[CLI] Installation on Ubuntu desktop fails

[TheZonks]

Hello,

i tried to install sift workstation on several ubuntu installations, all with the same result. what i have done is: installing a clean ubuntu vm with virtualbox. created user siftadmin running apt-get update running apt-get upgrade running apt-get dist-upgrade used versions: ubuntu server 16.04.04 LTS minimal (no unity) ubuntu desktop 16.04.04 LTS with unitiy

Environment (from the last test): Distributor ID: Ubuntu Description: Ubuntu 16.04.4 LTS Release: 16.04 Codename: xenial

Linux siftworkstation 4.13.0-38-generic #43~16.04.1-Ubuntu SMP Wed Mar 14 17:48:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Console-Log:

downloading v2018.08.0

downloading sift-saltstack-v2018.08.0.tar.gz.asc downloading sift-saltstack-v2018.08.0.tar.gz.sha256 downloading sift-saltstack-v2018.08.0.tar.gz.sha256.asc downloading sift-saltstack-v2018.08.0.tar.gz validating file sift-saltstack-v2018.08.0.tar.gz validating signature for sift-saltstack-v2018.08.0.tar.gz.sha256 extracting update sift-saltstack-v2018.08.0.tar.gz performing update v2018.08.0 Log file: /var/cache/sift/cli/v2018.08.0/saltstack.log

Running: python-software-properties Running: apt-transport-https Running: deb https://apt.dockerproject.org/repo ubuntu-xenial main Running: sift-gift-dev Running: gift Running: sift-dev Running: sift-repo Running: software-properties-common Running: noobslab-themes Running: noobslab-icons Running: openjdk-repo Running: deb http://archive.ubuntu.com/ubuntu/ xenial multiverse Running: deb http://archive.ubuntu.com/ubuntu/ xenial-security multiverse Running: deb http://archive.ubuntu.com/ubuntu/ xenial universe Running: ubuntutweak Running: sift-repos Running: binplist Running: unity-webapps-common Running: aeskeyfind Running: afflib-tools Running: afterglow Running: aircrack-ng Running: apache2 Running: arp-scan Running: autopsy Running: bcrypt Running: bitpim Running: bitpim-lib Running: bkhive Running: bless Running: blt Running: build-essential Running: bulk-extractor Running: cabextract Running: ccrypt Running: cifs-utils Running: clamav Running: cmospwd Running: cryptcat Running: cryptsetup Running: curl Running: dc3dd Running: dcfldd Running: dconf-tools Running: docker-engine Running: driftnet Running: dsniff Running: dumbpig Running: e2fslibs-dev Running: ent Running: epic5 Running: etherape Running: ettercap-graphical Running: exfat-fuse Running: exfat-utils Running: exif Running: extundelete Running: fdupes Running: feh Running: flasm Running: flex Running: foremost Running: g++ Running: gawk Running: gcc Running: gdb Running: gddrescue Running: ghex Running: git Running: graphviz Running: gthumb Running: gzrt Running: hexedit Running: htop Running: hydra Running: hydra-gtk Running: ipython Running: jq Running: kdiff3 Running: knocker Running: kpartx Running: lft Running: libafflib-dev Running: libafflib0v5 Running: libbde Running: libbde-tools Running: libesedb Running: libesedb-tools Running: libevt Running: libevt-tools Running: libevtx Running: libevtx-tools Running: libewf Running: libewf-dev Running: libewf-python Running: libewf-tools Running: libffi-dev Running: libfuse-dev Running: libfvde Running: libfvde-tools Running: liblightgrep Running: libmsiecf Running: libncurses5-dev Running: libnet1 Running: libolecf Running: libparse-win32registry-perl Running: libpff Running: libpff-dev Running: libpff-python Running: libpff-tools Running: libplist-utils Running: libregf Running: libregf-dev Running: libregf-python Running: libregf-tools Running: libssl-dev Running: libtext-csv-perl Running: libvmdk Running: libvshadow Running: libvshadow-dev Running: libvshadow-python Running: libvshadow-tools Running: libxml2-dev Running: libxslt-dev Running: md5deep Running: nbd-client Running: nbtscan Running: netcat Running: netpbm Running: netsed Running: netwox Running: nfdump Running: ngrep Running: nikto Running: okular Running: open-iscsi Running: openjdk-7-jdk Running: ophcrack Running: ophcrack-cli Running: outguess Running: p0f Running: p7zip-full Running: pdftk Running: perl Running: perl -MCPAN -e 'my $c = "CPAN::HandleConfig"; $c->load(doit => 1, autoconfig => 1); $c->edit(prerequisites_policy => "follow"); $c->edit(build_requires_install_policy => "yes"); $c->commit' Running: pev Running: phonon Running: pkg-config Running: python-plaso Running: python-dfvfs Running: python3-xlsxwriter Running: python-xlsxwriter Running: python-dfvfs Running: python-plaso Running: plaso-tools Running: /var/cache/sift/archives/powershell_6.0.0-alpha.13-1ubuntu1.16.04.1_amd64.deb Running: sift-powershell Running: pv Running: pyew Running: python Running: python-dev Running: python-flowgrep Running: python-fuse Running: python-nids Running: python-ntdsxtract Running: python-pefile Running: python-pip Running: pytsk3 Running: python-pytsk3 Running: python-qt4 Running: python-tk Running: python-virtualenv Running: colorama Running: construct Running: dpapick Running: distorm3 Running: haystack Running: pefile Running: pycoin Running: pysocks Running: simplejson Running: yara-python Running: python-volatility Running: /usr/lib/python2.7/dist-packages/volatility/plugins/sift/ Running: /usr/lib/python2.7/dist-packages/volatility/plugins/malprocfind.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/idxparser.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/chromehistory.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/mimikatz.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/openioc_scan.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/pstotal.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/firefoxhistory.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/autoruns.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/malfinddeep.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/prefetch.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/baseline.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/ssdeepscan.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/uninstallinfo.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/trustrecords.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/usnparser.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/apihooksdeep.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/editbox.py Running: /usr/lib/python2.7/dist-packages/volatility/plugins/javarat.py Running: python-yara Running: qemu Running: qemu-utils Running: radare2 Running: rar Running: readpst Running: rsakeyfind Running: safecopy Running: samba Running: samdump2 Running: scalpel Running: sleuthkit Running: socat Running: ssdeep Running: ssldump Running: sslsniff Running: stunnel4 Running: system-config-samba Running: tcl Running: tcpflow Running: tcpick Running: tcpreplay Running: tcpslice Running: tcpstat Running: tcptrace Running: tcptrack Running: tcpxtract Running: testdisk Running: tofrodos Running: transmission Running: unity-control-center Running: unrar Running: upx-ucl Running: vbindiff Running: vim Running: virtuoso-minimal Running: vmfs-tools Running: winbind Running: dpkg --add-architecture i386 Running: sift-wine-apt-update Running: wine Running: wireshark Running: xdot Running: xfsprogs Running: xmount Running: xpdf Running: zenity Running: analyzemft Running: argparse Running: bitstring Running: docopt Running: geoip2 Running: pip Running: python-dateutil >= 2.4.2 Running: python-evtx Running: python-magic Running: python-registry Running: setuptools Running: wheel Running: /opt/rekall Running: rekall Running: six Running: timesketch Running: unicodecsv Running: usnparser Running: virustotal-api Running: windowsprefetch Running: /usr/local/src/densityscout/densityscout_build_45_linux Running: /usr/local/bin/densityscout-build-45 Running: /usr/local/bin/densityscout Running: /usr/local/bin/sift Running: https://github.com/cheeky4n6monkey/4n6-scripts.git Running: /usr/local/bin/WP8_AppPerms.py Running: /usr/local/bin/bing-bar-parser.pl Running: /usr/local/bin/chunkymonkey.py Running: /usr/local/bin/dextract.def Running: /usr/local/bin/dextract.py Running: /usr/local/bin/docx-font-extractor.pl Running: /usr/local/bin/exif2map.pl Running: /usr/local/bin/fbmsg-extractor.py Running: /usr/local/bin/gis4cookie.pl Running: /usr/local/bin/google-ei-time.py Running: /usr/local/bin/imgcache-parse-mod.py Running: /usr/local/bin/imgcache-parse.py Running: /usr/local/bin/json-printer.pl Running: /usr/local/bin/msoffice-pic-extractor.py Running: /usr/local/bin/plist2db.py Running: /usr/local/bin/print_apk_perms.py Running: /usr/local/bin/s2-cellid2latlong.py Running: /usr/local/bin/s2-latlong2cellid.py Running: /usr/local/bin/sms-grep-sample-config.txt Running: /usr/local/bin/sms-grep.pl Running: /usr/local/bin/sqlite-base64-decode.py Running: /usr/local/bin/sqlite-blob-dumper.py Running: /usr/local/bin/sqlite-parser.pl Running: /usr/local/bin/squirrelgripper-README.txt Running: /usr/local/bin/squirrelgripper.pl Running: /usr/local/bin/timediff32.pl Running: /usr/local/bin/vmail-db-2-html.pl Running: /usr/local/bin/wp8-1-callhistory.py Running: /usr/local/bin/wp8-1-contacts.py Running: /usr/local/bin/wp8-1-mms-filesort.py Running: /usr/local/bin/wp8-1-mms.py Running: /usr/local/bin/wp8-1-sms.py Running: /usr/local/bin/wp8-callhistory.py Running: /usr/local/bin/wp8-contacts.py Running: /usr/local/bin/wp8-fb-msg.py Running: /usr/local/bin/wp8-sha256-pin-finder.py Running: /usr/local/bin/wp8-sms.py Running: /usr/local/bin/wwf-chat-parser.py Running: /usr/local/bin/amcache.py Running: /usr/local/bin/amcache.py Running: /usr/local/bin/dump-mft-entry.pl Running: /usr/local/bin/dump-mft-entry.pl Running: /usr/local/bin/imageMounter.py Running: /usr/local/bin/idx_parser.py Running: /usr/local/bin/jobparser.py Running: https://github.com/keydet89/Tools.git Running: /usr/local/bin/bodyfile.pl Running: /usr/local/bin/bodyfile.pl Running: /usr/local/bin/evtparse.pl Running: /usr/local/bin/evtparse.pl Running: /usr/local/bin/evtrpt.pl Running: /usr/local/bin/evtrpt.pl Running: /usr/local/bin/evtxparse.pl Running: /usr/local/bin/evtxparse.pl Running: /usr/local/bin/fb.pl Running: /usr/local/bin/fb.pl Running: /usr/local/bin/ff.pl Running: /usr/local/bin/ff.pl Running: /usr/local/bin/ff_signons.pl Running: /usr/local/bin/ff_signons.pl Running: /usr/local/bin/ftkparse.pl Running: /usr/local/bin/ftkparse.pl Running: /usr/local/bin/idx.pl Running: /usr/local/bin/idx.pl Running: /usr/local/bin/idxparse.pl Running: /usr/local/bin/idxparse.pl Running: /usr/local/bin/jl.pl Running: /usr/local/bin/jl.pl Running: /usr/local/bin/jobparse.pl Running: /usr/local/bin/jobparse.pl Running: /usr/local/bin/lfle.pl Running: /usr/local/bin/lfle.pl Running: /usr/local/bin/lnk.pl Running: /usr/local/bin/lnk.pl Running: /usr/local/bin/mft.pl Running: /usr/local/bin/mft.pl Running: /usr/local/bin/parse.pl Running: /usr/local/bin/parse.pl Running: /usr/local/bin/parsei30.pl Running: /usr/local/bin/parsei30.pl Running: /usr/local/bin/parseie.pl Running: /usr/local/bin/parseie.pl Running: /usr/local/bin/pie.pl Running: /usr/local/bin/pie.pl Running: /usr/local/bin/pref.pl Running: /usr/local/bin/pref.pl Running: /usr/local/bin/rawie.pl Running: /usr/local/bin/rawie.pl Running: /usr/local/bin/recbin.pl Running: /usr/local/bin/recbin.pl Running: /usr/local/bin/regslack.pl Running: /usr/local/bin/regslack.pl Running: /usr/local/bin/regtime.pl Running: /usr/local/bin/regtime.pl Running: /usr/local/bin/rfc.pl Running: /usr/local/bin/rfc.pl Running: /usr/local/bin/rlo.pl Running: /usr/local/bin/rlo.pl Running: /usr/local/bin/tln.pl Running: /usr/local/bin/tln.pl Running: /usr/local/bin/usnj.pl Running: /usr/local/bin/usnj.pl Running: /usr/local/bin/packerid.py Running: /usr/local/bin/packerid.py Running: /usr/local/bin Running: /usr/local/bin/parseusn.py Running: /usr/local/bin Running: /usr/local/bin/pecarve.py Running: /usr/local/bin/pecarve.py Running: /usr/local/bin/pescanner.py Running: https://github.com/keydet89/RegRipper2.8.git Running: /usr/share/regripper Running: /usr/share/regripper/rip.pl Running: /usr/share/regripper/plugins Running: /usr/local/bin/rip.pl Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "All" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/all Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "All" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/all Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "NTUSER" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/ntuser Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "NTUSER" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/ntuser Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "USRCLASS" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/usrclass Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "USRCLASS" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/usrclass Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "SAM" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/sam Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "SAM" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/sam Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "Security" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/security Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "Security" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/security Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "Software" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/software Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "Software" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/software Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "System" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/system Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "System" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/system Running: /usr/local/bin/set-display-scale Running: /usr/local/bin/ShimCacheParser.py Running: /usr/local/bin/ShimCacheParser.py Running: /usr/share/sift/resources Running: /usr/share/sift/images Running: /usr/share/sift/audio Running: /usr/share/sift/other Running: /usr/share/sift/scripts Running: /usr/share/sift Running: /usr/share/tsk/sorter Running: /usr/share/tsk/sorter Running: /usr/local/bin/sqlparser.py Running: /usr/local/bin/sqlparser.py Running: /usr/local/bin/usbdeviceforensics.py Running: /usr/local/bin/usbdeviceforensics.py Running: /usr/local/src/virustotal-search-v0.1.4 Running: /usr/local/bin/virustotal-search.py Running: /usr/local/src/virustotal-submit-v0.0.3 Running: /usr/local/bin/virustotal-submit.py Running: /usr/local/bin/vshot Running: sift-scripts Running: /etc/hostname Running: hostnamectl set-hostname siftworkstation Running: siftworkstation Running: siftadmin Running: /home/siftadmin/.bash_aliases Running: /home/siftadmin/.bash_aliases Running: /root/.bash_aliases Running: /home/siftadmin/.bashrc Running: /home/siftadmin/.bashrc Running: /home/siftadmin/.bashrc Running: /home/siftadmin/.bashrc Running: /root/.bashrc Running: /root/.bashrc Running: /root/.bashrc Running: /home/siftadmin/.config/autostart Running: /home/siftadmin/Desktop/Network-Forensics-Poster.pdf Running: /home/siftadmin/Desktop/DFIR-Threat-Intel-Poster.pdf Running: /home/siftadmin/Desktop/SIFT-REMnux-Poster.pdf Running: /home/siftadmin/Desktop/Memory-Forensics-Poster.pdf Running: /home/siftadmin/Desktop/Rekall-Cheatsheet.pdf Running: /home/siftadmin/Desktop/DFIR-Smartphone-Forensics-Poster.pdf Running: /home/siftadmin/Desktop/Windows-Forensics-Poster.pdf Running: /home/siftadmin/Desktop/Find-Evil.pdf Running: /home/siftadmin/Desktop/SIFT-Cheatsheet.pdf Running: /home/siftadmin/Desktop/Linux-Shell-Survival-Guide.pdf Running: /home/siftadmin/Desktop/Windows-to-Unix-Cheatsheet.pdf Running: /home/siftadmin/Desktop/Volatility-Cheatsheet.pdf Running: /home/siftadmin/Desktop/Hex-File-Regex-Cheatsheet.pdf Running: /home/siftadmin/Desktop Running: /home/siftadmin/Desktop/mount_points Running: /home/siftadmin/Desktop/cases Running: /usr/share/sift/terminal-profiles.txt Running: dconf load /org/gnome/terminal/ < /usr/share/sift/terminal-profiles.txt Running: arc-icons Running: arc-theme Running: gsettings set org.gnome.desktop.interface gtk-theme Arc Running: gsettings set org.gnome.desktop.interface icon-theme Arc-Icons Running: /usr/share/backgrounds Running: /usr/share/backgrounds/warty-final-ubuntu.png Running: /usr/share/unity-greeter Running: /usr/share/unity-greeter/logo.png Running: /home/siftadmin/.config/autostart/ Running: /home/siftadmin/.config/autostart/gnome-terminal.desktop Running: gsettings set com.canonical.Unity.Launcher launcher-position Bottom Running: gsettings set com.canonical.Unity.Lenses disabled-scopes "['more_suggestions-amazon.scope', 'more_suggestions-u1ms.scope', 'more_suggestions-populartracks.scope', 'music-musicstore.scope', 'more_suggestions-ebay.scope', 'more_suggestions-ubuntushop.scope', 'more_suggestions-skimlinks.scope']" Running: gsettings set com.canonical.Unity.Launcher favorites "['application://gnome-terminal.desktop', 'application://firefox.desktop', 'application://org.gnome.Nautilus.desktop', 'application://unity-control-center.desktop', 'unity://running-apps', 'unity://expo-icon', 'unity://devices']" Running: dconf write /org/compiz/profiles/unity/plugins/unityshell/icon-size 32 Running: dconf write /org/compiz/profiles/unity/plugins/unityshell/launcher-minimize-window true Running: Etc/UTC Running: /cases Running: /mnt/usb Running: /mnt/vss Running: /mnt/shadow_mount Running: /mnt/windows_mount Running: /mnt/ewf_mount Running: /mnt/e01 Running: /mnt/aff Running: /mnt/ewf Running: /mnt/bde Running: /mnt/iscsi Running: /mnt/windows_mount1 Running: /mnt/windows_mount2 Running: /mnt/windows_mount3 Running: /mnt/windows_mount4 Running: /mnt/windows_mount5 Running: /mnt/shadow_mount/vss1 Running: /mnt/shadow_mount/vss2 Running: /mnt/shadow_mount/vss3 Running: /mnt/shadow_mount/vss4 Running: /mnt/shadow_mount/vss5 Running: /mnt/shadow_mount/vss6 Running: /mnt/shadow_mount/vss7 Running: /mnt/shadow_mount/vss8 Running: /mnt/shadow_mount/vss9 Running: /mnt/shadow_mount/vss10 Running: /mnt/shadow_mount/vss11 Running: /mnt/shadow_mount/vss12 Running: /mnt/shadow_mount/vss13 Running: /mnt/shadow_mount/vss14 Running: /mnt/shadow_mount/vss15 Running: /mnt/shadow_mount/vss16 Running: /mnt/shadow_mount/vss17 Running: /mnt/shadow_mount/vss18 Running: /mnt/shadow_mount/vss19 Running: /mnt/shadow_mount/vss20 Running: /mnt/shadow_mount/vss21 Running: /mnt/shadow_mount/vss22 Running: /mnt/shadow_mount/vss23 Running: /mnt/shadow_mount/vss24 Running: /mnt/shadow_mount/vss25 Running: /mnt/shadow_mount/vss26 Running: /mnt/shadow_mount/vss27 Running: /mnt/shadow_mount/vss28 Running: /mnt/shadow_mount/vss29 Running: /mnt/shadow_mount/vss30 Running: salt-minion Running: /etc/samba/smb.conf Running: smbd Running: nmbd Running: /etc/foremost.conf Running: /usr/local/etc/foremost.conf Running: sift-config-tools

Completed with Failures -- Success: 514, Failure: 18

sift version gives me: /usr/local/bin$ sift version

sift-cli@1.5.2-master.2035949 sift-version: notinstalled

BTW: i would prefer not to use unity or gnome or kde. i would like to use some more lightweight like xfce, lubuntu or similar from a minimal-installation of ubuntu. is there any chance in the future for this?

thank you

[ekristen]

I'd need to see your install log (not just the output from the terminal) to see what has failed.

Unity is the only supported option at this time, but Ubuntu is even moving back to gnome, so that'll most likely become the default.

[TheZonks]

thank your for your quick reply, where is the installation-log located?

[ekristen]

It’s in the terminal output

Log file: /var/cache/sift/cli/v2018.08.0/saltstack.log

[TheZonks]

Hi,

attached my logfile (reneamed to saltstack.txt)

saltstack.txt

best regards

[crrfx]

saltstack.log

The Problem seems to be very similar if not identical to my current issue on Ubuntu 16.04.4 LTS.

[ekristen]

@TheZonks it seems you are getting some sort of weird utf8 issue when managing files.

are you behind a proxy?

[crrfx]

Dear Erik,

thank you for our quick reply. I am definitely not behind a proxy.

Best regards

crrfx

From: Erik Kristensen [mailto:notifications@github.com] Sent: Sunday, April 15, 2018 12:03 AM To: sans-dfir/sift Cc: crrfx; Comment Subject: Re: [sans-dfir/sift] [CLI] Installation on Ubuntu desktop fails (#252)

@TheZonks https://github.com/TheZonks it seems you are getting some sort of weird utf8 issue when managing files.

are you behind a proxy?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/sans-dfir/sift/issues/252#issuecomment-381363714 , or mute the thread https://github.com/notifications/unsubscribe-auth/AklqEXJt0l5qd4WrRQmhjXe76mfMei6Vks5tonH2gaJpZM4TOTE5 . https://github.com/notifications/beacon/AklqEaFbsGo-ODbMDUEXZWN0NqduNrUiks5tonH2gaJpZM4TOTE5.gif

[ekristen]

@crrfx are you running on a clean ubuntu 16.04 desktop? I'm seeing some weird errors and utf8 encoding errors, I've never seen this before.

[crrfx]

I installed Ubuntu on a USB stick (as HDD). The installation was done by an iso file from https://www.ubuntu.com/download/desktop . Immediately afterwards I tried installing SIFT.

Best regards, crrfx

From: Erik Kristensen [mailto:notifications@github.com] Sent: Sunday, April 15, 2018 12:38 AM To: sans-dfir/sift Cc: crrfx; Mention Subject: Re: [sans-dfir/sift] [CLI] Installation on Ubuntu desktop fails (#252)

@crrfx https://github.com/crrfx are you running on a clean ubuntu 16.04 desktop? I'm seeing some weird errors and utf8 encoding errors, I've never seen this before.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/sans-dfir/sift/issues/252#issuecomment-381365514 , or mute the thread https://github.com/notifications/unsubscribe-auth/AklqETGOkGBi1KVzxqUQVyKoG_-EOjBYks5tonosgaJpZM4TOTE5 . https://github.com/notifications/beacon/AklqEai_Dcof9fJ81uXayOHNRGayp3vgks5tonosgaJpZM4TOTE5.gif

[crrfx]

I set up ubuntu 16.04 LTS several times anew, tested two networks (at home, office) and used both sift-cli@1.5.1-master and sift-cli@1.5.2-master for installing sift. I was, however, not successful. This is the latest log-file: saltstack.log

[ekristen]

I've installed SIFT about half a dozen times in the last 3 days from scratch without issues.

Are you using any custom language settings, terminal settings, etc?

The more details the better, but at this point, unfortunately since I cannot replicate it, I'm going to have to say it's your environment. I'm happy to continue to help troubleshoot, but super hard when I can't replicate.

[crrfx]

The only thing I change during installing Ubuntu is the language from English to German and the time zone. Could this be an issue? The hardware is an Lenovo T540p.

[ekristen]

The timezone definitely should not be, although we highly recommend leaving the timezone as UTC.

The language could definitely be an issue. We do not unfortunately test against anything other than English. It could be the thing causing the problem with the utf8 encoding.

[crrfx]

I installed SIFT (1.5.2) again from scratch and used only the English variant from Ubuntu 16.04 LTS. Something changed indeed - I have now posters on my desktop. Nevertheless, I had still no success. I tried a second installation, and the result was worse compared with the fist trial. Both log files are attached. Which custom language settings and terminal settings should I check additionally?

saltstack1.log saltstack2.log

[ekristen]

@crrfx please use the pre-release of the sift-cli to try and install.

[crrfx]

Still having problems: using $ sudo curl -o /usr/local/bin/sift https://github.com/sans-dfir/sift-cli/releases/download/v1.6.0/sift-cli-linux I got only a partial download % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 604 0 604 0 0 853 0 --:--:-- --:--:-- --:--:-- 853 with this file sift_curl.txt. And $ sudo chmod +x /usr/local/bin/sift $ sudo sift install led to the message /usr/local/bin/sift: 1: /usr/local/bin/sift: Syntax error: redirection unexpected Downloading alternatively sift-cli-linux directly and using $ sudo mv sift-cli-linux /usr/local/bin/sift $ chmod 755 /usr/local/bin/sift $ sudo sift install led to

sift-cli@1.6.0-master.1e4df5c sift-version: notinstalled

ENOENT: no such file or directory, open '/etc/apt/sources.list.d/saltstack.list' Error: ENOENT: no such file or directory, open '/etc/apt/sources.list.d/saltstack.list'

[ekristen]

Use 1.6.1

curl -Lo /usr/local/bin/sift https://github.com/sans-dfir/sift-cli/releases/download/v1.6.1/sift-cli-linux
chmod +x /usr/local/bin/sift

[ekristen]

We definitely had some weird things happen lately. Python PIP is mostly to blame.

Try installing 1.6.1 and then running sudo sift install --pre-release

[crrfx]

That's it. Without "--pre-release" there were still 12 failures, probably Python PIP, with this option v2018.16.0 was installed.

Thank you very much for your help!

[ekristen]

Very good. We did a full release so --pre-release is no longer needed. Cheers.

[amcap623]

I am getting this error trying to install SIFT workstation v2020.7.1 on Ubuntu 16.04. The install does not show me at the end Completed with Errors. It just stops. Below this error is the error from the saltstack.log

Running: sift-config-tools Update returned exit code not zero Error: Update returned exit code not zero at ChildProcess. (/snapshot/sift-cli/sift-cli.js:529:23) at ChildProcess.emit (events.js:196:13) at maybeClose (internal/child_process.js:1011:16) at Process.ChildProcess._handle.onexit (internal/child_process.js:268:5)

----- PLEASE READ ----------------------

A lot of failures are caused by the apt system being locked or unhealthy.

Before opening an issue in GitHub, please check to see if your apt system is healthy.

Try running 'apt-get update' then remove any packages that aren't used by running 'apt-get autoremove'

sansforensics@siftworkstation: ~/Downloads $ ------------------------SALTSTACK.LOG ERROR-------------------------- Requirement already satisfied: pip in /opt/rekall/lib/python2.7/site-packages (20.2.2)

  Requirement already satisfied: setuptools in /opt/rekall/lib/python2.7/site-packages
  (45.0.0)

  DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please
  upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop
  support for Python 2.7 in January 2021. More details about Python 2 support
  in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support

  WARNING: The directory ''/home/sansforensics/.cache/pip'' or its parent directory
  is not owned or is not writable by the current user. The cache has been disabled.
  Check the permissions and owner of that directory. If executing pip with sudo,
  you may want sudo''s -H flag.

  ERROR: Package ''setuptools'' requires a different Python: 2.7.12 not in ''>=3.5'''
duration: 3512.975
name: /opt/rekall
result: false
start_time: '03:37:03.278404'