Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
z
zwass
02/16/2021, 5:43 PMAnyone currently using TLS for Fleet's MySQL connection? Can you show us how you are configuring that in Fleet?
g
Gavin
02/16/2021, 6:19 PMTLS Client certificate auth or connecting to a TLS endpoint ?
z
zwass
02/16/2021, 6:41 PMConnecting to a MySQL database using TLS as a transport
g
Gavin
02/16/2021, 8:37 PMSo currently we are but nothing special on the fleet end.
- name: KOLIDE_MYSQL_DATABASE
valueFrom:
secretKeyRef:
name: kolide-mysql
key: databaseWhere it’s raw IP username + password on key’s
I just checked the mysql connection from the DB end and it’s upgraded to an SSL connection and it appears there is a client upgrade.
j
Jocelyn Bothe
02/16/2021, 8:45 PMspecifically, what mysql: tls_config: value are you setting in fleet.yml?
h
hilt
04/01/2021, 1:06 AMdid this get resolved @zwass - I’m surprised this issue is not more common considering the importance of TLS comms between fleet and the db! Is it correct to assume that only
mysql_tls_cait is currently ambiguous whether other mysql_tls* keys are related to client or server (one can infer but still)
j
Jocelyn Bothe
04/01/2021, 4:58 PMwe just gave up on it and went back to non-TLS
If anyone has a fix, we'd love to implement it
z
zwass
04/01/2021, 5:51 PMIt seems like we should support this natively and I'm not sure why we don't. I know that some folks have used tunneling to get encrypted connections to the DB.
Are we just not exposing the right parameters to allow the connection?
j
Jocelyn Bothe
04/01/2021, 6:02 PMit requires all of mysql_tls_ca, mysql_tls_cert, and mysql_tls_key, but it should only require either ca or cert/key
z
zwass
04/01/2021, 6:07 PMCan you please file that in an issue so I can have it tracked to get to? If it's really that simple should be able to get to it before the next release.
Hey @hilt @Jocelyn Bothe please give this another try with Fleet 3.11.0. I fixed this for at least some of the cases with https://github.com/fleetdm/fleet/pull/689.
j
Jocelyn Bothe
04/28/2021, 10:13 PMthanks! we'll upgrade and give it a whirl
🍻 1