clong / DetectionLab

Automate the creation of a lab environment complete with security tooling and logging best practices
MIT License
4.57k stars 978 forks source link

Terraform failing #458

Closed hermitsy closed 4 years ago

hermitsy commented 4 years ago

Description of the issue:

Terrform doesn't seems to be working with latest build.

Error

aws_instance.logger (remote-exec): [05:03:35]: Installing Zeek...
aws_instance.logger (remote-exec): ERROR: no certificate subject alternative name matches
aws_instance.logger (remote-exec):  requested host name ‘download.opensuse.org’.
aws_instance.logger (remote-exec): To connect to download.opensuse.org insecurely, use `--no-check-certificate'.
aws_instance.logger: Still creating... [7m50s elapsed]
aws_instance.logger (remote-exec): W: GPG error: http://download.opensuse.org/repositories/security:/zeek/xUbuntu_18.04  InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 69D1B2AAEE3D166A
aws_instance.logger (remote-exec): E: The repository 'http://download.opensuse.org/repositories/security:/zeek/xUbuntu_18.04  InRelease' is not signed.
aws_instance.logger (remote-exec): E: Unable to locate package zeek
aws_instance.logger (remote-exec): /opt/DetectionLab/Vagrant/bootstrap.sh: line 304: pip: command not found
aws_instance.logger (remote-exec): /opt/DetectionLab/Vagrant/bootstrap.sh: line 305: zkg: command not found
aws_instance.logger (remote-exec): /opt/DetectionLab/Vagrant/bootstrap.sh: line 306: zkg: command not found
aws_instance.logger (remote-exec): /opt/DetectionLab/Vagrant/bootstrap.sh: line 307: zkg: command not found
aws_instance.logger (remote-exec): /opt/DetectionLab/Vagrant/bootstrap.sh: line 328: /opt/zeek/share/zeek/site/local.zeek: No such file or directory
aws_instance.logger (remote-exec): [Errno 2] No such file or directory: '/opt/zeek/etc/node.cfg'
aws_instance.logger (remote-exec): [Errno 2] No such file or directory: '/opt/zeek/etc/node.cfg'
aws_instance.logger (remote-exec): [Errno 2] No such file or directory: '/opt/zeek/etc/node.cfg'
aws_instance.logger (remote-exec): [Errno 2] No such file or directory: '/opt/zeek/etc/node.cfg'
aws_instance.logger (remote-exec): [Errno 2] No such file or directory: '/opt/zeek/etc/node.cfg'
aws_instance.logger (remote-exec): [Errno 2] No such file or directory: '/opt/zeek/etc/node.cfg'
aws_instance.logger (remote-exec): [Errno 2] No such file or directory: '/opt/zeek/etc/node.cfg'
aws_instance.logger (remote-exec): [Errno 2] No such file or directory: '/opt/zeek/etc/node.cfg'
aws_instance.logger (remote-exec): [Errno 2] No such file or directory: '/opt/zeek/etc/node.cfg'
aws_instance.logger (remote-exec): Created symlink /etc/systemd/system/multi-user.target.wants/zeek.service → /lib/systemd/system/zeek.service.
aws_instance.logger (remote-exec): Job for zeek.service failed because the control process exited with error code.
aws_instance.logger (remote-exec): See "systemctl status zeek.service" and "journalctl -xe" for details.
aws_instance.logger (remote-exec): cp: cannot stat '/opt/splunk/etc/apps/Splunk_TA_bro/default/inputs.conf': No such file or directory
aws_instance.logger (remote-exec): Stopping splunkd...
aws_instance.logger (remote-exec): Shutting down.  Please wait, as this may take a few minutes.
aws_instance.logger (remote-exec): .
aws_instance.logger (remote-exec): .
aws_instance.logger: Still creating... [8m0s elapsed]
aws_instance.logger (remote-exec): Stopping splunk helpers...
aws_instance.logger (remote-exec): Done.
aws_instance.logger (remote-exec): Splunk> Like an F-18, bro.
aws_instance.logger (remote-exec): Checking prerequisites...
aws_instance.logger (remote-exec):  Checking http port [8000]: open
aws_instance.logger (remote-exec):  Checking mgmt port [8089]: open
aws_instance.logger (remote-exec):  Checking appserver port [127.0.0.1:8065]: open
aws_instance.logger (remote-exec):  Checking kvstore port [8191]: open
aws_instance.logger (remote-exec):  Checking configuration... Done.
aws_instance.logger (remote-exec):  Checking critical directories...    Done
aws_instance.logger (remote-exec):  Checking indexes...
aws_instance.logger (remote-exec):      Validated: _audit _internal _introspection _metrics _metrics_rollup _telemetry _thefishbucket history main osquery osquery-status powershell summary suricata sysmon threathunting wineventlog zeek
aws_instance.logger (remote-exec):  Done
aws_instance.logger (remote-exec):  Checking filesystem compatibility...  Done
aws_instance.logger (remote-exec):  Checking conf files for problems...
aws_instance.logger (remote-exec):  Done
aws_instance.logger (remote-exec):  Checking default conf files for edits...
aws_instance.logger (remote-exec):  Validating installed files against hashes from '/opt/splunk/splunk-8.0.4-767223ac207f-linux-2.6-x86_64-manifest'
aws_instance.logger (remote-exec):  All installed files intact.
aws_instance.logger (remote-exec):  Done
aws_instance.logger (remote-exec): All preliminary checks passed.
aws_instance.logger (remote-exec): Starting splunk server daemon (splunkd)...
aws_instance.logger (remote-exec): Done
aws_instance.logger (remote-exec): Waiting for web server at https://127.0.0.1:8000 to be available
aws_instance.logger (remote-exec): .
aws_instance.logger (remote-exec): .
aws_instance.logger (remote-exec): . Done
Error: error executing "/tmp/terraform_1678971520.sh": Process exited with status 1
clong commented 4 years ago

Attempting to reproduce this now

clong commented 4 years ago

Maybe this was an intermittent issue? I'm unable to reproduce:

aws_instance.logger: Still creating... [11m11s elapsed]
aws_instance.logger (remote-exec): [01:09:44]: Installing Zeek...
aws_instance.logger (remote-exec): 2020-06-09 01:09:45 URL:https://download.opensuse.org/repositories/security:/zeek/xUbuntu_18.04/Release.key [1084/1084] -> "/tmp/Release.key" [1]
aws_instance.logger: Still creating... [11m21s elapsed]
aws_instance.logger (remote-exec): Extracting templates from packages: 90%
aws_instance.logger (remote-exec): Extracting templates from packages: 100%
aws_instance.logger (remote-exec): Preconfiguring packages ...
aws_instance.logger (remote-exec):
<snip>
aws_instance.logger (remote-exec): Collecting smmap2>=2.0.0 (from gitdb2<3,>=2->gitpython->zkg==2.1.1)
aws_instance.logger (remote-exec):   Downloading https://files.pythonhosted.org/packages/88/77/b1542b654fa594580fa82a1e0af4bf81074323d272a50a838c943e3de7b4/smmap2-3.0.1.tar.gz
aws_instance.logger (remote-exec): Collecting smmap>=3.0.1 (from smmap2>=2.0.0->gitdb2<3,>=2->gitpython->zkg==2.1.1)
aws_instance.logger (remote-exec):   Downloading https://files.pythonhosted.org/packages/b0/9a/4d409a6234eb940e6a78dfdfc66156e7522262f5f2fecca07dc55915952d/smmap-3.0.4-py2.py3-none-any.whl
aws_instance.logger (remote-exec): Installing collected packages: configparser, semantic-version, btest, smmap, smmap2, gitdb2, gitpython, zkg
aws_instance.logger (remote-exec):   Running setup.py install for btest ...
aws_instance.logger (remote-exec): done
aws_instance.logger (remote-exec):   Running setup.py install for smmap2 ...
aws_instance.logger (remote-exec): done
aws_instance.logger: Still creating... [11m41s elapsed]
aws_instance.logger (remote-exec): Successfully installed btest-0.61 configparser-4.0.2 gitdb2-2.0.6 gitpython-2.1.15 semantic-version-2.8.5 smmap-3.0.4 smmap2-3.0.1 zkg-2.1.1
aws_instance.logger (remote-exec): Refresh package source: zeek
aws_instance.logger (remote-exec):  No changes
aws_instance.logger (remote-exec): Refresh installed packages
aws_instance.logger (remote-exec):  No new outdated packages
aws_instance.logger (remote-exec): Successfully wrote config file to /home/ubuntu/.zkg/config
aws_instance.logger (remote-exec): Installed "zeek/salesforce/ja3" (master)
aws_instance.logger (remote-exec): Loaded "zeek/salesforce/ja3"
aws_instance.logger (remote-exec): Created symlink /etc/systemd/system/multi-user.target.wants/zeek.service → /lib/systemd/system/zeek.service.
clong commented 4 years ago

@hermitsy can you try again and let me know if this problem is persisting for you?

hermitsy commented 4 years ago

@hermitsy can you try again and let me know if this problem is persisting for you?

Seems to have resolved itself. Working on 18.04 and 20.04. Possibly issue with AWS or my network.

All good for now. Thanks mate.

clong commented 4 years ago

Cheers!