osquery #kolide

nick

01/28/2019, 10:33 AM

Figured it out

nick

01/28/2019, 11:06 AM

Copy code

api/v1/osquery/enroll  (Request error: certificate verify failed) retrying...

b0l

02/04/2019, 4:25 PM

I am reading that yes, but I have few questions about 🙂 1) is it possible to push different configuration per OS (win, osx, linux) from kolide? 2) kolide UI or API supports the packs and FIM (per OS) deploy now?

harveywells

02/06/2019, 6:10 PM

Howdy! Is there a way to add batch add labels to enrolled nodes with

fleectl

? For example we have a number of enrolled centos linux hosts that we’d like to label with

dev

and

prod

benbass

02/06/2019, 6:44 PM

I have “distributed_tls_max_attempts” set to 5, but I am seeing the query attempted 15+ times after the osquery process bounces.

Aleks

02/07/2019, 1:27 PM

Hello, I'm having problems with osquery for windows connecting to fleet server over tls .. debugging it give me this "(Cannot parse JSON: Invalid value. Offset: 0) retrying..." Can anybody her help ?

Dave Greene

02/07/2019, 1:52 PM

Hi all, I’m having 2 issues I was hoping someone could help with. The first is that I’m using a letsencrypt cert on my fleet setup but if I run the launcher without the

--insecure

flag I get

x509: certificate signed by unknown authority

. The letsencrypt root cert has explicit trust in my keychain so I’m not sure why I’m seeing this error. The second issue is that when I try to target any other platform with the package-builder I get the following error:

Copy code

could not generate packages: version detection: Failed to exec. Perhaps -- Can't autodetect while cross compiling. (): run command /var/folders/0l/2f0_fh4905l8n9vsf56g08gh2c9r19/T/package.packageRoot626913343/usr/local/launcher/bin/launcher [-version], stderr=: fork/exec /var/folders/0l/2f0_fh4905l8n9vsf56g08gh2c9r19/T/package.packageRoot626913343/usr/local/launcher/bin/launcher: exec format error

The command I’m running is:

Copy code

./build/package-builder make --hostname=<http://fleet.example.com|fleet.example.com> --enroll_secret=mysecret --extension_version nightly --output_dir=./build/pkg --targets=linux-systemd-deb

Dave Greene

02/07/2019, 1:54 PM

I also see this log line a lot while the launcher is running:

Copy code

{
  "caller": "query_target.go:68",
  "err": "fetching target memberships: rpc error: code = Unimplemented desc = unknown service kolide.launcher.QueryTarget",
  "msg": "updating kolide_target_membership data",
  "severity": "error",
  "ts": "2019-02-07T13:53:36.917353Z"
}

blaedj

02/07/2019, 2:29 PM

You can safely ignore those errors, they pertain to a feature that launcher supports but fleet does not.

blaedj

02/07/2019, 4:02 PM

@Dave Greene @David.Kenny this PR, once merged, should help with those errors, you'll only see them if you use the

-debug

flag when running launcher.

Shawn

02/07/2019, 7:54 PM

how long is a user invite valid?

crimsonknave

02/07/2019, 8:33 PM

What's the best way to reset/roll a user's api token?

mbmy

02/08/2019, 12:02 AM

@seph confirmed i can successfully connect now with packages built on 0.8 now. previously i couldn’t connect without using launcher 0.5

😁 2

Woogs

02/08/2019, 8:54 PM

is there anyway to export my fleet pack config in json format that standalone osquery is expecting? Have some system that I won't be able to connect to my fleet server directly, so if I could export my config in osquery format, would save me some effort having to do it manually

Dave Greene

02/11/2019, 4:39 PM

The tl;dr is that no, even with ACM support for NLBs it still requires the protocol to be

TLS

which messes up gRPC transmission.

stefanmaerz

02/12/2019, 5:02 PM

@Johan Edholm ^^^ These are at least 3 benefits

brandon

02/12/2019, 5:11 PM

Does the fleet api use basic auth? I keep getting "Authentication failed" when trying to hit the api:

Copy code

$ curl -u "brandon.klise:XXXX" -X GET <https://fleet.quiq.sh/api/v1/kolide/hosts>
{
  "message": "Authentication Failed",
  "errors": [
    {
      "name": "base",
      "reason": "username or email and password do not match"
    }
  ]
}

groob

02/19/2019, 2:07 PM

specify multiple logger plugins in your config

seph

02/19/2019, 7:26 PM

Still a bit of a draft, but it’s a bunch of refactor that should help.

Tracy

02/20/2019, 4:29 PM

@teoseller You blocked out a few important bits with the error at the top, but it looks like you provided the wrong certificate as I believe it says "certificate valid for [x] and not [y]" where you need it to be valid for [y]

thatMacAdmin

02/25/2019, 9:56 PM

Apparently setting up your Go path is important.

nick

02/26/2019, 10:09 AM

What's the advantages of https://github.com/kolide/launcher over plain simple osquery working with fleet?

Kenny Stevens

02/28/2019, 4:49 PM

Hey @zwass. Yeah. When it registers, I see a 172. address instead of a public or private address range.

rkumar

03/01/2019, 5:01 PM

Hi there !!! - Last 10 days back I have upgraded kolide to 2.0.2 and later when ever we run queries couldn't able to view any system targets. It will be blank and couldn't able to add using hostname or IP address nor team. But I can query individual hosts not on group or teams. Can it be possible to help me out.

Stephen

03/02/2019, 3:17 PM

As a follow on from my message above, adding a linux client to fleet using the linux version of launcher works in exactly the same way, while it collects the information from the client, kolide never displays it and continues flipping the coloured box in the results window forever

ag4ve

03/02/2019, 4:27 PM

What is https://github.com/kolide/fleet/tree/master/examples/config-many-files for? It looks like your example systemd bakes everything in and the server config option points to a file?

groob

03/04/2019, 5:03 PM

it defaults to

true

so you must explicitly set it to false

dystie

03/04/2019, 9:10 PM

hey folks, I'm having problems when I run a query on the fleet console. the host i'm querying receives the query and there's logs but I never get the results back in the console.

harveywells

03/04/2019, 9:56 PM

👋 Question about labels. I’m writing a simple label query to group gke nodes together. Do I need to specify a platform in my yaml file or if I apply it via

fleetctl

will it apply it to all enrolled clients?

jaredcatkinson

03/05/2019, 4:20 PM

does anyone have good documentation on using the kolide/fleet docker container in conjunction with the docker-compose.yaml file in the github repo?