Hi team What s the best way to tighten networking around my

Question

Hi team What s the best way to tighten networking around my Fleet host I have it all open on 0 0 0 0 and allowing all ports which is ofcourse not ideal and I want to tighten it further but without breaking osquery lt gt fleet comms What s the best way to do that

Kathy Satterlee · Answer

You shouldn t need to worry about what ports are open for incoming traffic since all communication with the server is initiated on the host side

pvirani · Answer

what if an attacker decides to initite a comm on their host

pvirani · Answer

are you suggesting just keeping 80 and 443 open on my Fleet server should do the trick and lock the rest down

Jason · Answer

We ve used a WAF and allowed only the paths needed for the osquery and fleet desktop endpoints to the world

Jason · Answer

Admin is restricted and of course with a waf you can block things like Tor nodes known malicious IPs etc

Keith Swagler · Answer

< defensivedepth> has a good blog post about this here

Jason · Answer

FYI most of these URL paths are out of date and orbit no longer uses gRPC However the concept is valid