IDH node Installation

[jenny2321]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

12

RAM

64

Storage for /

200

Storage for /nsm

500

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I have been using a security onion for a little while now and i have one manager node, one forward(sensor) node and one search node. Now i wante to install an idh node and have seen the guide on the documentation + the youtube video provided but since the video was for 2.3 i follow the instruction on the documentation and install the idh and it joins the grid member. The problem is the idh is seen in the grid member but not in the grid list, also i can access through 22 from anywhere to the idh which shouldn't be and there are no logs seen in the dashbord for the idh node. I'm seeking guidance on how to resolve these issues or if there's a recommended approach to reinstalling the IDH node. Any assistance would be greatly appreciated.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

When the IDH node appeared in Grid Members, it starts out under Pending Members. Did you then accept it as described at https://docs.securityonion.net/en/2.4/configuration.html#production-server-distributed-deployment?

Are there any firewall, routers, or other network devices between the IDH node and your manager that might be interfering with the traffic? If so, have you allowed the traffic through the network device as shown at https://docs.securityonion.net/en/2.4/firewall.html#node-communication?

[jenny2321]

yes, i have accepted the idh and is shown in the accepted grid members list along with the other three nodes. i try running salt -C "G@role:so-idh" state.highstate linfo and the result is different from the discussion #12952 my result is:
sec-idh1_idh:
Data failed to compile:

Rendering SLS 'base:ssl' failed: Jinja variable list object has no element 0; line 48

---

[...]

Trust the CA

trusttheca:
x509.pem_managed:
- name: /etc/pki/tls/certs/intca.crt
- text: {{ trusttheca_text }} <======================

{% if GLOBALS.os_family == 'Debian' %}
symlinkca:
file.symlink:
- target: /etc/pki/tls/certs/intca.crt
[...]
how can i fix this?

[jenny2321]

any advice?

[m0duspwnens]

From your manager, can you run sudo salt-run mine.update \*? Verify that the mine was updated and the CA is present with sudo salt-run mine.get \* x509.get_pem_entries. If that returns, try again to run sudo salt -C "G@role:so-idh" state.highstate

[jenny2321]

Thank you for the reply. Here is what i got
salt-run mine.update \*
sec-idh1_idh:
True
sec-manager_manager:
True
sec-search_searchnode:
True
sec-sensor_sensor:
True
[INFO ] Runner completed: 20240517055554944216

salt-run mine.get \* x509.get_pem_entries
sec-manager_manager:
----------
/etc/pki/ca.crt:
-----BEGIN CERTIFICATE-----
certificate content here
-----END CERTIFICATE-----
[INFO ] Runner completed: 20240517055618353256

salt -C "G@role:so-idh" state.highstate
sec-idh1_idh:
Data failed to compile:

Rendering SLS 'base:ssl' failed: Jinja variable list object has no element 0; line 48

---

[...]

Trust the CA

trusttheca:
x509.pem_managed:
- name: /etc/pki/tls/certs/intca.crt
- text: {{ trusttheca_text }} <======================

{% if GLOBALS.os_family == 'Debian' %}
symlinkca:
file.symlink:
- target: /etc/pki/tls/certs/intca.crt
[...]

ERROR: Minions returned with non-zero exit code
it is not fixed

[m0duspwnens]

The IDH node is likely suffering from the same bug as posted in this discussion: #12952

Can you try that solution and let us know if it solves the issue?