https://github.com/osquery/osquery logo
Powered by
#fleet
Title
# fleet
z

zwass

02/16/2021, 5:43 PM
Anyone currently using TLS for Fleet's MySQL connection? Can you show us how you are configuring that in Fleet?
g

Gavin

02/16/2021, 6:19 PM
TLS Client certificate auth or connecting to a TLS endpoint ?
z

zwass

02/16/2021, 6:41 PM
Connecting to a MySQL database using TLS as a transport
g

Gavin

02/16/2021, 8:37 PM
So currently we are but nothing special on the fleet end.
Copy code
- name: KOLIDE_MYSQL_DATABASE
              valueFrom:
                secretKeyRef:
                  name: kolide-mysql
                  key: database
Where it’s raw IP username + password on key’s I just checked the mysql connection from the DB end and it’s upgraded to an SSL connection and it appears there is a client upgrade.
j

Jocelyn Bothe

02/16/2021, 8:45 PM
specifically, what mysql: tls_config: value are you setting in fleet.yml?
h

hilt

04/01/2021, 1:06 AM
did this get resolved @zwass - I’m surprised this issue is not more common considering the importance of TLS comms between fleet and the db! Is it correct to assume that only 
mysql_tls_ca
is required to connect to a TLS enabled mysql server?
it is currently ambiguous whether other mysql_tls* keys are related to client or server (one can infer but still)
j

Jocelyn Bothe

04/01/2021, 4:58 PM
we just gave up on it and went back to non-TLS If anyone has a fix, we'd love to implement it
z

zwass

04/01/2021, 5:51 PM
It seems like we should support this natively and I'm not sure why we don't. I know that some folks have used tunneling to get encrypted connections to the DB.
Are we just not exposing the right parameters to allow the connection?
j

Jocelyn Bothe

04/01/2021, 6:02 PM
it requires all of mysql_tls_ca, mysql_tls_cert, and mysql_tls_key, but it should only require either ca or cert/key
z

zwass

04/01/2021, 6:07 PM
Can you please file that in an issue so I can have it tracked to get to? If it's really that simple should be able to get to it before the next release.
Hey @hilt @Jocelyn Bothe please give this another try with Fleet 3.11.0. I fixed this for at least some of the cases with https://github.com/fleetdm/fleet/pull/689.
j

Jocelyn Bothe

04/28/2021, 10:13 PM
thanks! we'll upgrade and give it a whirl
🍻 1
Powered by