I am getting an authentication error when trying to download osquery #fleet

I am getting an authentication error when trying t...

benbass

09/13/2021, 4:36 PM

I am getting an authentication error when trying to download a carve from fleet 4.2.4.

Copy code

download carve received status 401: Authentication required: Authentication required

I am able to query the carve table on that instance, and even a subsequent login does not resolve the issue. This is using fleetctl 4.2.2 and fleetctel 4.2.4 on macOS

zwass

09/13/2021, 5:52 PM

Not sure if I'm interpreting correctly -- You've tried with matching Fleet server and

fleetctl

versions?

benbass

09/13/2021, 5:53 PM

Yes, my last try was with matching 4.2.4 versions.

benbass

09/13/2021, 5:54 PM

I can get the carve status, but not the actual files.

zwass

09/13/2021, 5:58 PM

Can you try adding

--debug

to the

fleetctl

command and seeing the network request/response?

benbass

09/13/2021, 6:37 PM

% fleetctl get carve --outfile file.tar 1 --context test-outer 143532 download carve received status 401: Authentication required: Authentication required % fleetctl get carve --outfile file.tar 1 --context test-outer --debug 143537 download carve received status 401: Authentication required: Authentication required

benbass

09/13/2021, 6:38 PM

However when i run the get carves with debug I get info:

Copy code

fleetctl get carves --context test-outer --debug                                                              14:36:46
GET <https://fleetdm-test.fqdn:8080/api/v1/fleet/carves>

GET <https://fleetdm-test.fqdn:8080/api/v1/fleet/carves> 200 OK (106ms)
{
  "carves": [
    {
      "id": 1,
      "created_at": "2021-09-13T16:04:49Z",
      "host_id": 1,
      "name": "hostname-2021-09-13T16:04:49Z-51224d0a-3065-45ea-a3dc-29fc8670c93c",
      "block_count": 1,
      "block_size": 2000000,
      "carve_size": 37888,
      "carve_id": "e7e5d654-c7da-400a-8866-1f52b5fa61f0",
      "request_id": "51224d0a-3065-45ea-a3dc-29fc8670c93c",
      "session_id": "499ac948-6a28-423a-92ee-c9f338f17bfb",
      "expired": false,
      "max_block": 0
    }
  ]
}
+----+-------------------------------+--------------------------------------+------------+------------+
| ID |          CREATED AT           |              REQUEST ID              | CARVE SIZE | COMPLETION |
+----+-------------------------------+--------------------------------------+------------+------------+
|  1 | 2021-09-13 12:04:49 -0400 EDT | 51224d0a-3065-45ea-a3dc-29fc8670c93c |      37888 | 100%       |
+----+-------------------------------+--------------------------------------+------------+------------+

benbass

09/13/2021, 6:38 PM

I cleaned up hostnames but that was it.

6 Views

Open in Slack

Previous Next