https://github.com/osquery/osquery logo
Powered by
#fleet
Title
# fleet
b

benbass

09/13/2021, 4:36 PM
I am getting an authentication error when trying to download a carve from fleet 4.2.4.
Copy code
download carve received status 401: Authentication required: Authentication required
I am able to query the carve table on that instance, and even a subsequent login does not resolve the issue. This is using fleetctl 4.2.2 and fleetctel 4.2.4 on macOS
z

zwass

09/13/2021, 5:52 PM
Not sure if I'm interpreting correctly -- You've tried with matching Fleet server and 
fleetctl
versions?
b

benbass

09/13/2021, 5:53 PM
Yes, my last try was with matching 4.2.4 versions.
I can get the carve status, but not the actual files.
z

zwass

09/13/2021, 5:58 PM
Can you try adding 
--debug
to the 
fleetctl
command and seeing the network request/response?
b

benbass

09/13/2021, 6:37 PM
% fleetctl get carve --outfile file.tar 1 --context test-outer                          143532 download carve received status 401: Authentication required: Authentication required % fleetctl get carve --outfile file.tar 1 --context test-outer --debug                     143537 download carve received status 401: Authentication required: Authentication required
However when i run the get carves with debug I get info:
Copy code
fleetctl get carves --context test-outer --debug                                                              14:36:46
GET <https://fleetdm-test.fqdn:8080/api/v1/fleet/carves>

GET <https://fleetdm-test.fqdn:8080/api/v1/fleet/carves> 200 OK (106ms)
{
  "carves": [
    {
      "id": 1,
      "created_at": "2021-09-13T16:04:49Z",
      "host_id": 1,
      "name": "hostname-2021-09-13T16:04:49Z-51224d0a-3065-45ea-a3dc-29fc8670c93c",
      "block_count": 1,
      "block_size": 2000000,
      "carve_size": 37888,
      "carve_id": "e7e5d654-c7da-400a-8866-1f52b5fa61f0",
      "request_id": "51224d0a-3065-45ea-a3dc-29fc8670c93c",
      "session_id": "499ac948-6a28-423a-92ee-c9f338f17bfb",
      "expired": false,
      "max_block": 0
    }
  ]
}
+----+-------------------------------+--------------------------------------+------------+------------+
| ID |          CREATED AT           |              REQUEST ID              | CARVE SIZE | COMPLETION |
+----+-------------------------------+--------------------------------------+------------+------------+
|  1 | 2021-09-13 12:04:49 -0400 EDT | 51224d0a-3065-45ea-a3dc-29fc8670c93c |      37888 | 100%       |
+----+-------------------------------+--------------------------------------+------------+------------+
I cleaned up hostnames but that was it.
5 Views
Powered by