diff --git a/salt/common/init.sls b/salt/common/init.sls index 93f76c3b3..3ce6286be 100644 --- a/salt/common/init.sls +++ b/salt/common/init.sls @@ -304,6 +304,11 @@ sostatusdir: - user: 0 - group: 0 - makedirs: True + +sostatus_log: + file.managed: + - name: /opt/so/log/sostatus/status.log + - mode: 644 # Install sostatus check cron /usr/sbin/so-status -q && echo $? > /opt/so/log/sostatus/status.log 2>&1: diff --git a/setup/so-functions b/setup/so-functions index b7acf7cb1..604eb56b7 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -162,6 +162,25 @@ check_hive_init() { docker rm so-thehive } +check_manager_state() { + echo "Checking state of manager services. This may take a moment..." + retry 2 15 "__check_so_status" && retry 2 15 "__check_salt_master" && return 0 || return 1 +} + +__check_so_status() { + local so_status_output + so_status_output=$($sshcmd -i /root/.ssh/so.key soremote@"$MSRV" cat /opt/so/log/sostatus/status.log) + [[ -z $so_status_output ]] && so_status_output=1 + return $so_status_output +} + +__check_salt_master() { + local salt_master_status + salt_master_status=$($sshcmd -i /root/.ssh/so.key soremote@"$MSRV" systemctl is-active --quiet salt-master) + [[ -z $salt_master_status ]] && salt_master_status=1 + return $salt_master_status +} + check_network_manager_conf() { local gmdconf="/usr/lib/NetworkManager/conf.d/10-globally-managed-devices.conf" local nmconf="/etc/NetworkManager/NetworkManager.conf" diff --git a/setup/so-setup b/setup/so-setup index 5b1a7417c..79c9b9784 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -574,6 +574,10 @@ if [[ $is_manager || $is_import ]]; then collect_so_allow; fi # This block sets REDIRECTIT which is used by a function outside the below subshell set_redirect >> $setup_log 2>&1 +if [[ $is_minion ]] && ! check_manager_state; then + whiptail_manager_error || exit 1 +fi + whiptail_end_settings # From here on changes will be made. diff --git a/setup/so-whiptail b/setup/so-whiptail index 493ae7a68..2b1199fb5 100755 --- a/setup/so-whiptail +++ b/setup/so-whiptail @@ -79,7 +79,7 @@ whiptail_bond_nics_mtu() { whiptail_cancel() { - whiptail --title "Security Onion Setup" --msgbox "Cancelling Setup. No changes have been made." 8 75 + whiptail --title "Security Onion Setup" --msgbox "Cancelling Setup." 8 75 if [ -d "/root/installtmp" ]; then { echo "/root/installtmp exists"; @@ -88,7 +88,7 @@ whiptail_cancel() { } >> $setup_log 2>&1 fi - title "User cancelled setup, no changes made." + title "User cancelled setup." exit } @@ -1140,6 +1140,19 @@ whiptail_manager_adv_service_zeeklogs() { } +whiptail_manager_error() { + local msg + read -r -d '' <<- EOM + Setup could not determine if the manager $MSRV is in a good state. + + Continuing without verifying all services on the manager are running may result in a failure. + + Would you like to continue anyway? + EOM + + whiptail --title "Security Onion Setup" --yesno "$msg" 13 75 || whiptail_check_exitstatus 1 +} + whiptail_manager_updates() { [ -n "$TESTING" ] && return