https://github.com/osquery/osquery logo
Join Slack
Powered by
Hey folks, We're trying to setup Fleet with Apple ...
# fleet
c
Hey folks, We're trying to setup Fleet with Apple for MDM. We're getting an odd error when we try to enroll a brand new device. It's basically a Domain 303 error on the EULA Page. Does anyone have any idea what this could be?
When I look @ the HTTP Request in the NGINX logs. This is what I see. 74.205.135.20 is the IP of the request that was sent. That IP Belongs to the device being provisioned as well.
Copy code
74.205.135.20 - - [17/Nov/2023:11:26:01 -0800] "-" 000 0 "-" "-"
74.205.135.20 - - [17/Nov/2023:11:26:05 -0800] "-" 000 0 "-" "-"
162.252.100.250 - - [17/Nov/2023:11:26:05 -0800] "POST /api/fleet/orbit/config HTTP/2.0" 200 26 "-" "Go-http-client/2.0"
74.205.135.20 - - [17/Nov/2023:11:26:06 -0800] "-" 000 0 "-" "-"
74.205.135.20 - - [17/Nov/2023:11:26:07 -0800] "-" 000 0 "-" "-"
162.252.100.250 - - [17/Nov/2023:11:26:11 -0800] "POST /api/v1/osquery/distributed/read HTTP/1.1" 200 39 "-" "osquery/5.9.1"
74.205.135.20 - - [17/Nov/2023:11:26:11 -0800] "-" 000 0 "-" "-"
74.205.135.20 - - [17/Nov/2023:11:26:14 -0800] "-" 000 0 "-" "-"
74.205.135.20 - - [17/Nov/2023:11:26:15 -0800] "-" 000 0 "-" "-"
74.205.135.20 - - [17/Nov/2023:11:26:18 -0800] "-" 000 0 "-" "-"
162.252.100.250 - - [17/Nov/2023:11:26:21 -0800] "POST /api/v1/osquery/distributed/read HTTP/1.1" 200 39 "-" "osquery/5.9.1"
162.252.100.250 - - [17/Nov/2023:11:26:31 -0800] "POST /api/v1/osquery/distributed/read HTTP/1.1" 200 39 "-" "osquery/5.9.1"
162.252.100.250 - - [17/Nov/2023:11:26:35 -0800] "POST /api/fleet/orbit/config HTTP/2.0" 200 26 "-" "Go-http-client/2.0"
74.205.135.20 - - [17/Nov/2023:11:26:35 -0800] "-" 000 0 "-" "-"
162.252.100.250 - - [17/Nov/2023:11:26:36 -0800] "POST /api/fleet/orbit/config HTTP/2.0" 200 26 "-" "Go-http-client/2.0"
fleetctl get mdm-apple
Shows a valid response.
Copy code
Common name (CN):	APSP:e9<Redacted>              	
Serial number:   	19<Redacted>                                    	
Issuer:          	Apple Application Integration 2 Certification Authority	
Renew date:      	November 9, 2024
Rotated the BM Credentials. No fix.
fleetctl get mdm-apple-bm
Shows our valid information.
Could this be related to us using LetsEncrypt for our domain certificate?
d
@Chris Timberlake are you trying to do an ADE (ABM) enrollment in the free version? The ABM functionality is a premium only feature.
c
@Dherder No, We should have 2 Host license on our account. We have no enrolled hosts right now.
d
ah, gotcha. errors around setup process and config would exist in the Fleet server logs. Anything juicy in there?
c
Nope, Not a thing.
d
Does a manual MDM enrollment work in a testing scenario?
c
Good question; I haven't tried that because we'll have to wipe a machine a second time to try it.
I'll try it on Monday, about to go travel to the office over the weekend.
d
I usually try the manual enrollment stuff on a vm, just to avoid the time suck of going through ABM. Alternatively, if you have a console open during Setup Assistant, you could grab some mdmclient logs that might help troubleshoot without having to do the manual enrollment.
c
@Dherder Do you happen to have any docs on how I might use mdmclient to figure that out? The machines we're using, the whole point is for people to pull them out of the box and be provisioned. We're moving over our entire company to FleetDM and MacBooks. So I don't have any machines w/o MDM. Although the VM approach makes me wonder. I'm sure I can spin up a OSX VM. 🤔
d
As a troubleshooting step when you are in Setup Assistant:
Copy code
When you are in Setup Assistant, you can open Terminal or Console by pressing:

CTL + OPTION + CMD + T (for Terminal)
CTL + OPTION + CMD + C (for Console)
k
@Chris Timberlake Did you see any interesting information in the terminal while the Setup Assistant was running?
4 Views
Open in Slack
PreviousNext
Powered by