An error occurred during DFIR-IRIS installation

Hello everyone,
I hope this message finds you well.

I’m writing to you today because I’m very interested in the DFIR-IRIS project and I’m currently trying to install it on a KVM Ubuntu 22.04 virtual machine. The installation of Docker and Wazuh went smoothly, however, I’m encountering a warning message when running Wazuh. I’m not sure if this warning can be resolved

WARN[0000] /home/faravena/t-guard/wazuh/generate-indexer-certs.yml: `version` is obsolete 

Shuffle is installed without problems but has the same warning:

WARN[0000] /home/faravena/t-guard/shuffle/docker-compose.yml: `version` is obsolete 

The real problem is created in module 5 (Install DFIR-IRIS)
It also delivers the warning:

WARN[0000] /home/faravena/t-guard/iris-web/docker-compose.yml: `version` is obsolete 

But I can only get here with the installation because it does not finish installing and generates the following error:

69.64   DEPRECATION: python-docx is being installed using the legacy 'setup.py install' method, because it does not have a 'pyproject.toml' and the 'wheel' package is not installed. pip 23.1 will enforce this behaviour change. A possible replacement is to enable the '--use-pep517' option. Discussion can be found at https://github.com/pypa/pip/issues/8559
69.64   Running setup.py install for python-docx: started
70.46   Running setup.py install for python-docx: finished with status 'done'
74.32   DEPRECATION: splunk-hec is being installed using the legacy 'setup.py install' method, because it does not have a 'pyproject.toml' and the 'wheel' package is not installed. pip 23.1 will enforce this behaviour change. A possible replacement is to enable the '--use-pep517' option. Discussion can be found at https://github.com/pypa/pip/issues/8559
74.32   Running setup.py install for splunk-hec: started
74.65   Running setup.py install for splunk-hec: finished with status 'error'
74.66   error: subprocess-exited-with-error
74.66   
74.66   × Running setup.py install for splunk-hec did not run successfully.
74.66   │ exit code: 1
74.66   ╰─> [39 lines of output]
74.66       /opt/venv/lib/python3.9/site-packages/setuptools/_distutils/cmd.py:66: SetuptoolsDeprecationWarning: setup.py install is deprecated.
74.66       !!
74.66       
74.66               ********************************************************************************
74.66               Please avoid running ``setup.py`` directly.
74.66               Instead, use pypa/build, pypa/installer or other
74.66               standards-based tools.
74.66       
74.66               See https://blog.ganssle.io/articles/2021/10/setup-py-deprecated.html for details.
74.66               ********************************************************************************
74.66       
74.66       !!
74.66         self.initialize_options()
74.66       Traceback (most recent call last):
74.66         File "<string>", line 2, in <module>
74.66         File "<pip-setuptools-caller>", line 34, in <module>
74.66         File "/tmp/pip-install-cq22_lsb/splunk-hec_c35a3d88c10e46b08a27a4d494c18ad3/setup.py", line 13, in <module>
74.66           setup(name='Splunk-HEC',
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/_distutils/core.py", line 184, in setup
74.66           return run_commands(dist)
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/_distutils/core.py", line 200, in run_commands
74.66           dist.run_commands()
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/_distutils/dist.py", line 970, in run_commands
74.66           self.run_command(cmd)
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/dist.py", line 956, in run_command
74.66           super().run_command(command)
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/_distutils/dist.py", line 988, in run_command
74.66           cmd_obj.ensure_finalized()
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/_distutils/cmd.py", line 111, in ensure_finalized
74.66           self.finalize_options()
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/command/install.py", line 57, in finalize_options
74.66           super().finalize_options()
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/_distutils/command/install.py", line 407, in finalize_options
74.66           'dist_fullname': self.distribution.get_fullname(),
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/_core_metadata.py", line 266, in get_fullname
74.66           return _distribution_fullname(self.get_name(), self.get_version())
74.66         File "/opt/venv/lib/python3.9/site-packages/setuptools/_core_metadata.py", line 284, in _distribution_fullname
74.66           canonicalize_version(version, strip_trailing_zero=False),
74.66       TypeError: canonicalize_version() got an unexpected keyword argument 'strip_trailing_zero'
74.66       [end of output]
74.66   
74.66   note: This error originates from a subprocess, and is likely not a problem with pip.
74.66 error: legacy-install-failure
74.66 
74.66 × Encountered error while trying to install package.
74.66 ╰─> splunk-hec
74.66 
74.66 note: This is an issue with the package mentioned above, not pip.
74.66 hint: See above for output from the failure.
74.99 
74.99 [notice] A new release of pip is available: 23.0.1 -> 24.1.2
74.99 [notice] To update, run: pip install --upgrade pip
------
failed to solve: process "/bin/sh -c pip3 install -r requirements.txt" did not complete successfully: exit code: 1

As I mentioned previously, the installation gets stuck at that point and I’m unable to proceed. I’ve tried various methods to resolve this issue, but to no avail. Therefore, I’m reaching out to you, the experts, for assistance in getting this installation completed.
To provide more context, here’s a detailed account of the issue:

Hi, panxos!

Thank you for your feedback.

We are currently in the process of addressing this issue. It has only arisen recently.

Once we have a solution, we will promptly announce it.

Thank you!

Hi, panxos!

You can try this following steps:

  1. Go to iris-web directories
  2. Run this command:
sed s',pip3 install -r requirements.txt,pip3 install --upgrade pip \&\& pip3 install -r requirements.txt,' -i docker/webApp/Dockerfile
  1. Run setup.sh again.

We hope this can resolve the issue.

Thank you!

Ref: [BUG] Docker build is not working · Issue #542 · dfir-iris/iris-web · GitHub

Hello, thanks this worked!

Does this somehow affect Wazuh installation? IRIS web interface is now reachable on port 8443 but I can’t access the wazuh dashboard on port 443. Tried to run the whole script again, compose down and up but no luck.

Thank you!

Actually, this issue doesn’t impact the Wazuh installation. On our VM, both Wazuh and IRIS are running smoothly after resolving the issue mentioned above.

Perhaps you could consider reinstalling the Wazuh.

Or, could you provide more detailed information about the specific issue you’re encountering with the Wazuh dashboard?

Thank you!

Hello, thanks for the reply. It was my bad, I rebuilt the server and one of the firewall rules was wrongly configured. Thanks!

Awesome! it works, many thanks!