Problems with agents
# fleet
d
About half a year ago i have successfully installed fleet on centos in local environment with agents on various linux systems, so i made it once and made script for semi-automatic install. Found my own script for centos, made it prettier and some manuals in internet like this one (https://www.howtoforge.com/how-to-install-fleet-osquery-manager-on-ubuntu-22-04/) Made my self-signed certificates, and installed everything, but when i made package for agent installation i had an error in agent: (file1) (

https://static.main.linendev.com/attachments/cf6ce637-04e8-496e-b7a1-b0642b3d1445/image_2024-02-13_202905795_1856x279.png

) Token is 100% correct, i have generated this deb file with code fleetctl package \ --type=deb \ --fleet-url=https://ub22test24.ucm.loc:8080 \ --enroll-secret=/var/osquery/enroll_secret \ --fleet-certificate=/var/osquery/fleet.pem In this installation variant there is pem files in /opt/orbit/ (fleet.pem and certs.pem) i have added them to trusted store, but error is still there Next variant is command from web-interface: fleetctl package --type=deb --fleet-desktop --fleet-url=https://ub22test24.ucm.loc:8080 --enroll-secret=2DNez5+a0aksDcHrAUN8wmshnLa5ss3d If i install this package i don't have pem files in /opt/orbit/ and have error like this (file 2) (

https://static.main.linendev.com/attachments/f76138b7-62ca-4f0c-a70d-63bcbf7aa45e/image_2024-02-13_202830726_2397x412.png

) Curl to this address doesn't have any errors, so i don't understand, what's the problem (file 3) (

https://static.main.linendev.com/attachments/6095af61-6771-4883-9613-ce8b5dc8ccb5/image_2024-02-13_202937533_768x998.png

) If i would start osqyeryd manually (like code after), there would not be any problems sudo /usr/bin/osqueryd \ --enroll_secret_path=/var/osquery/enroll_secret \ --tls_server_certs=/var/osquery/fleet.pem \ --tls_hostname=$(hostname):8080 \ --host_identifier=instance \ --enroll_tls_endpoint=/api/osquery/enroll \ --config_plugin=tls \ --config_tls_endpoint=/api/osquery/config \ --config_refresh=10 \ --disable_distributed=false \ --distributed_plugin=tls \ --distributed_interval=3 \ --distributed_tls_max_attempts=3 \ --distributed_tls_read_endpoint=/api/osquery/distributed/read \ --distributed_tls_write_endpoint=/api/osquery/distributed/write \ --logger_plugin=tls \ --logger_tls_endpoint=/api/osquery/log \ --logger_tls_period=10 Can you help me, please)
UPD: After running /opt/orbit/bin/osqueryd/linux/stable/osqueryd --pidfile=/opt/orbit/osquery.pid --database_path=/opt/orbit/osquery.db --extensions_socket=/opt/orbit/orbit-osquery.em --logger_path=/opt/orbit/osquery_log --enroll_secret_env ENROLL_SECRET --tls_hostname=ub22test24.ucm.loc:8080 --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_refresh=60 --disable_distributed=false --distributed_plugin=tls --distributed_tls_max_attempts=10 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls,filesystem --logger_tls_endpoint=/api/v1/osquery/log --disable_carver=false --carver_disable_function=false --carver_start_endpoint=/api/v1/osquery/carve/begin --carver_continue_endpoint=/api/v1/osquery/carve/block --carver_block_size=8000000 --tls_server_certs /opt/orbit/fleet.pem --augeas_lenses /opt/orbit/lenses --force --flagfile /opt/orbit/osquery.flags --host-identifier uuid --tls_dump --verbose Discovered that i dont have Enroll_Secret in env.
UPD2: After i edited command from previous upd and replased "--enroll_secret_env ENROLL_SECRET" with "--enroll_secret_path=/var/osquery/enroll_secret" agents working in manual mode without errors. /opt/orbit/bin/osqueryd/linux/stable/osqueryd --pidfile=/opt/orbit/osquery.pid --database_path=/opt/orbit/osquery.db --extensions_socket=/opt/orbit/orbit-osquery.em --logger_path=/opt/orbit/osquery_log --enroll_secret_path=/var/osquery/enroll_secret --tls_hostname=ub22test24.ucm.loc:8080 --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_refresh=60 --disable_distributed=false --distributed_plugin=tls --distributed_tls_max_attempts=10 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls,filesystem --logger_tls_endpoint=/api/v1/osquery/log --disable_carver=false --carver_disable_function=false --carver_start_endpoint=/api/v1/osquery/carve/begin --carver_continue_endpoint=/api/v1/osquery/carve/block --carver_block_size=8000000 --tls_server_certs /opt/orbit/fleet.pem --augeas_lenses /opt/orbit/lenses --force --flagfile /opt/orbit/osquery.flags --host-identifier uuid --tls_dump --verbose So, now i need to understand how can i add ENROLL-SECRET to datastore or add path to service manually. Or what flag should i use to make deb package with secret inside
UPD3: Some trouble was with " --enroll-secret=/var/osquery/enroll_secret \" key on package creation stage. When i use "--enroll-secret=2DNez5+a0aksDcHrAUN8wmshnLa5ss3d" key and install not from root, orbit service working without troubles, if i install from root or make deb file with path to secret - i have errors with ENROLL_SECRET in env. Maybe bug