Re: [security-onion] Security Onion Failing to Install on VM

[Scott Runnels]

I've never run it in Parallels but I've confirmed it to work I VMWare fusion, VMWare ESXi, and VirtualBox. Virtualbox is free, maybe try that and see if its an issue with parallels?

Vr
Scott

On Dec 16, 2012, at 3:49 PM, Simon Carlson-Thies <simo...@gmail.com> wrote:

> I have been trying to install Security Onion in Parallels Desktop 7. Every time I do it fails with error code 5 input/output error with some claim of a dirty CD rom which makes no sense considering that I am installing from an ISO.
> Steps I have tried:
> I have tried installing from both the boot menu as well as from the live desktop
> I have tried re-downloading the image multiple times
> I have also verified the hash on each instance
>
> Any ideas?
>
> Thanks,
> -Simon
>
> --
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To post to this group, send email to securit...@googlegroups.com.
> To unsubscribe from this group, send email to security-onio...@googlegroups.com.
> Visit this group at http://groups.google.com/group/security-onion?hl=en-US.
>
>

[Doug Burks]

Hi Simon,

If you're having problems with the old Security Onion 10.04 ISO image,
you might try the new Security Onion 12.04 RC1:
http://securityonion.blogspot.com/2012/12/security-onion-1204-rc1-available-now.html

Hope that helps!

Thanks,
Doug

On Sun, Dec 16, 2012 at 3:49 PM, Simon Carlson-Thies

<simo...@gmail.com> wrote:
> I have been trying to install Security Onion in Parallels Desktop 7. Every time I do it fails with error code 5 input/output error with some claim of a dirty CD rom which makes no sense considering that I am installing from an ISO.
> Steps I have tried:
> I have tried installing from both the boot menu as well as from the live desktop
> I have tried re-downloading the image multiple times
> I have also verified the hash on each instance
>
> Any ideas?
>
> Thanks,
> -Simon
>
> --
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To post to this group, send email to securit...@googlegroups.com.
> To unsubscribe from this group, send email to security-onio...@googlegroups.com.
> Visit this group at http://groups.google.com/group/security-onion?hl=en-US.
>
>

--
Doug Burks
http://securityonion.blogspot.com

[Doug Burks]

On Mon, Dec 17, 2012 at 4:28 AM, Simon Carlson-Thies
<simo...@gmail.com> wrote:

Good morning Simon,

> The new version installs, but it runs horribly slow, and Snorby and ELISA will not login without causing the whole system to hang. It just won't work for my purposes.

What are the specs of your system?

Please send the output of the following (redacting sensitive info as necessary):
sudo sostat

When running Setup, have you tried not enabling ELSA?

> The system needs to run on a ultra-thinbook.

Why?

> The 10.04 based live distro works fine it just isn't customizable,

What do you mean?

> which is the problem.

I thought the problem was trying to install in Parallels Desktop 7?

Thanks,

[Net]

I think the 10.04 is quite fast because its already using xfce , etc ..
So the operating system is also being configured to be light on use

I think security onion also have to make some recommended setting for the OS env

Thanks

-----Original Message-----
From: Simon Carlson-Thies <simo...@gmail.com>
Sender: securit...@googlegroups.com
Date: Mon, 17 Dec 2012 01:28:04
To: <securit...@googlegroups.com>
Reply-To: securit...@googlegroups.com
Subject: Re: [security-onion] Security Onion Failing to Install on VM

The new version installs, but it runs horribly slow, and Snorby and ELISA will not login without causing the whole system to hang. It just won't work for my purposes. The system needs to run on a ultra-thinbook. The 10.04 based live distro works fine it just isn't customizable, which is the problem.

Thanks for the help though.

[Doug Burks]

On Mon, Dec 17, 2012 at 5:50 AM, Net <netzer...@gmail.com> wrote:
> I think the 10.04 is quite fast because its already using xfce , etc ..
> So the operating system is also being configured to be light on use

Hi Net,

Yes, as mentioned on the RC1 page
(http://code.google.com/p/security-onion/wiki/RC1), users can install
on their preferred flavor of Ubuntu 12.04. That could be Xubuntu
(with XFCE interface) or it could be Ubuntu Server (with no GUI at
all).

> I think security onion also have to make some recommended setting for the OS env

Yes, there are recommendations on the RC1 page:
http://code.google.com/p/security-onion/wiki/RC1

Thanks,
Doug

>
> Thanks
>
> -----Original Message-----
> From: Simon Carlson-Thies <simo...@gmail.com>
> Sender: securit...@googlegroups.com
> Date: Mon, 17 Dec 2012 01:28:04
> To: <securit...@googlegroups.com>
> Reply-To: securit...@googlegroups.com
> Subject: Re: [security-onion] Security Onion Failing to Install on VM
>
> The new version installs, but it runs horribly slow, and Snorby and ELISA will not login without causing the whole system to hang. It just won't work for my purposes. The system needs to run on a ultra-thinbook. The 10.04 based live distro works fine it just isn't customizable, which is the problem.
>
> Thanks for the help though.
>
> --
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To post to this group, send email to securit...@googlegroups.com.
> To unsubscribe from this group, send email to security-onio...@googlegroups.com.
> Visit this group at http://groups.google.com/group/security-onion?hl=en-US.
>
>
> --
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To post to this group, send email to securit...@googlegroups.com.
> To unsubscribe from this group, send email to security-onio...@googlegroups.com.
> Visit this group at http://groups.google.com/group/security-onion?hl=en-US.
>
>

[scott burkhart]

I have been doing all my testing in Virtualbox (Windows 7 host) and have had zero issues. The only issues I have had were attributed to not allocating enough memory to the guest VM.

I had some time last night so I did several clean installs on Ubuntu server 12.04 (no gui) and had no issues to report. Both snort and suricata engines ran beautifully.

[Doug Burks]

On Mon, Dec 17, 2012 at 12:34 PM, Simon Carlson-Thies
<simo...@gmail.com> wrote:
> I am trying to run it in standalone mode, on a 2010 Macbook Air. It does not have to deal with high volumes of network data. Especially considering the fact that I often am generating the data it has to deal with for demonstration purposes. The system had 1 core allocated and 1.5GBs of RAM with a 64GB hard drive.

Did you see the RAM requirements on the RC1 page?
http://code.google.com/p/security-onion/wiki/RC1

I would highly recommend increasing RAM if at all possible.
Otherwise, you can try installing on Ubuntu *Server* (no GUI to save
RAM) and choose Quick Setup and choose to disable ELSA. But ELSA is
very powerful and it's worth purchasing extra RAM to be able to run
it.

Thanks,
Doug