diff --git a/VERIFY_ISO.md b/VERIFY_ISO.md index c87e75499f..9475951750 100644 --- a/VERIFY_ISO.md +++ b/VERIFY_ISO.md @@ -1,18 +1,18 @@ -### 2.3.260-20230620 ISO image built on 2023/06/20 +### 2.3.270-20231006 ISO image built on 2023/10/06 ### Download and Verify -2.3.260-20230620 ISO image: -https://download.securityonion.net/file/securityonion/securityonion-2.3.260-20230620.iso +2.3.270-20231006 ISO image: +https://download.securityonion.net/file/securityonion/securityonion-2.3.270-20231006.iso -MD5: E09BB9800BAE84E84511516952264F33 -SHA1: DBDDFCE58B87F61F40BCE03840A749D8054B7AF1 -SHA256: 06ED74278587B09167FBAC1E5796B666FC24AD15D06EA3CC36419D07967E06DD +MD5: 3FC7A37EA402A5F0C6609D7431387575 +SHA1: 979851603E431EE9670A1576E5DCCD838CEDA294 +SHA256: 34F72EDEA9A62E1545347A31DEDEDD099D824466EC52B8674ACC7DB6D7E8B943 Signature for ISO image: -https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.260-20230620.iso.sig +https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.270-20231006.iso.sig Signing key: https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS @@ -26,22 +26,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/ma Download the signature file for the ISO: ``` -wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.260-20230620.iso.sig +wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.270-20231006.iso.sig ``` Download the ISO image: ``` -wget https://download.securityonion.net/file/securityonion/securityonion-2.3.260-20230620.iso +wget https://download.securityonion.net/file/securityonion/securityonion-2.3.270-20231006.iso ``` Verify the downloaded ISO image using the signature file: ``` -gpg --verify securityonion-2.3.260-20230620.iso.sig securityonion-2.3.260-20230620.iso +gpg --verify securityonion-2.3.270-20231006.iso.sig securityonion-2.3.270-20231006.iso ``` The output should show "Good signature" and the Primary key fingerprint should match what's shown below: ``` -gpg: Signature made Fri 16 Jun 2023 02:58:22 PM EDT using RSA key ID FE507013 +gpg: Signature made Thu 21 Sep 2023 10:43:13 AM EDT using RSA key ID FE507013 gpg: Good signature from "Security Onion Solutions, LLC " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. diff --git a/VERSION b/VERSION index 8800901043..415d027e4b 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.3.260 +2.3.270 diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup index 3a5a807c21..993ca4c8c7 100755 --- a/salt/common/tools/sbin/soup +++ b/salt/common/tools/sbin/soup @@ -579,6 +579,7 @@ preupgrade_changes() { [[ "$INSTALLEDVERSION" == 2.3.230 ]] && up_to_2.3.240 [[ "$INSTALLEDVERSION" == 2.3.240 ]] && up_to_2.3.250 [[ "$INSTALLEDVERSION" == 2.3.250 ]] && up_to_2.3.260 + [[ "$INSTALLEDVERSION" == 2.3.260 ]] && up_to_2.3.270 true } @@ -610,6 +611,7 @@ postupgrade_changes() { [[ "$POSTVERSION" == 2.3.230 ]] && post_to_2.3.240 [[ "$POSTVERSION" == 2.3.240 ]] && post_to_2.3.250 [[ "$POSTVERSION" == 2.3.250 ]] && post_to_2.3.260 + [[ "$POSTVERSION" == 2.3.260 ]] && post_to_2.3.270 true } @@ -763,6 +765,13 @@ post_to_2.3.260() { POSTVERSION=2.3.260 } +post_to_2.3.270() { + echo "Pruning unused docker volumes on all nodes - This process will run in the background." + salt --async \* cmd.run "docker volume prune -f" + + POSTVERSION=2.3.270 +} + stop_salt_master() { # kill all salt jobs across the grid because the hang indefinitely if they are queued and salt-master restarts set +e @@ -1123,6 +1132,11 @@ up_to_2.3.260() { INSTALLEDVERSION=2.3.260 } +up_to_2.3.270() { + echo "Upgrading to 2.3.270" + INSTALLEDVERSION=2.3.270 +} + verify_upgradespace() { CURRENTSPACE=$(df -BG / | grep -v Avail | awk '{print $4}' | sed 's/.$//') if [ "$CURRENTSPACE" -lt "10" ]; then diff --git a/salt/kibana/bin/so-kibana-config-load b/salt/kibana/bin/so-kibana-config-load index 6d3db568f5..5bfba8bd01 100644 --- a/salt/kibana/bin/so-kibana-config-load +++ b/salt/kibana/bin/so-kibana-config-load @@ -59,7 +59,7 @@ update() { IFS=$'\r\n' GLOBIGNORE='*' command eval 'LINES=($(cat $1))' for i in "${LINES[@]}"; do - RESPONSE=$({{ ELASTICCURL }} -X PUT "localhost:5601/api/saved_objects/config/8.7.1" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d " $i ") + RESPONSE=$({{ ELASTICCURL }} -X PUT "localhost:5601/api/saved_objects/config/8.8.2" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d " $i ") echo $RESPONSE; if [[ "$RESPONSE" != *"\"success\":true"* ]] && [[ "$RESPONSE" != *"updated_at"* ]] ; then RETURN_CODE=1;fi done diff --git a/salt/kibana/files/config_saved_objects.ndjson b/salt/kibana/files/config_saved_objects.ndjson index e1a9defb3a..67554a49f9 100644 --- a/salt/kibana/files/config_saved_objects.ndjson +++ b/salt/kibana/files/config_saved_objects.ndjson @@ -1 +1 @@ -{"attributes": {"buildNum": 39457,"defaultIndex": "2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","defaultRoute": "/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645","discover:sampleSize": 100,"theme:darkMode": true,"timepicker:timeDefaults": "{\n \"from\": \"now-24h\",\n \"to\": \"now\"\n}"},"coreMigrationVersion": "8.7.1","id": "8.7.1","migrationVersion": {"config": "7.13.0"},"references": [],"type": "config","updated_at": "2021-10-10T10:10:10.105Z","version": "WzI5NzUsMl0="} +{"attributes": {"buildNum": 39457,"defaultIndex": "2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","defaultRoute": "/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645","discover:sampleSize": 100,"theme:darkMode": true,"timepicker:timeDefaults": "{\n \"from\": \"now-24h\",\n \"to\": \"now\"\n}"},"coreMigrationVersion": "8.8.2","id": "8.8.2","references": [],"type": "config","updated_at": "2021-10-10T10:10:10.105Z","version": "WzI5NzUsMl0="} diff --git a/salt/playbook/init.sls b/salt/playbook/init.sls index 57195c21c1..ee721d9eea 100644 --- a/salt/playbook/init.sls +++ b/salt/playbook/init.sls @@ -84,6 +84,14 @@ playbook_password_none: {% else %} +playbookfilesdir: + file.directory: + - name: /opt/so/conf/playbook/redmine-files + - dir_mode: 775 + - user: 939 + - group: 939 + - makedirs: True + so-playbook: docker_container.running: - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-playbook:{{ VERSION }} @@ -91,6 +99,7 @@ so-playbook: - name: so-playbook - binds: - /opt/so/log/playbook:/playbook/log:rw + - /opt/so/conf/playbook/redmine-files:/usr/src/redmine/files:rw - environment: - REDMINE_DB_MYSQL={{ MANAGERIP }} - REDMINE_DB_DATABASE=playbook diff --git a/salt/redis/init.sls b/salt/redis/init.sls index bb1c134cb3..5cb349ee4d 100644 --- a/salt/redis/init.sls +++ b/salt/redis/init.sls @@ -52,6 +52,13 @@ redisconf: - group: 939 - template: jinja +redisdatadir: + file.directory: + - name: /nsm/redis/data + - user: 939 + - group: 939 + - makedirs: True + so-redis: docker_container.running: - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-redis:{{ VERSION }} @@ -64,6 +71,7 @@ so-redis: - /opt/so/log/redis:/var/log/redis:rw - /opt/so/conf/redis/etc/redis.conf:/usr/local/etc/redis/redis.conf:ro - /opt/so/conf/redis/working:/redis:rw + - /nsm/redis/data:/data:rw - /etc/pki/redis.crt:/certs/redis.crt:ro - /etc/pki/redis.key:/certs/redis.key:ro {% if grains['role'] in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import'] %} diff --git a/salt/strelka/init.sls b/salt/strelka/init.sls index 66cc1b9b72..9d374403b2 100644 --- a/salt/strelka/init.sls +++ b/salt/strelka/init.sls @@ -194,9 +194,25 @@ filcheck_history_clean: - minute: '33' # End Filecheck Section +strelkagkredisdatadir: + file.directory: + - name: /nsm/strelka/gk-redis-data + - user: 939 + - group: 939 + - makedirs: True + +strelkacoordredisdatadir: + file.directory: + - name: /nsm/strelka/coord-redis-data + - user: 939 + - group: 939 + - makedirs: True + strelka_coordinator: docker_container.running: - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-redis:{{ VERSION }} + - binds: + - /nsm/strelka/coord-redis-data:/data:rw - name: so-strelka-coordinator - entrypoint: redis-server --save "" --appendonly no - port_bindings: @@ -210,6 +226,8 @@ append_so-strelka-coordinator_so-status.conf: strelka_gatekeeper: docker_container.running: - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-redis:{{ VERSION }} + - binds: + - /nsm/strelka/gk-redis-data:/data:rw - name: so-strelka-gatekeeper - entrypoint: redis-server --save "" --appendonly no --maxmemory-policy allkeys-lru - port_bindings: diff --git a/sigs/securityonion-2.3.270-20231006.iso.sig b/sigs/securityonion-2.3.270-20231006.iso.sig new file mode 100644 index 0000000000..647e81c08d Binary files /dev/null and b/sigs/securityonion-2.3.270-20231006.iso.sig differ