Hi all

auto sw_vers = SQL::selectAllFrom("plist", "path", EQUALS, kVersionPath); kVersionPath = '/System/Library/CoreServices/SystemVersion.plist' fetchs the empty data. please look into this

please find the screenshot from the xcode:

How long ago was the issue with the database path resolved?

https://osquery.slack.com/archives/C01DXJL16D8/p1662472936461979 does anyone have an idea why is it happening?

https://osquery.slack.com/archives/C01DXJL16D8/p1662630223198419 im using fleet 3.5.1 if it metters

Having an issue configuring Fleet with a YAML file. The password is specified in the file, but when I attempt to start it up using

fleet serve --config /etc/fleet/fleet.yml

, I’m getting:

mysql="could not connect to db: Error 1045: Access denied for user 'fleet'@'localhost' (using password: NO), sleeping 0s"

If instead I specify the password with a CLI flag, it works fine. The config file is fairly simple:

apiVersion: v1
kind: config
spec:
  mysql:
    password: '<my password>'
  server:
    address: 0.0.0.0:443
    cert: '/etc/letsencrypt/live/<my domain>/fullchain.pem'
    key: '/etc/letsencrypt/live/<my domain>/privkey.pem'

Anyone know why fleet would seem to be ignoring my config file?

👋 Random one I don’t know if it’s an open issue but Github search has failed but on the latest fleet v4.19.1 we’re seeing CVE’s being created for the same software daily and at multiple times.

a newb here. I checkout and build on ubuntu 22.04. How do I do a minimal purge of the stack so that I can run

fleetctl setup

more than once? The 2nd attempt says

Fleet has already been setup

I'd rather not totally remove the whole stack and start over.

<!here> Announcing Fleet 4.20.0 🔥 The headline features for this release are aggregated Munki issues for macOS, controlled rollout for features on Teams (Fleet Premium), and improved vulnerability processing on macOS. See more in the release blog post or the changelog. Happy weekend, and hope you enjoy these new improvements (on Monday 😅)!

When your terraform build pulls the latest version but the latest version has a bug 😅

Any notion from the Fleet folks about supporting https://aws.amazon.com/memorydb/ ?

I’m a bit stuck. When I log into fleetctl I get an error ‘`the Fleet instance is not set up`’ is a piece of config missing? maybe it needs a host added first? (currently no hosts) When I execute remotely

fleetctl setup --email $email --name '$name' --org-name '$company Fleet'

I get

Error: Fleet has already been setup

hmm, maybe it’s the config file, I’ll delete that and try again

Fixed- it wasn’t the config file, it was the port number on my URL

Is there a schedule when Orbit on the stable channel will update osquery to version 5.5.1 or am I misunderstanding how this works?

Does this config look good for sending logs to kinesis data stream ? i am not seeing the logs there nor do i see any err in orbit err file :? config: spec: host_settings: enable_software_inventory: true vulnerability_settings: databases_path: /tmp/ kinesis: region: eu-west-2 access_key_id: ********** result_stream: osquery_result status_stream: osquery_status result_log_file: /var/log/osquery/result.log secret_access_key: ********* sts_assume_role_arn: >- ********** options: logger_plugin: ‘firehose,aws_firehose’ disable_carver: false pack_delimiter: / proxy_hostname: ********** carver_block_size: 2097152 logger_tls_period: 10 distributed_plugin: tls disable_distributed: false logger_tls_endpoint: /api/osquery/log distributed_interval: 10 carver_start_endpoint: /api/v1/osquery/carve/begin carver_disable_function: false carver_continue_endpoint: /api/v1/osquery/carve/block distributed_tls_max_attempts: 3 osquery: osquery_result_log_plugin: kinesis osquery_status_log_plugin: kinesis decorators: load: - SELECT uuid AS host_uuid FROM system_info; - SELECT hostname AS hostname FROM system_info; overrides: {}

Hi, I am working on creating yara rule to find webshells using fleet. Can someone advise me how to do it ? I am new to Fleet/OSquery/Yara☺️

Hi, I'm getting this error running

fleet prepare db

on a fresh installation:

INFO: 00:13:41 Deleting dummy software_cpe entries...
INFO: 00:13:41 Done deleting dummy cpe_id entries...
INFO: 00:13:41 Removing cpe_id from software_cve...
2022/09/16 00:13:41 FAIL 20220831100036_RemoveCpeIDColumnFromSoftwareCve.go (removing cpe_id FK from software_cve: Error 1091: Can't DROP FOREIGN KEY `software_cve_ibfk_1`; check that it exists), quitting migration.

anyone could help?

anyone knows what is the err meaning when i start the fleet? Sep 16 034719 n107-019-021 fleet[1560407]: {"component":"http","err":"authentication error: invalid node key: JlBVRLpv/doDpN1CvShCIpZpnfCERea0","level":"info","path":"/api/v1/osquery/distributed/read","ts":"2022-09-16T034719.825997124Z"}

Hey @mikermcneil, It's not a generated Query rather It's a generated source code from the CMake Build system ran from Mac OSx as per defined in the doc's where. have integrated all the Public headers and CPP source files into the XCode IDE ∈ Mac OSx successfully & Unable to get the os_version info from the above api which is defined in the cpp source code. please let me know still if you have any queries!.... and You will be the Guy I am expecting will take this to resolution. eagerly awaiting!....

<!here>: Announcing Fleet 4.20.1 ☁️ 🚀 This patch release fixes bugs that caused duplicate vulnerability automations and issues with SSO logins, as well as a migration issue for Fleet instances using MariaDB*. We have also upgraded the Go version used in Fleet to address CVE-2022-27664. While we believe this to be low severity, we'd like you to avoid potential Denial of Service attacks and feel that this is an important security fix.

*

MariaDB is not officially supported. Future issues specific to MariaDB may not be fixed quickly (or at all). We strongly advise migrating to MySQL 8.0.19+.

fleetctl setup

documentation and help text says it takes a

--config

argument with a path to a config file, but if I include that flag I get:

Error: set the Fleet API address with: fleetctl config set --address <https://localhost:8080>

If I run setup without the config file and then

fleetctl apply -f

the config file, it works. I don’t see any open bug reports, has anyone else seen this or can confirm the behavior, or let me know what I’m doing wrong?

Also, what can I monitor to see when fleet has finished initializing? My cloud-init is running

fleetctl setup

immediately after

systemctl start fleet

but the server is not ready for incoming API calls. I’d rather do something smarter than just a

sleep

I had the same observation

For the first, see https://fleetdm.com/docs/deploying/configuration#logging-debug … the line would be:

—logging_debug=true

also note you’d need

\

at the end of the previous line to continue the command. For the second I believe it's only accepted as an environment variable, so you’d need a separate line in the

[Service]

block:

Environment=FLEET_ENABLE_DEV_SQL_INTERCEPTOR=true

This message was deleted.

What version of Fleet are you running, @Mystery Incorporated ?

I'm guessing it's because the Go library is using the equivalent of

pkgbuild --ownership preserve

instead of

pkgbuild --ownership recommended

... a simple flag to switch