mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-07 17:52:46 +01:00
Merge branch 'dev' into foxtrot
This commit is contained in:
Jason Ertel
@@ -86,10 +86,82 @@ add_interface_bond0() {
|
||||
fi
|
||||
}
|
||||
|
||||
check_container() {
|
||||
docker ps | grep "$1:" > /dev/null 2>&1
|
||||
return $?
|
||||
}
|
||||
|
||||
check_password() {
|
||||
local password=$1
|
||||
echo "$password" | egrep -v "'|\"|\\$|\\\\" > /dev/null 2>&1
|
||||
return $?
|
||||
}
|
||||
|
||||
fail() {
|
||||
msg=$1
|
||||
echo "ERROR: $msg"
|
||||
echo "Exiting."
|
||||
exit 1
|
||||
}
|
||||
|
||||
get_random_value() {
|
||||
length=${1:-20}
|
||||
head -c 5000 /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1
|
||||
}
|
||||
|
||||
header() {
|
||||
printf '%s\n' "" "$banner" " $*" "$banner"
|
||||
}
|
||||
|
||||
init_monitor() {
|
||||
MONITORNIC=$1
|
||||
|
||||
if [[ $MONITORNIC == "bond0" ]]; then
|
||||
BIFACES=$(lookup_bond_interfaces)
|
||||
else
|
||||
BIFACES=$MONITORNIC
|
||||
fi
|
||||
|
||||
for DEVICE_IFACE in $BIFACES; do
|
||||
for i in rx tx sg tso ufo gso gro lro; do
|
||||
ethtool -K "$DEVICE_IFACE" "$i" off;
|
||||
done
|
||||
ip link set dev "$DEVICE_IFACE" arp off multicast off allmulticast off promisc on
|
||||
done
|
||||
}
|
||||
|
||||
is_manager_node() {
|
||||
# Check to see if this is a manager node
|
||||
role=$(lookup_role)
|
||||
is_single_node_grid && return 0
|
||||
[ $role == 'manager' ] && return 0
|
||||
[ $role == 'managersearch' ] && return 0
|
||||
[ $role == 'helix' ] && return 0
|
||||
return 1
|
||||
}
|
||||
|
||||
is_sensor_node() {
|
||||
# Check to see if this is a sensor (forward) node
|
||||
role=$(lookup_role)
|
||||
is_single_node_grid && return 0
|
||||
[ $role == 'sensor' ] && return 0
|
||||
[ $role == 'heavynode' ] && return 0
|
||||
[ $role == 'helix' ] && return 0
|
||||
return 1
|
||||
}
|
||||
|
||||
is_single_node_grid() {
|
||||
role=$(lookup_role)
|
||||
[ $role == 'eval' ] && return 0
|
||||
[ $role == 'standalone' ] && return 0
|
||||
[ $role == 'import' ] && return 0
|
||||
return 1
|
||||
}
|
||||
|
||||
lookup_bond_interfaces() {
|
||||
cat /proc/net/bonding/bond0 | grep "Slave Interface:" | sed -e "s/Slave Interface: //g"
|
||||
}
|
||||
|
||||
lookup_salt_value() {
|
||||
key=$1
|
||||
group=$2
|
||||
@@ -129,15 +201,41 @@ lookup_role() {
|
||||
echo ${pieces[1]}
|
||||
}
|
||||
|
||||
check_container() {
|
||||
docker ps | grep "$1:" > /dev/null 2>&1
|
||||
return $?
|
||||
require_manager() {
|
||||
if is_manager_node; then
|
||||
echo "This is a manager, We can proceed."
|
||||
else
|
||||
echo "Please run this command on the manager; the manager controls the grid."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
check_password() {
|
||||
local password=$1
|
||||
echo "$password" | egrep -v "'|\"|\\$|\\\\" > /dev/null 2>&1
|
||||
return $?
|
||||
retry() {
|
||||
maxAttempts=$1
|
||||
sleepDelay=$2
|
||||
cmd=$3
|
||||
expectedOutput=$4
|
||||
attempt=0
|
||||
while [[ $attempt -lt $maxAttempts ]]; do
|
||||
attempt=$((attempt+1))
|
||||
echo "Executing command with retry support: $cmd"
|
||||
output=$(eval "$cmd")
|
||||
exitcode=$?
|
||||
echo "Results: $output ($exitcode)"
|
||||
if [ -n "$expectedOutput" ]; then
|
||||
if [[ "$output" =~ "$expectedOutput" ]]; then
|
||||
return $exitCode
|
||||
else
|
||||
echo "Expected '$expectedOutput' but got '$output'"
|
||||
fi
|
||||
elif [[ $exitcode -eq 0 ]]; then
|
||||
return $exitCode
|
||||
fi
|
||||
echo "Command failed with exit code $exitcode; will retry in $sleepDelay seconds ($attempt / $maxAttempts)..."
|
||||
sleep $sleepDelay
|
||||
done
|
||||
echo "Command continues to fail; giving up."
|
||||
return 1
|
||||
}
|
||||
|
||||
set_os() {
|
||||
@@ -171,83 +269,6 @@ set_version() {
|
||||
fi
|
||||
}
|
||||
|
||||
require_manager() {
|
||||
if is_manager_node; then
|
||||
echo "This is a manager, We can proceed."
|
||||
else
|
||||
echo "Please run this command on the manager; the manager controls the grid."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
is_manager_node() {
|
||||
# Check to see if this is a manager node
|
||||
role=$(lookup_role)
|
||||
is_single_node_grid && return 0
|
||||
[ $role == 'manager' ] && return 0
|
||||
[ $role == 'managersearch' ] && return 0
|
||||
[ $role == 'helix' ] && return 0
|
||||
return 1
|
||||
}
|
||||
|
||||
is_sensor_node() {
|
||||
# Check to see if this is a sensor (forward) node
|
||||
role=$(lookup_role)
|
||||
is_single_node_grid && return 0
|
||||
[ $role == 'sensor' ] && return 0
|
||||
[ $role == 'heavynode' ] && return 0
|
||||
[ $role == 'helix' ] && return 0
|
||||
return 1
|
||||
}
|
||||
|
||||
is_single_node_grid() {
|
||||
role=$(lookup_role)
|
||||
[ $role == 'eval' ] && return 0
|
||||
[ $role == 'standalone' ] && return 0
|
||||
[ $role == 'import' ] && return 0
|
||||
return 1
|
||||
}
|
||||
|
||||
fail() {
|
||||
msg=$1
|
||||
echo "ERROR: $msg"
|
||||
echo "Exiting."
|
||||
exit 1
|
||||
}
|
||||
|
||||
get_random_value() {
|
||||
length=${1:-20}
|
||||
head -c 5000 /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1
|
||||
}
|
||||
|
||||
retry() {
|
||||
maxAttempts=$1
|
||||
sleepDelay=$2
|
||||
cmd=$3
|
||||
expectedOutput=$4
|
||||
attempt=0
|
||||
while [[ $attempt -lt $maxAttempts ]]; do
|
||||
attempt=$((attempt+1))
|
||||
echo "Executing command with retry support: $cmd"
|
||||
output=$(eval "$cmd")
|
||||
exitcode=$?
|
||||
echo "Results: $output ($exitcode)"
|
||||
if [ -n "$expectedOutput" ]; then
|
||||
if [[ "$output" =~ "$expectedOutput" ]]; then
|
||||
return $exitCode
|
||||
else
|
||||
echo "Expected '$expectedOutput' but got '$output'"
|
||||
fi
|
||||
elif [[ $exitcode -eq 0 ]]; then
|
||||
return $exitCode
|
||||
fi
|
||||
echo "Command failed with exit code $exitcode; will retry in $sleepDelay seconds ($attempt / $maxAttempts)..."
|
||||
sleep $sleepDelay
|
||||
done
|
||||
echo "Command continues to fail; giving up."
|
||||
return 1
|
||||
}
|
||||
|
||||
valid_cidr() {
|
||||
# Verify there is a backslash in the string
|
||||
echo "$1" | grep -qP "^[^/]+/[^/]+$" || return 1
|
||||
|
||||
@@ -17,4 +17,11 @@
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
# Regenerate ElastAlert & update Plays
|
||||
docker exec so-soctopus python3 playbook_play-update.py
|
||||
|
||||
# Delete current Elastalert Rules
|
||||
rm /opt/so/rules/elastalert/playbook/*.yaml
|
||||
|
||||
# Regenerate Elastalert Rules
|
||||
so-playbook-sync
|
||||
@@ -24,11 +24,11 @@ show_stats() {
|
||||
echo
|
||||
echo "Average throughput:"
|
||||
echo
|
||||
docker exec -it so-zeek /opt/zeek/bin/zeekctl capstats
|
||||
docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin runuser -l zeek -c '/opt/zeek/bin/zeekctl capstats'
|
||||
echo
|
||||
echo "Average packet loss:"
|
||||
echo
|
||||
docker exec -it so-zeek /opt/zeek/bin/zeekctl netstats
|
||||
docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats'
|
||||
echo
|
||||
}
|
||||
|
||||
|
||||
@@ -121,17 +121,13 @@ check_sudoers() {
|
||||
}
|
||||
|
||||
check_log_size_limit() {
|
||||
local wait_for_enter=false
|
||||
|
||||
local num_minion_pillars
|
||||
num_minion_pillars=$(find /opt/so/saltstack/local/pillar/minions/ -type f | wc -l)
|
||||
|
||||
if [[ $num_minion_pillars -gt 1 ]]; then
|
||||
if find /opt/so/saltstack/local/pillar/minions/ -type f | grep -q "_heavynode"; then
|
||||
wait_for_enter=true
|
||||
echo "[INFO] The value of log_size_limit in any heavy node minion pillars may be incorrect."
|
||||
echo " -> We recommend checking and adjusting the values as necessary."
|
||||
echo " -> Minion pillar directory: /opt/so/saltstack/local/pillar/minions/"
|
||||
lsl_msg='distributed'
|
||||
fi
|
||||
else
|
||||
local minion_id
|
||||
@@ -172,16 +168,8 @@ check_log_size_limit() {
|
||||
new_limit=$( echo "$disk_size_gb" "$percent" | awk '{printf("%.0f", $1 * ($2/100))}')
|
||||
|
||||
if [[ $current_limit != "$new_limit" ]]; then
|
||||
wait_for_enter=true
|
||||
echo "[WARNING] The value of log_size_limit (${current_limit}) does not match the recommended value of ${new_limit}."
|
||||
echo " -> We recommend checking and adjusting the value as necessary."
|
||||
echo " -> File: /opt/so/saltstack/local/pillar/minions/${minion_id}.sls"
|
||||
fi
|
||||
|
||||
if [[ $wait_for_enter == true ]]; then
|
||||
echo ""
|
||||
read -n 1 -s -r -p "Press any key to continue..."
|
||||
echo "" # Since read doesn't print a newline, print one for it
|
||||
lsl_msg='single-node'
|
||||
lsl_details=( "$current_limit" "$new_limit" "$minion_id" )
|
||||
fi
|
||||
fi
|
||||
}
|
||||
@@ -742,7 +730,21 @@ fi
|
||||
|
||||
check_sudoers
|
||||
|
||||
|
||||
if [[ -n $lsl_msg ]]; then
|
||||
case $lsl_msg in
|
||||
'distributed')
|
||||
echo "[INFO] The value of log_size_limit in any heavy node minion pillars may be incorrect."
|
||||
echo " -> We recommend checking and adjusting the values as necessary."
|
||||
echo " -> Minion pillar directory: /opt/so/saltstack/local/pillar/minions/"
|
||||
;;
|
||||
'single-node')
|
||||
# We can assume the lsl_details array has been set if lsl_msg has this value
|
||||
echo "[WARNING] The value of log_size_limit (${lsl_details[0]}) does not match the recommended value of ${lsl_details[1]}."
|
||||
echo " -> We recommend checking and adjusting the value as necessary."
|
||||
echo " -> File: /opt/so/saltstack/local/pillar/minions/${lsl_details[2]}.sls"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
|
||||
@@ -2,4 +2,4 @@
|
||||
# When updating the salt version, also update the version in securityonion-builds/images/iso-task/Dockerfile and saltify function in so-functions
|
||||
salt:
|
||||
master:
|
||||
version: 3002.2
|
||||
version: 3002.5
|
||||
@@ -2,5 +2,5 @@
|
||||
# When updating the salt version, also update the version in securityonion-builds/images/iso-task/Dockerfile and saltify function in so-functions
|
||||
salt:
|
||||
minion:
|
||||
version: 3002.2
|
||||
version: 3002.5
|
||||
check_threshold: 3600 # in seconds, threshold used for so-salt-minion-check. any value less than 600 seconds may cause a lot of salt-minion restarts since the job to touch the file occurs every 5-8 minutes by default
|
||||
@@ -53,10 +53,10 @@
|
||||
{ "name": "SMTP", "description": "SMTP grouped by subject", "query": "event.dataset:smtp | groupby smtp.subject"},
|
||||
{ "name": "SNMP", "description": "SNMP grouped by version and string", "query": "event.dataset:snmp | groupby snmp.community snmp.version"},
|
||||
{ "name": "Software", "description": "List of software seen on the network", "query": "event.dataset:software | groupby software.type software.name"},
|
||||
{ "name": "SSH", "description": "SSH grouped by version", "query": "event.dataset:ssh | groupby ssh.version"},
|
||||
{ "name": "SSH", "description": "SSH grouped by version and client", "query": "event.dataset:ssh | groupby ssh.version ssh.client"},
|
||||
{ "name": "SSL", "description": "SSL grouped by version and server name", "query": "event.dataset:ssl | groupby ssl.version ssl.server_name"},
|
||||
{ "name": "SYSLOG", "description": "SYSLOG grouped by severity and facility ", "query": "event.dataset:syslog | groupby syslog.severity syslog.facility"},
|
||||
{ "name": "Tunnel", "description": "Tunnels grouped by action", "query": "event.dataset:tunnel | groupby event.action"},
|
||||
{ "name": "Tunnel", "description": "Tunnels grouped by type and action", "query": "event.dataset:tunnel | groupby tunnel.type event.action"},
|
||||
{ "name": "Weird", "description": "Zeek weird log grouped by name", "query": "event.dataset:weird | groupby weird.name"},
|
||||
{ "name": "x509", "description": "x.509 grouped by key length and name", "query": "event.dataset:x509 | groupby x509.certificate.key.length x509.san_dns"},
|
||||
{ "name": "x509", "description": "x.509 grouped by name and issuer", "query": "event.dataset:x509 | groupby x509.san_dns x509.certificate.issuer"},
|
||||
|
||||
@@ -1,2 +1,2 @@
|
||||
#!/bin/bash
|
||||
/usr/bin/docker exec so-zeek /opt/zeek/bin/zeekctl netstats | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1
|
||||
/usr/bin/docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats' | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1
|
||||
|
||||
@@ -1,8 +1,20 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020,2021 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
if [[ "$DEVICE_IFACE" != "$MNIC" && "$DEVICE_IFACE" != *"docker"* && "$DEVICE_IFACE" != *"tun"* && "DEVICE_IFACE" != *"wg"* ]]; then
|
||||
for i in rx tx sg tso ufo gso gro lro; do
|
||||
ethtool -K "$DEVICE_IFACE" "$i" off;
|
||||
done
|
||||
ip link set dev "$DEVICE_IFACE" arp off multicast off allmulticast off promisc on
|
||||
fi
|
||||
. /usr/sbin/so-common
|
||||
|
||||
init_monitor $MNIC
|
||||
|
||||
@@ -160,10 +160,10 @@ check_network_manager_conf() {
|
||||
} >> "$setup_log" 2>&1
|
||||
fi
|
||||
|
||||
if test -f "$nmconf"; then
|
||||
sed -i 's/managed=false/managed=true/g' "$nmconf" >> "$setup_log" 2>&1
|
||||
systemctl restart NetworkManager >> "$setup_log" 2>&1
|
||||
fi
|
||||
#if test -f "$nmconf"; then
|
||||
# sed -i 's/managed=false/managed=true/g' "$nmconf" >> "$setup_log" 2>&1
|
||||
# systemctl restart NetworkManager >> "$setup_log" 2>&1
|
||||
# fi
|
||||
|
||||
if [[ ! -d "$preupdir" ]]; then
|
||||
mkdir "$preupdir" >> "$setup_log" 2>&1
|
||||
@@ -331,7 +331,7 @@ collect_es_space_limit() {
|
||||
collect_fleet_custom_hostname_inputs() {
|
||||
whiptail_fleet_custom_hostname
|
||||
|
||||
while ! valid_fqdn "$FLEETCUSTOMHOSTNAME" || [[ $FLEETCUSTOMHOSTNAME != "" ]]; do
|
||||
while [[ -n $FLEETCUSTOMHOSTNAME ]] && ! valid_fqdn "$FLEETCUSTOMHOSTNAME"; do
|
||||
whiptail_invalid_input
|
||||
whiptail_fleet_custom_hostname "$FLEETCUSTOMHOSTNAME"
|
||||
done
|
||||
@@ -751,15 +751,26 @@ check_sos_appliance() {
|
||||
}
|
||||
|
||||
compare_main_nic_ip() {
|
||||
if ! [[ $MNIC =~ ^(tun|wg|vpn).*$ ]]; then
|
||||
if [[ "$MAINIP" != "$MNIC_IP" ]]; then
|
||||
read -r -d '' message <<- EOM
|
||||
The IP being routed by Linux is not the IP address assigned to the management interface ($MNIC).
|
||||
|
||||
This is not a supported configuration, please remediate and rerun setup.
|
||||
This has been known to cause installs to fail in some scenarios.
|
||||
|
||||
Please select whether to continue the install or exit setup to remediate any potential issues.
|
||||
EOM
|
||||
whiptail --title "Security Onion Setup" --msgbox "$message" 10 75
|
||||
whiptail --title "Security Onion Setup" \
|
||||
--yesno "$message" 10 75 \
|
||||
--yes-button "Continue" --no-button "Exit" --defaultno
|
||||
|
||||
kill -SIGINT "$(ps --pid $$ -oppid=)"; exit 1
|
||||
fi
|
||||
else
|
||||
# Setup uses MAINIP, but since we ignore the equality condition when using a VPN
|
||||
# just set the variable to the IP of the VPN interface
|
||||
MAINIP=$MNIC_IP
|
||||
fi
|
||||
}
|
||||
|
||||
compare_versions() {
|
||||
@@ -1005,27 +1016,6 @@ disable_ipv6() {
|
||||
sysctl -w net.ipv6.conf.all.disable_ipv6=1
|
||||
sysctl -w net.ipv6.conf.default.disable_ipv6=1
|
||||
} >> "$setup_log" 2>&1
|
||||
}
|
||||
|
||||
disable_misc_network_features() {
|
||||
filter_unused_nics
|
||||
if [ ${#filtered_nics[@]} -ne 0 ]; then
|
||||
for unused_nic in "${filtered_nics[@]}"; do
|
||||
if [ -n "$unused_nic" ]; then
|
||||
echo "Disabling unused NIC: $unused_nic" >> "$setup_log" 2>&1
|
||||
|
||||
# Disable DHCPv4/v6 and autoconnect
|
||||
nmcli con mod "$unused_nic" \
|
||||
ipv4.method disabled \
|
||||
ipv6.method ignore \
|
||||
connection.autoconnect "no" >> "$setup_log" 2>&1
|
||||
|
||||
# Flush any existing IPs
|
||||
ip addr flush "$unused_nic" >> "$setup_log" 2>&1
|
||||
fi
|
||||
done
|
||||
fi
|
||||
# Disable IPv6
|
||||
{
|
||||
echo "net.ipv6.conf.all.disable_ipv6 = 1"
|
||||
echo "net.ipv6.conf.default.disable_ipv6 = 1"
|
||||
@@ -1033,6 +1023,32 @@ disable_misc_network_features() {
|
||||
} >> /etc/sysctl.conf
|
||||
}
|
||||
|
||||
#disable_misc_network_features() {
|
||||
# filter_unused_nics
|
||||
# if [ ${#filtered_nics[@]} -ne 0 ]; then
|
||||
# for unused_nic in "${filtered_nics[@]}"; do
|
||||
# if [ -n "$unused_nic" ]; then
|
||||
# echo "Disabling unused NIC: $unused_nic" >> "$setup_log" 2>&1
|
||||
#
|
||||
# # Disable DHCPv4/v6 and autoconnect
|
||||
# nmcli con mod "$unused_nic" \
|
||||
# ipv4.method disabled \
|
||||
# ipv6.method ignore \
|
||||
# connection.autoconnect "no" >> "$setup_log" 2>&1
|
||||
#
|
||||
# # Flush any existing IPs
|
||||
# ip addr flush "$unused_nic" >> "$setup_log" 2>&1
|
||||
# fi
|
||||
# done
|
||||
# fi
|
||||
# # Disable IPv6
|
||||
# {
|
||||
# echo "net.ipv6.conf.all.disable_ipv6 = 1"
|
||||
# echo "net.ipv6.conf.default.disable_ipv6 = 1"
|
||||
# echo "net.ipv6.conf.lo.disable_ipv6 = 1"
|
||||
# } >> /etc/sysctl.conf
|
||||
#}
|
||||
|
||||
docker_install() {
|
||||
|
||||
if [ $OS = 'centos' ]; then
|
||||
@@ -1223,7 +1239,7 @@ filter_unused_nics() {
|
||||
fi
|
||||
|
||||
# Finally, set filtered_nics to any NICs we aren't using (and ignore interfaces that aren't of use)
|
||||
filtered_nics=$(ip link | awk -F: '$0 !~ "lo|vir|veth|br|docker|tun|wg|wl|^[^0-9]"{print $2}' | grep -vwe "$grep_string" | sed 's/ //g')
|
||||
filtered_nics=$(ip link | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}' | grep -vwe "$grep_string" | sed 's/ //g')
|
||||
readarray -t filtered_nics <<< "$filtered_nics"
|
||||
|
||||
nic_list=()
|
||||
@@ -1720,17 +1736,11 @@ network_setup() {
|
||||
echo "... Verifying all network devices are managed by Network Manager";
|
||||
check_network_manager_conf;
|
||||
|
||||
echo "... Disabling unused NICs";
|
||||
disable_misc_network_features;
|
||||
|
||||
echo "... Setting ONBOOT for management interface";
|
||||
command -v netplan &> /dev/null || nmcli con mod "$MNIC" connection.autoconnect "yes"
|
||||
|
||||
echo "... Copying 99-so-checksum-offload-disable";
|
||||
cp ./install_scripts/99-so-checksum-offload-disable /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable ;
|
||||
|
||||
echo "... Modifying 99-so-checksum-offload-disable";
|
||||
sed -i "s/\$MNIC/${MNIC}/g" /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable;
|
||||
sed -i "s/\$MNIC/${INTERFACE}/g" /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable;
|
||||
} >> "$setup_log" 2>&1
|
||||
}
|
||||
|
||||
@@ -1899,7 +1909,7 @@ saltify() {
|
||||
if [ $OS = 'centos' ]; then
|
||||
set_progress_str 5 'Installing Salt repo'
|
||||
{
|
||||
sudo rpm --import https://repo.saltstack.com/py3/redhat/7/x86_64/archive/3002.2/SALTSTACK-GPG-KEY.pub;
|
||||
sudo rpm --import https://repo.saltstack.com/py3/redhat/7/x86_64/archive/3002.5/SALTSTACK-GPG-KEY.pub;
|
||||
cp ./yum_repos/saltstack.repo /etc/yum.repos.d/saltstack.repo;
|
||||
} >> "$setup_log" 2>&1
|
||||
set_progress_str 6 'Installing various dependencies'
|
||||
@@ -1916,14 +1926,14 @@ saltify() {
|
||||
# Download Ubuntu Keys in case manager updates = 1
|
||||
mkdir -p /opt/so/gpg >> "$setup_log" 2>&1
|
||||
if [[ ! $is_airgap ]]; then
|
||||
logCmd "wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com/py3/ubuntu/18.04/amd64/archive/3002.2/SALTSTACK-GPG-KEY.pub"
|
||||
logCmd "wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com/py3/ubuntu/18.04/amd64/archive/3002.5/SALTSTACK-GPG-KEY.pub"
|
||||
logCmd "wget -q --inet4-only -O /opt/so/gpg/docker.pub https://download.docker.com/linux/ubuntu/gpg"
|
||||
logCmd "wget -q --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH"
|
||||
logCmd "cp ./yum_repos/wazuh.repo /etc/yum.repos.d/wazuh.repo"
|
||||
fi
|
||||
set_progress_str 7 'Installing salt-master'
|
||||
if [[ ! $is_iso ]]; then
|
||||
logCmd "yum -y install salt-master-3002.2"
|
||||
logCmd "yum -y install salt-master-3002.5"
|
||||
fi
|
||||
systemctl enable salt-master >> "$setup_log" 2>&1
|
||||
;;
|
||||
@@ -1951,7 +1961,7 @@ saltify() {
|
||||
{
|
||||
if [[ ! $is_iso ]]; then
|
||||
yum -y install epel-release
|
||||
yum -y install salt-minion-3002.2\
|
||||
yum -y install salt-minion-3002.5\
|
||||
python3\
|
||||
python36-docker\
|
||||
python36-dateutil\
|
||||
@@ -2002,8 +2012,8 @@ saltify() {
|
||||
'MANAGER' | 'EVAL' | 'MANAGERSEARCH' | 'STANDALONE' | 'IMPORT' | 'HELIXSENSOR')
|
||||
|
||||
# Add saltstack repo(s)
|
||||
wget -q --inet4-only -O - https://repo.saltstack.com"$py_ver_url_path"/ubuntu/"$ubuntu_version"/amd64/archive/3002.2/SALTSTACK-GPG-KEY.pub | apt-key add - >> "$setup_log" 2>&1
|
||||
echo "deb http://repo.saltstack.com$py_ver_url_path/ubuntu/$ubuntu_version/amd64/archive/3002.2 $OSVER main" > /etc/apt/sources.list.d/saltstack.list 2>> "$setup_log"
|
||||
wget -q --inet4-only -O - https://repo.saltstack.com"$py_ver_url_path"/ubuntu/"$ubuntu_version"/amd64/archive/3002.5/SALTSTACK-GPG-KEY.pub | apt-key add - >> "$setup_log" 2>&1
|
||||
echo "deb http://repo.saltstack.com$py_ver_url_path/ubuntu/$ubuntu_version/amd64/archive/3002.5 $OSVER main" > /etc/apt/sources.list.d/saltstack.list 2>> "$setup_log"
|
||||
|
||||
# Add Docker repo
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - >> "$setup_log" 2>&1
|
||||
@@ -2011,7 +2021,7 @@ saltify() {
|
||||
|
||||
# Get gpg keys
|
||||
mkdir -p /opt/so/gpg >> "$setup_log" 2>&1
|
||||
wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com$py_ver_url_path/ubuntu/"$ubuntu_version"/amd64/archive/3002.2/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1
|
||||
wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com$py_ver_url_path/ubuntu/"$ubuntu_version"/amd64/archive/3002.5/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1
|
||||
wget -q --inet4-only -O /opt/so/gpg/docker.pub https://download.docker.com/linux/ubuntu/gpg >> "$setup_log" 2>&1
|
||||
wget -q --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH >> "$setup_log" 2>&1
|
||||
|
||||
@@ -2024,7 +2034,7 @@ saltify() {
|
||||
set_progress_str 6 'Installing various dependencies'
|
||||
retry 50 10 "apt-get -y install sqlite3 argon2 libssl-dev" >> "$setup_log" 2>&1 || exit 1
|
||||
set_progress_str 7 'Installing salt-master'
|
||||
retry 50 10 "apt-get -y install salt-master=3002.2+ds-1" >> "$setup_log" 2>&1 || exit 1
|
||||
retry 50 10 "apt-get -y install salt-master=3002.5+ds-1" >> "$setup_log" 2>&1 || exit 1
|
||||
retry 50 10 "apt-mark hold salt-master" >> "$setup_log" 2>&1 || exit 1
|
||||
;;
|
||||
*)
|
||||
@@ -2035,14 +2045,14 @@ saltify() {
|
||||
echo "Using apt-key add to add SALTSTACK-GPG-KEY.pub and GPG-KEY-WAZUH" >> "$setup_log" 2>&1
|
||||
apt-key add "$temp_install_dir"/gpg/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1
|
||||
apt-key add "$temp_install_dir"/gpg/GPG-KEY-WAZUH >> "$setup_log" 2>&1
|
||||
echo "deb http://repo.saltstack.com$py_ver_url_path/ubuntu/$ubuntu_version/amd64/archive/3002.2/ $OSVER main" > /etc/apt/sources.list.d/saltstack.list 2>> "$setup_log"
|
||||
echo "deb http://repo.saltstack.com$py_ver_url_path/ubuntu/$ubuntu_version/amd64/archive/3002.5/ $OSVER main" > /etc/apt/sources.list.d/saltstack.list 2>> "$setup_log"
|
||||
echo "deb https://packages.wazuh.com/3.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list 2>> "$setup_log"
|
||||
;;
|
||||
esac
|
||||
|
||||
retry 50 10 "apt-get update" >> "$setup_log" 2>&1 || exit 1
|
||||
set_progress_str 8 'Installing salt-minion & python modules'
|
||||
retry 50 10 "apt-get -y install salt-minion=3002.2+ds-1 salt-common=3002.2+ds-1" >> "$setup_log" 2>&1 || exit 1
|
||||
retry 50 10 "apt-get -y install salt-minion=3002.5+ds-1 salt-common=3002.5+ds-1" >> "$setup_log" 2>&1 || exit 1
|
||||
retry 50 10 "apt-mark hold salt-minion salt-common" >> "$setup_log" 2>&1 || exit 1
|
||||
if [[ $OSVER != 'xenial' ]]; then
|
||||
retry 50 10 "apt-get -y install python3-pip python3-dateutil python3-m2crypto python3-mysqldb" >> "$setup_log" 2>&1 || exit 1
|
||||
@@ -2333,8 +2343,6 @@ set_hostname() {
|
||||
|
||||
set_initial_firewall_policy() {
|
||||
|
||||
set_main_ip
|
||||
|
||||
if [ -f $default_salt_dir/pillar/data/addtotab.sh ]; then chmod +x $default_salt_dir/pillar/data/addtotab.sh; fi
|
||||
if [ -f $default_salt_dir/salt/common/tools/sbin/so-firewall ]; then chmod +x $default_salt_dir/salt/common/tools/sbin/so-firewall; fi
|
||||
|
||||
|
||||
@@ -46,8 +46,8 @@ check_new_repos() {
|
||||
if [[ $OS == 'centos' ]]; then
|
||||
local repo_arr=(
|
||||
"https://download.docker.com/linux/centos/docker-ce.repo"
|
||||
"https://repo.saltstack.com/py3/redhat/7/x86_64/archive/3002.2/SALTSTACK-GPG-KEY.pub"
|
||||
"https://repo.saltstack.com/py3/ubuntu/18.04/amd64/archive/3002.2/SALTSTACK-GPG-KEY.pub"
|
||||
"https://repo.saltstack.com/py3/redhat/7/x86_64/archive/3002.5/SALTSTACK-GPG-KEY.pub"
|
||||
"https://repo.saltstack.com/py3/ubuntu/18.04/amd64/archive/3002.5/SALTSTACK-GPG-KEY.pub"
|
||||
"https://download.docker.com/linux/ubuntu/gpg"
|
||||
"https://packages.wazuh.com/key/GPG-KEY-WAZUH"
|
||||
"https://packages.wazuh.com/3.x/yum/"
|
||||
@@ -59,7 +59,7 @@ check_new_repos() {
|
||||
local repo_arr=(
|
||||
"https://download.docker.com/linux/ubuntu/gpg"
|
||||
"https://download.docker.com/linux/ubuntu"
|
||||
"https://repo.saltstack.com$py_ver_url_path/ubuntu/$ubuntu_version/amd64/archive/3002.2/SALTSTACK-GPG-KEY.pub"
|
||||
"https://repo.saltstack.com$py_ver_url_path/ubuntu/$ubuntu_version/amd64/archive/3002.5/SALTSTACK-GPG-KEY.pub"
|
||||
"https://packages.wazuh.com/key/GPG-KEY-WAZUH"
|
||||
"https://packages.wazuh.com"
|
||||
)
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
[saltstack]
|
||||
name=SaltStack repo for RHEL/CentOS $releasever PY3
|
||||
baseurl=https://repo.saltstack.com/py3/redhat/7/x86_64/archive/3002.2/
|
||||
baseurl=https://repo.saltstack.com/py3/redhat/7/x86_64/archive/3002.5/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://repo.saltstack.com/py3/redhat/7/x86_64/archive/3002.2/SALTSTACK-GPG-KEY.pub
|
||||
gpgkey=https://repo.saltstack.com/py3/redhat/7/x86_64/archive/3002.5/SALTSTACK-GPG-KEY.pub
|
||||
Reference in New Issue
Block a user