Security onion installation failling 2.4

[sandraimmaculate]

Hello, I want to install SO in Debian 12 with 256 root volume and 4vcpu and 16gb ram and with 2 NIC i started to installation using the below commands from official document

But i'm getting the below error

2024-12-06T05:30:36Z | INFO | Executing command: mkdir -p /opt/so/saltstack/local/salt/zeek/policy/intel
2024-12-06T05:30:36Z | INFO | Executing command: touch /opt/so/saltstack/local/salt/zeek/policy/intel/intel.dat
2024-12-06T05:30:36Z | INFO | Chown the salt dirs on the manager for socore
2024-12-06T05:30:36Z | INFO | Executing command: chown -R socore:socore /opt/so
2024-12-06T05:30:36Z | INFO | Executing command: mkdir -p /opt/so/saltstack/local/pillar/elasticfleet
2024-12-06T05:30:36Z | INFO | Executing command: touch /opt/so/saltstack/local/pillar/elasticsearch/adv_elasticsearch.sls
2024-12-06T05:30:36Z | INFO | Executing command: mkdir -p /opt/so/saltstack/local/pillar/logrotate
2024-12-06T05:30:36Z | INFO | Executing command: touch /opt/so/saltstack/local/pillar/logrotate/adv_logrotate.sls
2024-12-06T05:30:36Z | INFO | Executing command: touch /opt/so/saltstack/local/pillar/logrotate/soc_logrotate.sls
2024-12-06T05:30:36Z | INFO | Executing command: mkdir -p /opt/so/saltstack/local/pillar/kibana
2024-12-06T05:30:36Z | INFO | Executing command: touch /opt/so/saltstack/local/pillar/kibana/adv_kibana.sls
2024-12-06T05:30:36Z | INFO | Executing command: touch /opt/so/saltstack/local/pillar/kibana/soc_kibana.sls
2024-12-06T05:30:36Z | INFO | Executing command: mkdir -p /opt/so/saltstack/local/pillar/kafka
2024-12-06T05:30:36Z | INFO | Executing command: touch /opt/so/saltstack/local/pillar/kafka/adv_kafka.sls
2024-12-06T05:30:36Z | INFO | Executing command: touch /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls
2024-12-06T05:30:36Z | INFO | Generating the minion pillar
2024-12-06T05:30:36Z | INFO | Executing command: so-minion -o=setup
Minion file created for sec-on_standalone
./so-functions: line 47: rsync: command not found
./so-functions: line 50: rsync: command not found
2024-12-06T05:30:36Z | INFO | Running apt-get update
2024-12-06T05:30:37Z | INFO | Running apt-get upgrade
2024-12-06T05:30:38Z | INFO | Installing Salt
Executing command with retry support: apt-get -y install apache2-utils ca-certificates curl software-properties-common apt-transport-https openssl netcat-openbsd jq gnupg
Results: Reading package lists...
Building dependency tree...
Reading state information...
apache2-utils is already the newest version (2.4.62-1~deb12u2).
ca-certificates is already the newest version (20230311).
curl is already the newest version (7.88.1-10+deb12u8).
software-properties-common is already the newest version (0.99.30-4.1~deb12u1).
apt-transport-https is already the newest version (2.6.1).
openssl is already the newest version (3.0.15-1~deb12u1).
netcat-openbsd is already the newest version (1.219-1).
jq is already the newest version (1.6-2.1).
gnupg is already the newest version (2.2.40-1.1).
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded. (0)
2024-12-06T05:30:38Z | INFO | Executing command: mkdir -vp /etc/apt/keyrings
2024-12-06T05:30:38Z | INFO | Executing command: wget -q --inet4-only -O /etc/apt/keyrings/docker.pub https://download.docker.com/linux/ubuntu/gpg
2024-12-06T05:30:38Z | INFO | Executing command: curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2023.gpg https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9/SALT-PROJECT-GPG-PUBKEY-2023.gpg
curl: (6) Could not resolve host: repo.saltproject.io
deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg] https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9/ bullseye main
File '/etc/apt/keyrings/docker.gpg' exists. Overwrite? (y/N) y
2024-12-06T05:30:45Z | INFO | Executing command: apt-key add /etc/apt/keyrings/salt-archive-keyring-2023.gpg
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
gpg: can't open '/etc/apt/keyrings/salt-archive-keyring-2023.gpg': No such file or directory
2024-12-06T05:30:45Z | INFO | Executing command: apt-key add /etc/apt/keyrings/docker.pub
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
OK
Executing command with retry support: apt-get update
W: Failed to fetch https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9/dists/bullseye/InRelease  Could not resolve 'repo.saltproject.io'
W: Some index files failed to download. They have been ignored, or old ones used instead.
Results: Ign:1 https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9 bullseye InRelease
Get:2 file:/etc/apt/mirrors/debian.list Mirrorlist [38 B]
Get:3 file:/etc/apt/mirrors/debian-security.list Mirrorlist [47 B]
Hit:8 https://download.docker.com/linux/debian bookworm InRelease
Hit:4 https://cdn-aws.deb.debian.org/debian bookworm InRelease
Hit:5 https://cdn-aws.deb.debian.org/debian bookworm-updates InRelease
Hit:6 https://cdn-aws.deb.debian.org/debian bookworm-backports InRelease
Hit:7 https://cdn-aws.deb.debian.org/debian-security bookworm-security InRelease
Ign:1 https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9 bullseye InRelease
Ign:1 https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9 bullseye InRelease
Err:1 https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9 bullseye InRelease
  Could not resolve 'repo.saltproject.io'
Reading package lists... (0)
Found failedOutput: 'Err:' in the output below from running the command: 'apt-get update'
<Start of output>
Ign:1 https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9 bullseye InRelease
Get:2 file:/etc/apt/mirrors/debian.list Mirrorlist [38 B]
Get:3 file:/etc/apt/mirrors/debian-security.list Mirrorlist [47 B]
Hit:8 https://download.docker.com/linux/debian bookworm InRelease
Hit:4 https://cdn-aws.deb.debian.org/debian bookworm InRelease
Hit:5 https://cdn-aws.deb.debian.org/debian bookworm-updates InRelease
Hit:6 https://cdn-aws.deb.debian.org/debian bookworm-backports InRelease
Hit:7 https://cdn-aws.deb.debian.org/debian-security bookworm-security InRelease
Ign:1 https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9 bullseye InRelease
Ign:1 https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9 bullseye InRelease
Err:1 https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/3006.9 bullseye InRelease
  Could not resolve 'repo.saltproject.io'
Reading package lists...
<End of output>
Forcing exit code to 1
Command failed with exit code 1; will retry in 20 seconds (1 / 150)...
^C
root@ip-172-31-35-35:/securityonion# 

[NeoLife-iT]

Hi try using the DNS you know working for your installation other than the default 8.8.8.8 or 8.8.4.4. I happened to installed sOs many times for Hyper-V environment on 4 difference network. When you see some error like something not found chances are it is your Network. VLAN, Proxy, DNS..

Go Back to the Basic network setup ...no vpn, no proxy..etc if that don't work tried install from the network that work and copy or moved the vm. I had done this for sOs and Graylog 6.11 - with the current network @ work. It's works but the caveat is doing so take some experiment...you need to know the final configuration for your installation.

Hope this help.

[sandraimmaculate]

Thank for your reply i will go through about it !

[br3nj1]

Same issue. Their DNS records for saltproject.io are messed up. Various whois, domaintools are showing failings. Site is still reged buck something has an issue. i can't GET url in security onion. joining their discord to ask. no time to troubleshoot atm.

https://viewdns.info/dnsreport/?domain=saltproject.io
Oops! The primary nameserver listed in your SOA record (acc-exdns-1.broadcom.net.) is not listed at the parent servers! This could suggest a configuration issue with your SOA record.

https://mxtoolbox.com/emailhealth/saltproject.io/
Primary Name Server Not Listed At Parent

https://whois.domaintools.com/saltproject.io
IP Address | 185.199.108.153
Dates | 1,498 days old
Created on 2020-11-02
Expires on 2025-11-02Updated on 2024-10-27

ChatGPT
https://chatgpt.com/share/6757b793-f36c-800b-b4bc-2a0bd9e21a12
The Salt Project has recently migrated its package repositories from repo.saltproject.io to packages.broadcom.com. As a result, repo.saltproject.io is no longer available, which may be causing your connectivity issues.
Key Points:
Repository Migration: The previous repository (repo.saltproject.io) has been deprecated. The new repository locations are:
Documentation Migration: The Salt Project's documentation has also moved to GitHub Pages. During the DNS propagation and cutover, users may experience connection quirks.
Recommendations:
Update Repository Configurations: Modify your system's package manager configurations to point to the new repository URLs.

[sandraimmaculate]

Thanks for your reply i will go through about this

[sandraimmaculate]

this issues i faced when i'm installing new security onion in a new box. So if i do upgrade of security onion version 2.4.100 to 2.4.110 do i will get this issues

[NeoLife-iT]

Best not to drift too far away from the default setup. As you operate sOs in production environment there will be issues that will cause complication.

[sandraimmaculate]

Yes, Thanks for your reply!
My security onion is in production environment. My current version is 2.4.100 the latest version of security onion is 2.4.110 as the their DNS records for saltproject.io are messed up. do it cause any issues while i do soup??. Shall i do upgrade or its not better to do upgrade??