Hello guys Good morning from Nigeria flag ng Question Osquer osquery #general

Hello guys Good morning from Nigeria :flag-ng:. ...

AGASTRONICS

01/13/2024, 9:40 AM

Hello guys Good morning from Nigeria 🇳🇬. Question: Osquery Enrollment
uuid
logic During the enrollment

osqueryd

makes a

POST

request to the

server: /enroll

in which the request data contains

uuid:

value is there a specific

logic

behind this and in what

probability

will the

uuid

occur

once

around the world 🌎 🌀

John Speno

01/13/2024, 12:29 PM

It depends on the node. I've seen plenty of duplicate UUIDs because of faulty hardware and/or firmware bugs.

AGASTRONICS

01/13/2024, 12:52 PM

@John Speno Thanks

AGASTRONICS

01/13/2024, 1:04 PM

Suggestions: UUID management Since there is a high chance of duplicate

uuid

we can

generate 32 random characters

to concatenate with the actual

uuid

uuid+'.'+rand_id

Note: we check the database for any existing

rand_id

In this case, we split them on our server whenever we want to make use of it.

Copy code

split_uuid[0]
split_uuid[1]

John Speno

01/13/2024, 1:25 PM

I think the issues with UUID stem from how osquery chooses it. If it takes the value from the hardware, then you may encounter the issues I've noted. There's always

instance_uuid

which might be a better choice. I'd recommend reading the source to see how those things are set.

AGASTRONICS

01/13/2024, 1:29 PM

Yeah, good suggestion since it's open-source thanks @John Speno

seph

01/16/2024, 2:19 PM

There are configuration options around this behavior:

Copy code

$ osqueryd --help | grep host_identifier
    --host_identifier VALUE                          Field used to identify the host running osquery (hostname, uuid, instance, ephemeral, specified)
    --specified_identifier VALUE                     Field used to specify the host_identifier when set to "specified"

🤔 1

🌀 1

John Speno

01/16/2024, 3:33 PM

That does set the

hostIdentifier

as sent in the various logs, but it doesn't have any impact on what data is sent during the enroll process, AFAIK.

seph

01/17/2024, 5:16 PM

It’s been awhile since I looked at this code, but I’d have expexcted it to effect enrollment. Hrm

John Speno

01/17/2024, 5:21 PM

During enrollment, osquery sends the contents of the

osquery_info

table (among others) which contains both the

uuid

and

instance_uuid

. It also sends

host_identifier

which is affected by the

--host_identifier

. It would be up to the backend system to determine how to use that data. I only know what Fleet does, which is to use the

uuid

🫶 1

seph

01/18/2024, 12:23 PM

Ah, that fits my expectations — osquery sends it, but it’s up to the servers to use it as they choose.

Open in Slack

Previous Next