resolve startup errors

Merge branch '3/dev' into jertel/wip
alarms and ntf
2026-09-30 11:37:16 +02:00 · 2026-09-29 12:02:48 -04:00 · 2026-09-28 13:47:19 -04:00 · 2026-09-28 13:47:16 -04:00 · 2026-09-28 13:05:26 -04:00 · 2026-09-25 09:23:09 -04:00
31 changed files with 76 additions and 2 deletions
@@ -177,6 +177,7 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Unexpected authorization header" # expected WARN log lines indicating invalid auth header
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Missing ory_kratos_session cookie" # expected WARN log lines indicating invalid auth header
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Static assets preprocessor only supports GET and HEAD requests" # expected WARN log lines indicating invalid auth header
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|respondError"                 # respondError is a function name, output via http middleware as standard request logging
 fi

 if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
@@ -21,6 +21,7 @@ elastalert:
    - gid: 933
    - home: /opt/so/conf/elastalert
    - createhome: False
+    - shell: /sbin/nologin

 elastalogdir:
  file.directory:
@@ -19,6 +19,7 @@ elastic-agent-pr:
    - gid: 948
    - home: /opt/so/conf/elastic-fleet-pr
    - createhome: False
+    - shell: /sbin/nologin

 {% else %}

@@ -20,6 +20,7 @@ elastic-agent:
    - gid: 949
    - home: /opt/so/conf/elastic-agent
    - createhome: False
+    - shell: /sbin/nologin

 elasticagentconfdir:
  file.directory:
@@ -26,6 +26,7 @@ elastic-fleet:
    - gid: 947
    - home: /opt/so/conf/elastic-fleet
    - createhome: False
+    - shell: /sbin/nologin

 elasticfleet_sbin:
  file.recurse:
@@ -32,6 +32,7 @@ elasticsearch:
    - gid: 930
    - home: /opt/so/conf/elasticsearch
    - createhome: False
+    - shell: /sbin/nologin

 elasticsearch_sbin:
  file.recurse:
@@ -21,6 +21,7 @@ kafka_user:
    - gid: 960
    - home: /opt/so/conf/kafka
    - createhome: False
+    - shell: /sbin/nologin

 kafka_home_dir:
  file.absent:
@@ -22,6 +22,7 @@ kibana:
    - gid: 932
    - home: /opt/so/conf/kibana
    - createhome: False
+    - shell: /sbin/nologin

 # Drop the correct nginx config based on role

@@ -27,6 +27,7 @@ kratos:
    - uid: 928
    - gid: 928
    - home: /opt/so/conf/kratos
+    - shell: /sbin/nologin

 kratosdir:
  file.directory:
@@ -35,6 +35,7 @@ logstash:
    - uid: 931
    - gid: 931
    - home: /opt/so/conf/logstash
+    - shell: /sbin/nologin

 logstash_sbin:
  file.recurse:
@@ -1,2 +1,3 @@
-requests>=2.31.0
-whoisit>=2.7.0
+requests>=2.34.0
+whoisit>=4.0.5
+anyio>=4.15.1
@@ -1494,6 +1494,9 @@ soc:
          org: Security Onion
          bucket: telegraf/so_short_term
          verifyCert: false
+        notification:
+          dismissedPruneDays: 30
+          enabled: true
        playbook:
          autoUpdateEnabled: true
          playbookImportFrequencySeconds: 86400
@@ -160,6 +160,7 @@ soc:
        description: Schedules that are shared across the Security Onion product. Modify via one of the SOC Schedules view.
        readonlyUi: True
        global: True
+        advanced: True
        forcedType: string
        syntax: json
        storage: db
@@ -495,9 +496,23 @@ soc:
            description: JSON list of notifications. Modify via the SOC Notifications view.
            readonlyUi: True
            global: True
+            advanced: True
            forcedType: string
            syntax: json
            storage: db
+          dismissedPruneDays:
+            title: Dismissed Retention Days
+            description: The number of days to retain dismissed notifications. When a notification is dismissed, it will be pruned after this many days. Only one user need dismiss a notification for it to be pruned.
+            forcedType: int
+            global: True
+          maxListLimit:
+            description: Maximum number of notifications to display.
+            forcedType: int
+            global: True
+          enabled:
+            description: Enables or disables the SOC notification module.
+            forcedType: bool
+            global: True
        postgres:
          host:
            description: Hostname or IP address of the PostgreSQL server used by SOC. Defaults to the manager hostname.
@@ -524,6 +539,48 @@ soc:
            global: True
            sensitive: True
            advanced: True
+        postgresmetrics:
+          host:
+            description: Hostname or IP address of the PostgreSQL server used by Telegraf. Defaults to the manager hostname.
+            global: True
+            advanced: True
+          port:
+            description: Port of the PostgreSQL server used by Telegraf.
+            global: True
+            advanced: True
+          sslMode:
+            description: "Use encrypted connections to the PostgreSQL server used by Telegraf. Must be one of the following values: disable, allow, prefer, require, verify-ca, verify-full."
+            global: True
+            advanced: True
+          database:
+            description: Database to authenticate to on the PostgreSQL server.
+            global: True
+            advanced: True
+          user:
+            description: Username to authenticate to the PostgreSQL server used by Telegraf.
+            global: True
+            advanced: True
+          password:
+            description: Password used to authenticate to the PostgreSQL server used by Telegraf.
+            global: True
+            sensitive: True
+            advanced: True
+          cacheExpirationMs:
+            description: The interval (in milliseconds) to wait before querying the DB for updated metrics.
+            global: True
+            advanced: True
+          maxMetricAgeSeconds:
+            description: The maximum age (in seconds) of metrics to display in the SOC Grid Metrics view. Metrics older than this value will not be displayed.
+            global: True
+            advanced: True
+          alarms:
+            description: JSON list of metric alarms. Modify via the SOC Grid Alarms view.
+            readonlyUi: True
+            advanced: True
+            global: True
+            forcedType: string
+            syntax: json
+            storage: db
        salt:
          longRelayTimeoutMs:
            description: Duration (in milliseconds) to wait for a response from the Salt API when executing tasks known for being long running before giving up and showing an error on the SOC UI.
@@ -782,6 +839,7 @@ soc:
                - gemini
                - openai_responses
                - openai_chat
+                - openai_embeddings
            - field: apiUrl
              label: API URL
              required: False
@@ -64,6 +64,7 @@ suricata:
    - gid: 940
    - home: /nsm/suricata
    - createhome: False
+    - shell: /sbin/nologin

 socoregroupwithsuricata:
  group.present:
@@ -23,6 +23,7 @@ zeek:
    - gid: 937
    - home: /opt/so/conf/zeek
    - createhome: False
+    - shell: /sbin/nologin

 # Create some directories
 zeekpolicydir:
Author	SHA1	Message	Date
Jason Ertel	eb803dce0e	resolve startup errors	2026-09-29 12:02:48 -04:00
Jason Ertel	a8f7c46b0d	Merge branch '3/dev' into jertel/wip	2026-09-28 13:47:19 -04:00
Jason Ertel	26d895ccb7	alarms and ntf	2026-09-28 13:47:16 -04:00
Josh Patterson	b43efc458f	Merge pull request #16263 from Security-Onion-Solutions/fix/service-account-nologin FIX: use /sbin/nologin for service accounts	2026-09-28 13:05:26 -04:00
Josh Patterson	21222ff119	FIX: use /sbin/nologin for service accounts These accounts existed only for container UID mapping and filesystem ownership, but user.present omitted shell:, so Salt fell through to the platform useradd default and every one of them got /bin/bash. Pin them to /sbin/nologin so none can be used as an interactive login or `su -` target. socore keeps /bin/bash: `su socore -c '/usr/sbin/so-repo-sync'` in soup and so-kernel-upgrade execs the account's passwd shell, and operator docs tell users to su to socore. soqemussh keeps /bin/bash as an SSH login account. elastic-agent, elastic-agent-pr and kafka are included alongside the accounts named in the issue, being the same class with the same unset shell, so the default is uniform. Cron is unaffected: cronie runs jobs via the crontab SHELL (default /bin/sh), not the passwd shell. suricata is the only account changed here that owns a crontab, and somon has shipped as nologin with a working cron job already. The zeek `runuser -l zeek` calls all run inside so-zeek via docker.run/exec, so they resolve the shell from the image, not the host. Verified on a 3.4.0 managersearch + sensor grid: highstate converges with the shell as the only change and no failures, is idempotent on a second run, all containers stay up, SOC still issues a Kratos login flow, and the suricata surilogcompress cron job runs post-change ((suricata) CMD/CMDEND in /var/log/cron) while `su - suricata` is now refused. Closes #16256	2026-09-25 09:23:09 -04:00
Mike Reeves	88fa7e7fb4	Merge pull request #16262 from Security-Onion-Solutions/TOoSmOotH-patch-4 Add openai_embeddings to the YAML configuration	2026-09-24 15:29:17 -04:00
Mike Reeves	efe0581892	Add openai_embeddings to the YAML configuration	2026-09-24 15:27:51 -04:00
Jorge Reyes	2684a5ca95	Merge pull request #16260 from Security-Onion-Solutions/reyesj2/16254 FIX: Fleet scripts failing when endpoints-initial is missing	2026-09-23 08:58:15 -05:00
Jason Ertel	f4defdfde0	Merge pull request #16258 from Security-Onion-Solutions/jertel/wip upgrade whoislookup analyzer deps; notification annotations	2026-09-22 08:41:04 -04:00
Jason Ertel	36652e8f23	fixed malformed desc annotation	2026-09-22 08:30:44 -04:00
Jason Ertel	7bef194540	force transitive dep version	2026-09-22 08:28:44 -04:00
Jason Ertel	e2bf2837fe	notification annotations	2026-09-22 08:18:59 -04:00
Jason Ertel	06704dad22	upgrade whoislookup analyzer deps	2026-09-22 08:17:18 -04:00