Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CLI] Installation on Ubuntu desktop fails #252

Closed
TheZonks opened this issue Apr 10, 2018 · 21 comments
Closed

[CLI] Installation on Ubuntu desktop fails #252

TheZonks opened this issue Apr 10, 2018 · 21 comments

Comments

@TheZonks
Copy link

Hello,

i tried to install sift workstation on several ubuntu installations, all with the same result.
what i have done is:
installing a clean ubuntu vm with virtualbox.
created user siftadmin
running apt-get update
running apt-get upgrade
running apt-get dist-upgrade
used versions: ubuntu server 16.04.04 LTS minimal (no unity)
ubuntu desktop 16.04.04 LTS with unitiy

Environment (from the last test):
Distributor ID: Ubuntu
Description: Ubuntu 16.04.4 LTS
Release: 16.04
Codename: xenial

Linux siftworkstation 4.13.0-38-generic #43~16.04.1-Ubuntu SMP Wed Mar 14 17:48:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Console-Log:

downloading v2018.08.0

downloading sift-saltstack-v2018.08.0.tar.gz.asc
downloading sift-saltstack-v2018.08.0.tar.gz.sha256
downloading sift-saltstack-v2018.08.0.tar.gz.sha256.asc
downloading sift-saltstack-v2018.08.0.tar.gz
validating file sift-saltstack-v2018.08.0.tar.gz
validating signature for sift-saltstack-v2018.08.0.tar.gz.sha256
extracting update sift-saltstack-v2018.08.0.tar.gz
performing update v2018.08.0
Log file: /var/cache/sift/cli/v2018.08.0/saltstack.log

Running: python-software-properties
Running: apt-transport-https
Running: deb https://apt.dockerproject.org/repo ubuntu-xenial main
Running: sift-gift-dev
Running: gift
Running: sift-dev
Running: sift-repo
Running: software-properties-common
Running: noobslab-themes
Running: noobslab-icons
Running: openjdk-repo
Running: deb http://archive.ubuntu.com/ubuntu/ xenial multiverse
Running: deb http://archive.ubuntu.com/ubuntu/ xenial-security multiverse
Running: deb http://archive.ubuntu.com/ubuntu/ xenial universe
Running: ubuntutweak
Running: sift-repos
Running: binplist
Running: unity-webapps-common
Running: aeskeyfind
Running: afflib-tools
Running: afterglow
Running: aircrack-ng
Running: apache2
Running: arp-scan
Running: autopsy
Running: bcrypt
Running: bitpim
Running: bitpim-lib
Running: bkhive
Running: bless
Running: blt
Running: build-essential
Running: bulk-extractor
Running: cabextract
Running: ccrypt
Running: cifs-utils
Running: clamav
Running: cmospwd
Running: cryptcat
Running: cryptsetup
Running: curl
Running: dc3dd
Running: dcfldd
Running: dconf-tools
Running: docker-engine
Running: driftnet
Running: dsniff
Running: dumbpig
Running: e2fslibs-dev
Running: ent
Running: epic5
Running: etherape
Running: ettercap-graphical
Running: exfat-fuse
Running: exfat-utils
Running: exif
Running: extundelete
Running: fdupes
Running: feh
Running: flasm
Running: flex
Running: foremost
Running: g++
Running: gawk
Running: gcc
Running: gdb
Running: gddrescue
Running: ghex
Running: git
Running: graphviz
Running: gthumb
Running: gzrt
Running: hexedit
Running: htop
Running: hydra
Running: hydra-gtk
Running: ipython
Running: jq
Running: kdiff3
Running: knocker
Running: kpartx
Running: lft
Running: libafflib-dev
Running: libafflib0v5
Running: libbde
Running: libbde-tools
Running: libesedb
Running: libesedb-tools
Running: libevt
Running: libevt-tools
Running: libevtx
Running: libevtx-tools
Running: libewf
Running: libewf-dev
Running: libewf-python
Running: libewf-tools
Running: libffi-dev
Running: libfuse-dev
Running: libfvde
Running: libfvde-tools
Running: liblightgrep
Running: libmsiecf
Running: libncurses5-dev
Running: libnet1
Running: libolecf
Running: libparse-win32registry-perl
Running: libpff
Running: libpff-dev
Running: libpff-python
Running: libpff-tools
Running: libplist-utils
Running: libregf
Running: libregf-dev
Running: libregf-python
Running: libregf-tools
Running: libssl-dev
Running: libtext-csv-perl
Running: libvmdk
Running: libvshadow
Running: libvshadow-dev
Running: libvshadow-python
Running: libvshadow-tools
Running: libxml2-dev
Running: libxslt-dev
Running: md5deep
Running: nbd-client
Running: nbtscan
Running: netcat
Running: netpbm
Running: netsed
Running: netwox
Running: nfdump
Running: ngrep
Running: nikto
Running: okular
Running: open-iscsi
Running: openjdk-7-jdk
Running: ophcrack
Running: ophcrack-cli
Running: outguess
Running: p0f
Running: p7zip-full
Running: pdftk
Running: perl
Running: perl -MCPAN -e 'my $c = "CPAN::HandleConfig"; $c->load(doit => 1, autoconfig => 1); $c->edit(prerequisites_policy => "follow"); $c->edit(build_requires_install_policy => "yes"); $c->commit'
Running: pev
Running: phonon
Running: pkg-config
Running: python-plaso
Running: python-dfvfs
Running: python3-xlsxwriter
Running: python-xlsxwriter
Running: python-dfvfs
Running: python-plaso
Running: plaso-tools
Running: /var/cache/sift/archives/powershell_6.0.0-alpha.13-1ubuntu1.16.04.1_amd64.deb
Running: sift-powershell
Running: pv
Running: pyew
Running: python
Running: python-dev
Running: python-flowgrep
Running: python-fuse
Running: python-nids
Running: python-ntdsxtract
Running: python-pefile
Running: python-pip
Running: pytsk3
Running: python-pytsk3
Running: python-qt4
Running: python-tk
Running: python-virtualenv
Running: colorama
Running: construct
Running: dpapick
Running: distorm3
Running: haystack
Running: pefile
Running: pycoin
Running: pysocks
Running: simplejson
Running: yara-python
Running: python-volatility
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/sift/
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/malprocfind.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/idxparser.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/chromehistory.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/mimikatz.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/openioc_scan.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/pstotal.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/firefoxhistory.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/autoruns.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/malfinddeep.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/prefetch.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/baseline.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/ssdeepscan.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/uninstallinfo.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/trustrecords.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/usnparser.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/apihooksdeep.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/editbox.py
Running: /usr/lib/python2.7/dist-packages/volatility/plugins/javarat.py
Running: python-yara
Running: qemu
Running: qemu-utils
Running: radare2
Running: rar
Running: readpst
Running: rsakeyfind
Running: safecopy
Running: samba
Running: samdump2
Running: scalpel
Running: sleuthkit
Running: socat
Running: ssdeep
Running: ssldump
Running: sslsniff
Running: stunnel4
Running: system-config-samba
Running: tcl
Running: tcpflow
Running: tcpick
Running: tcpreplay
Running: tcpslice
Running: tcpstat
Running: tcptrace
Running: tcptrack
Running: tcpxtract
Running: testdisk
Running: tofrodos
Running: transmission
Running: unity-control-center
Running: unrar
Running: upx-ucl
Running: vbindiff
Running: vim
Running: virtuoso-minimal
Running: vmfs-tools
Running: winbind
Running: dpkg --add-architecture i386
Running: sift-wine-apt-update
Running: wine
Running: wireshark
Running: xdot
Running: xfsprogs
Running: xmount
Running: xpdf
Running: zenity
Running: analyzemft
Running: argparse
Running: bitstring
Running: docopt
Running: geoip2
Running: pip
Running: python-dateutil >= 2.4.2
Running: python-evtx
Running: python-magic
Running: python-registry
Running: setuptools
Running: wheel
Running: /opt/rekall
Running: rekall
Running: six
Running: timesketch
Running: unicodecsv
Running: usnparser
Running: virustotal-api
Running: windowsprefetch
Running: /usr/local/src/densityscout/densityscout_build_45_linux
Running: /usr/local/bin/densityscout-build-45
Running: /usr/local/bin/densityscout
Running: /usr/local/bin/sift
Running: https://github.com/cheeky4n6monkey/4n6-scripts.git
Running: /usr/local/bin/WP8_AppPerms.py
Running: /usr/local/bin/bing-bar-parser.pl
Running: /usr/local/bin/chunkymonkey.py
Running: /usr/local/bin/dextract.def
Running: /usr/local/bin/dextract.py
Running: /usr/local/bin/docx-font-extractor.pl
Running: /usr/local/bin/exif2map.pl
Running: /usr/local/bin/fbmsg-extractor.py
Running: /usr/local/bin/gis4cookie.pl
Running: /usr/local/bin/google-ei-time.py
Running: /usr/local/bin/imgcache-parse-mod.py
Running: /usr/local/bin/imgcache-parse.py
Running: /usr/local/bin/json-printer.pl
Running: /usr/local/bin/msoffice-pic-extractor.py
Running: /usr/local/bin/plist2db.py
Running: /usr/local/bin/print_apk_perms.py
Running: /usr/local/bin/s2-cellid2latlong.py
Running: /usr/local/bin/s2-latlong2cellid.py
Running: /usr/local/bin/sms-grep-sample-config.txt
Running: /usr/local/bin/sms-grep.pl
Running: /usr/local/bin/sqlite-base64-decode.py
Running: /usr/local/bin/sqlite-blob-dumper.py
Running: /usr/local/bin/sqlite-parser.pl
Running: /usr/local/bin/squirrelgripper-README.txt
Running: /usr/local/bin/squirrelgripper.pl
Running: /usr/local/bin/timediff32.pl
Running: /usr/local/bin/vmail-db-2-html.pl
Running: /usr/local/bin/wp8-1-callhistory.py
Running: /usr/local/bin/wp8-1-contacts.py
Running: /usr/local/bin/wp8-1-mms-filesort.py
Running: /usr/local/bin/wp8-1-mms.py
Running: /usr/local/bin/wp8-1-sms.py
Running: /usr/local/bin/wp8-callhistory.py
Running: /usr/local/bin/wp8-contacts.py
Running: /usr/local/bin/wp8-fb-msg.py
Running: /usr/local/bin/wp8-sha256-pin-finder.py
Running: /usr/local/bin/wp8-sms.py
Running: /usr/local/bin/wwf-chat-parser.py
Running: /usr/local/bin/amcache.py
Running: /usr/local/bin/amcache.py
Running: /usr/local/bin/dump-mft-entry.pl
Running: /usr/local/bin/dump-mft-entry.pl
Running: /usr/local/bin/imageMounter.py
Running: /usr/local/bin/idx_parser.py
Running: /usr/local/bin/jobparser.py
Running: https://github.com/keydet89/Tools.git
Running: /usr/local/bin/bodyfile.pl
Running: /usr/local/bin/bodyfile.pl
Running: /usr/local/bin/evtparse.pl
Running: /usr/local/bin/evtparse.pl
Running: /usr/local/bin/evtrpt.pl
Running: /usr/local/bin/evtrpt.pl
Running: /usr/local/bin/evtxparse.pl
Running: /usr/local/bin/evtxparse.pl
Running: /usr/local/bin/fb.pl
Running: /usr/local/bin/fb.pl
Running: /usr/local/bin/ff.pl
Running: /usr/local/bin/ff.pl
Running: /usr/local/bin/ff_signons.pl
Running: /usr/local/bin/ff_signons.pl
Running: /usr/local/bin/ftkparse.pl
Running: /usr/local/bin/ftkparse.pl
Running: /usr/local/bin/idx.pl
Running: /usr/local/bin/idx.pl
Running: /usr/local/bin/idxparse.pl
Running: /usr/local/bin/idxparse.pl
Running: /usr/local/bin/jl.pl
Running: /usr/local/bin/jl.pl
Running: /usr/local/bin/jobparse.pl
Running: /usr/local/bin/jobparse.pl
Running: /usr/local/bin/lfle.pl
Running: /usr/local/bin/lfle.pl
Running: /usr/local/bin/lnk.pl
Running: /usr/local/bin/lnk.pl
Running: /usr/local/bin/mft.pl
Running: /usr/local/bin/mft.pl
Running: /usr/local/bin/parse.pl
Running: /usr/local/bin/parse.pl
Running: /usr/local/bin/parsei30.pl
Running: /usr/local/bin/parsei30.pl
Running: /usr/local/bin/parseie.pl
Running: /usr/local/bin/parseie.pl
Running: /usr/local/bin/pie.pl
Running: /usr/local/bin/pie.pl
Running: /usr/local/bin/pref.pl
Running: /usr/local/bin/pref.pl
Running: /usr/local/bin/rawie.pl
Running: /usr/local/bin/rawie.pl
Running: /usr/local/bin/recbin.pl
Running: /usr/local/bin/recbin.pl
Running: /usr/local/bin/regslack.pl
Running: /usr/local/bin/regslack.pl
Running: /usr/local/bin/regtime.pl
Running: /usr/local/bin/regtime.pl
Running: /usr/local/bin/rfc.pl
Running: /usr/local/bin/rfc.pl
Running: /usr/local/bin/rlo.pl
Running: /usr/local/bin/rlo.pl
Running: /usr/local/bin/tln.pl
Running: /usr/local/bin/tln.pl
Running: /usr/local/bin/usnj.pl
Running: /usr/local/bin/usnj.pl
Running: /usr/local/bin/packerid.py
Running: /usr/local/bin/packerid.py
Running: /usr/local/bin
Running: /usr/local/bin/parseusn.py
Running: /usr/local/bin
Running: /usr/local/bin/pecarve.py
Running: /usr/local/bin/pecarve.py
Running: /usr/local/bin/pescanner.py
Running: https://github.com/keydet89/RegRipper2.8.git
Running: /usr/share/regripper
Running: /usr/share/regripper/rip.pl
Running: /usr/share/regripper/plugins
Running: /usr/local/bin/rip.pl
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "All" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/all
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "All" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/all
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "NTUSER" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/ntuser
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "NTUSER" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/ntuser
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "USRCLASS" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/usrclass
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "USRCLASS" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/usrclass
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "SAM" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/sam
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "SAM" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/sam
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "Security" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/security
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "Security" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/security
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "Software" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/software
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "Software" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/software
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "System" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/system
Running: grep -R "my %config = (hive" /usr/share/regripper/plugins | grep "System" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/system
Running: /usr/local/bin/set-display-scale
Running: /usr/local/bin/ShimCacheParser.py
Running: /usr/local/bin/ShimCacheParser.py
Running: /usr/share/sift/resources
Running: /usr/share/sift/images
Running: /usr/share/sift/audio
Running: /usr/share/sift/other
Running: /usr/share/sift/scripts
Running: /usr/share/sift
Running: /usr/share/tsk/sorter
Running: /usr/share/tsk/sorter
Running: /usr/local/bin/sqlparser.py
Running: /usr/local/bin/sqlparser.py
Running: /usr/local/bin/usbdeviceforensics.py
Running: /usr/local/bin/usbdeviceforensics.py
Running: /usr/local/src/virustotal-search-v0.1.4
Running: /usr/local/bin/virustotal-search.py
Running: /usr/local/src/virustotal-submit-v0.0.3
Running: /usr/local/bin/virustotal-submit.py
Running: /usr/local/bin/vshot
Running: sift-scripts
Running: /etc/hostname
Running: hostnamectl set-hostname siftworkstation
Running: siftworkstation
Running: siftadmin
Running: /home/siftadmin/.bash_aliases
Running: /home/siftadmin/.bash_aliases
Running: /root/.bash_aliases
Running: /home/siftadmin/.bashrc
Running: /home/siftadmin/.bashrc
Running: /home/siftadmin/.bashrc
Running: /home/siftadmin/.bashrc
Running: /root/.bashrc
Running: /root/.bashrc
Running: /root/.bashrc
Running: /home/siftadmin/.config/autostart
Running: /home/siftadmin/Desktop/Network-Forensics-Poster.pdf
Running: /home/siftadmin/Desktop/DFIR-Threat-Intel-Poster.pdf
Running: /home/siftadmin/Desktop/SIFT-REMnux-Poster.pdf
Running: /home/siftadmin/Desktop/Memory-Forensics-Poster.pdf
Running: /home/siftadmin/Desktop/Rekall-Cheatsheet.pdf
Running: /home/siftadmin/Desktop/DFIR-Smartphone-Forensics-Poster.pdf
Running: /home/siftadmin/Desktop/Windows-Forensics-Poster.pdf
Running: /home/siftadmin/Desktop/Find-Evil.pdf
Running: /home/siftadmin/Desktop/SIFT-Cheatsheet.pdf
Running: /home/siftadmin/Desktop/Linux-Shell-Survival-Guide.pdf
Running: /home/siftadmin/Desktop/Windows-to-Unix-Cheatsheet.pdf
Running: /home/siftadmin/Desktop/Volatility-Cheatsheet.pdf
Running: /home/siftadmin/Desktop/Hex-File-Regex-Cheatsheet.pdf
Running: /home/siftadmin/Desktop
Running: /home/siftadmin/Desktop/mount_points
Running: /home/siftadmin/Desktop/cases
Running: /usr/share/sift/terminal-profiles.txt
Running: dconf load /org/gnome/terminal/ < /usr/share/sift/terminal-profiles.txt
Running: arc-icons
Running: arc-theme
Running: gsettings set org.gnome.desktop.interface gtk-theme Arc
Running: gsettings set org.gnome.desktop.interface icon-theme Arc-Icons
Running: /usr/share/backgrounds
Running: /usr/share/backgrounds/warty-final-ubuntu.png
Running: /usr/share/unity-greeter
Running: /usr/share/unity-greeter/logo.png
Running: /home/siftadmin/.config/autostart/
Running: /home/siftadmin/.config/autostart/gnome-terminal.desktop
Running: gsettings set com.canonical.Unity.Launcher launcher-position Bottom
Running: gsettings set com.canonical.Unity.Lenses disabled-scopes "['more_suggestions-amazon.scope', 'more_suggestions-u1ms.scope', 'more_suggestions-populartracks.scope', 'music-musicstore.scope', 'more_suggestions-ebay.scope', 'more_suggestions-ubuntushop.scope', 'more_suggestions-skimlinks.scope']"
Running: gsettings set com.canonical.Unity.Launcher favorites "['application://gnome-terminal.desktop', 'application://firefox.desktop', 'application://org.gnome.Nautilus.desktop', 'application://unity-control-center.desktop', 'unity://running-apps', 'unity://expo-icon', 'unity://devices']"
Running: dconf write /org/compiz/profiles/unity/plugins/unityshell/icon-size 32
Running: dconf write /org/compiz/profiles/unity/plugins/unityshell/launcher-minimize-window true
Running: Etc/UTC
Running: /cases
Running: /mnt/usb
Running: /mnt/vss
Running: /mnt/shadow_mount
Running: /mnt/windows_mount
Running: /mnt/ewf_mount
Running: /mnt/e01
Running: /mnt/aff
Running: /mnt/ewf
Running: /mnt/bde
Running: /mnt/iscsi
Running: /mnt/windows_mount1
Running: /mnt/windows_mount2
Running: /mnt/windows_mount3
Running: /mnt/windows_mount4
Running: /mnt/windows_mount5
Running: /mnt/shadow_mount/vss1
Running: /mnt/shadow_mount/vss2
Running: /mnt/shadow_mount/vss3
Running: /mnt/shadow_mount/vss4
Running: /mnt/shadow_mount/vss5
Running: /mnt/shadow_mount/vss6
Running: /mnt/shadow_mount/vss7
Running: /mnt/shadow_mount/vss8
Running: /mnt/shadow_mount/vss9
Running: /mnt/shadow_mount/vss10
Running: /mnt/shadow_mount/vss11
Running: /mnt/shadow_mount/vss12
Running: /mnt/shadow_mount/vss13
Running: /mnt/shadow_mount/vss14
Running: /mnt/shadow_mount/vss15
Running: /mnt/shadow_mount/vss16
Running: /mnt/shadow_mount/vss17
Running: /mnt/shadow_mount/vss18
Running: /mnt/shadow_mount/vss19
Running: /mnt/shadow_mount/vss20
Running: /mnt/shadow_mount/vss21
Running: /mnt/shadow_mount/vss22
Running: /mnt/shadow_mount/vss23
Running: /mnt/shadow_mount/vss24
Running: /mnt/shadow_mount/vss25
Running: /mnt/shadow_mount/vss26
Running: /mnt/shadow_mount/vss27
Running: /mnt/shadow_mount/vss28
Running: /mnt/shadow_mount/vss29
Running: /mnt/shadow_mount/vss30
Running: salt-minion
Running: /etc/samba/smb.conf
Running: smbd
Running: nmbd
Running: /etc/foremost.conf
Running: /usr/local/etc/foremost.conf
Running: sift-config-tools

Completed with Failures -- Success: 514, Failure: 18

sift version gives me:
/usr/local/bin$ sift version

sift-cli@1.5.2-master.2035949
sift-version: notinstalled

BTW: i would prefer not to use unity or gnome or kde. i would like to use some more lightweight like xfce, lubuntu or similar from a minimal-installation of ubuntu. is there any chance in the future for this?

thank you

@ekristen
Copy link
Contributor

I'd need to see your install log (not just the output from the terminal) to see what has failed.

Unity is the only supported option at this time, but Ubuntu is even moving back to gnome, so that'll most likely become the default.

@TheZonks
Copy link
Author

thank your for your quick reply,
where is the installation-log located?

@ekristen
Copy link
Contributor

It’s in the terminal output

Log file: /var/cache/sift/cli/v2018.08.0/saltstack.log

@TheZonks
Copy link
Author

Hi,

attached my logfile (reneamed to saltstack.txt)

saltstack.txt

best regards

@crrfx
Copy link

crrfx commented Apr 13, 2018

saltstack.log

The Problem seems to be very similar if not identical to my current issue on Ubuntu 16.04.4 LTS.

@ekristen
Copy link
Contributor

@TheZonks it seems you are getting some sort of weird utf8 issue when managing files.

are you behind a proxy?

@crrfx
Copy link

crrfx commented Apr 14, 2018 via email

@ekristen
Copy link
Contributor

@crrfx are you running on a clean ubuntu 16.04 desktop? I'm seeing some weird errors and utf8 encoding errors, I've never seen this before.

@crrfx
Copy link

crrfx commented Apr 14, 2018 via email

@crrfx
Copy link

crrfx commented Apr 16, 2018

I set up ubuntu 16.04 LTS several times anew, tested two networks (at home, office) and used both sift-cli@1.5.1-master and sift-cli@1.5.2-master for installing sift. I was, however, not successful. This is the latest log-file:
saltstack.log

@ekristen
Copy link
Contributor

I've installed SIFT about half a dozen times in the last 3 days from scratch without issues.

Are you using any custom language settings, terminal settings, etc?

The more details the better, but at this point, unfortunately since I cannot replicate it, I'm going to have to say it's your environment. I'm happy to continue to help troubleshoot, but super hard when I can't replicate.

@crrfx
Copy link

crrfx commented Apr 16, 2018 via email

@ekristen
Copy link
Contributor

The timezone definitely should not be, although we highly recommend leaving the timezone as UTC.

The language could definitely be an issue. We do not unfortunately test against anything other than English. It could be the thing causing the problem with the utf8 encoding.

@crrfx
Copy link

crrfx commented Apr 17, 2018

I installed SIFT (1.5.2) again from scratch and used only the English variant from Ubuntu 16.04 LTS. Something changed indeed - I have now posters on my desktop. Nevertheless, I had still no success. I tried a second installation, and the result was worse compared with the fist trial. Both log files are attached. Which custom language settings and terminal settings should I check additionally?

saltstack1.log
saltstack2.log

@ekristen
Copy link
Contributor

@crrfx please use the pre-release of the sift-cli to try and install.

@crrfx
Copy link

crrfx commented Apr 18, 2018

Still having problems: using
$ sudo curl -o /usr/local/bin/sift https://github.com/sans-dfir/sift-cli/releases/download/v1.6.0/sift-cli-linux
I got only a partial download
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 604 0 604 0 0 853 0 --:--:-- --:--:-- --:--:-- 853
with this file sift_curl.txt. And
$ sudo chmod +x /usr/local/bin/sift
$ sudo sift install
led to the message
/usr/local/bin/sift: 1: /usr/local/bin/sift: Syntax error: redirection unexpected
Downloading alternatively sift-cli-linux directly and using
$ sudo mv sift-cli-linux /usr/local/bin/sift
$ chmod 755 /usr/local/bin/sift
$ sudo sift install
led to

sift-cli@1.6.0-master.1e4df5c
sift-version: notinstalled

ENOENT: no such file or directory, open '/etc/apt/sources.list.d/saltstack.list'
Error: ENOENT: no such file or directory, open '/etc/apt/sources.list.d/saltstack.list'

@ekristen
Copy link
Contributor

Use 1.6.1

curl -Lo /usr/local/bin/sift https://github.com/sans-dfir/sift-cli/releases/download/v1.6.1/sift-cli-linux
chmod +x /usr/local/bin/sift

@ekristen
Copy link
Contributor

We definitely had some weird things happen lately. Python PIP is mostly to blame.

Try installing 1.6.1 and then running sudo sift install --pre-release

@crrfx
Copy link

crrfx commented Apr 19, 2018

That's it. Without "--pre-release" there were still 12 failures, probably Python PIP, with this option v2018.16.0 was installed.

Thank you very much for your help!

@ekristen
Copy link
Contributor

Very good. We did a full release so --pre-release is no longer needed. Cheers.

@amcap623
Copy link

amcap623 commented Sep 7, 2020

I am getting this error trying to install SIFT workstation v2020.7.1 on Ubuntu 16.04. The install does not show me at the end Completed with Errors. It just stops. Below this error is the error from the saltstack.log

Running: sift-config-tools
Update returned exit code not zero
Error: Update returned exit code not zero
at ChildProcess. (/snapshot/sift-cli/sift-cli.js:529:23)
at ChildProcess.emit (events.js:196:13)
at maybeClose (internal/child_process.js:1011:16)
at Process.ChildProcess._handle.onexit (internal/child_process.js:268:5)

----- PLEASE READ ----------------------

A lot of failures are caused by the apt system being locked
or unhealthy.

Before opening an issue in GitHub, please check to see if
your apt system is healthy.

Try running 'apt-get update' then remove any packages that
aren't used by running 'apt-get autoremove'

sansforensics@siftworkstation: ~/Downloads
$
------------------------SALTSTACK.LOG ERROR--------------------------
Requirement already satisfied: pip in /opt/rekall/lib/python2.7/site-packages
(20.2.2)

  Requirement already satisfied: setuptools in /opt/rekall/lib/python2.7/site-packages
  (45.0.0)

  DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please
  upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop
  support for Python 2.7 in January 2021. More details about Python 2 support
  in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support

  WARNING: The directory ''/home/sansforensics/.cache/pip'' or its parent directory
  is not owned or is not writable by the current user. The cache has been disabled.
  Check the permissions and owner of that directory. If executing pip with sudo,
  you may want sudo''s -H flag.

  ERROR: Package ''setuptools'' requires a different Python: 2.7.12 not in ''>=3.5'''
duration: 3512.975
name: /opt/rekall
result: false
start_time: '03:37:03.278404'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants