Interface Error upon Vagrant Up

[digital4rensics]

Hi! First off - awesome work - the amount of time to get this sort of lab set up with be reduced significantly due to this effort.

For the error - is this something you've run across using Virtualbox? Everything up to this point completed without issue.

==> logger: Configuring and enabling network interfaces...
The following SSH command responded with a non-zero exit status.
Vagrant assumes that this means the command failed!

/sbin/ifdown 'eth1' || true
/sbin/ip addr flush dev 'eth1'

Remove any previous network modifications from the interfaces file

sed -e '/^#VAGRANT-BEGIN/,$ d' /etc/network/interfaces > /tmp/vagrant-network-interfaces.pre
sed -ne '/^#VAGRANT-END/,$ p' /etc/network/interfaces | tac | sed -e '/^#VAGRANT-END/,$ d' | tac > /tmp/vagrant-network-interfaces.post

cat
/tmp/vagrant-network-interfaces.pre
/tmp/vagrant-network-entry
/tmp/vagrant-network-interfaces.post \

/etc/network/interfaces

rm -f /tmp/vagrant-network-interfaces.pre
rm -f /tmp/vagrant-network-entry
rm -f /tmp/vagrant-network-interfaces.post

/sbin/ifup 'eth1'

Stdout from the command:

Failed to bring up eth1.

Stderr from the command:

/sbin/ifdown: interface eth1 not configured
/usr/sbin/fanctl: 41: /usr/sbin/fanctl: arithmetic expression: expecting primary: " (32-)/4 "
run-parts: /etc/network/if-up.d/ubuntu-fan exited with return code 2

[clong]

Hi @digital4rensics,

Unfortunately I haven't seen this type of error before. Do you mind adding which OS, Vagrant, and VirtualBox versions you're using?

[digital4rensics]

Not a problem -

This was on:
OSX - 10.12.6
Vagrant - 2.0.1
VirtualBox - Version 5.1.30

[digital4rensics]

Also noted that if I log in to the logger box - eth1 does seem to be configured, and I can hit the Splunk interface, but not the osquery one.

[clong]

So the odd part about this is that since Ubuntu 15 (I believe), network interfaces are no longer using the eth[#] naming scheme.

You appear to be experiencing this Vagrant bug, which was supposed to be fixed in 1.9.3: hashicorp/vagrant#6871. Maybe there are some workarounds in that thread that might fix this for you.

My output for logger is shown below.

vagrant@logger:~$ cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto enp0s3
iface enp0s3 inet dhcp
pre-up sleep 2
#VAGRANT-BEGIN
# The contents below are automatically generated by Vagrant. Do not modify.
auto enp0s8
iface enp0s8 inet static
      address 192.168.38.5
      netmask 255.255.255.0
#VAGRANT-END

vagrant@logger:~$ ifconfig
br-dc3f91e7dcd8 Link encap:Ethernet  HWaddr 02:42:86:11:05:7d
          inet addr:172.18.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
          inet6 addr: fe80::42:86ff:fe11:57d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:56961 errors:0 dropped:0 overruns:0 frame:0
          TX packets:47793 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:58607129 (58.6 MB)  TX bytes:8342937 (8.3 MB)

docker0   Link encap:Ethernet  HWaddr 02:42:91:5b:8e:ed
          inet addr:172.17.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
          inet6 addr: fe80::42:91ff:fe5b:8eed/64 Scope:Link
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:9 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:612 (612.0 B)  TX bytes:828 (828.0 B)

enp0s3    Link encap:Ethernet  HWaddr 08:00:27:a8:df:8b
          inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fea8:df8b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:564443 errors:0 dropped:0 overruns:0 frame:0
          TX packets:123303 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:674279313 (674.2 MB)  TX bytes:9994613 (9.9 MB)

enp0s8    Link encap:Ethernet  HWaddr 08:00:27:46:63:f9
          inet addr:192.168.38.5  Bcast:192.168.38.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fe46:63f9/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:393503 errors:0 dropped:0 overruns:0 frame:0
          TX packets:274409 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:312635643 (312.6 MB)  TX bytes:103586426 (103.5 MB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:69406 errors:0 dropped:0 overruns:0 frame:0
          TX packets:69406 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:23829821 (23.8 MB)  TX bytes:23829821 (23.8 MB)

veth13cdb54 Link encap:Ethernet  HWaddr 92:16:b8:60:8d:55
          inet6 addr: fe80::9016:b8ff:fe60:8d55/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:276956 errors:0 dropped:0 overruns:0 frame:0
          TX packets:239617 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:87855390 (87.8 MB)  TX bytes:146734201 (146.7 MB)

vethaf1d490 Link encap:Ethernet  HWaddr 26:0f:a2:3a:0e:db
          inet6 addr: fe80::240f:a2ff:fe3a:edb/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:118 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:648 (648.0 B)  TX bytes:8390 (8.3 KB)

vethbd2b055 Link encap:Ethernet  HWaddr 92:b2:ff:0e:06:92
          inet6 addr: fe80::90b2:ffff:fe0e:692/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:191799 errors:0 dropped:0 overruns:0 frame:0
          TX packets:220247 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:138391899 (138.3 MB)  TX bytes:28469315 (28.4 MB)

vethfc985f6 Link encap:Ethernet  HWaddr 0e:46:ff:14:2d:c3
          inet6 addr: fe80::c46:ffff:fe14:2dc3/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:117 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:648 (648.0 B)  TX bytes:8300 (8.3 KB)

[digital4rensics]

Secondary note - I tried to bring each system up independently.
DC completed seemingly without error.
Logger exhibits the above
WEF Completed on second try (failed to join domain first time)
Win10 Semi-Completed on second try (timed out on first attempt)

I'll see if this functions w/ sysmon & splunk as is and perhaps try to work through the link you posted. Confirmed your output does differ from mine.

Second Win10 Output:
win10: cd : Cannot find path 'C:\Users\vagrant\AppData\Local\Temp\windows-event-forwarding-master\AutorunsToWinEventLog' win10: because it does not exist. win10: At C:\tmp\vagrant-shell.ps1:4 char:1 win10: + cd "c:\Users\vagrant\AppData\Local\Temp\windows-event-forwarding-mast ... win10: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ win10: + CategoryInfo : ObjectNotFound: (C:\Users\vagran...nsToWinEventLog:String) [Set-Location], ItemNotFoundE win10: xception win10: + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.SetLocationCommand win10: AutorunsToWinEventLog installed. Starting the scheduled task. Future runs will begin at 11am win10: .\Install.ps1 : The term '.\Install.ps1' is not recognized as the name of a cmdlet, function, script file, or operable win10: program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. win10: At C:\tmp\vagrant-shell.ps1:5 char:1 win10: + .\Install.ps1 win10: + ~~~~~~~~~~~~~ win10: + CategoryInfo : ObjectNotFound: (.\Install.ps1:String) [], CommandNotFoundException win10: + FullyQualifiedErrorId : CommandNotFoundException win10: Start-ScheduledTask : The system cannot find the file specified. win10: At C:\tmp\vagrant-shell.ps1:7 char:1 win10: + Start-ScheduledTask -TaskName "AutorunsToWinEventLog" win10: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ win10: + CategoryInfo : ObjectNotFound: (PS_ScheduledTask:Root/Microsoft/...S_ScheduledTask) [Start-ScheduledTas win10: k], CimException win10: + FullyQualifiedErrorId : HRESULT 0x80070002,Start-ScheduledTask

[digital4rensics]

This morning, I killed everything w/ Vagrant and started over. I didn't attempt to bring the boxes up collectively this time, just did each individually.

This round got a bit more running with a few less errors. IE: Fleet came up and is functioning and can see both WEF and WIN10.

Did still get the Win10 errors posted above.

[ajaxtpm]

Guys, I know ifconfig is deprecated but it helped me to change ifdown/ifup to ifconfig up/down in C:\HashiCorp\Vagrant\embedded\gems\gems\vagrant-2.0.1\plugins\guests\debian\cap\configure_networks.rb

My vagrant version is 2.0.1

[thesubtlety]

+1 this lab is amazing

Same issue here though
OSX - 10.12.6
Vagrant - 2.0.1
VirtualBox - 5.2.2

[clong]

This is really bizarre. By all accounts, this is supposed to be fixed in Vagrant by now.

I've been digging through this issue: hashicorp/vagrant#1777
and this commenter said it wasn't fixed until they uninstalled and reinstalled Vagrant: hashicorp/vagrant#1777 (comment)

Uninstall instructions:

rm -rf /opt/vagrant
rm -f /usr/local/bin/vagrant
sudo pkgutil --forget com.vagrant.vagrant

After doing that, can you also go to ~/.vagrant.d/boxes and rm -rf bento-VAGRANTSLASH-ubuntu-16.04? This will force a re-import of the box after Vagrant is reinstalled.

[thesubtlety]

Thanks that looked to have fixed it! Initially I wasn't seeing Splunk set up with providers or indexes (and I lost the log output, so I did a reload --provision on the logger box. And ran into the same error. So I destroyed the ~/.vagrant.d/boxes/bento image again, then ran vagrant up logger and things started working again. Not sure why it seems to fail on the second run..

If anyone comes across this in the future, try to rm -rf ~/.vagrant.d/boxes/<the bento image>, then re run vagrant up logger.

[clong]

@digital4rensics can you give this fix a shot and let me know if it takes care of the issue for you?

[thesubtlety]

Hmm. After a suspend, logger does not come back up due to a port forwarding conflict. And after a halt and vagrant up or vagrant reload logger --provision, the initial Failed to bring up eth1 error is thrown.

would collide with some other application that is already listening
on these ports. The forwarded port to 8000 is already in use
on the host machine.

To fix this, modify your current project's Vagrantfile to use another
port. Example, where '1234' would be replaced by a unique host port:

  config.vm.network :forwarded_port, guest: 8000, host: 1234

So I scratched the image again and ran vagrant suspend. Onvagrant up and vagrant resume, I get the port forward confict. But if I bring up each box by itself (vagrant resume logger, etc) individually, things work as expected. ¯_(ツ)_/¯

[clong]

Yeah, it's some Vagrant weirdness I think. I'm usually able to solve it with vagrant reload <host>, but wish there was a more permanent fix.

You can check what's listening on the port with: sudo lsof -n -iTCP:8000, but it's usually vmware/virtualbox.

I'm going to go ahead and close this issue out as it sounds like the Vagrant reinstall + deleting the old box fixed the original network interface issue. Feel free to open it back up if that issue reappears at some point.

[clong]

Reopening as I just ran into this issue for the first time tonight :)

[gymzombie]

+1 for this issue. Running into both the interface issue, as well as the port forwarding issue. Using a fresh install of Ubuntu 16.04.1, Vagrant 2.0.1, and VirtualBox 5.2.4.

I got around the interface issue by logging into the logger guest, running an ifconfig, and re-running vagrant up. Have not yet been able to get around the port forwarding error.

I tried removing and reinstalling vagrant, but now stuck in a rabbit hole around "could not find gem vagrant-reload" so will work on that shortly.

[pinnace]

First, I just want to say thanks for releasing this lab. It's amazing work.

Second, I am running into both of the issues mentioned here. I 'fixed' the interface issue by running sudo ifconfig eth1 up after sshing into the box. Got around the port forwarding issue by incrementing the :host ports 8000 and 8412 in the Vagrantfile by one and running vagrant up once more. Not a great solution, but at least the boxes are coming online now.

[gymzombie]

I found the same, but it still seems like a temporary solution. After a virtualbox crash, it's now telling me 8001 is in use, so will need to increment again.

[pinnace]

Same thing for me, incremented again.

[clong]

Thank you for the reports. I’m considering removing the port forwarding completely due to seemingly poor support in Vagrant and the fact that it’s a bit redundant (you can access the same services by connecting directly to the host). If anyone has objections to that, please let me know.

As for the interface issues, I’ll have to dig deeper to find the root cause. I’m on holiday until Jan 9, so it might be a bit before I’m able to work on a fix.

Thanks again for all the kind words and reports and happy 2018!

[pinnace]

Makes sense to me. Ill be on the lookout for it.

Enjoy the holiday and happy new year!

[clong]

Hey folks,

Is anyone still experiencing this issue? I just pushed a pretty big change with some updates and am curious if this issue still exists. I'll wait a week or so for responses, but will be closing this out if there's no further comments.

[clong]

Closing due to lack of activity

[mrIllo]

I ran into this after installing isc-dhcp-server on Ubuntu Server 18.04 LTS in combination with a public_network config using a static IP.
Without that package, everything starts up as expected and that behavior is restored after purging isc-dhcp-server again.