APT repository 404 error.

[digitalsleuth]

Good day. I've noticed that the Sysdig APT repo referenced here seems to be returning a 404 error today.

Additionally, when attempting to browse to https://download.sysdig.com/stable to see if there was a recent change, I'm noticing that stable is no longer a directory, but a bash script. Perhaps someone accidentally copied something somewhere they shouldn't have?

Either way, I was wondering if this has been noticed, and if their might be a fix coming soon.

Cheers

[therealbobo]

Hi @digitalsleuth! The reference that you linked is meant for the sysdig agent and not OSS sysdig 😄
For the APT repo of OSS sysdig (this project) please refer to the wiki... I know, it's a little old (we are planning to do a major revamp 😄) but all the info for the apt repo are correct (I just tried)! Let me know if you encounter any problem!

[digitalsleuth]

Hi @therealbobo , it's the same repo :)
From the wiki:

curl -s https://download.sysdig.com/DRAIOS-GPG-KEY.public | sudo apt-key add -  
sudo curl -s -o /etc/apt/sources.list.d/draios.list https://download.sysdig.com/stable/deb/draios.list

From the online manual:

curl -s https://download.sysdig.com/DRAIOS-GPG-KEY.public | apt-key add -
curl -s -o /etc/apt/sources.list.d/draios.list http://download.sysdig.com/stable/deb/draios.list

The same contents in both, and getting 404 for both of them.

[therealbobo]

Ops! My bad! Are you able to reach the s3 bucket with the following command?

aws s3 ls s3://download.draios.com/stable/ --human-readable --summarize --no-sign-request

[digitalsleuth]

That gives me a python error with docevents, unrelated to the connectivity (likely an issue with the awscli).

[digitalsleuth]

Fixed the python error, looks like I can reach it using that.

[digitalsleuth]

However, the URL provided in the draios.list is download.sysdig.com/stable, not the download.draios.com/stable.

[therealbobo]

I just installed it on a ubuntu bionic vm...

root@ubuntu-bionic:~# apt show sysdig
Package: sysdig
Version: 0.31.4
Priority: optional
Section: utils
Maintainer: Sysdig <support@sysdig.com>
Installed-Size: 43.9 MB
Depends: dkms (>= 2.1.0.0)
Homepage: http://www.sysdig.com
Download-Size: 16.0 MB
APT-Manual-Installed: yes
APT-Sources: https://download.sysdig.com/stable/deb stable-amd64/ Packages

I just noticed that here the ip is not the one that I'm resolving:
REMnux/remnux-cli#125 (comment)
Could you please take a look?

[digitalsleuth]

I checked from my instances, and the DNS resolves to 18.67.17.58. However, in the other two issues above, both resolved to different IP's (18.160.213.34 and 18.161.6.4).

From Issue 125:

╰─ nslookup download.sysdig.com
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	download.sysdig.com
Address: 18.160.213.34
Name:	download.sysdig.com
Address: 18.160.213.35
Name:	download.sysdig.com
Address: 18.160.213.7
Name:	download.sysdig.com
Address: 18.160.213.55

╰─ nslookup download.draios.com
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
download.draios.com	canonical name = download.draios.com.s3-website-us-east-1.amazonaws.com.
download.draios.com.s3-website-us-east-1.amazonaws.com	canonical name = s3-website.us-east-1.amazonaws.com.
Name:	s3-website.us-east-1.amazonaws.com
Address: 52.217.168.109
Name:	s3-website.us-east-1.amazonaws.com
Address: 52.217.121.157
Name:	s3-website.us-east-1.amazonaws.com
Address: 52.216.44.29
Name:	s3-website.us-east-1.amazonaws.com
Address: 54.231.163.93
Name:	s3-website.us-east-1.amazonaws.com
Address: 54.231.162.13
Name:	s3-website.us-east-1.amazonaws.com
Address: 54.231.140.85
Name:	s3-website.us-east-1.amazonaws.com
Address: 54.231.134.37
Name:	s3-website.us-east-1.amazonaws.com
Address: 52.217.103.83

[digitalsleuth]

According to mxtoolbox the IP addresses are slightly different from all of ours.

[digitalsleuth]

After looking into the DNS resolution a bit more, it's possible this is related to the Cloudflare maintenance they've been doing all day: Cloudflare Status

[therealbobo]

Great catch! I'll close this but feel free to reopen if the problem reappears! 😄