mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-27 15:07:51 +02:00
Merge branch 'dev' into hotfix/soup_salt
This commit is contained in:
Josh Patterson
GitHub
@@ -17,4 +17,4 @@
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
salt-call state.highstate
|
||||
salt-call state.highstate -linfo
|
||||
|
||||
@@ -153,16 +153,16 @@ Do you agree to the terms of the Elastic License?
|
||||
If so, type AGREE to accept the Elastic License and continue. Otherwise, press Enter to exit this program without making any changes.
|
||||
EOM
|
||||
|
||||
AGREED=$(whiptail --title "Security Onion Setup" --inputbox \
|
||||
"$message" 20 75 3>&1 1>&2 2>&3)
|
||||
AGREED=$(whiptail --title "$whiptail_title" --inputbox \
|
||||
"$message" 20 75 3>&1 1>&2 2>&3)
|
||||
|
||||
if [ "${AGREED^^}" = 'AGREE' ]; then
|
||||
mkdir -p /opt/so/state
|
||||
touch /opt/so/state/yeselastic.txt
|
||||
else
|
||||
echo "Starting in 2.3.40 you must accept the Elastic license if you want to run Security Onion."
|
||||
exit 1
|
||||
fi
|
||||
if [ "${AGREED^^}" = 'AGREE' ]; then
|
||||
mkdir -p /opt/so/state
|
||||
touch /opt/so/state/yeselastic.txt
|
||||
else
|
||||
echo "Starting in 2.3.40 you must accept the Elastic license if you want to run Security Onion."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
@@ -302,6 +302,7 @@ retry() {
|
||||
cmd=$3
|
||||
expectedOutput=$4
|
||||
attempt=0
|
||||
local exitcode=0
|
||||
while [[ $attempt -lt $maxAttempts ]]; do
|
||||
attempt=$((attempt+1))
|
||||
echo "Executing command with retry support: $cmd"
|
||||
@@ -321,7 +322,29 @@ retry() {
|
||||
sleep $sleepDelay
|
||||
done
|
||||
echo "Command continues to fail; giving up."
|
||||
return 1
|
||||
return $exitcode
|
||||
}
|
||||
|
||||
run_check_net_err() {
|
||||
local cmd=$1
|
||||
local err_msg=${2:-"Unknown error occured, please check /root/$WHATWOULDYOUSAYYAHDOHERE.log for details."} # Really need to rename that variable
|
||||
local no_retry=$3
|
||||
|
||||
local exit_code
|
||||
if [[ -z $no_retry ]]; then
|
||||
retry 5 60 "$cmd"
|
||||
exit_code=$?
|
||||
else
|
||||
eval "$cmd"
|
||||
exit_code=$?
|
||||
fi
|
||||
|
||||
if [[ $exit_code -ne 0 ]]; then
|
||||
ERR_HANDLED=true
|
||||
[[ -z $no_retry ]] || echo "Command failed with error $exit_code"
|
||||
echo "$err_msg"
|
||||
exit $exit_code
|
||||
fi
|
||||
}
|
||||
|
||||
set_os() {
|
||||
|
||||
@@ -35,6 +35,7 @@ if [ ! -f $BACKUPFILE ]; then
|
||||
{%- endfor %}
|
||||
tar -rf $BACKUPFILE /etc/pki
|
||||
tar -rf $BACKUPFILE /etc/salt
|
||||
tar -rf $BACKUPFILE /opt/so/conf/kratos
|
||||
|
||||
fi
|
||||
|
||||
|
||||
@@ -32,13 +32,15 @@ def get_image_version(string) -> str:
|
||||
ver = string.split(':')[-1]
|
||||
if ver == 'latest':
|
||||
# Version doesn't like "latest", so use a high semver
|
||||
return '999999.9.9'
|
||||
return '99999.9.9'
|
||||
else:
|
||||
try:
|
||||
Version(ver)
|
||||
except InvalidVersion:
|
||||
# Strip the last substring following a hyphen for automated branches
|
||||
ver = '-'.join(ver.split('-')[:-1])
|
||||
# Also return a very high semver for any version
|
||||
# with a dash in it since it will likely be a dev version of some kind
|
||||
if '-' in ver:
|
||||
return '999999.9.9'
|
||||
return ver
|
||||
|
||||
|
||||
@@ -73,8 +75,12 @@ def main(quiet):
|
||||
for tag in group:
|
||||
if not quiet: print(f'Removing image {tag}')
|
||||
client.images.remove(tag)
|
||||
except InvalidVersion as e:
|
||||
print(f'so-{get_so_image_basename(t_list[0])}: {e.args[0]}', file=sys.stderr)
|
||||
except (docker.errors.APIError, InvalidVersion) as e:
|
||||
print(f'so-{get_so_image_basename(t_list[0])}: {e}', file=sys.stderr)
|
||||
exit(1)
|
||||
except Exception as e:
|
||||
print('Unhandled exception occurred:')
|
||||
print(f'so-{get_so_image_basename(t_list[0])}: {e}', file=sys.stderr)
|
||||
exit(1)
|
||||
|
||||
if no_prunable and not quiet:
|
||||
@@ -86,4 +92,4 @@ if __name__ == "__main__":
|
||||
main_parser.add_argument('-q', '--quiet', action='store_const', const=True, required=False)
|
||||
args = main_parser.parse_args(sys.argv[1:])
|
||||
|
||||
main(args.quiet)
|
||||
main(args.quiet)
|
||||
|
||||
+67
@@ -0,0 +1,67 @@
|
||||
{%- set mainint = salt['pillar.get']('host:mainint') %}
|
||||
{%- set MYIP = salt['grains.get']('ip_interfaces:' ~ mainint)[0] %}
|
||||
|
||||
#!/bin/bash
|
||||
# Copyright 2014,2015,2016,2017,2018,2019 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
default_conf_dir=/opt/so/conf
|
||||
ELASTICSEARCH_HOST="{{ MYIP }}"
|
||||
ELASTICSEARCH_PORT=9200
|
||||
#ELASTICSEARCH_AUTH=""
|
||||
|
||||
# Define a default directory to load pipelines from
|
||||
FB_MODULE_YML="/usr/share/filebeat/module-setup.yml"
|
||||
|
||||
|
||||
# Wait for ElasticSearch to initialize
|
||||
echo -n "Waiting for ElasticSearch..."
|
||||
COUNT=0
|
||||
ELASTICSEARCH_CONNECTED="no"
|
||||
while [[ "$COUNT" -le 240 ]]; do
|
||||
curl -k --output /dev/null --silent --head --fail -L https://"$ELASTICSEARCH_HOST":"$ELASTICSEARCH_PORT"
|
||||
if [ $? -eq 0 ]; then
|
||||
ELASTICSEARCH_CONNECTED="yes"
|
||||
echo "connected!"
|
||||
break
|
||||
else
|
||||
((COUNT+=1))
|
||||
sleep 1
|
||||
echo -n "."
|
||||
fi
|
||||
done
|
||||
if [ "$ELASTICSEARCH_CONNECTED" == "no" ]; then
|
||||
echo
|
||||
echo -e "Connection attempt timed out. Unable to connect to ElasticSearch. \nPlease try: \n -checking log(s) in /var/log/elasticsearch/\n -running 'sudo docker ps' \n -running 'sudo so-elastic-restart'"
|
||||
echo
|
||||
fi
|
||||
echo "Testing to see if the pipelines are already applied"
|
||||
ESVER=$(curl -sk https://"$ELASTICSEARCH_HOST":"$ELASTICSEARCH_PORT" |jq .version.number |tr -d \")
|
||||
PIPELINES=$(curl -sk https://"$ELASTICSEARCH_HOST":"$ELASTICSEARCH_PORT"/_ingest/pipeline/filebeat-$ESVER-suricata-eve-pipeline | jq . | wc -c)
|
||||
|
||||
if [[ "$PIPELINES" -lt 5 ]]; then
|
||||
echo "Setting up ingest pipeline(s)"
|
||||
|
||||
for MODULE in activemq apache auditd aws azure barracuda bluecoat cef checkpoint cisco coredns crowdstrike cyberark cylance elasticsearch envoyproxy f5 fortinet gcp google_workspace googlecloud gsuite haproxy ibmmq icinga iis imperva infoblox iptables juniper kafka kibana logstash microsoft misp mongodb mssql mysql nats netscout nginx o365 okta osquery panw postgresql rabbitmq radware redis santa snort snyk sonicwall sophos squid suricata system tomcat traefik zeek zscaler
|
||||
do
|
||||
echo "Loading $MODULE"
|
||||
docker exec -i so-filebeat filebeat setup modules -pipelines -modules $MODULE -c $FB_MODULE_YML
|
||||
sleep 2
|
||||
done
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
|
||||
@@ -18,6 +18,7 @@
|
||||
# NOTE: This script depends on so-common
|
||||
IMAGEREPO=security-onion-solutions
|
||||
|
||||
# shellcheck disable=SC2120
|
||||
container_list() {
|
||||
MANAGERCHECK=$1
|
||||
|
||||
@@ -128,13 +129,13 @@ update_docker_containers() {
|
||||
mkdir -p $SIGNPATH >> "$LOG_FILE" 2>&1
|
||||
|
||||
# Let's make sure we have the public key
|
||||
retry 50 10 "curl -sSL https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS -o $SIGNPATH/KEYS" >> "$LOG_FILE" 2>&1
|
||||
run_check_net_err \
|
||||
"curl --retry 5 --retry-delay 60 -sSL https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS -o $SIGNPATH/KEYS" \
|
||||
"Could not pull signature key file, please ensure connectivity to https://raw.gihubusercontent.com" \
|
||||
noretry >> "$LOG_FILE" 2>&1
|
||||
result=$?
|
||||
if [[ $result -eq 0 ]]; then
|
||||
cat $SIGNPATH/KEYS | gpg --import - >> "$LOG_FILE" 2>&1
|
||||
else
|
||||
echo "Failed to pull signature key file: $result"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Download the containers from the interwebs
|
||||
@@ -148,14 +149,15 @@ update_docker_containers() {
|
||||
|
||||
# Pull down the trusted docker image
|
||||
local image=$i:$VERSION$IMAGE_TAG_SUFFIX
|
||||
retry 50 10 "docker pull $CONTAINER_REGISTRY/$IMAGEREPO/$image" >> "$LOG_FILE" 2>&1
|
||||
run_check_net_err \
|
||||
"docker pull $CONTAINER_REGISTRY/$IMAGEREPO/$image" \
|
||||
"Could not pull $image, please ensure connectivity to $CONTAINER_REGISTRY" >> "$LOG_FILE" 2>&1
|
||||
|
||||
# Get signature
|
||||
retry 50 10 "curl -A '$CURLTYPE/$CURRENTVERSION/$OS/$(uname -r)' https://sigs.securityonion.net/$VERSION/$i:$VERSION$IMAGE_TAG_SUFFIX.sig --output $SIGNPATH/$image.sig" >> "$LOG_FILE" 2>&1
|
||||
if [[ $? -ne 0 ]]; then
|
||||
echo "Unable to pull signature file for $image" >> "$LOG_FILE" 2>&1
|
||||
exit 1
|
||||
fi
|
||||
run_check_net_err \
|
||||
"curl --retry 5 --retry-delay 60 -A '$CURLTYPE/$CURRENTVERSION/$OS/$(uname -r)' https://sigs.securityonion.net/$VERSION/$i:$VERSION$IMAGE_TAG_SUFFIX.sig --output $SIGNPATH/$image.sig" \
|
||||
"Could not pull signature file for $image, please ensure connectivity to https://sigs.securityonion.net " \
|
||||
noretry >> "$LOG_FILE" 2>&1
|
||||
# Dump our hash values
|
||||
DOCKERINSPECT=$(docker inspect $CONTAINER_REGISTRY/$IMAGEREPO/$image)
|
||||
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020,2021 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
wdurregex="^[0-9]+w$"
|
||||
ddurregex="^[0-9]+d$"
|
||||
|
||||
echo -e "\nThis script is used to reduce the size of InfluxDB by removing old data and retaining only the duration specified."
|
||||
echo "The duration will need to be specified as an integer followed by the duration unit without a space."
|
||||
echo -e "\nFor example, to purge all data but retain the past 12 weeks, specify 12w for the duration."
|
||||
echo "The duration units are as follows:"
|
||||
echo " w - week(s)"
|
||||
echo " d - day(s)"
|
||||
|
||||
while true; do
|
||||
echo ""
|
||||
read -p 'Enter the duration of past data that you would like to retain: ' duration
|
||||
duration=$(echo $duration | tr '[:upper:]' '[:lower:]')
|
||||
|
||||
if [[ "$duration" =~ $wdurregex ]] || [[ "$duration" =~ $ddurregex ]]; then
|
||||
break
|
||||
fi
|
||||
|
||||
echo -e "\nInvalid duration."
|
||||
done
|
||||
|
||||
echo -e "\nInfluxDB will now be cleaned and leave only the past $duration worth of data."
|
||||
read -r -p "Are you sure you want to continue? [y/N] " yorn
|
||||
if [[ "$yorn" =~ ^([yY][eE][sS]|[yY])$ ]]; then
|
||||
echo -e "\nCleaning InfluxDb and saving only the past $duration. This may could take several minutes depending on how much data needs to be cleaned."
|
||||
if docker exec -t so-influxdb /bin/bash -c "influx -ssl -unsafeSsl -database telegraf -execute \"DELETE FROM /.*/ WHERE \"time\" >= '2020-01-01T00:00:00.0000000Z' AND \"time\" <= now() - $duration\""; then
|
||||
echo -e "\nInfluxDb clean complete."
|
||||
else
|
||||
echo -e "\nSomething went wrong with cleaning InfluxDB. Please verify that the so-influxdb Docker container is running, and check the log at /opt/so/log/influxdb/influxdb.log for any details."
|
||||
fi
|
||||
else
|
||||
echo -e "\nExiting as requested."
|
||||
fi
|
||||
@@ -0,0 +1,47 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020,2021 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
echo -e "\nThis script is used to reduce the size of InfluxDB by downsampling old data into the so_long_term retention policy."
|
||||
|
||||
echo -e "\nInfluxDB will now be migrated. This could take a few hours depending on how large the database is and hardware resources available."
|
||||
read -r -p "Are you sure you want to continue? [y/N] " yorn
|
||||
if [[ "$yorn" =~ ^([yY][eE][sS]|[yY])$ ]]; then
|
||||
echo -e "\nMigrating InfluxDb started at `date`. This may take several hours depending on how much data needs to be moved."
|
||||
day=0
|
||||
startdate=`date`
|
||||
|
||||
while docker exec -t so-influxdb /bin/bash -c "influx -ssl -unsafeSsl -database telegraf -execute \"SELECT mean(*) INTO \"so_long_term\".:MEASUREMENT FROM \"autogen\"./.*/ WHERE \"time\" >= '2020-07-21T00:00:00.0000000Z' + ${day}d AND \"time\" <= '2020-07-21T00:00:00.0000000Z' + $((day+1))d GROUP BY time(5m),*\""; do
|
||||
# why 2020-07-21?
|
||||
migrationdate=`date -d "2020-07-21 + ${day} days" +"%y-%m-%d"`
|
||||
echo "Migration of $migrationdate started at $startdate and completed at `date`."
|
||||
|
||||
newdaytomigrate=$(date -d "$migrationdate + 1 days" +"%s")
|
||||
today=$(date +"%s")
|
||||
if [ $newdaytomigrate -ge $today ]; then
|
||||
break
|
||||
else
|
||||
((day=day+1))
|
||||
startdate=`date`
|
||||
echo -e "\nMigrating the next day's worth of data."
|
||||
fi
|
||||
done
|
||||
|
||||
echo -e "\nInfluxDb data migration complete."
|
||||
|
||||
else
|
||||
echo -e "\nExiting as requested."
|
||||
fi
|
||||
@@ -0,0 +1,26 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020,2021 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
if [ $# -lt 2 ]; then
|
||||
echo "Usage: $0 <steno-query> Output-Filename"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
docker exec -it so-sensoroni scripts/stenoquery.sh "$1" -w /nsm/pcapout/$2.pcap
|
||||
|
||||
echo ""
|
||||
echo "If successful, the output was written to: /nsm/pcapout/$2.pcap"
|
||||
@@ -22,5 +22,5 @@ salt-call state.apply playbook.db_init,playbook,playbook.automation_user_create
|
||||
/usr/sbin/so-soctopus-restart
|
||||
|
||||
echo "Importing Plays - this will take some time...."
|
||||
wait 5
|
||||
/usr/sbin/so-playbook-ruleupdate
|
||||
sleep 5
|
||||
/usr/sbin/so-playbook-ruleupdate
|
||||
|
||||
@@ -17,18 +17,6 @@
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
#check_boss_raid() {
|
||||
# BOSSBIN=/opt/boss/mvcli
|
||||
# BOSSRC=$($BOSSBIN info -o vd | grep functional)
|
||||
#
|
||||
# if [[ $BOSSRC ]]; then
|
||||
# # Raid is good
|
||||
# BOSSRAID=0
|
||||
# else
|
||||
# BOSSRAID=1
|
||||
# fi
|
||||
#}
|
||||
|
||||
check_lsi_raid() {
|
||||
# For use for LSI on Ubuntu
|
||||
#MEGA=/opt/MegaRAID/MegeCli/MegaCli64
|
||||
@@ -66,13 +54,11 @@ mkdir -p /opt/so/log/raid
|
||||
{%- if grains['sosmodel'] in ['SOSMN', 'SOSSNNV'] %}
|
||||
#check_boss_raid
|
||||
check_software_raid
|
||||
#echo "osraid=$BOSSRAID nsmraid=$SWRAID" > /opt/so/log/raid/status.log
|
||||
echo "osraid=1 nsmraid=$SWRAID" > /opt/so/log/raid/status.log
|
||||
echo "nsmraid=$SWRAID" > /opt/so/log/raid/status.log
|
||||
{%- elif grains['sosmodel'] in ['SOS1000F', 'SOS1000', 'SOSSN7200', 'SOS10K', 'SOS4000'] %}
|
||||
#check_boss_raid
|
||||
check_lsi_raid
|
||||
#echo "osraid=$BOSSRAID nsmraid=$LSIRAID" > /opt/so/log/raid/status.log
|
||||
echo "osraid=1 nsmraid=$LSIRAID" > /opt/so/log/raid/status.log
|
||||
echo "nsmraid=$LSIRAID" > /opt/so/log/raid/status.log
|
||||
{%- else %}
|
||||
exit 0
|
||||
{%- endif %}
|
||||
|
||||
@@ -23,6 +23,11 @@ TESTPCAP=$2
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
if [ $# -lt 2 ]; then
|
||||
echo "Usage: $0 <CustomRule> <TargetPCAP>"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "==============="
|
||||
echo "Running all.rules and $TESTRULE against the following pcap: $TESTPCAP"
|
||||
|
||||
@@ -10,11 +10,10 @@ zeek_logs_enabled() {
|
||||
}
|
||||
|
||||
whiptail_manager_adv_service_zeeklogs() {
|
||||
BLOGS=$(whiptail --title "Security Onion Setup" --checklist "Please Select Logs to Send:" 24 78 12 \
|
||||
BLOGS=$(whiptail --title "so-zeek-logs" --checklist "Please Select Logs to Send:" 24 78 12 \
|
||||
"conn" "Connection Logging" ON \
|
||||
"dce_rpc" "RPC Logs" ON \
|
||||
"dhcp" "DHCP Logs" ON \
|
||||
"dhcpv6" "DHCP IPv6 Logs" ON \
|
||||
"dnp3" "DNP3 Logs" ON \
|
||||
"dns" "DNS Logs" ON \
|
||||
"dpd" "DPD Logs" ON \
|
||||
@@ -25,25 +24,20 @@ whiptail_manager_adv_service_zeeklogs() {
|
||||
"irc" "IRC Chat Logs" ON \
|
||||
"kerberos" "Kerberos Logs" ON \
|
||||
"modbus" "MODBUS Logs" ON \
|
||||
"mqtt" "MQTT Logs" ON \
|
||||
"notice" "Zeek Notice Logs" ON \
|
||||
"ntlm" "NTLM Logs" ON \
|
||||
"openvpn" "OPENVPN Logs" ON \
|
||||
"pe" "PE Logs" ON \
|
||||
"radius" "Radius Logs" ON \
|
||||
"rfb" "RFB Logs" ON \
|
||||
"rdp" "RDP Logs" ON \
|
||||
"signatures" "Signatures Logs" ON \
|
||||
"sip" "SIP Logs" ON \
|
||||
"smb_files" "SMB Files Logs" ON \
|
||||
"smb_mapping" "SMB Mapping Logs" ON \
|
||||
"smtp" "SMTP Logs" ON \
|
||||
"snmp" "SNMP Logs" ON \
|
||||
"software" "Software Logs" ON \
|
||||
"ssh" "SSH Logs" ON \
|
||||
"ssl" "SSL Logs" ON \
|
||||
"syslog" "Syslog Logs" ON \
|
||||
"telnet" "Telnet Logs" ON \
|
||||
"tunnel" "Tunnel Logs" ON \
|
||||
"weird" "Zeek Weird Logs" ON \
|
||||
"mysql" "MySQL Logs" ON \
|
||||
@@ -61,10 +55,10 @@ whiptail_manager_adv_service_zeeklogs
|
||||
return_code=$?
|
||||
case $return_code in
|
||||
1)
|
||||
whiptail --title "Security Onion Setup" --msgbox "Cancelling. No changes have been made." 8 75
|
||||
whiptail --title "so-zeek-logs" --msgbox "Cancelling. No changes have been made." 8 75
|
||||
;;
|
||||
255)
|
||||
whiptail --title "Security Onion Setup" --msgbox "Whiptail error occured, exiting." 8 75
|
||||
whiptail --title "so-zeek-logs" --msgbox "Whiptail error occured, exiting." 8 75
|
||||
;;
|
||||
*)
|
||||
zeek_logs_enabled
|
||||
|
||||
+327
-210
@@ -20,10 +20,79 @@
|
||||
UPDATE_DIR=/tmp/sogh/securityonion
|
||||
INSTALLEDVERSION=$(cat /etc/soversion)
|
||||
POSTVERSION=$INSTALLEDVERSION
|
||||
INSTALLEDSALTVERSION=$(salt --versions-report | grep Salt: | awk {'print $2'})
|
||||
INSTALLEDSALTVERSION=$(salt --versions-report | grep Salt: | awk '{print $2}')
|
||||
BATCHSIZE=5
|
||||
SOUP_LOG=/root/soup.log
|
||||
INFLUXDB_MIGRATION_LOG=/opt/so/log/influxdb/soup_migration.log
|
||||
WHATWOULDYOUSAYYAHDOHERE=soup
|
||||
whiptail_title='Security Onion UPdater'
|
||||
|
||||
check_err() {
|
||||
local exit_code=$1
|
||||
local err_msg="Unhandled error occured, please check $SOUP_LOG for details."
|
||||
|
||||
[[ $ERR_HANDLED == true ]] && exit $exit_code
|
||||
if [[ $exit_code -ne 0 ]]; then
|
||||
printf '%s' "Soup failed with error $exit_code: "
|
||||
case $exit_code in
|
||||
2)
|
||||
echo 'No such file or directory'
|
||||
;;
|
||||
5)
|
||||
echo 'Interrupted system call'
|
||||
;;
|
||||
12)
|
||||
echo 'Out of memory'
|
||||
;;
|
||||
28)
|
||||
echo 'No space left on device'
|
||||
echo 'Likely ran out of space on disk, please review hardware requirements for Security Onion: https://docs.securityonion.net/en/2.3/hardware.html'
|
||||
;;
|
||||
30)
|
||||
echo 'Read-only file system'
|
||||
;;
|
||||
35)
|
||||
echo 'Resource temporarily unavailable'
|
||||
;;
|
||||
64)
|
||||
echo 'Machine is not on the network'
|
||||
;;
|
||||
67)
|
||||
echo 'Link has been severed'
|
||||
;;
|
||||
100)
|
||||
echo 'Network is down'
|
||||
;;
|
||||
101)
|
||||
echo 'Network is unreachable'
|
||||
;;
|
||||
102)
|
||||
echo 'Network reset'
|
||||
;;
|
||||
110)
|
||||
echo 'Connection timed out'
|
||||
;;
|
||||
111)
|
||||
echo 'Connection refused'
|
||||
;;
|
||||
112)
|
||||
echo 'Host is down'
|
||||
;;
|
||||
113)
|
||||
echo 'No route to host'
|
||||
;;
|
||||
*)
|
||||
echo 'Unhandled error'
|
||||
echo "$err_msg"
|
||||
;;
|
||||
esac
|
||||
if [[ $exit_code -ge 64 && $exit_code -le 113 ]]; then
|
||||
echo "$err_msg"
|
||||
fi
|
||||
exit $exit_code
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
add_common() {
|
||||
cp $UPDATE_DIR/salt/common/tools/sbin/so-common $DEFAULT_SALT_DIR/salt/common/tools/sbin/
|
||||
@@ -39,15 +108,14 @@ airgap_mounted() {
|
||||
echo "The ISO is already mounted"
|
||||
else
|
||||
echo ""
|
||||
echo "Looks like we need access to the upgrade content"
|
||||
echo ""
|
||||
echo "If you just copied the .iso file over you can specify the path."
|
||||
echo "If you burned the ISO to a disk the standard way you can specify the device."
|
||||
echo "Example: /home/user/securityonion-2.X.0.iso"
|
||||
echo "Example: /dev/sdx1"
|
||||
echo ""
|
||||
read -p 'Enter the location of the iso: ' ISOLOC
|
||||
if [ -f $ISOLOC ]; then
|
||||
cat << EOF
|
||||
In order for soup to proceed, the path to the downloaded Security Onion ISO file, or the path to the CD-ROM or equivalent device containing the ISO media must be provided.
|
||||
For example, if you have copied the new Security Onion ISO file to your home directory, then the path might look like /home/myuser/securityonion-2.x.y.iso.
|
||||
Or, if you have burned the new ISO onto an optical disk then the path might look like /dev/cdrom.
|
||||
|
||||
EOF
|
||||
read -rp 'Enter the path to the new Security Onion ISO content: ' ISOLOC
|
||||
if [[ -f $ISOLOC ]]; then
|
||||
# Mounting the ISO image
|
||||
mkdir -p /tmp/soagupdate
|
||||
mount -t iso9660 -o loop $ISOLOC /tmp/soagupdate
|
||||
@@ -59,7 +127,7 @@ airgap_mounted() {
|
||||
else
|
||||
echo "ISO has been mounted!"
|
||||
fi
|
||||
elif [ -f $ISOLOC/SecurityOnion/VERSION ]; then
|
||||
elif [[ -f $ISOLOC/SecurityOnion/VERSION ]]; then
|
||||
ln -s $ISOLOC /tmp/soagupdate
|
||||
echo "Found the update content"
|
||||
else
|
||||
@@ -77,9 +145,9 @@ airgap_mounted() {
|
||||
}
|
||||
|
||||
airgap_update_dockers() {
|
||||
if [ $is_airgap -eq 0 ]; then
|
||||
if [[ $is_airgap -eq 0 ]]; then
|
||||
# Let's copy the tarball
|
||||
if [ ! -f $AGDOCKER/registry.tar ]; then
|
||||
if [[ ! -f $AGDOCKER/registry.tar ]]; then
|
||||
echo "Unable to locate registry. Exiting"
|
||||
exit 1
|
||||
else
|
||||
@@ -87,9 +155,9 @@ airgap_update_dockers() {
|
||||
docker stop so-dockerregistry
|
||||
docker rm so-dockerregistry
|
||||
echo "Copying the new dockers over"
|
||||
tar xvf $AGDOCKER/registry.tar -C /nsm/docker-registry/docker
|
||||
tar xvf "$AGDOCKER/registry.tar" -C /nsm/docker-registry/docker
|
||||
echo "Add Registry back"
|
||||
docker load -i $AGDOCKER/registry_image.tar
|
||||
docker load -i "$AGDOCKER/registry_image.tar"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
@@ -101,9 +169,9 @@ update_registry() {
|
||||
}
|
||||
|
||||
check_sudoers() {
|
||||
if grep -q "so-setup" /etc/sudoers; then
|
||||
echo "There is an entry for so-setup in the sudoers file, this can be safely deleted using \"visudo\"."
|
||||
fi
|
||||
if grep -q "so-setup" /etc/sudoers; then
|
||||
echo "There is an entry for so-setup in the sudoers file, this can be safely deleted using \"visudo\"."
|
||||
fi
|
||||
}
|
||||
|
||||
check_log_size_limit() {
|
||||
@@ -177,7 +245,9 @@ check_os_updates() {
|
||||
echo "Continuing without updating packages"
|
||||
elif [[ "$confirm" == [uU] ]]; then
|
||||
echo "Applying Grid Updates"
|
||||
salt \* -b 5 state.apply patch.os queue=True
|
||||
set +e
|
||||
run_check_net_err "salt '*' -b 5 state.apply patch.os queue=True" 'Could not apply OS updates, please check your network connection.'
|
||||
set -e
|
||||
else
|
||||
echo "Exiting soup"
|
||||
exit 0
|
||||
@@ -205,7 +275,9 @@ clone_to_tmp() {
|
||||
if [ -n "$BRANCH" ]; then
|
||||
SOUP_BRANCH="-b $BRANCH"
|
||||
fi
|
||||
git clone $SOUP_BRANCH https://github.com/Security-Onion-Solutions/securityonion.git
|
||||
set +e
|
||||
run_check_net_err "git clone $SOUP_BRANCH https://github.com/Security-Onion-Solutions/securityonion.git" "Could not clone repo, please ensure network access to https://github.com"
|
||||
set -e
|
||||
cd /tmp
|
||||
if [ ! -f $UPDATE_DIR/VERSION ]; then
|
||||
echo "Update was unable to pull from github. Please check your internet."
|
||||
@@ -257,6 +329,7 @@ preupgrade_changes() {
|
||||
[[ "$INSTALLEDVERSION" == 2.3.0 || "$INSTALLEDVERSION" == 2.3.1 || "$INSTALLEDVERSION" == 2.3.2 || "$INSTALLEDVERSION" == 2.3.10 ]] && up_2.3.0_to_2.3.20
|
||||
[[ "$INSTALLEDVERSION" == 2.3.20 || "$INSTALLEDVERSION" == 2.3.21 ]] && up_2.3.2X_to_2.3.30
|
||||
[[ "$INSTALLEDVERSION" == 2.3.30 || "$INSTALLEDVERSION" == 2.3.40 ]] && up_2.3.3X_to_2.3.50
|
||||
true
|
||||
}
|
||||
|
||||
postupgrade_changes() {
|
||||
@@ -266,6 +339,8 @@ postupgrade_changes() {
|
||||
[[ "$POSTVERSION" =~ rc.1 ]] && post_rc1_to_rc2
|
||||
[[ "$POSTVERSION" == 2.3.20 || "$POSTVERSION" == 2.3.21 ]] && post_2.3.2X_to_2.3.30
|
||||
[[ "$POSTVERSION" == 2.3.30 ]] && post_2.3.30_to_2.3.40
|
||||
[[ "$POSTVERSION" == 2.3.50 ]] && post_2.3.5X_to_2.3.60
|
||||
true
|
||||
}
|
||||
|
||||
post_rc1_to_2.3.21() {
|
||||
@@ -286,6 +361,10 @@ post_2.3.30_to_2.3.40() {
|
||||
POSTVERSION=2.3.40
|
||||
}
|
||||
|
||||
post_2.3.5X_to_2.3.60() {
|
||||
POSTVERSION=2.3.60
|
||||
}
|
||||
|
||||
|
||||
rc1_to_rc2() {
|
||||
|
||||
@@ -419,7 +498,7 @@ up_2.3.2X_to_2.3.30() {
|
||||
sed -i "/ imagerepo: securityonion/c\ imagerepo: 'security-onion-solutions'" /opt/so/saltstack/local/pillar/global.sls
|
||||
|
||||
# Strelka rule repo pillar addition
|
||||
if [ $is_airgap -eq 0 ]; then
|
||||
if [[ $is_airgap -eq 0 ]]; then
|
||||
# Add manager as default Strelka YARA rule repo
|
||||
sed -i "/^strelka:/a \\ repos: \n - https://$HOSTNAME/repo/rules/strelka" /opt/so/saltstack/local/pillar/global.sls;
|
||||
else
|
||||
@@ -446,7 +525,7 @@ upgrade_to_2.3.50_repo() {
|
||||
rm -f "/etc/yum.repos.d/$DELREPO.repo"
|
||||
fi
|
||||
done
|
||||
if [ $is_airgap -eq 1 ]; then
|
||||
if [[ $is_airgap -eq 1 ]]; then
|
||||
# Copy the new repo file if not airgap
|
||||
cp $UPDATE_DIR/salt/repo/client/files/centos/securityonion.repo /etc/yum.repos.d/
|
||||
yum clean all
|
||||
@@ -562,7 +641,7 @@ upgrade_check() {
|
||||
# Let's make sure we actually need to update.
|
||||
NEWVERSION=$(cat $UPDATE_DIR/VERSION)
|
||||
HOTFIXVERSION=$(cat $UPDATE_DIR/HOTFIX)
|
||||
CURRENTHOTFIX=$(cat /etc/sohotfix 2>/dev/null)
|
||||
[[ -f /etc/sohotfix ]] && CURRENTHOTFIX=$(cat /etc/sohotfix)
|
||||
if [ "$INSTALLEDVERSION" == "$NEWVERSION" ]; then
|
||||
echo "Checking to see if there are hotfixes needed"
|
||||
if [ "$HOTFIXVERSION" == "$CURRENTHOTFIX" ]; then
|
||||
@@ -579,13 +658,14 @@ upgrade_check() {
|
||||
}
|
||||
|
||||
upgrade_check_salt() {
|
||||
NEWSALTVERSION=$(grep version: $UPDATE_DIR/salt/salt/master.defaults.yaml | awk {'print $2'})
|
||||
NEWSALTVERSION=$(grep version: $UPDATE_DIR/salt/salt/master.defaults.yaml | awk '{print $2}')
|
||||
if [ "$INSTALLEDSALTVERSION" == "$NEWSALTVERSION" ]; then
|
||||
echo "You are already running the correct version of Salt for Security Onion."
|
||||
else
|
||||
UPGRADESALT=1
|
||||
fi
|
||||
}
|
||||
|
||||
upgrade_salt() {
|
||||
SALTUPGRADED=True
|
||||
echo "Performing upgrade of Salt from $INSTALLEDSALTVERSION to $NEWSALTVERSION."
|
||||
@@ -597,7 +677,11 @@ upgrade_salt() {
|
||||
yum versionlock delete "salt-*"
|
||||
echo "Updating Salt packages and restarting services."
|
||||
echo ""
|
||||
sh $UPDATE_DIR/salt/salt/scripts/bootstrap-salt.sh -r -F -M -x python3 stable "$NEWSALTVERSION"
|
||||
set +e
|
||||
run_check_net_err \
|
||||
"sh $UPDATE_DIR/salt/salt/scripts/bootstrap-salt.sh -r -F -M -x python3 stable \"$NEWSALTVERSION\"" \
|
||||
"Could not update salt, please check $SOUP_LOG for details."
|
||||
set -e
|
||||
echo "Applying yum versionlock for Salt."
|
||||
echo ""
|
||||
yum versionlock add "salt-*"
|
||||
@@ -610,7 +694,11 @@ upgrade_salt() {
|
||||
apt-mark unhold "salt-minion"
|
||||
echo "Updating Salt packages and restarting services."
|
||||
echo ""
|
||||
sh $UPDATE_DIR/salt/salt/scripts/bootstrap-salt.sh -F -M -x python3 stable "$NEWSALTVERSION"
|
||||
set +e
|
||||
run_check_net_err \
|
||||
"sh $UPDATE_DIR/salt/salt/scripts/bootstrap-salt.sh -F -M -x python3 stable \"$NEWSALTVERSION\"" \
|
||||
"Could not update salt, please check $SOUP_LOG for details."
|
||||
set -e
|
||||
echo "Applying apt hold for Salt."
|
||||
echo ""
|
||||
apt-mark hold "salt-common"
|
||||
@@ -635,222 +723,250 @@ verify_latest_update_script() {
|
||||
cp $UPDATE_DIR/salt/common/tools/sbin/soup $DEFAULT_SALT_DIR/salt/common/tools/sbin/
|
||||
cp $UPDATE_DIR/salt/common/tools/sbin/so-common $DEFAULT_SALT_DIR/salt/common/tools/sbin/
|
||||
cp $UPDATE_DIR/salt/common/tools/sbin/so-image-common $DEFAULT_SALT_DIR/salt/common/tools/sbin/
|
||||
salt-call state.apply common queue=True
|
||||
salt-call state.apply -l info common queue=True
|
||||
echo ""
|
||||
echo "soup has been updated. Please run soup again."
|
||||
exit 0
|
||||
fi
|
||||
}
|
||||
|
||||
main () {
|
||||
echo "### Preparing soup at `date` ###"
|
||||
while getopts ":b" opt; do
|
||||
case "$opt" in
|
||||
b ) # process option b
|
||||
shift
|
||||
BATCHSIZE=$1
|
||||
if ! [[ "$BATCHSIZE" =~ ^[0-9]+$ ]]; then
|
||||
echo "Batch size must be a number greater than 0."
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
\? )
|
||||
echo "Usage: cmd [-b]"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
echo "Checking to see if this is a manager."
|
||||
echo ""
|
||||
require_manager
|
||||
set_minionid
|
||||
echo "Checking to see if this is an airgap install"
|
||||
echo ""
|
||||
check_airgap
|
||||
echo "Found that Security Onion $INSTALLEDVERSION is currently installed."
|
||||
echo ""
|
||||
set_os
|
||||
set_palette
|
||||
check_elastic_license
|
||||
echo ""
|
||||
if [ $is_airgap -eq 0 ]; then
|
||||
# Let's mount the ISO since this is airgap
|
||||
airgap_mounted
|
||||
else
|
||||
echo "Cloning Security Onion github repo into $UPDATE_DIR."
|
||||
echo "Removing previous upgrade sources."
|
||||
rm -rf $UPDATE_DIR
|
||||
clone_to_tmp
|
||||
fi
|
||||
check_os_updates
|
||||
echo ""
|
||||
echo "Verifying we have the latest soup script."
|
||||
verify_latest_update_script
|
||||
echo ""
|
||||
|
||||
echo "Generating new repo archive"
|
||||
generate_and_clean_tarballs
|
||||
if [ -f /usr/sbin/so-image-common ]; then
|
||||
. /usr/sbin/so-image-common
|
||||
else
|
||||
add_common
|
||||
fi
|
||||
|
||||
echo "Let's see if we need to update Security Onion."
|
||||
upgrade_check
|
||||
upgrade_space
|
||||
|
||||
echo "Checking for Salt Master and Minion updates."
|
||||
upgrade_check_salt
|
||||
|
||||
|
||||
if [ "$is_hotfix" == "true" ]; then
|
||||
echo "Applying $HOTFIXVERSION"
|
||||
copy_new_files
|
||||
echo ""
|
||||
update_version
|
||||
salt-call state.highstate -l info queue=True
|
||||
main() {
|
||||
set -e
|
||||
trap 'check_err $?' EXIT
|
||||
|
||||
else
|
||||
echo ""
|
||||
echo "Performing upgrade from Security Onion $INSTALLEDVERSION to Security Onion $NEWVERSION."
|
||||
echo ""
|
||||
echo "### Preparing soup at $(date) ###"
|
||||
while getopts ":b" opt; do
|
||||
case "$opt" in
|
||||
b ) # process option b
|
||||
shift
|
||||
BATCHSIZE=$1
|
||||
if ! [[ "$BATCHSIZE" =~ ^[0-9]+$ ]]; then
|
||||
echo "Batch size must be a number greater than 0."
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
\? )
|
||||
echo "Usage: cmd [-b]"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
echo "Updating dockers to $NEWVERSION."
|
||||
if [ $is_airgap -eq 0 ]; then
|
||||
airgap_update_dockers
|
||||
update_centos_repo
|
||||
yum clean all
|
||||
check_os_updates
|
||||
echo "Checking to see if this is a manager."
|
||||
echo ""
|
||||
require_manager
|
||||
set_minionid
|
||||
echo "Checking to see if this is an airgap install"
|
||||
echo ""
|
||||
check_airgap
|
||||
echo "Found that Security Onion $INSTALLEDVERSION is currently installed."
|
||||
echo ""
|
||||
set_os
|
||||
set_palette
|
||||
check_elastic_license
|
||||
echo ""
|
||||
if [[ $is_airgap -eq 0 ]]; then
|
||||
# Let's mount the ISO since this is airgap
|
||||
airgap_mounted
|
||||
else
|
||||
update_registry
|
||||
update_docker_containers "soup"
|
||||
echo "Cloning Security Onion github repo into $UPDATE_DIR."
|
||||
echo "Removing previous upgrade sources."
|
||||
rm -rf $UPDATE_DIR
|
||||
clone_to_tmp
|
||||
fi
|
||||
check_os_updates
|
||||
echo ""
|
||||
echo "Verifying we have the latest soup script."
|
||||
verify_latest_update_script
|
||||
echo ""
|
||||
|
||||
echo ""
|
||||
echo "Stopping Salt Minion service."
|
||||
systemctl stop salt-minion
|
||||
echo "Killing any remaining Salt Minion processes."
|
||||
pkill -9 -ef /usr/bin/salt-minion
|
||||
echo ""
|
||||
echo "Stopping Salt Master service."
|
||||
systemctl stop salt-master
|
||||
echo ""
|
||||
|
||||
upgrade_to_2.3.50_repo
|
||||
|
||||
# Does salt need upgraded. If so update it.
|
||||
if [ "$UPGRADESALT" == "1" ]; then
|
||||
echo "Upgrading Salt"
|
||||
# Update the repo files so it can actually upgrade
|
||||
upgrade_salt
|
||||
echo "Generating new repo archive"
|
||||
generate_and_clean_tarballs
|
||||
if [ -f /usr/sbin/so-image-common ]; then
|
||||
. /usr/sbin/so-image-common
|
||||
else
|
||||
add_common
|
||||
fi
|
||||
|
||||
echo "Checking if Salt was upgraded."
|
||||
echo ""
|
||||
# Check that Salt was upgraded
|
||||
SALTVERSIONPOSTUPGRADE=$(salt --versions-report | grep Salt: | awk {'print $2'})
|
||||
if [[ "$SALTVERSIONPOSTUPGRADE" != "$NEWSALTVERSION" ]]; then
|
||||
echo "Salt upgrade failed. Check of indicators of failure in $SOUP_LOG."
|
||||
echo "Once the issue is resolved, run soup again."
|
||||
echo "Exiting."
|
||||
echo "Let's see if we need to update Security Onion."
|
||||
upgrade_check
|
||||
upgrade_space
|
||||
|
||||
echo "Checking for Salt Master and Minion updates."
|
||||
upgrade_check_salt
|
||||
|
||||
|
||||
if [ "$is_hotfix" == "true" ]; then
|
||||
echo "Applying $HOTFIXVERSION"
|
||||
copy_new_files
|
||||
echo ""
|
||||
exit 1
|
||||
update_version
|
||||
salt-call state.highstate -l info queue=True
|
||||
else
|
||||
echo "Salt upgrade success."
|
||||
echo ""
|
||||
fi
|
||||
|
||||
preupgrade_changes
|
||||
echo ""
|
||||
|
||||
if [ $is_airgap -eq 0 ]; then
|
||||
echo "Updating Rule Files to the Latest."
|
||||
update_airgap_rules
|
||||
fi
|
||||
|
||||
# Only update the repo if its airgap
|
||||
if [[ $is_airgap -eq 0 ]] && [[ "$UPGRADESALT" != "1" ]]; then
|
||||
update_centos_repo
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Copying new Security Onion code from $UPDATE_DIR to $DEFAULT_SALT_DIR."
|
||||
copy_new_files
|
||||
echo ""
|
||||
update_version
|
||||
|
||||
echo ""
|
||||
echo "Locking down Salt Master for upgrade"
|
||||
masterlock
|
||||
|
||||
echo ""
|
||||
echo "Starting Salt Master service."
|
||||
systemctl start salt-master
|
||||
|
||||
# Only regenerate osquery packages if Fleet is enabled
|
||||
FLEET_MANAGER=$(lookup_pillar fleet_manager)
|
||||
FLEET_NODE=$(lookup_pillar fleet_node)
|
||||
if [[ "$FLEET_MANAGER" == "True" || "$FLEET_NODE" == "True" ]]; then
|
||||
echo "Performing upgrade from Security Onion $INSTALLEDVERSION to Security Onion $NEWVERSION."
|
||||
echo ""
|
||||
echo "Regenerating Osquery Packages.... This will take several minutes."
|
||||
salt-call state.apply fleet.event_gen-packages -l info queue=True
|
||||
|
||||
echo "Updating dockers to $NEWVERSION."
|
||||
if [[ $is_airgap -eq 0 ]]; then
|
||||
airgap_update_dockers
|
||||
update_centos_repo
|
||||
yum clean all
|
||||
check_os_updates
|
||||
else
|
||||
update_registry
|
||||
set +e
|
||||
update_docker_containers "soup"
|
||||
set -e
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Stopping Salt Minion service."
|
||||
systemctl stop salt-minion
|
||||
echo "Killing any remaining Salt Minion processes."
|
||||
set +e
|
||||
pkill -9 -ef /usr/bin/salt-minion
|
||||
set -e
|
||||
echo ""
|
||||
echo "Stopping Salt Master service."
|
||||
systemctl stop salt-master
|
||||
echo ""
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Running a highstate to complete the Security Onion upgrade on this manager. This could take several minutes."
|
||||
salt-call state.highstate -l info queue=True
|
||||
echo ""
|
||||
echo "Upgrade from $INSTALLEDVERSION to $NEWVERSION complete."
|
||||
preupgrade_changes_2.3.50_repo
|
||||
|
||||
echo ""
|
||||
echo "Stopping Salt Master to remove ACL"
|
||||
systemctl stop salt-master
|
||||
# Does salt need upgraded. If so update it.
|
||||
if [[ $UPGRADESALT -eq 1 ]]; then
|
||||
echo "Upgrading Salt"
|
||||
# Update the repo files so it can actually upgrade
|
||||
upgrade_salt
|
||||
fi
|
||||
|
||||
masterunlock
|
||||
|
||||
echo ""
|
||||
echo "Starting Salt Master service."
|
||||
systemctl start salt-master
|
||||
echo "Running a highstate. This could take several minutes."
|
||||
salt-call state.highstate -l info queue=True
|
||||
postupgrade_changes
|
||||
unmount_update
|
||||
thehive_maint
|
||||
|
||||
if [ "$UPGRADESALT" == "1" ]; then
|
||||
if [ $is_airgap -eq 0 ]; then
|
||||
echo "Checking if Salt was upgraded."
|
||||
echo ""
|
||||
# Check that Salt was upgraded
|
||||
SALTVERSIONPOSTUPGRADE=$(salt --versions-report | grep Salt: | awk '{print $2}')
|
||||
if [[ "$SALTVERSIONPOSTUPGRADE" != "$NEWSALTVERSION" ]]; then
|
||||
echo "Salt upgrade failed. Check of indicators of failure in $SOUP_LOG."
|
||||
echo "Once the issue is resolved, run soup again."
|
||||
echo "Exiting."
|
||||
echo ""
|
||||
echo "Cleaning repos on remote Security Onion nodes."
|
||||
salt -C 'not *_eval and not *_helixsensor and not *_manager and not *_managersearch and not *_standalone and G@os:CentOS' cmd.run "yum clean all"
|
||||
exit 1
|
||||
else
|
||||
echo "Salt upgrade success."
|
||||
echo ""
|
||||
fi
|
||||
fi
|
||||
|
||||
check_sudoers
|
||||
preupgrade_changes
|
||||
echo ""
|
||||
|
||||
if [[ -n $lsl_msg ]]; then
|
||||
case $lsl_msg in
|
||||
'distributed')
|
||||
echo "[INFO] The value of log_size_limit in any heavy node minion pillars may be incorrect."
|
||||
echo " -> We recommend checking and adjusting the values as necessary."
|
||||
echo " -> Minion pillar directory: /opt/so/saltstack/local/pillar/minions/"
|
||||
;;
|
||||
'single-node')
|
||||
# We can assume the lsl_details array has been set if lsl_msg has this value
|
||||
echo "[WARNING] The value of log_size_limit (${lsl_details[0]}) does not match the recommended value of ${lsl_details[1]}."
|
||||
echo " -> We recommend checking and adjusting the value as necessary."
|
||||
echo " -> File: /opt/so/saltstack/local/pillar/minions/${lsl_details[2]}.sls"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
if [[ $is_airgap -eq 0 ]]; then
|
||||
echo "Updating Rule Files to the Latest."
|
||||
update_airgap_rules
|
||||
fi
|
||||
|
||||
NUM_MINIONS=$(ls /opt/so/saltstack/local/pillar/minions/*_*.sls | wc -l)
|
||||
# Only update the repo if its airgap
|
||||
if [[ $is_airgap -eq 0 && $UPGRADESALT -ne 1 ]]; then
|
||||
update_centos_repo
|
||||
fi
|
||||
|
||||
if [ $NUM_MINIONS -gt 1 ]; then
|
||||
echo ""
|
||||
echo "Copying new Security Onion code from $UPDATE_DIR to $DEFAULT_SALT_DIR."
|
||||
copy_new_files
|
||||
echo ""
|
||||
update_version
|
||||
|
||||
cat << EOF
|
||||
echo ""
|
||||
echo "Locking down Salt Master for upgrade"
|
||||
masterlock
|
||||
|
||||
echo ""
|
||||
echo "Starting Salt Master service."
|
||||
systemctl start salt-master
|
||||
|
||||
# Testing that salt-master is up by checking that is it connected to itself
|
||||
set +e
|
||||
retry 50 10 "salt-call state.show_top -l error" || fail "salt-master could not be reached. Check $SOUP_LOG for details."
|
||||
set -e
|
||||
|
||||
echo ""
|
||||
echo "Ensuring python modules for Salt are installed and patched."
|
||||
salt-call state.apply salt.python3-influxdb -l info queue=True
|
||||
echo ""
|
||||
|
||||
# Only regenerate osquery packages if Fleet is enabled
|
||||
FLEET_MANAGER=$(lookup_pillar fleet_manager)
|
||||
FLEET_NODE=$(lookup_pillar fleet_node)
|
||||
if [[ "$FLEET_MANAGER" == "True" || "$FLEET_NODE" == "True" ]]; then
|
||||
echo ""
|
||||
echo "Regenerating Osquery Packages.... This will take several minutes."
|
||||
salt-call state.apply fleet.event_gen-packages -l info queue=True
|
||||
echo ""
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Running a highstate to complete the Security Onion upgrade on this manager. This could take several minutes."
|
||||
salt-call state.highstate -l info queue=True
|
||||
echo ""
|
||||
echo "Upgrade from $INSTALLEDVERSION to $NEWVERSION complete."
|
||||
|
||||
echo ""
|
||||
echo "Stopping Salt Master to remove ACL"
|
||||
systemctl stop salt-master
|
||||
|
||||
masterunlock
|
||||
|
||||
echo ""
|
||||
echo "Starting Salt Master service."
|
||||
systemctl start salt-master
|
||||
|
||||
# Testing that salt-master is up by checking that is it connected to itself
|
||||
set +e
|
||||
retry 50 10 "salt-call state.show_top -l error" || fail "salt-master could not be reached. Check $SOUP_LOG for details."
|
||||
set -e
|
||||
|
||||
echo "Running a highstate. This could take several minutes."
|
||||
salt-call state.highstate -l info queue=True
|
||||
postupgrade_changes
|
||||
[[ $is_airgap -eq 0 ]] && unmount_update
|
||||
thehive_maint
|
||||
|
||||
if [[ $UPGRADESALT -eq 1 ]]; then
|
||||
if [[ $is_airgap -eq 0 ]]; then
|
||||
echo ""
|
||||
echo "Cleaning repos on remote Security Onion nodes."
|
||||
salt -C 'not *_eval and not *_helixsensor and not *_manager and not *_managersearch and not *_standalone and G@os:CentOS' cmd.run "yum clean all"
|
||||
echo ""
|
||||
fi
|
||||
fi
|
||||
|
||||
check_sudoers
|
||||
|
||||
if [[ -n $lsl_msg ]]; then
|
||||
case $lsl_msg in
|
||||
'distributed')
|
||||
echo "[INFO] The value of log_size_limit in any heavy node minion pillars may be incorrect."
|
||||
echo " -> We recommend checking and adjusting the values as necessary."
|
||||
echo " -> Minion pillar directory: /opt/so/saltstack/local/pillar/minions/"
|
||||
;;
|
||||
'single-node')
|
||||
# We can assume the lsl_details array has been set if lsl_msg has this value
|
||||
echo "[WARNING] The value of log_size_limit (${lsl_details[0]}) does not match the recommended value of ${lsl_details[1]}."
|
||||
echo " -> We recommend checking and adjusting the value as necessary."
|
||||
echo " -> File: /opt/so/saltstack/local/pillar/minions/${lsl_details[2]}.sls"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
NUM_MINIONS=$(ls /opt/so/saltstack/local/pillar/minions/*_*.sls | wc -l)
|
||||
|
||||
if [[ $NUM_MINIONS -gt 1 ]]; then
|
||||
|
||||
cat << EOF
|
||||
|
||||
|
||||
|
||||
@@ -864,10 +980,10 @@ For more information, please see https://docs.securityonion.net/en/2.3/soup.html
|
||||
|
||||
EOF
|
||||
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "### soup has been served at `date` ###"
|
||||
echo "### soup has been served at $(date) ###"
|
||||
}
|
||||
|
||||
cat << EOF
|
||||
@@ -882,6 +998,7 @@ Press Enter to continue or Ctrl-C to cancel.
|
||||
|
||||
EOF
|
||||
|
||||
read input
|
||||
read -r input
|
||||
|
||||
main "$@" | tee -a $SOUP_LOG
|
||||
|
||||
Reference in New Issue
Block a user