CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

setup improvements

Browse Source
This commit is contained in:
doug
2022-12-13 11:20:00 -05:00
parent f94eb243e4
commit d3a8bdff52
6 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/common/tools/sbin/so-analyst-install
View File

@@ -6,7 +6,7 @@
# Elastic License 2.0. # Elastic License 2.0.
doc_workstation_url="https://docs.securityonion.net/en/2.3/analyst-vm.html" doc_workstation_url="https://docs.securityonion.net/en/2.4/analyst-vm.html"
{# we only want the script to install the workstation if it is CentOS -#} {# we only want the script to install the workstation if it is CentOS -#}
{% if grains.os == 'CentOS' -%} {% if grains.os == 'CentOS' -%}
{# if this is a manager -#} {# if this is a manager -#}

4
salt/common/tools/sbin/so-common
View File

@@ -155,11 +155,11 @@ elastic_license() {
read -r -d '' message <<- EOM read -r -d '' message <<- EOM
\n \n
Elastic Stack binaries and Security Onion components are only available under the Elastic License version 2 (ELv2): Elastic Stack binaries and Security Onion components are only available under the Elastic License version 2 (ELv2):
https://www.elastic.co/licensing/elastic-license https://securityonion.net/license/
Do you agree to the terms of ELv2? Do you agree to the terms of ELv2?
If so, type AGREE to accept ELv2 and continue. Otherwise, press Enter to exit this program without making any changes. If so, type AGREE to accept ELv2 and continue. Otherwise, press Enter to exit this program without making any changes.
EOM EOM
AGREED=$(whiptail --title "$whiptail_title" --inputbox \ AGREED=$(whiptail --title "$whiptail_title" --inputbox \

12
salt/common/tools/sbin/soup
View File

@@ -47,7 +47,7 @@ check_err() {
;; ;;
28) 28)
echo 'No space left on device' echo 'No space left on device'
echo 'Likely ran out of space on disk, please review hardware requirements for Security Onion: https://docs.securityonion.net/en/2.3/hardware.html' echo 'Likely ran out of space on disk, please review hardware requirements for Security Onion: https://docs.securityonion.net/en/2.4/hardware.html'
;; ;;
30) 30)
echo 'Read-only file system' echo 'Read-only file system'
@@ -357,7 +357,7 @@ clone_to_tmp() {
git clone $SOUP_BRANCH https://github.com/Security-Onion-Solutions/securityonion.git git clone $SOUP_BRANCH https://github.com/Security-Onion-Solutions/securityonion.git
cd /tmp cd /tmp
if [ ! -f $UPDATE_DIR/VERSION ]; then if [ ! -f $UPDATE_DIR/VERSION ]; then
echo "Update was unable to pull from github. Please check your internet." echo "Update was unable to pull from Github. Please check your Internet access."
exit 0 exit 0
fi fi
} }
@@ -458,7 +458,7 @@ es_indices_check() {
if [ -z "$UNSUPPORTED_INDICES" ]; then if [ -z "$UNSUPPORTED_INDICES" ]; then
echo "No unsupported indices found." echo "No unsupported indices found."
else else
echo "The following indices were created with Elasticsearch 6, and are not supported when upgrading to Elasticsearch 8. These indices may need to be deleted, migrated, or re-indexed before proceeding with the upgrade. Please see https://docs.securityonion.net/en/2.3/soup.html#elastic-8 for more details." echo "The following indices were created with Elasticsearch 6, and are not supported when upgrading to Elasticsearch 8. These indices may need to be deleted, migrated, or re-indexed before proceeding with the upgrade. Please see https://docs.securityonion.net/en/2.4/soup.html#elastic-8 for more details."
echo echo
echo "$UNSUPPORTED_INDICES" echo "$UNSUPPORTED_INDICES"
exit 1 exit 1
@@ -1411,7 +1411,7 @@ Each minion is on a random 15 minute check-in period and things like network ban
If it looks like you’re missing data after the upgrade, please avoid restarting services and instead make sure at least one search node has completed its upgrade. The best way to do this is to run 'sudo salt-call state.highstate' from a search node and make sure there are no errors. Typically if it works on one node it will work on the rest. Forward nodes are less complex and will update as they check in so you can monitor those from the Grid section of SOC. If it looks like you’re missing data after the upgrade, please avoid restarting services and instead make sure at least one search node has completed its upgrade. The best way to do this is to run 'sudo salt-call state.highstate' from a search node and make sure there are no errors. Typically if it works on one node it will work on the rest. Forward nodes are less complex and will update as they check in so you can monitor those from the Grid section of SOC.
For more information, please see https://docs.securityonion.net/en/2.3/soup.html#distributed-deployments. For more information, please see https://docs.securityonion.net/en/2.4/soup.html#distributed-deployments.
EOF EOF
@@ -1425,7 +1425,7 @@ EOF
A custom Elasticsearch configuration has been found at /opt/so/saltstack/local/elasticsearch/files/elasticsearch.yml. This file is no longer referenced in Security Onion versions >= 2.3.80. A custom Elasticsearch configuration has been found at /opt/so/saltstack/local/elasticsearch/files/elasticsearch.yml. This file is no longer referenced in Security Onion versions >= 2.3.80.
If you still need those customizations, you'll need to manually migrate them to the new Elasticsearch config as shown at https://docs.securityonion.net/en/2.3/elasticsearch.html. If you still need those customizations, you'll need to manually migrate them to the new Elasticsearch config as shown at https://docs.securityonion.net/en/2.4/elasticsearch.html.
EOF EOF
@@ -1472,7 +1472,7 @@ if [[ -z $UNATTENDED ]]; then
SOUP - Security Onion UPdater SOUP - Security Onion UPdater
Please review the following for more information about the update process and recent updates: Please review the following for more information about the update process and recent updates:
https://docs.securityonion.net/soup https://docs.securityonion.net/en/2.4/soup.html
https://blog.securityonion.net https://blog.securityonion.net
EOF EOF

2
setup/so-functions
View File

@@ -1541,7 +1541,7 @@ networking_needful() {
source "$net_init_file" source "$net_init_file"
fi fi
if [[ $reinit_networking ]] || ! [[ -f $net_init_file ]]; then if [[ $reinit_networking ]] || ! [[ -f $net_init_file ]]; then
whiptail_network_init_notice #whiptail_network_init_notice
network_init network_init
fi fi
set_main_ip set_main_ip

4
setup/so-setup
View File

@@ -272,7 +272,7 @@ if ! [[ -f $install_opt_file ]]; then
whiptail_dhcp_warn whiptail_dhcp_warn
whiptail_management_nic whiptail_management_nic
fi fi
whiptail_network_init_notice #whiptail_network_init_notice
# Initializing the network based on the previous information # Initializing the network based on the previous information
network_init network_init
printf '%s\n' \ printf '%s\n' \
@@ -287,7 +287,7 @@ if ! [[ -f $install_opt_file ]]; then
if [[ $option == "CONFIGURENETWORK" ]]; then if [[ $option == "CONFIGURENETWORK" ]]; then
collect_hostname collect_hostname
network_init_whiptail network_init_whiptail
whiptail_network_init_notice #whiptail_network_init_notice
network_init network_init
printf '%s\n' \ printf '%s\n' \
"MNIC=$MNIC" \ "MNIC=$MNIC" \

26
setup/so-whiptail
View File

@@ -244,7 +244,7 @@ whiptail_storage_requirements() {
You need ${needed_val} to meet minimum requirements. You need ${needed_val} to meet minimum requirements.
Visit https://docs.securityonion.net/en/latest/hardware.html for more information. Visit https://docs.securityonion.net/en/2.4/hardware.html for more information.
Select YES to continue anyway, or select NO to cancel. Select YES to continue anyway, or select NO to cancel.
EOM EOM
@@ -460,7 +460,7 @@ whiptail_install_type() {
# What kind of install are we doing? # What kind of install are we doing?
install_type=$(whiptail --title "$whiptail_title" --radiolist \ install_type=$(whiptail --title "$whiptail_title" --radiolist \
"Choose install type. \nSee https://docs.securityonion.net/architecture for details." 13 65 5 \ "Choose install type. \nSee https://docs.securityonion.net/en/2.4/architecture.html for details." 13 65 5 \
"EVAL" "Evaluation mode (not for production) " ON \ "EVAL" "Evaluation mode (not for production) " ON \
"STANDALONE" "Standalone production install " OFF \ "STANDALONE" "Standalone production install " OFF \
"DISTRIBUTED" "Distributed install submenu " OFF \ "DISTRIBUTED" "Distributed install submenu " OFF \
@@ -508,7 +508,7 @@ whiptail_install_type_dist_new() {
read -r -d '' mngr_msg <<- EOM read -r -d '' mngr_msg <<- EOM
Choose a distributed manager type to start a new grid. Choose a distributed manager type to start a new grid.
See https://docs.securityonion.net/architecture for details. See https://docs.securityonion.net/en/2.4/architecture.html for details.
Note: MANAGER is the recommended option for most users. MANAGERSEARCH should only be used in very specific situations. Note: MANAGER is the recommended option for most users. MANAGERSEARCH should only be used in very specific situations.
EOM EOM
@@ -528,7 +528,7 @@ whiptail_install_type_dist_existing() {
local node_msg local node_msg
read -r -d '' node_msg <<- EOM read -r -d '' node_msg <<- EOM
Choose a distributed node type to join to an existing grid. See https://docs.securityonion.net/architecture for details. Choose a distributed node type to join to an existing grid. See https://docs.securityonion.net/en/2.4/architecture.html for details.
Note: Heavy nodes (HEAVYNODE) are NOT recommended for most users. Note: Heavy nodes (HEAVYNODE) are NOT recommended for most users.
EOM EOM
@@ -776,13 +776,13 @@ whiptail_management_nic() {
filter_unused_nics filter_unused_nics
MNIC=$(whiptail --title "$whiptail_title" --radiolist "Please select your management NIC:" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 ) MNIC=$(whiptail --title "$whiptail_title" --radiolist "Please select the NIC you would like to use for management. Use the arrow keys to move around and the space bar to select." 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 )
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
while [ -z "$MNIC" ] while [ -z "$MNIC" ]
do do
MNIC=$(whiptail --title "$whiptail_title" --radiolist "Please select your management NIC:" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 ) MNIC=$(whiptail --title "$whiptail_title" --radiolist "Please select the NIC you would like to use for management. Use the arrow keys to move around and the space bar to select." 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 )
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
done done
@@ -929,7 +929,7 @@ whiptail_manager_updates_warning() {
[ -n "$TESTING" ] && return [ -n "$TESTING" ] && return
whiptail --title "$whiptail_title"\ whiptail --title "$whiptail_title"\
--msgbox "Updating through the manager node requires the manager to have internet access, press ENTER to continue."\ --msgbox "Updating through the manager node requires the manager to have access to the Internet. Press ENTER to continue."\
8 75 8 75
local exitstatus=$? local exitstatus=$?
@@ -986,7 +986,7 @@ whiptail_network_notice() {
[ -n "$TESTING" ] && return [ -n "$TESTING" ] && return
whiptail --title "$whiptail_title" --yesno "Since this is a network install we assume the management interface, DNS, Hostname, etc are already set up. Select YES to continue." 8 75 whiptail --title "$whiptail_title" --yesno "Since this is a network install we assume the management interface, DNS, Hostname, etc are already set up. Select Yes if you've already configured these settings. Otherwise, select No to quit." 8 75
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
@@ -1198,7 +1198,7 @@ whiptail_set_redirect() {
options+=("OTHER" "Use a different name like a FQDN or Load Balancer" OFF) options+=("OTHER" "Use a different name like a FQDN or Load Balancer" OFF)
REDIRECTINFO=$(whiptail --title "$whiptail_title" --radiolist \ REDIRECTINFO=$(whiptail --title "$whiptail_title" --radiolist \
"How would you like to access the web interface?\n\nSecurity Onion uses strict cookie enforcement, so whatever you choose here will be the only way that you can access the web interface.\n\nIf you choose something other than IP address, then you'll need to ensure that you can resolve the name via DNS or hosts entry. If you are unsure, please select IP." 20 75 4 \ "How would you like to access the web interface?\n\nWhatever you choose here will be the only way that you can access the web interface.\n\nIf you choose something other than IP address, then you'll need to ensure that you can resolve the name via DNS or hosts entry. If you are unsure, please select IP." 20 75 4 \
"${options[@]}" \ "${options[@]}" \
3>&1 1>&2 2>&3 3>&1 1>&2 2>&3
) )
@@ -1298,7 +1298,7 @@ whiptail_storage_requirements() {
You need ${needed_val} to meet minimum requirements. You need ${needed_val} to meet minimum requirements.
Visit https://docs.securityonion.net/en/latest/hardware.html for more information. Visit https://docs.securityonion.net/en/2.4/hardware.html for more information.
Press YES to continue anyway, or press NO to cancel. Press YES to continue anyway, or press NO to cancel.
EOM EOM
@@ -1350,10 +1350,10 @@ whiptail_you_sure() {
read -r -d '' you_sure_text <<- EOM read -r -d '' you_sure_text <<- EOM
Welcome to Security Onion Setup! Welcome to Security Onion Setup!
You can use Setup for several different use cases, from a small standalone installation to a large distributed deployment for your enterprise. Don't forget to review the documentation at: You can use Setup for several different use cases, from a small standalone installation to a large distributed deployment for your enterprise. You can learn more in the documentation at:
https://docs.securityonion.net https://docs.securityonion.net/en/2.4/
Setup uses keyboard navigation and you can use arrow keys to move around. Certain screens may provide a list and ask you to select one or more items from that list. You can use [SPACE] to select items and [ENTER] to proceed to the next screen. Setup uses keyboard navigation and you can use arrow keys to move around. Certain screens may provide a list and ask you to select one or more items from that list. You can use [SPACE] to select items and [ENTER] to proceed to the next screen.
Would you like to continue? Would you like to continue?
EOM EOM