#371 Osctrl technology
Issue created by
nidhin077
Hi,
I'm hoping this is going well for you. This is unrelated to the issue. instead, I would want to know about the technologies and techniques you employed in the osctrl.
As we are creating an application, we must utilise Osquery to gather information about numerous machines and show it on the user interface. This is the use case, so we have now utilised the
Osquery TLS test endpoint service at port 8080:
$ git clone
https://github.com/osquery/osquery
$ cd osquery
$ tools/tests/test_http_server.py --tls --persist --cert tools/tests/configs/test_server.pem --key tools/tests/configs/test_server.key --ca tools/tests/configs/test_server_ca.pem --use_enroll_secret --enrol
l_secret tools/tests/configs/test_enroll_secret.txt --test-configs-dir tools/tests/configs/ 8080
127.0.0.1 - - [15/Nov/2023 16
3738] "POST /logger HTTP/1.1" 200 -
127.0.0.1 - - [15/Nov/2023 16
3738] "POST /logger HTTP/1.1" 200 -
Also tried enrolling a node to the above osctrl-tls like remote endpoint using the osquery daemon service like below:
$ git clone
https://github.com/osquery/osquery
$ cd osquery
$ sudo osqueryd --verbose --ephemeral --disable_database
--tls_hostname localhost:8080
--tls_server_certs ./tools/tests/configs/test_server_ca.pem
--config_plugin tls
--config_tls_endpoint /config
--logger_tls_endpoint /logger
--logger_plugin tls
--enroll_tls_endpoint /enroll
--enroll_secret_path ./tools/tests/configs/test_enroll_secret.txt
I1115 16
3912.656174 8048 init.cpp:413] osquery initialized [version=5.10.2]
I1115 16
3912.656275 8048 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: /etc/osquery/extensions.load
I1115 16
3912.656335 8048 dispatcher.cpp:78] Adding new service: WatcherRunner (0x557f52ef3858) to thread: 140628891117312 (0x557f52eb1580) in process 8048
I1115 16
3912.656767 8049 watcher.cpp:720] osqueryd watcher (8048) executing worker (8050)
I1115 16
3912.661576 8050 init.cpp:410] osquery worker initialized [watcher=8048]
I1115 16
3912.661681 8050 dispatcher.cpp:78] Adding new service: WatcherWatcherRunner (0x564e42c44308) to thread: 140385638168320 (0x564e42c41af0) in process 8050
I1115 16
3912.661760 8050 dispatcher.cpp:78] Adding new service: ExtensionWatcher (0x564e42c4a828) to thread: 140385629775616 (0x564e42c44b10) in process 8050
I1115 16
3912.661805 8050 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (0x564e42c4a0b8) to thread: 140385621382912 (0x564e42c5fd50) in process 8050
I1115 16
3912.661839 8053 interface.cpp:299] Extension manager service starting: /var/osquery/osquery.em
I1115 16
3912.661841 8050 tls_enroll.cpp:81] TLSEnrollPlugin requesting a node enroll key from:
https://localhost:8080/enroll
I1115 16
3912.662338 8050 system.cpp:164] Failed to read system uuid, returning ephemeral uuid
I1115 16
3912.662437 8050 smbios_tables.cpp:253] Could not read SMBIOS memory
I1115 16
3912.663532 8050 tls.cpp:263] TLS/HTTPS POST request to URI:
https://localhost:8080/enroll
I1115 16
3912.668138 8050 auto_constructed_tables.cpp:99] Removing stale ATC entries
I1115 16
3912.668260 8050 tls.cpp:263] TLS/HTTPS POST request to URI:
https://localhost:8080/config
I want to know how to write the data to a Postgres database after obtaining the connection from the machine using this way.
Upon reviewing your configuration, I noticed that you were storing and displaying data in the user interface using a Postgres database.
We're stuck right now, so if you don't mind, could you please explain the process or step? It would be really helpful for us to keep moving forward.
jmpsec/osctrl