Hi all I noticed that orbit is making connections to differe osquery #fleet

Hi all, I noticed that orbit is making connection...

Darshal Shah

09/05/2023, 8:18 PM

Hi all, I noticed that orbit is making connections to different online IPs in the internet such as

143.244.50.*

169.150.249.*

which is ripe.net. Is there a way to stop osquery/orbit/fleetdm from making connections like that? We dont want it to be able to access the internet

Kathy Satterlee

09/05/2023, 8:39 PM

Is it specifically Orbit that's making those requests, or osquery?

Darshal Shah

09/05/2023, 8:40 PM

Orbit

Darshal Shah

09/05/2023, 8:54 PM

@Kathy Satterlee any way to stop orbit from connecting to outside internet?

Kathy Satterlee

09/05/2023, 8:56 PM

It needs to be able to connect to Fleet and the update server. I'm checking in with the team to see what else we would expect to see outside of those two.

Kathy Satterlee

09/05/2023, 9:14 PM

Is there a specific OS you're seeing this on?

Darshal Shah

09/05/2023, 9:15 PM

Linux rhel/centos

Kathy Satterlee

09/05/2023, 9:41 PM

One thing that could feasibly be making outside requests as Orbit would be the sntp_request table. In osquery, there's also the curl table. You could disable both of these with the

--disable-tables

flag, In your agent options, that would look like:

Copy code

config:
  options: [...]
  decorators: [...]
overrides: [...]
command_line_flags: 
  disable-tables: curl,snt_request

Kathy Satterlee

09/05/2023, 9:43 PM

I'm setting up a CentOS host to make sure there isn't any inherent oddness going on, if you could also try disabling those tables. I'd like to know if those requests go away. Just as a note, in order for those tables to make requests they'd need to be queried first. They definitely shouldn't be making calls unprompted.

2 Views

Open in Slack

Previous Next