Airgap install manager, 401 Authorization Required, so-soc ERROR #1563

howsTricks · 2020-10-20T13:36:04Z

howsTricks
Oct 20, 2020

Working on doing an airgap install via ISO, using all default options only setting only the required fields when I head to the IP on https it loads the following URL and message

https://x.x.x.x/login/?request=0b4a3829-c1c1-4c5b-b0ea-4b0585c4a4ec

401 Authorization Required
nginx/1.17.10

I checked so-status and it shows everything OK except so-soc which shows ERROR. I tried so-soc-start and it shows the below, but afterwards so-status still shows so-soc as error.

[root@xxxhostname onionadmin]# so-soc-start

Starting soc...

This could take a while if another Salt job is running.
Run this command with --force to stop all Salt jobs before proceeding.

local:

      ID: socdir
Function: file.directory
    Name: /opt/so/conf/soc
  Result: True
 Comment: The directory /opt/so/conf/soc is in the correct state
 Started: 13:33:04.434270
Duration: 10.114 ms
 Changes:

      ID: socdatadir
Function: file.directory
    Name: /nsm/soc/jobs
  Result: True
 Comment: The directory /nsm/soc/jobs is in the correct state
 Started: 13:33:04.444556
Duration: 2.642 ms
 Changes:

      ID: soclogdir
Function: file.directory
    Name: /opt/so/log/soc
  Result: True
 Comment: The directory /opt/so/log/soc is in the correct state
 Started: 13:33:04.447370
Duration: 2.272 ms
 Changes:

      ID: socconfig
Function: file.managed
    Name: /opt/so/conf/soc/soc.json
  Result: True
 Comment: File /opt/so/conf/soc/soc.json is in the correct state
 Started: 13:33:04.449806
Duration: 107.318 ms
 Changes:

      ID: socchanges
Function: file.managed
    Name: /opt/so/conf/soc/changes.json
  Result: True
 Comment: File /opt/so/conf/soc/changes.json is in the correct state
 Started: 13:33:04.557336
Duration: 16.346 ms
 Changes:

      ID: so-soc
Function: docker_container.running
  Result: True
 Comment: Created container 'so-soc'
 Started: 13:33:04.644864
Duration: 1730.291 ms
 Changes:
          ----------
          container_id:
              ----------
              added:
                  f58947ce7183d2c296d9edbb34ef74a6ba227898be66aef81dc8760534cfe2c6
          state:
              ----------
              new:
                  running
              old:
                  None

      ID: kratosgroup
Function: group.present
    Name: kratos
  Result: True
 Comment: Group kratos is present and up to date
 Started: 13:33:06.376751
Duration: 7.134 ms
 Changes:

      ID: kratos
Function: user.present
  Result: True
 Comment: User kratos is present and up to date
 Started: 13:33:06.384780
Duration: 39.662 ms
 Changes:

      ID: kratosdir
Function: file.directory
    Name: /opt/so/conf/kratos/db
  Result: True
 Comment: The directory /opt/so/conf/kratos/db is in the correct state
 Started: 13:33:06.424648
Duration: 2.72 ms
 Changes:

      ID: kratoslogdir
Function: file.directory
    Name: /opt/so/log/kratos
  Result: True
 Comment: The directory /opt/so/log/kratos is in the correct state
 Started: 13:33:06.427533
Duration: 2.325 ms
 Changes:

      ID: kratossync
Function: file.recurse
    Name: /opt/so/conf/kratos
  Result: True
 Comment: The directory /opt/so/conf/kratos is in the correct state
 Started: 13:33:06.430027
Duration: 76.967 ms
 Changes:

      ID: so-kratos
Function: docker_container.running
  Result: True
 Comment: Container 'so-kratos' is already configured as specified
 Started: 13:33:06.508086
Duration: 1892.982 ms
 Changes:

Summary for local

Succeeded: 12 (changed=1)
Failed: 0

Total states run: 12
Total run time: 3.891 s

I checked the nginx logs and it shows the following, maybe related?

2020/10/20 13:27:07 [error] 7#7: *1 open() "/opt/socore/html/kolide.launcher.QueryTarget/GetTargets" failed (2: No such file or directory), client: x.x.x.x, server: _, request: "POST /kolide.launcher.QueryTarget/GetTargets HTTP/2.0", host: "x.x.x.x"
2020/10/20 13:28:07 [error] 7#7: *1 open() "/opt/socore/html/kolide.launcher.QueryTarget/GetTargets" failed (2: No such file or directory), client: x.x.x.x, server: _, request: "POST /kolide.launcher.QueryTarget/GetTargets HTTP/2.0", host: "x.x.x.x"
2020/10/20 13:29:07 [error] 7#7: *1 open() "/opt/socore/html/kolide.launcher.QueryTarget/GetTargets" failed (2: No such file or directory), client: x.x.x.x, server: _, request: "POST /kolide.launcher.QueryTarget/GetTargets HTTP/2.0", host: "x.x.x.x"
2020/10/20 13:29:43 [error] 7#7: *271 connect() failed (111: Connection refused) while connecting to upstream, client: y.y.y.y, server: _, request: "GET /login/?request=0b4a3829-c1c1-4c5b-b0ea-4b0585c4a4ec HTTP/2.0", upstream: "http://x.x.x.x:9822/login/?request=0b4a3829-c1c1-4c5b-b0ea-4b0585c4a4ec", host: "x.x.x.x"
2020/10/20 13:29:43 [error] 7#7: *271 connect() failed (111: Connection refused) while connecting to upstream, client: y.y.y.y, server: _, request: "GET /login/?request=08e420bd-ceb4-4fcb-a19d-85ddbf7c11c6 HTTP/2.0", upstream: "http://1x.x.x.x:9822/login/?request=08e420bd-ceb4-4fcb-a19d-85ddbf7c11c6", host: "x.x.x.x", referrer: "https://x.x.x.x/login/?request=0b4a3829-c1c1-4c5b-b0ea-4b0585c4a4ec"
2020/10/20 13:30:07 [error] 7#7: *1 open() "/opt/socore/html/kolide.launcher.QueryTarget/GetTargets" failed (2: No such file or directory), client: x.x.x.x, server: _, request: "POST /kolide.launcher.QueryTarget/GetTargets HTTP/2.0", host: "x.x.x.x"
2020/10/20 13:31:07 [error] 7#7: *1 open() "/opt/socore/html/kolide.launcher.QueryTarget/GetTargets" failed (2: No such file or directory), client: x.x.x.x, server: _, request: "POST /kolide.launcher.QueryTarget/GetTargets HTTP/2.0", host: "x.x.x.x"
2020/10/20 13:32:07 [error] 7#7: *1 open() "/opt/socore/html/kolide.launcher.QueryTarget/GetTargets" failed (2: No such file or directory), client: x.x.x.x, server: _, request: "POST /kolide.launcher.QueryTarget/GetTargets HTTP/2.0", host: "x.x.x.x"
2020/10/20 13:33:07 [error] 7#7: *1 open() "/opt/socore/html/kolide.launcher.QueryTarget/GetTargets" failed (2: No such file or directory), client: x.x.x.x, server: _, request: "POST /kolide.launcher.QueryTarget/GetTargets HTTP/2.0", host: "x.x.x.x"
2020/10/20 13:34:07 [error] 7#7: *1 open() "/opt/socore/html/kolide.launcher.QueryTarget/GetTargets" failed (2: No such file or directory), client: x.x.x.x, server: _, request: "POST /kolide.launcher.QueryTarget/GetTargets HTTP/2.0", host: "x.x.x.x"

Answered by TOoSmOotH

Oct 20, 2020

4a9fcfb

Do that and it will fix it. Line 58 needs a "

View full answer

TOoSmOotH · 2020-10-20T14:10:55Z

TOoSmOotH
Oct 20, 2020
Maintainer

Did you select ip, hostname, or other during the install?

cat /opt/so/saltstack/local/pillar/global.sls | grep url_base

You need to access it via that value.

0 replies

howsTricks · 2020-10-20T14:21:11Z

howsTricks
Oct 20, 2020
Author

I left it as default selecting IP, and am trying to reach it via that IP. Here's the output of the command:

url_base: 'x.x.x.x' (matches the host IP and all of the x.x.x.x logs above).

0 replies

howsTricks · 2020-10-20T14:22:59Z

howsTricks
Oct 20, 2020
Author

I found a potentially similar issue: #1546

In checking that thread, I am seeing similar logs on my manger host:

[root@xxxhostname onionadmin]# docker logs so-soc
Error: Unable to read configuration file 'sensoroni.json' [invalid character '\n' in string literal]
2020/10/20 13:33:05 error Syntax error reading json object error=invalid character '\n' in string literal offset=817
2020/10/20 13:41:53 error Syntax error reading json object error=invalid character '\n' in string literal offset=817
Error: Unable to read configuration file 'sensoroni.json' [invalid character '\n' in string literal]
Error: Unable to read configuration file 'sensoroni.json' [invalid character '\n' in string literal]
2020/10/20 13:56:52 error Syntax error reading json object error=invalid character '\n' in string literal offset=817
Error: Unable to read configuration file 'sensoroni.json' [invalid character '\n' in string literal]
2020/10/20 14:11:53 error Syntax error reading json object error=invalid character '\n' in string literal offset=817

0 replies

darth-drew · 2020-10-20T14:23:50Z

darth-drew
Oct 20, 2020

I am having the same issue, but using hostname.

…

On Tue, Oct 20, 2020 at 10:21 AM howsTricks ***@***.***> wrote: I left it as default selecting IP, and am trying to reach it via that IP. Here's the output of the command: url_base: 'x.x.x.x' (matches the host IP and all of the x.x.x.x logs above). — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1563 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADC5ZNX2UHEHBPOTBM5ZGLDSLWMGVANCNFSM4SYLUFUQ> .

-- Andrew R. Albertson C: (540)908-8551

0 replies

TOoSmOotH · 2020-10-20T14:45:54Z

TOoSmOotH
Oct 20, 2020
Maintainer

Can one of you post the sensoroni.json in /opt/so/conf/soc?

0 replies

howsTricks · 2020-10-20T14:48:04Z

howsTricks
Oct 20, 2020
Author

I only have soc.json and changes.json in that folder:

[root@xxxhostname onionadmin]# ls /opt/so/conf/soc/
changes.json soc.json

0 replies

darth-drew · 2020-10-20T14:49:52Z

darth-drew
Oct 20, 2020

Same.

…

On Tue, Oct 20, 2020 at 10:48 AM howsTricks ***@***.***> wrote: I only have soc.json and changes.json in that folder: ***@***.*** onionadmin]# ls /opt/so/conf/soc/ changes.json soc.json — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1563 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADC5ZNR4ARKICOEZ4GHVIZLSLWPLNANCNFSM4SYLUFUQ> .

-- Andrew R. Albertson C: (540)908-8551

0 replies

TOoSmOotH · 2020-10-20T14:53:28Z

TOoSmOotH
Oct 20, 2020
Maintainer

sorry /opt/so/conf/sensoroni/sensoroni.json

0 replies

darth-drew · 2020-10-20T14:55:41Z

darth-drew
Oct 20, 2020

Directory /opt/so/conf/sensoroni does not exist

…

On Tue, Oct 20, 2020 at 10:53 AM Mike Reeves ***@***.***> wrote: sorry /opt/so/conf/sensoroni/sensoroni.json — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1563 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADC5ZNTIQYRYRYQVFCZYKIDSLWP7TANCNFSM4SYLUFUQ> .

-- Andrew R. Albertson C: (540)908-8551

0 replies

howsTricks · 2020-10-20T14:57:04Z

howsTricks
Oct 20, 2020
Author

I don't have anything called sensoroni in the /opt/so/conf folder:

[root@xxxhostname onionadmin]# ls /opt/so/conf/
aptcacher-ng cortex elastalert filebeat grafana influxdb kratos logstash navigator redis soctopus thehive
ca docker-registry elasticsearch fleet idstools kibana log-rotate.conf mysql nginx soc telegraf wazuh

However, I think maybe /opt/so/conf/soc/soc.conf is mapped to sensoroni.conf in the docker container? If helpful, here is that file. Note there is a empty first line, wondering if that is causing issues?

https://pastebin.com/ruUbFPfr

0 replies

TOoSmOotH · 2020-10-20T15:14:39Z

TOoSmOotH
Oct 20, 2020
Maintainer

ok I created an issue for this. I see the problem.

0 replies

darth-drew · 2020-10-20T15:16:42Z

darth-drew
Oct 20, 2020

Awesome. Thanks Mike. Let me know if there is anything I can do to help!

…

On Tue, Oct 20, 2020 at 11:14 AM Mike Reeves ***@***.***> wrote: ok I created an issue for this. I see the problem. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1563 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADC5ZNXRKSEWRRFGM3MOLYTSLWSPBANCNFSM4SYLUFUQ> .

-- Andrew R. Albertson C: (540)908-8551

0 replies

TOoSmOotH · 2020-10-20T15:20:04Z

TOoSmOotH
Oct 20, 2020
Maintainer

Change line 19 in /opt/so/saltstack/default/salt/soc/files/soc/soc.json
{%- if ISAIRGAP is sameas true -%}
to
{%- if ISAIRGAP is sameas true %}

1 reply

TOoSmOotH Oct 20, 2020
Maintainer

Then do a so-soc-restart

TOoSmOotH · 2020-10-20T15:22:18Z

TOoSmOotH
Oct 20, 2020
Maintainer

line 57 needs the same treatment as well.

0 replies

darth-drew · 2020-10-20T15:27:50Z

darth-drew
Oct 20, 2020

Both lines changed. Situation remains. So-status showing error for so-soc

1 reply

TOoSmOotH Oct 20, 2020
Maintainer

What does soc.json look like now?

darth-drew · 2020-10-20T15:32:14Z

darth-drew
Oct 20, 2020

Looks like both lines took the change. I am not able to transfer between networks. Should I be looking for something in particular?

…

On Tue, Oct 20, 2020 at 11:30 AM Mike Reeves ***@***.***> wrote: What does soc.json look like now? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1563 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADC5ZNXM3XCEQ3WE7DBWP3TSLWUJRANCNFSM4SYLUFUQ> .

-- Andrew R. Albertson C: (540)908-8551

1 reply

TOoSmOotH Oct 20, 2020
Maintainer

Should look something like this:

[root@standalone ~]# cat /opt/so/conf/soc/soc.json

{
"logFilename": "/opt/sensoroni/logs/sensoroni-server.log",
"server": {
"bindAddress": "0.0.0.0:9822",
"baseUrl": "/",
"maxPacketCount": 5000,
"htmlDir": "html",
"airgapEnabled": true,
"modules": {
"filedatastore": {
"jobDir": "jobs"

darth-drew · 2020-10-20T15:42:40Z

darth-drew
Oct 20, 2020

That chunk of code looks identical (minus some whitespace). Note: /opt/sensoroni DNE

…

On Tue, Oct 20, 2020 at 11:35 AM Mike Reeves ***@***.***> wrote: Should look something like this: ***@***.*** ~]# cat /opt/so/conf/soc/soc.json { "logFilename": "/opt/sensoroni/logs/sensoroni-server.log", "server": { "bindAddress": "0.0.0.0:9822", "baseUrl": "/", "maxPacketCount": 5000, "htmlDir": "html", "airgapEnabled": true, "modules": { "filedatastore": { "jobDir": "jobs" — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1563 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADC5ZNU5YEOYIIO4YIH4E2DSLWU3FANCNFSM4SYLUFUQ> .

-- Andrew R. Albertson C: (540)908-8551

1 reply

TOoSmOotH Oct 20, 2020
Maintainer

how about running:

sudo docker stop so-soc
sudo docker rm so-soc
sudo salt-call state.apply soc

Then try incognito mode on the browser

darth-drew · 2020-10-20T15:59:04Z

darth-drew
Oct 20, 2020

salt is busy right now. I'll check back soon.

…

On Tue, Oct 20, 2020 at 11:56 AM Mike Reeves ***@***.***> wrote: how about running: sudo docker stop so-soc sudo docker rm so-soc sudo salt-call state.apply soc Then try incognito mode on the browser — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1563 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADC5ZNVVRKPQQKYL5ON5F73SLWXKFANCNFSM4SYLUFUQ> .

-- Andrew R. Albertson C: (540)908-8551

0 replies

darth-drew · 2020-10-20T16:19:46Z

darth-drew
Oct 20, 2020

Sir, Looks like we are still in the same state. Is it worth doing a reboot? On Tue, Oct 20, 2020 at 11:56 AM Andrew Albertson < [email protected]> wrote:

…

salt is busy right now. I'll check back soon. On Tue, Oct 20, 2020 at 11:56 AM Mike Reeves ***@***.***> wrote: > how about running: > > sudo docker stop so-soc > sudo docker rm so-soc > sudo salt-call state.apply soc > > Then try incognito mode on the browser > > — > You are receiving this because you commented. > Reply to this email directly, view it on GitHub > <#1563 (reply in thread)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ADC5ZNVVRKPQQKYL5ON5F73SLWXKFANCNFSM4SYLUFUQ> > . > -- Andrew R. Albertson C: (540)908-8551

-- Andrew R. Albertson C: (540)908-8551

1 reply

TOoSmOotH Oct 20, 2020
Maintainer

I am going a fresh install to see what the deal is

darth-drew · 2020-10-20T16:22:11Z

darth-drew
Oct 20, 2020

Thanks for your energy on this. Standing by.

…

On Tue, Oct 20, 2020 at 12:20 PM Mike Reeves ***@***.***> wrote: I am going a fresh install to see what the deal is — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1563 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADC5ZNU4ZJDJOOMXUD3WP43SLW2ERANCNFSM4SYLUFUQ> .

-- Andrew R. Albertson C: (540)908-8551

0 replies

TOoSmOotH · 2020-10-20T17:18:27Z

TOoSmOotH
Oct 20, 2020
Maintainer

4a9fcfb

Do that and it will fix it. Line 58 needs a "

0 replies

darth-drew · 2020-10-20T17:23:00Z

darth-drew
Oct 20, 2020

That fixed my issue!! Thanks!!!

…

On Tue, Oct 20, 2020 at 1:18 PM Mike Reeves ***@***.***> wrote: 4a9fcfb <4a9fcfb> Do that and it will fix it. Line 58 needs a " — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1563 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADC5ZNTABQBNP2AWQGHFWSDSLXA7HANCNFSM4SYLUFUQ> .

-- Andrew R. Albertson C: (540)908-8551

0 replies

howsTricks · 2020-10-21T06:35:04Z

howsTricks
Oct 21, 2020
Author

Hi @TOoSmOotH Thanks for the help! I did the changes in a119d8f and 4a9fcfb and was able to start the soc container using the commands you mentioned:

sudo docker stop so-soc
sudo docker rm so-soc
sudo salt-call state.apply soc

0 replies

gr8matt · 2020-10-21T18:32:32Z

gr8matt
Oct 21, 2020

All, I have this same issue and after running through all the fixes listed above, I am still seeing the so-soc ERROR. Any thoughts on what else may be going on? I am AirGapped and running by IP, not hostname. While I cannot copy and paste configs (due to airgap), I can post screenshots if needed.

3 replies

TOoSmOotH Oct 21, 2020
Maintainer

Did you fix /docs?

gr8matt Oct 21, 2020

Yes, I did both...

To reiterate what I have done, I fixed the dash in lines 19 and 57 and also added the quotes in /docs/"...

I then ran the:
sudo docker stop so-soc
sudo docker rm so-soc
sudo salt-call state.apply soc

When I run the #docker logs so-soc
I am still seeing some errors:

When I do the so-status, everything is happy except for so-soc which has the ERROR and I get the 401 Authorization Error when I run (incognito mode or not).

Thanks for your help!

Matt

TOoSmOotH Oct 21, 2020
Maintainer

hrm ok. We are in the final testing for 2.3.1 and it will address this issue. Not sure what line in there is tripping you up.

Airgap install manager, 401 Authorization Required, so-soc ERROR #1563

Uh oh!

Uh oh!

[root@xxxhostname onionadmin]# so-soc-start

This could take a while if another Salt job is running. Run this command with --force to stop all Salt jobs before proceeding.

local:

Summary for local

Succeeded: 12 (changed=1) Failed: 0

Replies: 24 comments · 8 replies

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

howsTricks Oct 20, 2020 Author

Uh oh!

Uh oh!

howsTricks Oct 20, 2020 Author

Uh oh!

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

howsTricks Oct 20, 2020 Author

Uh oh!

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

Uh oh!

howsTricks Oct 20, 2020 Author

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

Uh oh!

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

Uh oh!

TOoSmOotH Oct 20, 2020 Maintainer

Uh oh!

Uh oh!

howsTricks Oct 21, 2020 Author

Uh oh!

Uh oh!

TOoSmOotH Oct 21, 2020 Maintainer

Uh oh!

Uh oh!

This could take a while if another Salt job is running.
Run this command with --force to stop all Salt jobs before proceeding.

Succeeded: 12 (changed=1)
Failed: 0

Replies: 24 comments 8 replies

TOoSmOotH
Oct 20, 2020
Maintainer

howsTricks
Oct 20, 2020
Author

howsTricks
Oct 20, 2020
Author

TOoSmOotH
Oct 20, 2020
Maintainer

howsTricks
Oct 20, 2020
Author

TOoSmOotH
Oct 20, 2020
Maintainer

howsTricks
Oct 20, 2020
Author

TOoSmOotH
Oct 20, 2020
Maintainer

TOoSmOotH
Oct 20, 2020
Maintainer

TOoSmOotH Oct 20, 2020
Maintainer

TOoSmOotH
Oct 20, 2020
Maintainer

TOoSmOotH Oct 20, 2020
Maintainer

TOoSmOotH Oct 20, 2020
Maintainer

TOoSmOotH Oct 20, 2020
Maintainer

TOoSmOotH Oct 20, 2020
Maintainer

TOoSmOotH
Oct 20, 2020
Maintainer

howsTricks
Oct 21, 2020
Author

TOoSmOotH Oct 21, 2020
Maintainer