From 7d4f2e54f3f0d4dcdfc1f9412d75dbeaaba51c16 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Sat, 5 Sep 2026 06:37:50 -0500 Subject: [PATCH] [#772] stage SO 3.2.0 install: VM 51017 prepped + verified ISO + runbook VM created on pfv-tsys5 (stopped, onboot=0, 200G local-nonprod, sniffing NIC link-down); ISO GPG-verified on node against SO published fingerprint; human runs the SO installer per docs/runbook-install-51017.md. https://projects.knownelement.com/issues/772 --- docs/runbook-install-51017.md | 41 +++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 docs/runbook-install-51017.md diff --git a/docs/runbook-install-51017.md b/docs/runbook-install-51017.md new file mode 100644 index 0000000..4d9ab62 --- /dev/null +++ b/docs/runbook-install-51017.md @@ -0,0 +1,41 @@ +# Security Onion install runbook — VM 51017 (sectestbed lane) + +> Ticket [#772](https://projects.knownelement.com/issues/772) · Lane index +> https://community.turnsys.com/t/297 · Provenance: plan from the security-lane +> merge (2026-09-04); VM + ISO staged by the OAM agent 2026-09-05. +> Human (Charles) drives the actual SO install per plan. + +## Prepped state (2026-09-05, all on pfv-tsys5) + +| item | value | +|---|---| +| VMID / name | 51017 / `sectestbed-securityonion` | +| sizing | 4 cores (host), 16 GB RAM, 200 GB disk (`local-nonprod`, thin) | +| NICs | net0 mgmt on vmbr0 · net1 sniffing on vmbr0 (**link_down** — connect to the SPAN/mirror source before install) | +| boot | disk first, falls through to the attached ISO while the disk is empty | +| autostart | **off** (lane rule: non-prod stays down across host reboots) | +| ISO | `securityonion-3.2.0-20260729.iso` attached as ide2, GPG-verified on the node against SO's published key `C804 A93D 36BE 0C73 3EA1 9644 7C10 60B7 FE50 7013` (sig + KEYS also saved beside the ISO) | +| guest agent | SO ships qemu-guest-agent in the image; confirm `qm agent 51017 ping` after install, install `qemu-guest-agent` if absent | + +## Install steps (human) + +1. `qm start 51017` (console via PVE noVNC). +2. SO 3.2.0 installer → **Standalone** deployment. +3. Follow the SO installer prompts (management iface = the DHCP/eth0 NIC; + agree to the attack-surface reduction; set the SO admin account). +4. After first boot + setup completes: detach ide2 (`qm set 51017 --ide2 none,media=cdrom`) + and set `--boot order=scsi0`. +5. Connect the sniffing path: attach net1 to the bridge that carries the + mirrored traffic (OPNsense port mirror) — `qm set 51017 --net1 virtio,bridge=` + then `qm set 51017 --link_down 0` semantics via editing, or just attach and `qm start`. +6. Register the VM in GLPI + Uptime Kuma (ping monitor), and add the host to + the KNELIAC inventory (`virtual_guests`). +7. Hook-ups owned by this lane (post-install): Wazuh/SO input matrix + (README coverage matrix), OPNsense netflow (nprobe/netflow target = + SO's Zeek/suricata + flow input), syslog routing decision (Wazuh vs SO + Elastic ingest) — tracked in the README matrix. + +## Rollback + +VM is unregistered-from-nothing and dataless before install: destroy with +`qm destroy 51017` if the plan changes (ISO + sig remain staged on the node).