containers to have major issues, as that's one of the main advantages to containerizing things.

[petiepooo]

It looks like the process will be fairly straightforward. As a starting point, here are my notes:

1. disable the saltstack and docker repositories (otherwise do-release-upgrade fails)
2. unhold all packages held via apt-mark (otherwise do-release-upgrade fails)
3. upgrade all OS packages if needed
4. do-release-upgrade (I used maintainers files when asked)
5. reboot into new OS
6. reassert hold on packages unheld in step 2
7. make sure NetworkManager is managing bond0 and monitor interfaces (mine changed names and I had to recreate)
8. remove /opt/so/state/influx*.patched files (so salt will reapply patches in step 15)
9. disable ipv6 again (if you used maintainer's sysctl.conf during upgrade)
10. limit sshd to strong ciphers again (if you used maintainer's sshd_config during upgrade)
11. reenable saltstack and docker repositories, updating from bionic to focal
12. apt-get update
13. install docker-ce{,cli,-rootless-extras} packages (match pinned version on existing focal install)
14. install salt-{comon,minion,master} packages (match pinned version on existing focal install, master only if mgr node)
15. salt-call state.apply salt.python3-influxdb
16. salt-call state.highstate
17. apt-get autoremove
18. reboot to test that all changes are persistent and system comes up stable

[petiepooo]

Thank you, devs. https://docs.securityonion.net/en/latest/appendix-b.html