Ahmed
06/21/2021, 6:02 PM/usr/bin/osqueryd --flagfile /etc/osquery/osquery.flags --verbose --tls_dump
i noticed that they have the same node_key, and UUID, what would be the solution for this ?--enroll_secret_path=/etc/osquery/osquery_enroll_secret
--tls_server_certs=/etc/osquery/osquery_cert.pem
--tls_hostname=<http://fleet.example.com:443|fleet.example.com:443>
--host_identifier=hostname
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_tls_refresh=360
--config_tls_max_attempts=360
--disable_distributed=false
--disable_logging=false
--distributed_plugin=tls
--distributed_interval=60
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/kolide/distributed/read
--distributed_tls_write_endpoint=/api/v1/kolide/distributed/write
--logger_plugin=filesystem
--logger_path=/var/log/osquery/logs
--database_path=/var/log/osquery/db/osquery.db
--schedule_splay_percent=10
--pack_refresh_interval=360
--watchdog_level=0
--config_refresh=360
--utc
--force=true
i noticed there is something like --tls_client_cert
and --tls_client_key
that could be used (link) but havenot used that before, hopefully you have some suggestions and also would tls client be usefull and how to generate that cert/key to be accepted by fleet/osqueryAvi Norowitz
06/21/2021, 6:56 PMsudo service osqueryd stop; sudo osqueryctl clean; sudo service osqueryd start
On then when recreating your GCP image, erase the RocksDB before creating the image: sudo service osqueryd stop; sudo osqueryctl clean
Ahmed
06/21/2021, 7:18 PMhow can we get a new node_key?
and for the creation of image would it be sufficient to delete the db file or make sure it doesnot exist before starting ?
i’n my current setup, i had a check in puppet to stop the service if its in the build process
$service_ensure = $::built_by_packer ? {
true => 'stopped',
default => $osquery::agent::service,
}
i guess that didnot prevent the db from creation,Avi Norowitz
06/21/2021, 7:31 PM--database_path=/var/log/osquery/db/osquery.db
So I'm not sure if that osqueryctl clean
command would work.Ahmed
06/21/2021, 7:32 PMzwass
06/22/2021, 4:49 PMAvi Norowitz
06/22/2021, 4:49 PMzwass
06/22/2021, 4:50 PMAhmed
06/22/2021, 6:45 PMosqueryctl clean
is not cleaning the node key as well?
i have been trying to delete the db in the build process when packer runs, but still getting the same. if you have tried that before and could point me to something similar that would be great.Avi Norowitz
06/22/2021, 8:05 PMosqueryctl clean
removes /var/osquery/osquery.db
. But in your config, you have:
--database_path=/var/log/osquery/db/osquery.db
Is there any particular reason you need to use the non-default path for this?Ahmed
06/23/2021, 11:53 AMAvi Norowitz
06/23/2021, 1:33 PMAhmed
06/23/2021, 1:38 PMzwass
06/23/2021, 3:23 PMrm -rf
on that directory should work fine) before creating the image. Make sure that osquery is configured to start on boot.Ahmed
06/29/2021, 2:24 PM