Elastic-test.git URL Replacment

[jg.hap...@gmail.com]

Good Afternoon All,

I am having numerous problems where I'm getting 401 authentication Errors when running "sudo soup". I've diagnosed the fault to being the GITURL for updates no longer exists.


/File Snippet:
/LOCATION: /etc/nsm/elasticdownload.conf
# Elastic Download
GITREPO="elastic-test"
GITURL="https://github.com/Security-Onion-Solutions/elastic-test.git"
DOCKERHUB="securityonionsolutions"
INSTALLED="yes"


That URL doesn't exist, if someone can please provide an indication of what that URL should be for the updates.

Thank you!

JG

[Wes Lambert]

JG,

While I agree that that file should probably be updated, I don't think it should be affecting you at the moment, because I believe only the DOCKERHUB value is being used at the moment.

Could it be that you are behind a proxy?

Thanks,

Wes

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

[jg.hap...@gmail.com]

On Wednesday, March 14, 2018 at 1:48:02 PM UTC, Wes wrote:
> JG,
>
>
> While I agree that that file should probably be updated, I don't think it should be affecting you at the moment, because I believe only the DOCKERHUB value is being used at the moment.
>
>
> Could it be that you are behind a proxy?
>
>
> Thanks,
> Wes
>
>
> On Wed, Mar 14, 2018 at 9:32 AM, <jg.hap...@gmail.com> wrote:
> Good Afternoon All,
>
>
>
> I am having numerous problems where I'm getting 401 authentication Errors when running "sudo soup".  I've diagnosed the fault to being the GITURL for updates no longer exists.
>
>
>
>
>
> /File Snippet:
>
> /LOCATION:  /etc/nsm/elasticdownload.conf
>
> # Elastic Download
>
> GITREPO="elastic-test"
>
> GITURL="https://github.com/Security-Onion-Solutions/elastic-test.git"
>
> DOCKERHUB="securityonionsolutions"
>
> INSTALLED="yes"
>
>
>
>
>
> That URL doesn't exist, if someone can please provide an indication of what that URL should be for the updates.
>
>
>
> Thank you!
>
>
>
> JG
>
>
>
> --
>
> Follow Security Onion on Twitter!
>
> https://twitter.com/securityonion
>
> ---
>
> You received this message because you are subscribed to the Google Groups "security-onion" group.
>

> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
>
> To post to this group, send email to securit...@googlegroups.com.

>
> Visit this group at https://groups.google.com/group/security-onion.
>
> For more options, visit https://groups.google.com/d/optout.

My setup is very simple, I've got a CentOS Firewall box, and then a security onion appliance on my network. From my SO appliance, i'm able to pull down packages and updates, but can't get it to work for "sudo soup". I thought that it was because of the dead URL link above, but clearly not.

Do I need to put my Firewall IP into the configuration file of the docker containers for the proxy?

Thanks,
John

[Wes Lambert]

John,

Could you please post a specific example of the failure condition(s)/error message(s) you've mentioned?

Thanks,

Wes

To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.

[jg.hap...@gmail.com]

Error below:

JG@SO:/etc$ sudo soup
###########################################################################

SOUP - Security Onion UPdater

........
........

it will prompt you to reboot at the end.
###########################################################################

Press Enter to continue or Ctrl-C to cancel.

Checking for kernels that can be removed...
No kernels are eligible for removal

Checking for updates...

Checking Security Onion Docker image status...
you are not authorized to perform this operation: server returned 401.
so-curator has been updated.
you are not authorized to perform this operation: server returned 401.
so-domainstats has been updated.
you are not authorized to perform this operation: server returned 401.
so-elastalert has been updated.
you are not authorized to perform this operation: server returned 401.
so-elasticsearch has been updated.
you are not authorized to perform this operation: server returned 401.
so-freqserver has been updated.
you are not authorized to perform this operation: server returned 401.
so-kibana has been updated.
you are not authorized to perform this operation: server returned 401.
so-logstash has been updated.
Stopping Docker containers...

Attached is the redacted output.

[Wes Lambert]

Do you get the same error if you manually run the following/

sudo /usr/bin/docker pull --disable-content-trust=false securityonionsolutions/so-kibana

Thanks,

Wes

To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.

[jg.hap...@gmail.com]

Yes, still have the same error sadly.

[jg.hap...@gmail.com]

Any further guidance would be much appreciated!!

[Wes Lambert]

What happens if you do the following?

sudo /usr/bin/docker pull --disable-content-trust=true securityonionsolutions/so-kibana

On Wed, Mar 14, 2018 at 2:42 PM, <jg.hap...@gmail.com> wrote:

Any further guidance would be much appreciated!!

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.

[Wes Lambert]

At any rate, it sounds like it may take less time and easier to reinstall from the latest ISO image.  

https://github.com/Security-Onion-Solutions/security-onion/blob/master/Verify_ISO.md

Thanks,

Wes

On Wed, Mar 14, 2018 at 2:47 PM, Wes Lambert <wlamb...@gmail.com> wrote:

What happens if you do the following?

sudo /usr/bin/docker pull --disable-content-trust=true securityonionsolutions/so-kibana

On Wed, Mar 14, 2018 at 2:42 PM, <jg.hap...@gmail.com> wrote:

Any further guidance would be much appreciated!!

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.

To post to this group, send email to securit...@googlegroups.com.