Security Onion 2.4 Base OS

Introduction

Recent events have forced us to change course on the base operating system (OS) for Security Onion 2.4. 

On 6/21/2023, Red Hat announced changes to their source code availability for Red Hat Enterprise Linux (RHEL):

https://www.redhat.com/en/blog/furthering-evolution-centos-stream

On 6/26/2023, Red Hat then posted a follow-up:

https://www.redhat.com/en/blog/red-hats-commitment-open-source-response-gitcentosorg-changes

These announcements prompted us to go back to first principles and re-evaluate the base OS options for our upcoming Security Onion 2.4 RC1 release.

First Principles

To re-evaluate our base OS options based on first principles, we start with the basic hard requirements. Security Onion 2.4 primarily consists of Docker images orchestrated by Saltstack, so here are our requirements for the base OS:

• stable Linux kernel
• stable Docker packages
• stable Saltstack packages
• freely available at no cost
• long term support (greater than 3 years)

In addition to the requirements above, our customers have indicated certain preferences:

• Most customers prefer some sort of Red Hat derivative.
• Some customers strongly prefer operating systems that meet specific US government standards or certifications.
  
  

Options

Based on the requirements and preferences above, we considered the following options:

• Rocky Linux 9 (free RHEL rebuild) - https://rockylinux.org/ 
• Alma Linux 9 (free RHEL/CentOS rebuild) - https://almalinux.org/ 
• Oracle Linux 9 (free RHEL rebuild) - https://www.oracle.com/linux/ 
• CentOS Stream 9 (free RHEL upstream) - https://www.centos.org/centos-stream/ 
• Ubuntu 22.04 (free Debian derivative) - https://ubuntu.com/ 
• Debian 12 - https://www.debian.org/ 

Over the last few weeks, we performed an exhaustive investigation of each option to see if they satisfy the requirements and preferences above and also determine if there are any additional advantages or disadvantages.

Security Onion 2.4 ISO Image

At the conclusion of our exhaustive investigation, we decided to base our Security Onion 2.4 ISO image on Oracle Linux 9 for the following reasons:

• Oracle Linux 9 satisfies the highest number of requirements and preferences for the greatest number of customers.
• Oracle Linux is a RHEL rebuild that has been available since 2006 so they have a long track record.
• Oracle Linux is free. From https://yum.oracle.com/oracle-linux-downloads.html:
  Since 2006, Oracle Linux has been completely free to download and use. Free source code, binaries, and updates. Freely redistributable. Free for production use.
• Oracle is well funded and fully committed to Oracle Linux in the long term:
  https://www.oracle.com/news/announcement/blog/keep-linux-open-and-free-2023-07-10/ 
• Oracle Linux 9 FIPS (Federal Information Processing Standards) certification is listed as “Under Test” as of 3/7/2023:
  https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/IUT-List 
• Oracle Linux offers the ability to run a newer Linux kernel which, in theory, should be more secure than the default kernel included in other RHEL rebuilds:
  https://unix.foo/posts/enterprise-linux/
  https://blogs.oracle.com/linux/post/tracking-linux-stable-kernels-with-uek 
  
  

Network Installation

If you don’t want to use our Security Onion 2.4 ISO image, you can still perform a network installation of our Security Onion components after manually installing one of the following:

• Oracle Linux 9
• Rocky Linux 9
• Alma Linux 9
• CentOS Stream 9
• RHEL 9
• Ubuntu 22.04
• Debian 12
  
  

Support

Customers with premium support and professional services can reach out to their normal support contacts for more information about support. 

If you are a non-paid community user, then please pay close attention to the support levels below.

Supported

Our Security Onion 2.4 ISO image (based on Oracle Linux 9) is the only fully supported installation method. Choose this option if any of the following apply to you:

• You are deploying in an enterprise environment.
• You are deploying in an airgap environment.
• You are performing a distributed deployment.
• You want the quickest and easiest installation with the fewest issues.
• You need full support.
  
  

Unsupported

If you don’t want to use our Security Onion 2.4 ISO image and choose to perform a manual OS installation followed by a network installation of our Security Onion components, then we recommend using Oracle Linux 9 or Rocky Linux 9. CentOS Stream 9 or Alma Linux 9 should also work. Another option might be RHEL 9 itself although that is a paid option.

If you really want to run Ubuntu 22.04 or Debian 12, then please note that these distros may work but they get less testing and therefore you will be more likely to run into issues.

Q&A

What will the Security Onion 2.4 ISO image be based on?

Our Security Onion 2.4 ISO image will be based on Oracle Linux 9.

Why Oracle Linux?

Oracle Linux has been around since 2006 and so it has a long track record. Additionally, FIPS certification is in progress. Finally, Oracle Linux offers a newer Linux kernel which, in theory, should be more secure than the default kernel included in other RHEL rebuilds.

Is Oracle Linux free?

Yes, from https://yum.oracle.com/oracle-linux-downloads.html:

Since 2006, Oracle Linux has been completely free to download and use. Free source code, binaries, and updates. Freely redistributable. Free for production use.

If we don’t want to use the Security Onion 2.4 ISO image or Oracle Linux, do we have other options?

If you don’t want or need support, then you can choose from Rocky Linux 9, Alma Linux 9, CentOS Stream 9, RHEL 9, Ubuntu 22.04, or Debian 12. However, please note that if you choose one of these options there will be more manual work required and you may be more likely to run into issues.

Why not use Rocky Linux 9 for the Security Onion 2.4 ISO image?

As of 7/25/2023, Rocky Linux 9 is not yet listed at the FIPS certification pages:

https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/IUT-List

https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List 

Why not use Alma Linux 9 for the Security Onion 2.4 ISO image?

Alma Linux does not yet have FIPS certification. Also, it has only been around since 2021 so it doesn’t have that long of a track record.

Why not use CentOS Stream for the Security Onion 2.4 ISO image?

CentOS Stream does not have any FIPS certification whatsoever.

Why not use Ubuntu for the Security Onion 2.4 ISO image?

Standard Ubuntu has no FIPS certification. FIPS certification requires a paid upgrade to Ubuntu Pro. Additionally, Ubuntu seems to be focused on their own snap architecture for the future.

Why not use Debian for the Security Onion 2.4 ISO image?

Debian does not have any FIPS certification whatsoever.

Why not use another Linux distro like fill in the blank?

We considered several other Linux distributions but only the ones listed above met the core requirements.

When do these Security Onion changes take effect?

These changes go into effect for the upcoming Security Onion 2.4 RC1 release.

When will Security Onion 2.4 reach General Availability (GA)?

These OS changes delayed our release schedule for Security Onion 2.4, but it was important to take our time and fully investigate our options. Security Onion 2.4 RC1 is coming soon. Stay tuned!

What does all of this mean for Security Onion 2.3?

There are no planned OS changes for 2.3.

I am a current customer with premium support and professional services and I have other questions about this change. To whom should I reach out?

Please feel free to reach out to your account manager.

I am a community user of Security Onion and I have other questions about this change. How may I ask those questions?

You may start a new discussion at https://securityonion.net/discuss. 

UPDATE 2023/07/27 - Added that these changes go into effect for the upcoming Security Onion 2.4 RC1 release.

Red Hat, Rocky Linux, and Security Onion

On 2023/06/21, Red Hat announced a change to their source code access:
https://www.redhat.com/en/blog/furthering-evolution-centos-stream

What does this change mean for Security Onion?

First, this change should have no effect on the current Security Onion 2.3 platform. 

For Security Onion 2.4, our plan is to use Rocky Linux as the base platform. On 2023/06/22, Rocky Linux posted the following: https://rockylinux.org/news/2023-06-22-press-release/

Based on Rocky's announcement, we are optimistic that we can continue our plans to use Rocky Linux. If, for some reason, this changes we have contingency plans available.

We are monitoring this situation closely and will provide further updates as needed.

UPDATE 2023/06/25 Here's an additional update from the Rocky Linux team:
https://rockylinux.org/news/brave-new-world-path-forward/

UPDATE 2023/07/25 We've published an updated blog post:
https://blog.securityonion.net/2023/07/security-onion-24-base-os.html

Security Onion in 2022 and 2023

Here's a quick review of some of the major improvements we made to Security Onion 2.3 in the past year!

Security Onion 2.3.100 added SOC Cases for Case Management and a new Receiver Node option for pipeline redundancy:
https://blog.securityonion.net/2022/01/security-onion-23100-now-available.html

Security Onion 2.3.110 added SOC Multi-Factor Authentication (MFA) and Intrusion Detection Honeypot (IDH) functionality:
https://blog.securityonion.net/2022/03/security-onion-23110-now-available.html

Security Onion 2.3.120 added Analyst Desktop improvements:
https://blog.securityonion.net/2022/04/security-onion-23120-now-available.html

Security Onion 2.3.130 added SOC Dashboards, Analyzers, and much more:
https://blog.securityonion.net/2022/06/security-onion-23130-now-available.html

Security Onion 2.3.140 improved SOC Dashboards and Cases:
https://blog.securityonion.net/2022/07/security-onion-23140-now-available.html

Security Onion 2.3.150 updated the TLP options in SOC Cases to align with TLP 2.0:
https://blog.securityonion.net/2022/08/security-onion-23150-now-available.html

Security Onion 2.3.160 added an Advanced toggle for SOC Alerts and Cases:
https://blog.securityonion.net/2022/08/security-onion-23160-now-available.html

Security Onion 2.3.170 improved Windows log parsing:
https://blog.securityonion.net/2022/09/security-onion-23170-now-available.html

Security Onion 2.3.180 added more SOC dashboards for sysmon logs:
https://blog.securityonion.net/2022/10/security-onion-23180-now-available.html

Security Onion 2.3.190 added coverage for lots of ICS/SCADA protocols:
https://blog.securityonion.net/2022/12/security-onion-23190-now-available.html

Security Onion 2.3.200 added more improvements for SOC dashboards and sysmon support:
https://blog.securityonion.net/2023/01/security-onion-23200-now-available.html

New Features in 2023

In 2023, we plan to release Security Onion 2.4 and it will bring some exciting new features!

• Configuration Interface
• Enhanced Grid Status Interface
• Simplified Setup
• Elastic Agent and Elastic Fleet
• Security Onion Virtual Appliance based on Rocky Linux 9
• Simplified Updates
• Improved Health Metric Visualizations

Configuration Interface

This feature has us really excited! With the introduction of the configuration interface, we hope to reduce the overall time spent to manage and administer the grid. The goal is to make editing files at the command line a thing of the past. The configuration interface will help lower the barrier of entry for new users to the platform as well as be a nice convenience for our more seasoned users.

Enhanced Grid Status Interface

In addition to the configuration interface, we’ve also enhanced the SOC Grid page to give you more information about the status of your grid.

Simplified Setup

The installer has been greatly simplified and configuring new members of the grid will take place in the configuration interface. This removes the need for the soremote account and ssh access to the manager. 

Elastic Agent and Elastic Fleet

Our primary endpoint agent will be Elastic Agent. It replaces osquery, beats, and Wazuh and is easily managed in Elastic Fleet, giving more control over upgrades. Users will also be able to deploy agents in standalone (unmanaged) mode if they choose to do so.

Security Onion Virtual Appliance based on Rocky Linux 9

When we were laying out features for Security Onion 2.4, we really wanted to shift the focus away from the OS and more into features that help our users find evil. Users should be able to image a system or run a script to easily provision their grid. We felt that we needed to shift to more of a virtual appliance model to allow us to continue to grow and scale to the needs of the future. We are basing this new appliance model on Rocky Linux 9. This change will allow us to deliver features faster and simplify support of the platform. Rocky Linux 9 has an EOL date of March 2032 allowing us to continue to innovate on the platform for years to come. Users will be able to install Security Onion either from our ISO image or on top of a minimal installation of Rocky Linux 9. Below we explain how this will impact Ubuntu-based deployments.

Simplified Updates

For this new virtual appliance model, all packages will be distributed from the manager similar to the current Airgap mode. You can optionally override the package source to some other source which hosts specific signed packages. In non-Airgap deployments, the manager or repo will sync daily with the upstream Security Onion repo to ensure updates are downloaded from the Internet. Airgap deployments will continue to pull their updates from the latest ISO image as they do in 2.3.

Improved Health Metric Visualizations

Security Onion 2.4 will include InfluxDB 2 and some improved health metric visualizations.

Component Changes in Security Onion 2.4

Security Onion 2.4 will have some major changes, including components that will be removed. If you are running Security Onion today and planning to run 2.4, you will want to ensure you are prepared. The following technologies will be retired or phased out:

• Ubuntu support
• Wazuh
• FleetDM 
• Dedicated osquery agents
• Filebeat for SO components

Phasing Out Support for Ubuntu

Back in 2009, the first release of Security Onion was based on Ubuntu 9.04 and we have continued to support Ubuntu through Security Onion 2.3. Since Security Onion 2.4 is shifting to more of an appliance model based on Rocky Linux 9 (as described above), we are phasing out support for Ubuntu. Users running a large distributed grid of Ubuntu 20.04 nodes will be able to gradually migrate those nodes to the new appliance structure as long as the manager runs Rocky Linux 9. We will release more details on this as we finalize the process.

Endpoint Agent Changes

As mentioned above, our primary endpoint agent will be Elastic Agent. Since Elastic Agent has osquery built in, it will be taking the place of the current osquery agent. Security Onion 2.4 will also use the Elastic Agent to send alerts and metadata from the sensors to the back end, replacing the current Filebeat agent. Users will be able to manage all of their Elastic Agents using Elastic Fleet in Kibana. Since Elastic Agent covers most of the Wazuh use cases used in Security Onion, Wazuh is being removed as well. This single agent architecture will save resources, streamline administrative processes, and ease the upgrade process in Security Onion.

Post 2.4 Release

After releasing Security Onion 2.4, we plan to launch some additional projects that will change some core elements of the platform. Notably, we intend to add more features to the SOC Grid interface. We also want to integrate the functions of Playbook directly into SOC. There are no release dates for these improvements, so please continue to monitor our social media for updates on these and other changes.