From b3be999aea09c8ee3fe92d0ad65df36cef3a2ce3 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Tue, 19 Dec 2023 09:00:32 -0500
Subject: [PATCH] dont enable startup_states during setup. use salt to add it

---
 salt/manager/sync_es_users.sls | 2 +-
 salt/salt/minion.sls           | 5 +++++
 setup/so-functions             | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/salt/manager/sync_es_users.sls b/salt/manager/sync_es_users.sls
index 79ab14669..03645c699 100644
--- a/salt/manager/sync_es_users.sls
+++ b/salt/manager/sync_es_users.sls
@@ -29,4 +29,4 @@ so-user_sync:
     - user: root
     - name: 'PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin /usr/sbin/so-user sync &>> /opt/so/log/soc/sync.log'
     - identifier: so-user_sync
-    - onlyif: "grep 'startup_states: highstate' /etc/salt/minion"
+    - onlyif: "grep -x 'startup_states: highstate' /etc/salt/minion"
diff --git a/salt/salt/minion.sls b/salt/salt/minion.sls
index e0c422e7f..83de89164 100644
--- a/salt/salt/minion.sls
+++ b/salt/salt/minion.sls
@@ -67,6 +67,11 @@ set_log_levels:
       - "log_level: info"
       - "log_level_logfile: info"
 
+enable_startup_states:
+  file.uncomment:
+    - name: /etc/salt/minion
+    - regex: '^startup_states: highstate$'
+
 # prior to 2.4.30 this managed file would restart the salt-minion service when updated
 # since this file is currently only adding a sleep timer on service start
 # it is not required to restart the service
diff --git a/setup/so-functions b/setup/so-functions
index e1faa275e..ddc092166 100755
--- a/setup/so-functions
+++ b/setup/so-functions
@@ -545,8 +545,8 @@ configure_minion() {
 checkin_at_boot() {
 	local minion_config=/etc/salt/minion
 
-	info "Enabling checkin at boot" 
-	echo "startup_states: highstate" >> "$minion_config"
+	# we add this commented so that we can use salt later to uncomment it
+	echo "#startup_states: highstate" >> "$minion_config"
 }
 
 check_requirements() {