LME correct install folder

[axenstarr]

Hello - can I get LME to install in the /opt directory instead of under the root dir? Or is that by design?

Thanks!

[aarz-snl]

Sorry can you expand on what you mean here? install files for lme are copied to /opt/lme during install (the install ansible playbook)

[axenstarr]

Sure when I run the command "curl -s https://api.github.com/repos/cisagov/LME/releases/latest | jq -r '.assets[0].browser_download_url' | xargs -I {} sh -c 'curl -L -O {} && unzip -d ~/LME $(basename {})' " It created a LME folder in root not in opt like I thought it would. I'm following the instrucitons from https://github.com/cisagov/LME?tab=readme-ov-file#3-downloading-and-installing-lme

Am I doing something wrong?

[aarz-snl]

thats just the install zip. You can install that from anywhere its going to end up at ~/LME of whatever user you're logged into.

If you dont want it on root logon as a non root user. I.e. "example-user"

It will add the files to /home/example-user/LME

During install these files are manipulated to import all configurations, passwords etc and stored in /opt/lme.

The curl command to download the files is the not the install. You're essentially just cloning the files you need to perform the install. Run the curl command and move on to the next steps. By the end of the install you will have all required files in /opt/lme

[aarz-snl]

to clarify install should look like:

install all required packages, ansible, etc.
curl and pull down the zip with install files
run commands to grab hostname ip -- adjust .env file
run the first ansible playbook to install -- wait about 10 minutes for all pods to be up and running.
Look for the post install ansible playbook command -- also included in the readme. Run that command.

The active install files will exist in /opt/lme at this point

[axenstarr]

Awesome thank you!

[axenstarr]

I do have one more question. I am not getting this directory (lme-2-arch) after I run the first command. So I dont have a lme-2-arch to goto before I run the install_lme command. I ran the first command (sudo apt update && sudo apt install -y ansible) so not sure if that lme-2-arch dir is suppoed to be created or not.

You can run this Ansible installer for a fully automated install.
sudo apt update && sudo apt install -y ansible
#cd ~/LME/lme-2-arch # Or path to your clone of this repo
ansible-playbook ./ansible/install_lme_local.yml

[aarz-snl]

You dont have to be in lme-2-arch -- I'm not really sure what that is -- may be old directions.

Earlier in the directions you go to:

cd ~/LME

Just run all commands from this LME path -- follow the 2nd part of the comment where it says "Or path to your clone of this repo" which should be ~/LME

[axenstarr]

Thanks so now I am at the posts-install and I am not able to connect to kibana https://ipofserver:8080 and I also dont have a post_install_local.yml that I can find in the lme folder or config (ansible-playbook ./ansible/post_install_local.yml)

[axenstarr]

Ok I see its going back to ~/LME and that seemed to work when I ran the (ansible-playbook ./ansible/post_install_local.yml command. I'll try the kibana url again after its done.

[axenstarr]

Any advice on fixing why dasboards did not finish? I also have bunch of errors during the post install for the dashboards.

root@canvlog01:/opt/lme# sudo -i ls -al /opt/lme/dashboards/elastic/INSTALLED
ls: cannot access '/opt/lme/dashboards/elastic/INSTALLED': No such file or directory
root@canvlog01:/opt/lme# sudo -i ls -al /opt/lme/dashboards/wazuh/INSTALLED
ls: cannot access '/opt/lme/dashboards/wazuh/INSTALLED': No such file or directory

Dashboard errors:
failed: [localhost] (item=/opt/lme/dashboards/elastic/computer_software_overview_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/computer_software_overview_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/security_dashboard_security_log_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/security_dashboard_security_log_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/privileged_activity_log_dashboards_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/privileged_activity_log_dashboards_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/policy_changes_and_system_activity_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/policy_changes_and_system_activity_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/user_security_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/user_security_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/credential_access_logs_dashboard_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/credential_access_logs_dashboard_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/alerting_dashboard_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/alerting_dashboard_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/healthcheck_dashboard_overview_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/healthcheck_dashboard_overview_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/process_explorer_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/process_explorer_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/sysmon_summary_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/sysmon_summary_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/user_hr_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/user_hr_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}
failed: [localhost] (item=/opt/lme/dashboards/elastic/identity_access_management_2_0.ndjson) => {"ansible_loop_var": "item", "changed": false, "item": "/opt/lme/dashboards/elastic/identity_access_management_2_0.ndjson", "msg": "Unsupported parameters for (ansible.legacy.command) module: warn. Supported parameters include: _raw_params, _uses_shell, argv, chdir, creates, executable, expand_argument_vars, removes, stdin, stdin_add_newline, strip_empty_ends."}

[axenstarr]

Looking at this it looks like Kibana is unreachable and I am not sure how to fix that. if I just goto http://myipaddress I get the elastic webpage.

[axenstarr]

I was wondering if I could get some help with the dashboard issues? I also cannot get to http://ipofserver:8080 for Kibana so not sure what is up with that. I do notice that 8080 is not listening but I also see the firewall inactive.

If I goto just the IP address for my LME server I get the elastic page but no password works so not sure how to login there.

[aarz-snl]

i'd recommending doing an uninstall and start over with a clean install. Follow instructions closely -- you shouldn't need to go to port 8080 -- kibana is 443 -- so its going to be https://ipofserver -- there will be no http (non secure) apps you will connect to with this install.

Make sure ansible playbooks run all the way through and every file is created in /opt/lme

If you have issues where its saying something doesn't exist but it does exist then you have permissions issues. You may need to manually set them and then run playbooks again. The playbooks set permissions I'm only saying that a troubleshooting step

passwords can be grabbed by running ./scripts/extract_secrets.sh -p from ~/LME -- try not to deviate from the instructions as all steps are from certain folders its expecting to exist.

Take your time on each step and wait 10 minutes in between running first playbook and post install playbook. Make sure every container has been up and running for a couple minutes before running post install. Make sure you read the entire README.md closely

its hard to help on my end because it can be any number of issues.

[axenstarr]

I completly understand. I'll run the uninstall and go over it again and thanks for replying.