https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi new friends! I just set up the fleetdm preview,...
# fleet
a
Hi new friends! I just set up the fleetdm preview, and I'm concerned that the log shows the Admin login coming from a public GitHub IP address.
Does the preview just load random fake data?
u
Let me take a look! I'm assuming you set this up through the website rather than running locally? If so, I'm betting that there's a job that does the initial setup step for you (and potentially adds you as a user.. I haven't played with that too recently).
a
I set it up locally as a docker compose stack
Tried again with incognito window. Fleet is running on a separate device in my network. I'm logging in to the web UI from my local workstation. The activity log is reporting the login is coming from an IP address that WHOIS reports is owned by GitHub
u
There is an automated step there that creates the admin login. Looking at how that's accomplished.
I double-checked and everything that's happening automatically is done locally. I spun up a new instance and saw only my IP address. Did you do anything like set up a GitOps repository to manage configuration?
a
Nope. I just downloaded 
<https://fleetdm.com/resources/install-fleetctl.sh>
and ran it, then ran 
~/.fleetctl/fleetctl preview
. I signed in with the default login.
I'd also like to point out that the 
fleetctl
CLI tool doesn't have an explicitly defined command to stop all the containers. maybe 
logout
does, but that's not what the word means. I stopped the docker stack, but it left all the preview devices running.
u
The command for that is 'fleetctl preview stop`. If you spin that instance back up, can you grab a screenshot of the activity you're seeing?
I'm definitely concerned about that login, nothing I can see should be causing that.
a
stop isn't in the help output, FYI
image.png
u
That's also very odd.
I confirmed that I'm seeing it in the latest version.
Can you show me what output you're seeing?
I'm also testing preview with a completely fresh start just to make sure nothing odd there happens.
I'd be curious to see what IP was listed when you logged in as well.
a
I'm not sure what output you're referring to, other than this. And this is the IP being logged by my logins.
Any update from your local testing?
u
It sounds like there's something in your local configuration that's causing that IP address to be used. Fleet is just grabbing the address from the headers of requests. I'm much less concerned since those logins are yours. The output I was referring to was the output of 'fleetctl preview --help`
4 Views
Open in Slack
PreviousNext
Powered by