Michael Barrientos
09/17/2020, 6:50 AM$ curl -L <https://pkg.osquery.io/rpm/GPG> | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery
...snip...
$ sudo yum-config-manager --add-repo <https://pkg.osquery.io/rpm/osquery-s3-rpm.repo>
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
adding repo from: <https://pkg.osquery.io/rpm/osquery-s3-rpm.repo>
grabbing file <https://pkg.osquery.io/rpm/osquery-s3-rpm.repo> to /etc/yum.repos.d/osquery-s3-rpm.repo
repo saved to /etc/yum.repos.d/osquery-s3-rpm.repo
$ sudo yum-config-manager --enable osquery-s3-rpm
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
$ sudo yum install osquery
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
<https://s3.amazonaws.com/osquery-packages/rpm/x86_64/repodata/repomd.xml>: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.
...snip...
failure: repodata/repomd.xml from osquery-s3-rpm-repo: [Errno 256] No more mirrors to try.
<https://s3.amazonaws.com/osquery-packages/rpm/x86_64/repodata/repomd.xml>: [Errno 14] HTTPS Error 403 - Forbidden
theopolis
09/17/2020, 11:26 AMryanw
09/17/2020, 4:36 PM"Error: requested datatype primary not available"
---- Begin output of yum -q -y makecache --disablerepo=* --enablerepo=osquery ----
STDOUT:
STDERR: Error: requested datatype primary not available
---- End output of yum -q -y makecache --disablerepo=* --enablerepo=osquery ----
Ran yum -q -y makecache --disablerepo=* --enablerepo=osquery returned 1
<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Error><Code>PermanentRedirect</Code><Message>The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.</Message><Endpoint><http://osquery-packages.s3.amazonaws.com|osquery-packages.s3.amazonaws.com></Endpoint><Bucket>osquery-packages</Bucket><RequestId>8280D830C4E0E8E6</RequestId><HostId>JRa9l1M9/PlK//UZNt1Zq+Mnw2X63P+pNYEbaPH9QJQeAdlZr7uzXLXP7QfcDYnGJAgV9z7AdKQ=</HostId></Error>
Our yum config:
[osquery]
name=Yum Repository
baseurl=<https://s3.amazonaws.com/osquery-packages/rpm/$basearch/>
enabled=1
fastestmirror_enabled=0
gpgcheck=1
gpgkey=<https://pkg.osquery.io/rpm/GPG>
<https://osquery-packages.s3.amazonaws.com/rpm/$basearch/>
works!
https://stackoverflow.com/a/39889337
Looks like this will need to be updated: https://pkg.osquery.io/rpm/osquery-s3-rpm.repotheopolis
09/17/2020, 5:20 PMryanw
09/17/2020, 7:39 PMtheopolis
09/17/2020, 8:06 PMMichael Barrientos
09/17/2020, 8:23 PM+ sh -c apt-get update -qq >/dev/null
E: Failed to fetch <https://osquery-packages.s3.amazonaws.com/deb/dists/deb/InRelease> 301 Moved Permanently [IP: 52.219.100.196 443]
E: The repository '<https://osquery-packages.s3.amazonaws.com/deb> deb InRelease' is no longer signed.
theopolis
09/17/2020, 9:12 PM