Mark Noonan
02/15/2021, 10:05 PMFeb 15 21:50:44 <ec2> systemd[1]: Started Kolide Fleet.
Feb 15 21:50:44 <ec2> fleet[10720]: Using config file: /etc/kolide/fleet.yml
Feb 15 21:50:44 <ec2> fleet[10720]: Error initializing datastore: register TLS config for mysql: register mysql tls config: key 'true' is reserved
Feb 15 21:50:44 <ec2?Feb 15 21:50:44 osquery-service-><http://ab251.ec2.vzbuilders.com|ab251.ec2.vzbuilders.com> systemd[1]: Unit fleet.service entered failed state.
Feb 15 21:50:44 <ec2> systemd[1]: fleet.service failed.
It looks like it hates the key true, however from the documentation:
mysql_tls_config
The tls value in a MYSQL DSN. Can be true,false,skip-verify or the CN value of the certificate.
Default value: none
Environment variable: FLEET_MYSQL_TLS_CONFIG
Config file format:
mysql:
tls_config: true
zwass
"true"
. It's looking for a string. I think the docs could make this more clear.Mark Noonan
02/15/2021, 10:11 PMzwass
Mark Noonan
02/15/2021, 10:13 PMtls_config: "true"
Feb 15 22:12:06 <ip> fleet: Error initializing datastore: register TLS config for mysql: register mysql tls config: key 'true' is reserved
Jocelyn Bothe
02/15/2021, 10:14 PM"TRUE"
'TRUE'
zwass
Jocelyn Bothe
02/15/2021, 10:15 PMtrue
,false
,skip-verify
zwass
skip-verify
? Can you paste in a snippet from the config?Mark Noonan
02/15/2021, 10:16 PMJocelyn Bothe
02/15/2021, 10:18 PMmysql:
address: [REDACTED].<http://us-east-1.rds.amazonaws.com:3306|us-east-1.rds.amazonaws.com:3306>
database: osq
username: osq
password: [REDACTED]
tls_config: 'TRUE'
tls_ca: /etc/kolide/rds-combined-ca-bundle.pem
tls_cert: [REDACTED].cert.pem
tls_key: [REDACTED].key.pem
servername: [REDACTED].<http://us-east-1.rds.amazonaws.com|us-east-1.rds.amazonaws.com>
redis:
address: 127.0.0.1:6379
password: [REDACTED]
server:
tls: false
logging:
json: true
auth:
jwt_key: [REDACTED]
session:
duration: 12h
osquery:
status_log_plugin: filesystem
result_log_plugin: kinesis
filesystem:
status_log_file: /var/log/osquery/status.log
kinesis:
region: us-east-1
sts_assume_role_arn: arn:aws:iam::734560425545:role/[REDACTED]
result_stream: osquery-kinesis-stream-us-east-1
zwass
[REDACTED]
have quotes around them ('[REDACTED]...'
)Jocelyn Bothe
02/15/2021, 10:22 PMzwass
Jocelyn Bothe
02/15/2021, 10:23 PMzwass
Jocelyn Bothe
02/15/2021, 10:25 PMError initializing datastore: register TLS config for mysql: register mysql tls config: key 'skip-verify' is reserved
zwass
Mark Noonan
02/15/2021, 10:39 PMzwass
custom
instead of true?tls_config
option may have been misdocumented going all the way back to the initial implementation in 2017. Would be interested to confirm.Mark Noonan
02/15/2021, 10:57 PMzwass
Jocelyn Bothe
02/16/2021, 3:28 PMError initializing datastore: remote error: tls: unknown certificate authority
mysql -vv -h [REDACTED].<http://us-east-1.rds.amazonaws.com|us-east-1.rds.amazonaws.com> --port=3306 --database=osq --user=osq --password=[REDACTED] --ssl-ca=/etc/kolide/rds-combined-ca-bundle.pem --ssl-mode=VERIFY_IDENTITY
mysql: [Warning] Using a password on the command line interface can be insecure.
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 173
Server version: 5.7.12 MySQL Community Server (GPL)
Copyright (c) 2000, 2021, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Reading history-file /root/.mysql_history
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> quit
Writing history-file /root/.mysql_history
Bye
zwass
Jocelyn Bothe
02/16/2021, 5:03 PMError initializing datastore: register TLS config for mysql: load mysql client cert and key: open : no such file or directory
zwass
Jocelyn Bothe
02/16/2021, 5:37 PM{
"mysql": "could not connect to db: Error 3159: Connections using insecure transport are prohibited while --require_secure_transport=ON., sleeping 0s",
"ts": "2021-02-16T17:38:43.182354467Z"
}
zwass