From 1236c8c1f2630e7a82e31a503b9a64234c13e212 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Fri, 21 Mar 2025 10:34:55 -0400
Subject: [PATCH] support pcap imports for sensors in distributed grids

---
 salt/soc/files/bin/salt-relay.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/salt/soc/files/bin/salt-relay.sh b/salt/soc/files/bin/salt-relay.sh
index c9e3ba8c8..16c387f86 100755
--- a/salt/soc/files/bin/salt-relay.sh
+++ b/salt/soc/files/bin/salt-relay.sh
@@ -283,7 +283,7 @@ function send_file() {
 
   log "encrypting..."
   password=$(lookup_pillar_secret import_pass)
-  response=$(gpg --passphrase "$password" --batch --symmetric --cipher-algo AES256 "$from")
+  response=$(gpg --passphrase "$password" --batch --yes --symmetric --cipher-algo AES256 "$from")
   log Response:$'\n'"$response"
 
   fromgpg="$from.gpg"
@@ -329,12 +329,11 @@ function import_file() {
 
   log "decrypting..."
   password=$(lookup_pillar_secret import_pass)
-  decrypt_cmd="gpg --passphrase $password -o $file.tmp --batch --decrypt $filegpg"
+  decrypt_cmd="gpg --passphrase $password -o $file --batch --yes --decrypt $filegpg"
   salt "$node" cmd.run "\"$decrypt_cmd\""
   decrypt_code=$?
 
   if [[ $decrypt_code -eq 0 ]]; then
-    mv "$file.tmp" "$file"
     log "importing..."
     case $importer in
       pcap)
@@ -357,7 +356,7 @@ function import_file() {
     exit_code=$decrypt_code
   fi
 
-  rm -f "$file" "$filegpg"
+  salt "$node" cmd.run "rm -f \"$file\" \"$filegpg\""
 
   log Response:$'\n'"$response"
   log "Exit Code: $exit_code"