search

philhagen / sof-elk

Configuration files for the SOF-ELK VM
GNU General Public License v3.0
1.47k stars 276 forks source link

Ansible errors when trying to intall to CentOS AWS instance #239

Closed matthewthomaskelly closed 2 years ago

matthewthomaskelly commented 2 years ago

I have a CentOS 7.9.2009 (Core) AWS instance that I am trying to install SOF-ELK to. This is with the aim of using this within a live Incident Response environment. At present I am receiving multiple errors when running the ansibe code relating to installation. I am struggling to get these in their entirity at this moment, but they all relate to "Processing Dependency ... for package..." finishing with a message that states: _"Finished Dependency Resolution You could try using --skip-broken to work around the problem You could try running: rpm -Va --nofiles --nodigest" Your thought or direction would be greatly appreciated. Are there any other issues I am likely to encounter, please? I know this isn't how your system is designed to be installed... Much appreciated

philhagen commented 2 years ago

I'd need more detail on which dependency is failing but if you can grab that, I'd be happy to try and assist.

matthewthomaskelly commented 2 years ago

Thanks a lot Phil. Please find a copy/paste effort of the specific error in its entirity CentOSLOG.txt .

philhagen commented 2 years ago

I think I see what may be some/all of the issue but will take some time before I can test... hope to take a closer look and provide candidate to fix soon though

philhagen commented 2 years ago

looks like the CERT repo went all sideways with some package consolidation and ensuing dependency hell. I changed over to the RPM Fusion repo for the one package we pulled from CERT with 699b115fae9b92d8fd62547ee534b1c5e76192c4. Should be good now. (be sure to git pull the SOF-ELK repo if you are re-trying on the same instance.)

Closing but please re-open if same issue persists. If it's something else, please open a new issue.

matthewthomaskelly commented 2 years ago

Awesome, thank you Phil. I got this to work on a minimal instance of CentOS using Virtual Box. This was suffering from same error. I also got this to work on our specific AWS instance of Cent OS, but I had to force disable of a bespoke forensics repo in repolist.

philhagen commented 2 years ago

hm - that sounds like the install is still using an old version. the CERT forensics repo has been totally removed. what git branch are you using that fails?

matthewthomaskelly commented 2 years ago

I was using main, but happy to checkout another branch if you advise. The CentOS instance is version 7.9.2009 (core) I'm not sure if this is included because of AWS or my team, I'll find out...

matthewthomaskelly commented 2 years ago

Had to make further changes in Kibana.yml to get the front end working in my workspace.

philhagen commented 2 years ago

ok, the fix was added to main so that should be fine. what changes were needed in kibana.yml? Again, the build I did here worked on a CentOS 7 system, so I'm not sure what the disconnect may be.

matthewthomaskelly commented 2 years ago

I needed to explicitly state the up ov the device for listening against port 5601.

philhagen commented 2 years ago

very strange. default of server.host: "0.0.0.0" has it listen on all interfaces. Explicit IP is not needed.

matthewthomaskelly commented 2 years ago

It timing out connection when 0.0.0.0

matthewthomaskelly commented 2 years ago

My bad. It works, I suspect Kiban service wasn't started!