What is the advised way for installing so-analyst-install on an airgapped system?

[cudeso]

Hello,
I installed the latest SecurityOnion on an airgapped system ('standalone' / 'airgapped'). I was assuming that the packages needed for so-analyst-install would have been locally available (based on https://docs.securityonion.net/en/2.3/airgap.html - although they do not specify explicitly the analyst workstation).

Unfortunately running so-analyst-install fails as it attempts to download packages from the Internet. Doing a yum install gdm seems to work to install the Gnome Display Manager without the need for a download for Internet, but that obviously does not include all things necessary for the analyst workstation.

Any help is highly appreciated.

Koen

[cudeso]

Installing the below packages from the (local - airgapped) repository is sufficient to get the X11 server running.

yum install gedit
yum install gnome-terminal control-center
yum install chromium
yum install xorg-x11-utils xorg-x11-drivers
yum install xorg-x11-proto-devel  xorg-x11-fonts-Type1 xorg-x11-font-utils
yum install wireshark-gnome

Then as a last command, run so-analyst-install so that any configuration files are set correctly. You can ignore the errors indicating that files cannot be downloaded.

Reboot, and then start the X server with startx.

[TOoSmOotH]

Boot the ISO and select the "Install Security Onion Analyst Workstation"

[cudeso]

Doesn't this overwrite / erase the existing SO installation? In this case SO is already running and I want to install the analyst workstation on top of the existing installation.

[TOoSmOotH]

I guess I read it wrong. You should be able to run the so-analyst install script to do it on top. Did you install your standalone in airgap mode?

[cudeso]

Yes, the system is installed in airgap mode.

When only running so-analyst-install (so without first adding the packages I listed above) it is missing the X server. Can't easily copy the logs, attached a screenshot. This is with 2.3.200-20230113

[TOoSmOotH]

ok that is a bug. Let me see if I can re-create.