Apt-Cacher-NG SecurityOnion

I built out a SecuriyOnion Master server 16.04.2 (wanted an older copy), and wanted to use Master Server since this is what I work on mostly. I am pretty sure they renamed it from Master server, but off the top of my head I cannot remember what is the new term. From there I ran the full setup and made sure that SecurityOnion was able to process data, next I installed Apt-cacher-NG on this machine. The setup was pretty strait forward. sudo apt get apt-cacher-ng edit the apng.conf file sudo ufw allow 3142 (the port for other machines to talk to the caching server) Next I ran sudo-soup and watched the updates come in. Verified it was updated to SecurityOnion 16.04.07. After this I built a second machine running SecurityOnion 16.04.2 and edited the sources.list, adding the IP address of the primary client to the front end of each of the repo locations. From there I ran sudo soup, and watched it connect to the primary SecurityOnion server and process all the updates. After reboot I verified that this was brought up to SecurityOnion 16.04.7 also. One issue/question that I have right now is that I believe docker is not part of the repo checking, and that it looks somewhere else to do those updates. I will need to figure out how to do the docker updates on the "repo" so that I can do the docker in an offline update. I think next I am going to download a vanillia version of ubuntu and verify that I can pull updates from the SecurityOnion "Repo" server to update that to the newest version of Ubuntu (16.04). I know that I am running older versions of software, but I am locked into a certain version of software, so I have to work with what I am allowed.

SecurityOnion/Ubuntu Repo for Offline Updates?

 I am back at it working on a solution for updating multiple instances of SecurityOnion that are disconnected from the internet.    In previous tries, I was using Apt-Catcher-NG and from the looks of it SecurityOnion 2.0 uses Apt-Catcher-NG for its offline updates, but I need to see how this would work for multiple single instances of SecurityOnion.  

Aside from that, I think I would need a 2nd machine as the actual machine that touches the internet.  This machine would be the "update" machine where all the patches are downloaded, and then burned to the Primary SecurityOnion repo maybe?   

I would need some way to hash the updates that are transferred over from the internet machine to the "primary".  Is there a way to send patches over a one-way tap and received at the other end?  Guess its time to do some more research.   

Offline SecurityOnion

I have a VM built with SecurityOnion  14 running Apt-Cacher-NG which was able to download all the updates for this version and cache thing for other boxes. 

I will be running a bunch of offline SecurityOnion (currently using an older version 14) which I would like to try and keep updated (at the 14 level) as much as possible, but I cannot use sudo soup to download any updates from the internet. 

I have done this before but I didn't take any notes on how it was done (except the first part which was to use apt-cacher-ng).  Now I am on step two and not sure what to do. 

I was hoping there was an easy way to burn the cached file to a DVD and then load them on the stand-alone, but I cannot find any information that would help (doesn't help that I am not an expert on things, I usually only look up stuff when I am trying to solve an issue), I get by mostly though.  My friend Google is pretty helpful, guess I am not searching for the right words in this one. 

I can't use the apt-cacher-ng as a proxy server either.  This will be just one machine that gets updated, no other machines will be touching that one.   

If anyone has any idea's to let me know.  Like I said I am currently at the stage of using apt-cacher-ng.  Now trying to figure out how to export the information to use on another machine.