security-onion-solutions/securityonion-cloud

Security Onion in the Cloud

NOTE: The scripts in the accompanying links are NOT guaranteed or recommended for production use.

Security Onion in AWS

See: AWS

Decapsulating VXLAN-encapsulated PCAP

See: VXLAN2PCAP

securityonion-cloud's Issues

on automirror.tf line 56, in resource "aws_iam_role" "auto_mirror_role":

Error: timeout - last error: dial tcp 54.236.19.43:22: i/o timeout

Error: Error creating IAM Role auto_mirror_role: InternalFailure:
status code: 500, request id: a8c10961-b0fb-437c-94fa-f35c95c6b25e

on automirror.tf line 56, in resource "aws_iam_role" "auto_mirror_role":
56: resource "aws_iam_role" "auto_mirror_role" {

Security Onion instance does not get a new public IPv4 address if AWS ec2 instance is stopped

When stopping and starting a pre-existing instance previously created with terraform, the security onion appliance does not pick up a new public IPv4 address:

Seen above both a windows and ubuntu instance pick up new IPv4 addresses as expected from the vpc.tf subnet creation:

# subnet creation
resource "aws_subnet" "default" {
  vpc_id                  = aws_vpc.terraform.id
  cidr_block              = "172.16.163.0/24"
  availability_zone       = var.availability_zone
  *map_public_ip_on_launch = true*
}

As a testing step I added associate_public_ip_address = true to so.tf but the instance still does not get a new public IPv4 address on stopping and starting the instance.

resource "aws_instance" "securityonion" {
  depends_on = [ aws_internet_gateway.default ]
  count         = var.onions
  instance_type = var.instance_type
  ami           = data.aws_ami.latest_so.id != "" ? data.aws_ami.latest_so.id : var.ami

  tags = {
    Name = "security-onion-${count.index}"
    so-lab = "True"
  }

  subnet_id              = aws_subnet.default.id
  vpc_security_group_ids = [aws_security_group.securityonion.id]
  key_name               = aws_key_pair.auth.key_name
  private_ip             = "172.16.163.1${count.index}"
  **associate_public_ip_address = true**

  root_block_device {
    delete_on_termination = true
    volume_size           = 250
  }
}

The reason for stopping instances is cost savings in a lab environment, without having to run through so-setup each time it's required.

Steps to reproduce:

1. terraform apply --auto-approve
2. Connect to instance as usual and run through so-setup
3. Stop instances via ec2 dashboard
4. Start instances via ec2 dashboard