for bootstrapping feedback wou

Question

< zwass> for < C01DXJL16D8|fleet> bootstrapping feedback would you like that here or in the MacAdmins Slack

Noah Talerman · Answer

Feel free to let us know here in this thread Or reach out privately in slack DMs if you d like the information to be shared confidentially

jby · Answer

I ll try and summarize what I d like to see in the documentation of initial setup tomorrow It s 6pm here now and I have family obligations to take care of tonight

jby · Answer

So there s a docker image available as fleetdm fleet at dockerhub Does that contain everything needed to run fleet I ve tried the <https github com fleetdm osquery in a box> before and that does contain everything If more is required than just the docker image what

jby · Answer

I m right now at a stage where all my endpoints has osquery itself installed and now I need somewhere to send the data and make it searchable and able to present in a manager friendly way Since I ve tried osquery in a box before I thought that I d give this non Kolide fleet a try but how

jby · Answer

So what I d like to see is instructions on how to get a fleet server up and running preferably using the fleetdm fleet docker image from docker hub or alternatively how do I get a fleet server up and running if not using the docker image

Noah Talerman · Answer

Thank you for the awesome questions Jonas gt So there s a docker image available as fleetdm fleet at dockerhub Does that contain everything needed to run fleet No You will also need to use a container orchestration platform to deploy the Fleet docker image in production Two examples of this container orchestration tool are and

jby · Answer

I want to run the complete installation on prem hence AWS is not an option for me

Gavin · Answer

What components do you have setup so far the fleet server is a configuration and log forwarding tool but doesn t do log storage or analysis

Gavin · Answer

Also you mention on prem do you have something like ELK Splunk to store the logs

jby · Answer

I ll deal with provisioning of the fleet docker image on my own At the moment I m just looking at getting something to run to see if it ll provide me with the insight about my machines that I m looking for Just a basic proof of concept setup to start with

jby · Answer

What are your recommendations for something like that

Gavin · Answer

I would recommend this blog post then <https jordanpotti com 2018 02 16 elk osquery kolide fleet love >

Gavin · Answer

It s a single tenant OSquery setup on an ubuntu Vm

jby · Answer

Yeah but I m trying to get the fleet team to provide documentation on how to set up their product Which is how I understood the request from < Noah Talerman>

Gavin · Answer

I appreciate that the only comment I have is that fleet should be considered in the larger osquery system as only being a compliant OSquery TLS server responsible for agent configuration and management on a host system and not a single out of the box product containing log storage aggregation or analysis at this time the fleet teams indicative roadmap posted in here suggests some changes to this in the future The docker image itself contains everything you need to have a fully functional osquery TLS Server with support for managing Scheduled Queries host groups enrolment amp log forwardning

Gavin · Answer

Once you have the server you need to look at the following guides The OSquery in a box repo deploys fleet + elk stack + a log shipper much like the above blog post

Noah Talerman · Answer

gt I m trying to get the fleet team to provide documentation on how to set up their product Which is how I understood the request from < Noah Talerman> Correct I just opened this issue in the fleetdm fleet repo that describes the project of creating Docker deploy production documentation Currently the fleet documentation only provides detailed instruction for deploying fleet and The blog post shared by < Gavin> also seems like a great resource for deploying Fleet The Fleet team plans to provide more detailed documentation on other deployment scenarios including those < jby> is inquiring about I m about to copy your awesome questions over to the new github issue if that s ok with you

jby · Answer

Let me start over here I have a fleet consisting of some 200 Macs and some 50 Linux clients I m looking at osquery to gather inventory data about all of them and to be able to present it in a manager friendly way I m trying to find a tool suitable for collation search ability and presentability of the data I can collect with osquery I ve been trying for almost all of 2020 to find a tool that can help me with what I d like to accomplish I might have misunderstood the usefulness of fleet in my quest but I don t think so if I have then let me know it and point me towards som other tool that can help me please

jby · Answer

If fleet is the way to go help me get it running if `osquery in a box` is the easiest way to go then I ll do that but I m more than happy to help develop the documentation of fleet and to get that to do what I m looking for

Gavin · Answer

What inventory data

jby · Answer

Applications with versions kernel versions is the disk encrypted etc

Gavin · Answer

Honestly for a quick and easy life I would recommend SAL

jby · Answer

Yeah I have that for the Macs but I haven t found a way to use it with my Linux clients

Gavin · Answer

I added linux support to SAL

jby · Answer

Ok care to share how

Gavin · Answer

Gavin · Answer

It uses gosal on a cron there is sal v3 amp v4 support depending on what version you run I don t capture disk encryption however

jby · Answer

I do have my puppet clients managed by puppet and I have an old foreman instance running for reporting only not as puppet server or enc but there are lots of data that could be a lot easier to get to than from foreman

zwass · Answer

< jby> have you tried following the instructions on Anything missing there to get you a test instance set up

jby · Answer

No it seemed to work the last time I tried it it s been a while though I think it was before the summer this year has wreaked havoc on dates and times

jby · Answer

So are you proposing I m using the `osquery in a box` as a production setup as well

zwass · Answer

No but it may inspire you on how you d like to set up a production instance

zwass · Answer

My recommendation would be to spend 5 mins setting up osquery in a box so that you can try the functionality of Fleet and then spend an hour or two setting up a prod instance if it s meeting your needs

jby · Answer

Ok I ll try that then

jby · Answer

< Gavin> I decided to give gosal a try but it fails immediately ``` build linux gosal config to json gosal did not complete build report reports getting serial DMI run exit status 1``` This is after cloning the repo and running `make deps` followed by `make build` and then running

Gavin · Answer

Run as root

jby · Answer

Ah ok

Gavin · Answer

Also you may be better on sal slack channel

jby · Answer

Ok < Noah Talerman> amp < zwass> I now have a working osquery in a box running after a bit of wrestling with SELinux in my RHEL server running docker

jby · Answer

What s the recommended way to get my clients to populate it with data

jby · Answer

just to be transparent here I ve done it before and I almost remember how I did it then these questions are mostly to help you clarify the documentation

jby · Answer

And after getting the launcher how do I set all parameters for it easily to make it deployable using Jamf or Munki for macOS and using puppet for Linux

jby · Answer

And starting the launcher as a normal user gives the same restrictions as running osqueryi as a normal user BUT starting as root gives the headache of `Will not autoload extension with unsafe directory permissions `

jby · Answer

Oh and the launcher only exist in the Kolide repo is that the one to use or will you provide a fleetdm launcher as well

jby · Answer

Or is there another way to populate the fleetdm fleet server with client data

Noah Talerman · Answer

Hi Jonas All the questions you re asking are awesome and will be very helpful for altering making additions to the existing documentation Right now I ll answer the questions I can to the best of my ability I m confident you ve come across the Adding Hosts to Fleet documentation <https github com fleetdm fleet blob master docs infrastructure adding hosts to fleet md> Here we outline two recommended ways to connect your clients to Fleet which include installing osquery binaries or the Kolide Launcher on your hosts Fleet remains compatible with Launcher and we do not expect to drop compatibility In the documentation I link to above the name Kolide Fleet is being used and this is inconsistent with other updated parts of the documentation should be Fleet I m drafting a PR to change this Thank you for calling my attention to possible confusion

Noah Talerman · Answer

gt What s the recommended way to get my clients to populate it with data < jby> I m not sure how if it s possible to connect your clients to the local instance of Fleet you ve started via osquery in a box I m working on getting that answer for you now In the meantime have you tried to start the containerized osquery agents to test this functionality Instructions are linked here

jby · Answer

So if it s not possible then I feel like I m back at square 1 with nothing other than a server running a docker instance of something that I can t use for anything disappointed

jby · Answer

I ve actually managed to get the Kolide launcher to send data to the osquery in a box but I seem unable to get osqueryd to do it it refuses to start properly

jby · Answer

```Dec 01 16 54 14 LIN5W2V3Z2 trioptima local osqueryd 111674 osqueryd started version=4 5 1 Dec 01 16 54 17 LIN5W2V3Z2 trioptima local systemd 1 osqueryd service Main process exited code=exited status=78 CONFIG Dec 01 16 54 17 LIN5W2V3Z2 trioptima local systemd 1 osqueryd service Failed with result exit code Dec 01 16 54 17 LIN5W2V3Z2 trioptima local audit 1 SERVICE STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system u system r init t s0 msg= unit=osqueryd comm= systemd exe= usr lib systemd systemd hostname= addr= terminal= res=failed ```

jby · Answer

And the ` var log osquery osqueryd INFO` says ```I1201 16 50 57 000754 111287 events cpp 867 Event publisher not enabled auditeventpublisher Publisher disabled via configuration I1201 16 50 57 000955 111287 events cpp 867 Event publisher not enabled syslog Publisher disabled via configuration I1201 16 50 57 001091 111287 events cpp 1126 Error registering subscriber apparmor events Subscriber disabled via configuration I1201 16 50 57 001191 111287 events cpp 1126 Error registering subscriber process file events Subscriber disabled via configuration I1201 16 50 57 001235 111287 events cpp 1126 Error registering subscriber selinux events Subscriber disabled via configuration I1201 16 50 57 001278 111287 events cpp 1126 Error registering subscriber socket events Subscriber disabled via configuration I1201 16 50 57 001502 111287 main cpp 105 Not starting the distributed query service Distributed query service not enabled I1201 16 50 57 001571 111295 events cpp 786 Starting event publisher run loop inotify I1201 16 50 57 001605 111296 events cpp 786 Starting event publisher run loop udev I1201 16 50 57 001598 111287 dispatcher cpp 78 Adding new service SchedulerRunner 0x55f0ab28c6b8 to thread 140484973627136 0x55f0ab268240 in process 111287```

jby · Answer

```E1201 17 12 14 111375 112857 shutdown cpp 69 Cannot activate tls```

jby · Answer

Oh well I have to give up today I ll continue tomorrow

zwass · Answer

Have you tried following the instructions in the Add New Host dialog If your configs are all correct that should step you through an enroll with plain osquery

zwass · Answer

To clarify that one you ll need to generate a new SSL certificate that matches the hostname IP hosts will be using to connect Osquery is picky about certificates matching where launcher lets you get around that with ` insecure`

jby · Answer

I ll try tomorrow

jby · Answer

It s 5 30 pm here now

jby · Answer

< zwass> using the instructions from the Add New Host dialog worked somewhat I downloaded everything from there and put that in my Linux client in etc osquery started osqueryd with the flagfile option pointing to the downloaded flagfile it read the flagfile the secret and the tls server cert and created the host in my fleet server I am however unable to get it to work using `systemctl` to start it disappointed

jby · Answer

Now my questions are more general both osquery and fleet so I ll move them out to the channels

jby · Answer

However I DO have another question for you guys How do I configure smtp without TLS No matter how I do with the mail form I DO uncheck the Use SSL TLS to connect it compains about

jby · Answer

And another can I install query packs into fleet somehow through the GUI

Noah Talerman · Answer

Hi Jonas I m working on getting answers for your questions By install do you mean inserting query packs to Fleet in bulk using the Fleet UI Instead of manually creating each query and then adding these queries to their respective packs using the UI

jby · Answer

I ve found packs on github that I m wondering if I can download and install using the fleet webgui

Noah Talerman · Answer

Got it Thanks for explaining your use case Working on answers for you

jby · Answer

I ll look through the docs on github and add what I ve found when you have something to edit

Noah Talerman · Answer

Feel free to submit a PR to the fleet documentation on github or DM me your suggested changes

jby · Answer

I will

jby · Answer

This is now my main outstanding problem <https osquery slack com archives C01DXJL16D8 p1606913930175900 thread ts=1606316442 122300 amp cid=C01DXJL16D8>

Noah Talerman · Answer

Do you mind sending steps to reproduce this error Either here in the thread or in a DM to me

jby · Answer

Admin gt Setup email gt SMTP port 25 gt Uncheck SSL TLS gt No user gt Save gt Error

jby · Answer

Any news on this

Noah Talerman · Answer

What are you trying to accomplish by setting up SMTP configuration Are you trying to invite other users Or use another feature that requires SMTP

zwass · Answer

I m going to dig into the code to take a look at what might be happening but is it possible your SMTP server is trying to upgrade the connection to TLS

jby · Answer

I m unable to setup any other user than the primary admin user that I created during setup since it refuses to take me to the user admin page since email is not setup

jby · Answer

I have tried both with and without TLS but to no avail I ll check with my exchange admin as well

zwass · Answer

< jby> you can get around that by `fleetctl user create` We have some changes coming in the next release today that will make this more clear Please let us know what you hear from the exchange admin

jby · Answer

Probably but I m also playing stupid newbie here to help you with the documentation as well stuck out tongue winking eye

jby · Answer

Clueless might be better than stupid