Expedition Working on Windows WSL1.0

[blwavg]

Out of sheer curiosity I wanted to see if I could get Expedition installed on WSL (Windows Subsystem for Linux). Surprisingly, it does, and it works quite well. Please let me know if you run into any issues. 

Standard disclaimer: This software is provided "as is" and without any warranties expressed or implied, including, but not limited to, implied warranties of fitness for a particular purpose, and non-infringement. You expressly acknowledge and agree that use of the Software is at your sole risk.

How to Install:

1. Install Windows Subsystem for Linux - From search type "turn on off windows features" and hit enter. Make sure the box is checked for "Windows Subsystem for Linux". Select "Ok".
2. Reboot the computer
3. From the Microsoft App Store, download Ubuntu 16.04 LTS - Expedition currently only works on 16.04 LTS. The installation script will check the version.
4. Open the Ubuntu App and create a username and password. This can be whatever you want it to be (assuming whatever you want it to be is all lowercase). The script will add/modify any accounts it needs to. It will create an account called expedition with the password ‘paloalto’ and change the root password to ‘paloalto’.
5. Grab a copy of the Expedition 7Zip file. The one drive link to the installation script is below.
   1. Extract Expedition.7z anywhere you prefer. We recommend on the desktop in a folder called expedition
6. From the Ubuntu window. Copy the files from windows location to the Linux home directory. This example assumes the files are extracted on the desktop in a file called Expedition (note that Linux is case sensitive).
   

   cp /mnt/c/Users/USERNAMEHERE/Desktop/Expedition/* ./

7. Run the installation script using this command
   

   sudo ./initSetup.sh

   1. NOTE: This will take about a half hour to complete depending on your internet connection. You can see what each section is doing by adding the -i flag (eg. sudo ./initSetup.sh -i ). This will stop at every section of work so you can manually review the progress. Then press enter to continue to the next section.
8. Login with the regular usernames and passwords - admin/paloalto for WebUI
9. The Expedition dashboard after logging in should be all green except for three instances 2x of ML (Machine Learning) and 1x PanOrders Agent. To fix this, change the ML address under settings to any IP on you appliance other than the loopback address (127.0.0.1). To fix the PanOrders Agent, just hit the big green start button...
10. PROFIT $$$

NOTE:
- These instructions are specific to WSL 1.0 – If you have WSL 2 enabled on your computer, give it a shot and let me know how it works.
- This install will take some time. Expect around 30min+.
- OriginalinitSetup.sh is included. This is the original PA script used to install the appliance. This is so you can compare changes made.

- From my testing you can access Expedition from any IP on your computer. Which means other computers on your network can get to the tool as well. Expedition itself is not a particularly secure tool. Now it will be turned on all the time on your local computer unless YOU do something to secure it.

Troubleshooting:
- To wipe the WSL instance, use the following command “wsl --unregister Ubuntu-16.04”. This command needs to be run from an admin command prompt. This will WIPE ALL DATA for the app and start fresh. Just reopen the app, and you will be prompted with the user created prompt.

wsl --unregister Ubuntu-16.04

- To "reboot" a WSL 1.0 instance. Use the following commands from an elevated command prompt:

net stop LxssManager
net start LxssManager

Installation Files:

https://1drv.ms/u/s!At8na8KMt9U6gRjyD7DSJTUOLlta?e=oyCDa0

sha256sum - 5e31102e7ed7812f7010dc3745fb4ff06b622c05ffacc2b4309d9c98d690b59b ExpeditionWSLinstall.zip

[dgildelaig]

Hi,

Thanks @Blwavg for this information.

As a developer of Expedition and the creator of the initSetup.sh and databases.tgz, I would recommend not to use external scripts to install Expedition from outside the ones we are publishing from the Expedition team and directly posted at the link https://live.paloaltonetworks.com/t5/Expedition-Migration-Tool/ct-p/migration_tool

If you would not mind, I would suggest that you modify your setup description to download the installer from the original resources.

Not only those are the ones we have originaly provided, but we may have to update them in the future to reflect any Expedition modifications we have implemented.

In case the initScript.sh is not valid as for your type of installation, contact us at fwmigrate at paloaltonetworks dot com. We will study with you the modifications that are needed and publish the script together with the Ubuntu 16.04. Obviously, you will get credit for this effort and research performed.

Besides this aspect, I am very glad to see that Expedition is gaining extra interest and that a rather young script is already being modified to cover even more platforms.

Thanks!

[blwavg]

The files for download include the main installation script that was created and a modified script. I included both so the changes can be reviewed. If you, @dgildelaig, are interested in getting this officially on WSL I can shoot you an email so we can talk about it. I have already found a couple of issues that I still need to work out.

I hope this did not come off as me claiming to have made the script of the files themselves. The files can be found in /var/www/html/OS/installer on your expedition appliance. I have modified the existing installation script so that it will work in a WSL environment. 

[dgildelaig]

That's not the intention.

My point is that we would like to provide officially the installer to have a level of control of what it is being used in the field, so we can provide support to known environments that we can reproduce and debug.

Also, the installer has a goal that may change in the future having additional packages that we may require. For instance, RabbiMQ was added to handle background messaging within Expedition.

If we have a level of control on the installers, we can make sure that users with all get the required dependencies. If users get installers from different sources, they have encounter issues that will be different from normal expected behavior, and also would require more time from our side to understand what went wrong.

I am sure you understand my point. The solution I see it is not to block additional flavours of this installer, but to make they go through the same channel to keep control whenever we need to update them.

And, as I said, we do not have any issue to give you credit of those modifications even if we post the installer together with the existing original one.