permissions on folder /opt/so/saltstack

[jamestest11]

Hello,

New to security onion here. I installed security onion latest build on a newly built Ubuntu server running 20.04 LTS. I'm trying to edit the file /opt/so/saltstack/local/pillar/global.sls to modify a rule to exclude alerts from a certain ip address. However, the user I am running under with root privileges does not have permissions to the folder /opt/so/saltstack. Permissions are as below to this folder.

drwxrwx--- 4 socore socore 4096 Aug 19 23:29 saltstack

Of course I can modify permissions to gain access to the folder. However, when I reboot the server, the permissions are rewritten to defaults again to where I no longer have access. Not sure if this is by design, if this is a bug, or if I am doing something wrong, etc. I am not sure the credentials to the account "socore" either. Any help appreciated.

[dougburks]

You shouldn't need to modify any permissions on the system and doing so may cause more problems than it solves.

From https://docs.securityonion.net/en/2.3/passwords.html#os-root-account:

Your default user account should have sudo permissions. Command-line utilities that require administrative access can be prefixed with sudo. For example, the so-status command requires administrative access so you can run it with sudo as follows:

sudo so-status

So, for your example, if you want to edit /opt/so/saltstack/local/pillar/global.sls using the nano text editor, you should be able to run:

sudo nano /opt/so/saltstack/local/pillar/global.sls