About half a year ago i have successfully installed fleet on centos in local environment with agents on various linux systems, so i made it once and made script for semi-automatic install. Found my own script for centos, made it prettier and some manuals in internet like this one (
https://www.howtoforge.com/how-to-install-fleet-osquery-manager-on-ubuntu-22-04/)
Made my self-signed certificates, and installed everything, but when i made package for agent installation i had an error in agent:
(file1) (
https://static.main.linendev.com/attachments/cf6ce637-04e8-496e-b7a1-b0642b3d1445/image_2024-02-13_202905795_1856x279.png▾
)
Token is 100% correct, i have generated this deb file with code
fleetctl package \
--type=deb \
--fleet-url=
https://ub22test24.ucm.loc:8080 \
--enroll-secret=/var/osquery/enroll_secret \
--fleet-certificate=/var/osquery/fleet.pem
In this installation variant there is pem files in /opt/orbit/ (fleet.pem and certs.pem) i have added them to trusted store, but error is still there
Next variant is command from web-interface:
fleetctl package --type=deb --fleet-desktop --fleet-url=
https://ub22test24.ucm.loc:8080 --enroll-secret=2DNez5+a0aksDcHrAUN8wmshnLa5ss3d
If i install this package i don't have pem files in /opt/orbit/ and have error like this
(file 2) (
https://static.main.linendev.com/attachments/f76138b7-62ca-4f0c-a70d-63bcbf7aa45e/image_2024-02-13_202830726_2397x412.png▾
)
Curl to this address doesn't have any errors, so i don't understand, what's the problem
(file 3) (
https://static.main.linendev.com/attachments/6095af61-6771-4883-9613-ce8b5dc8ccb5/image_2024-02-13_202937533_768x998.png▾
)
If i would start osqyeryd manually (like code after), there would not be any problems
sudo /usr/bin/osqueryd \
--enroll_secret_path=/var/osquery/enroll_secret \
--tls_server_certs=/var/osquery/fleet.pem \
--tls_hostname=$(hostname):8080 \
--host_identifier=instance \
--enroll_tls_endpoint=/api/osquery/enroll \
--config_plugin=tls \
--config_tls_endpoint=/api/osquery/config \
--config_refresh=10 \
--disable_distributed=false \
--distributed_plugin=tls \
--distributed_interval=3 \
--distributed_tls_max_attempts=3 \
--distributed_tls_read_endpoint=/api/osquery/distributed/read \
--distributed_tls_write_endpoint=/api/osquery/distributed/write \
--logger_plugin=tls \
--logger_tls_endpoint=/api/osquery/log \
--logger_tls_period=10
Can you help me, please)