From bdbc63785234646afb5b7c3113ff4443a6a2a3e6 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Wed, 30 Dec 2020 16:33:46 -0500
Subject: [PATCH] Stop SOC prior to opening the firewall for analysts, this
 ensures no outside requests can be processed prior to the server rebooting

---
 setup/so-setup | 1 +
 1 file changed, 1 insertion(+)

diff --git a/setup/so-setup b/setup/so-setup
index e76510292..d9bc03444 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -843,6 +843,7 @@ else
 		[ -n "$TESTING" ] && logCmd so-test
 
 		export percentage=95 # set to last percentage used in previous subshell
+		so-soc-stop # Stop SOC so it doesn't accept external requests prior to the reboot
 		if [[ -n $ALLOW_ROLE && -n $ALLOW_CIDR ]]; then 
 			set_progress_str 97 "Running so-allow -${ALLOW_ROLE} for ${ALLOW_CIDR}"
 			IP=$ALLOW_CIDR so-allow -$ALLOW_ROLE >> $setup_log 2>&1