Installation Fails to Create /opt/so/bin Directory on HP ProDesk 400 G7 (SO 2.4.160)

[ReynaldoN17]

Version

2.4.160

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

32

Storage for /

256

Storage for /nsm

999

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Problem Description:
The installation process appears to run to completion, ending with the "STANDALONE setup is now complete!" message. After rebooting, I can access the web interface (SOC). The "Grid" view eventually shows the node status as "OK" (green).

However, when I log in via SSH to perform any administrative task, I find that the /opt/so/bin/ directory does not exist.

• Running ls -l /opt/so/bin/ returns: ls: cannot access '/opt/so/bin/': No such file or directory.
• This means all management commands like so-setup, so-allow, etc., are missing.
• Interestingly, sudo so-status works, but it returns a warning: System appears to be starting. No highstate has completed since the system was restarted.

Troubleshooting Steps Already Taken:

1. Multiple Re-installations: I have tried reinstalling from scratch more than three times, and the result is always the same.
2. BIOS Configuration:
   • Secure Boot has been confirmed to be Disabled.
   • Virtualization Technology (Intel VT-x) is confirmed Enabled.
   • SATA Mode is set to AHCI.
   • Boot Mode is set to UEFI.
3. Installation Media:
   • The ISO has been downloaded multiple times from the official site and I plan to verify the SHA256 checksum to ensure it is not corrupt.
   • I have tried using different USB drives.
   • The bootable USB was created with BalenaEtcher.
4. Installation Process:
   • The installer is allowed to format the disks completely.
   • The disks were correctly partitioned during setup: the NVMe for the OS and the larger HDD for NSM storage, as prompted by the installer.

The Core Question:
The main point of confusion is how the system can report an OK status in the Grid view while being fundamentally broken (missing the /opt/so/bin directory). It seems the containerized services start, but the final host-level setup phase fails silently.

Has anyone encountered a similar issue, particularly with HP hardware? Are there any known incompatibilities or other BIOS settings I should investigate that could prevent the installer from completing the file copy operations to /opt/so/?

Thank you in advance for your time and any help you can provide.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

Hi @ReynaldoN17 and welcome to Security Onion Discussions!

Running ls -l /opt/so/bin/ returns: ls: cannot access '/opt/so/bin/': No such file or directory.

Yes, that is normal. We don't create an /opt/so/bin/ directory.

Management commands like so-status can be found in the /usr/sbin/ directory. For example:

which so-status
/usr/sbin/so-status

ls -alh /usr/sbin/so-status
-rwxr-xr-x. 1 socore socore 6.1K Feb  2  2024 /usr/sbin/so-status

Here's a screenshot showing all of the /usr/sbin/so-* commands:

For more information, please see the documentation:
https://docs.securityonion.net/en/2.4/so-status.html
https://docs.securityonion.net/en/2.4/services.html