From aed27fa111a51317e225c8402363767f4de2d60d Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Wed, 3 Dec 2025 11:19:46 -0500
Subject: [PATCH 1/3] reserve group ids

---
 setup/so-functions | 8 ++++++--
 setup/so-setup     | 5 +++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/setup/so-functions b/setup/so-functions
index a8414d0e8..689cc78aa 100755
--- a/setup/so-functions
+++ b/setup/so-functions
@@ -1604,16 +1604,20 @@ proxy_validate() {
 
 reserve_group_ids() {
 	# This is a hack to fix OS from taking group IDs that we need
+	logCmd "groupadd -g 920 docker"
 	logCmd "groupadd -g 928 kratos"
 	logCmd "groupadd -g 930 elasticsearch"
 	logCmd "groupadd -g 931 logstash"
 	logCmd "groupadd -g 932 kibana"
 	logCmd "groupadd -g 933 elastalert"
 	logCmd "groupadd -g 937 zeek"
+	logCmd "groupadd -g 939 socore"
 	logCmd "groupadd -g 940 suricata"
+	logCmd "groupadd -g 948 elastic-agent-pr"
+	logCmd "groupadd -g 949 elastic-agent"
 	logCmd "groupadd -g 941 stenographer"
-	logCmd "groupadd -g 945 ossec"
-	logCmd "groupadd -g 946 cyberchef"
+	logCmd "groupadd -g 947 elastic-fleet"
+	logCmd "groupadd -g 960 kafka"
 }
 
 reserve_ports() {
diff --git a/setup/so-setup b/setup/so-setup
index 91f1fa9aa..d09e8fc35 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -682,6 +682,8 @@ if ! [[ -f $install_opt_file ]]; then
 		fi
 		info "Reserving ports"
 		reserve_ports
+		info "Reserving group ids"
+		reserve_group_ids
 		info "Setting Paths"
 		# Set the paths
 		set_path
@@ -840,7 +842,10 @@ if ! [[ -f $install_opt_file ]]; then
 		if [[ $monints ]]; then
 			configure_network_sensor
 		fi
+		info "Reserving ports"
 		reserve_ports
+		info "Reserving group ids"
+		reserve_group_ids
 		# Set the version
 		mark_version
 		# Disable the setup from prompting at login

From 30487a54c137ecf0aacc86e780ca1792208d905a Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Wed, 3 Dec 2025 11:52:10 -0500
Subject: [PATCH 2/3] skip continue prompt if user cannot actually contine

---
 setup/so-functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/so-functions b/setup/so-functions
index a8414d0e8..8d1aafa0c 100755
--- a/setup/so-functions
+++ b/setup/so-functions
@@ -656,11 +656,11 @@ check_requirements() {
 	fi
 	
 	if [[ $total_mem_hr -lt $req_mem ]]; then
-		whiptail_requirements_error "memory" "${total_mem_hr} GB" "${req_mem} GB"
 		if [[ $is_standalone || $is_heavynode ]]; then
 			echo "This install type will fail with less than $req_mem GB of memory. Exiting setup."
 			exit 0
 		fi
+		whiptail_requirements_error "memory" "${total_mem_hr} GB" "${req_mem} GB"
 	fi
 	if [[ $is_standalone || $is_heavynode ]]; then
 		if [[ $total_mem_hr -gt 15 && $total_mem_hr -lt 24 ]]; then

From 8620d3987ee0c7805e075194994c23fca700d0a9 Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Wed, 3 Dec 2025 15:04:28 -0500
Subject: [PATCH 3/3] add saltgid

---
 setup/so-functions | 1 +
 1 file changed, 1 insertion(+)

diff --git a/setup/so-functions b/setup/so-functions
index 689cc78aa..3ac27f26b 100755
--- a/setup/so-functions
+++ b/setup/so-functions
@@ -1611,6 +1611,7 @@ reserve_group_ids() {
 	logCmd "groupadd -g 932 kibana"
 	logCmd "groupadd -g 933 elastalert"
 	logCmd "groupadd -g 937 zeek"
+	logCmd "groupadd -g 938 salt"
 	logCmd "groupadd -g 939 socore"
 	logCmd "groupadd -g 940 suricata"
 	logCmd "groupadd -g 948 elastic-agent-pr"