jby
11/25/2020, 3:00 PMNoah Talerman
11/25/2020, 4:31 PMjby
11/25/2020, 5:10 PMNoah Talerman
11/30/2020, 3:55 PMSo, there’s a docker image available as fleetdm/fleet at dockerhub. Does that contain everything needed to run fleet?No. You will also need to use a container orchestration platform to deploy the Fleet docker image in production. Two examples of this container orchestration tool are Kubernetes and AWS ECS.
jby
11/30/2020, 3:56 PMGavin
11/30/2020, 3:58 PMjby
11/30/2020, 3:59 PMGavin
11/30/2020, 4:00 PMjby
11/30/2020, 4:02 PMGavin
11/30/2020, 4:06 PMNoah Talerman
11/30/2020, 4:16 PMI’m trying to get the fleet team to provide documentation on how to set up their product. Which is how I understood the request from @Noah TalermanCorrect! I just opened this issue (https://github.com/fleetdm/fleet/issues/75) in the fleetdm/fleet repo that describes the project of creating Docker deploy production documentation. Currently, the fleet documentation only provides detailed instruction for deploying fleet on ubuntu and on centos. The blog post shared by @Gavin also seems like a great resource for deploying Fleet. The Fleet team plans to provide more detailed documentation on other deployment scenarios including those @jby is inquiring about. I’m about to copy your awesome questions over to the new github issue if that’s ok with you.
jby
11/30/2020, 4:20 PMosquery-in-a-box
is the easiest way to go then I’ll do that, but I’m more than happy to help develop the documentation of fleet and to get that to do what I’m looking for.Gavin
11/30/2020, 4:23 PMjby
11/30/2020, 4:24 PMGavin
11/30/2020, 4:24 PMjby
11/30/2020, 4:24 PMGavin
11/30/2020, 4:25 PMjby
11/30/2020, 4:25 PMGavin
11/30/2020, 4:26 PMjby
11/30/2020, 4:26 PMzwass
11/30/2020, 4:26 PMjby
11/30/2020, 4:28 PMosquery-in-a-box
as a production setup as well?zwass
11/30/2020, 4:29 PMjby
11/30/2020, 4:31 PM./build/linux/gosal --config to.json
gosal did not complete: build report: reports: getting serial: DMI run: exit status 1
This is after cloning the repo and running make deps
followed by make build
and then runningGavin
12/01/2020, 9:36 AMjby
12/01/2020, 9:36 AMGavin
12/01/2020, 9:36 AMjby
12/01/2020, 2:16 PMWill not autoload extension with unsafe directory permissions:
Noah Talerman
12/01/2020, 3:07 PMWhat’s the recommended way to get my clients to populate it with data?@jby I’m not sure how/if it’s possible to connect your clients to the local instance of Fleet you’ve started via osquery-in-a-box. I’m working on getting that answer for you now. In the meantime, have you tried to start the containerized osquery agents to test this functionality? Instructions are linked here: https://github.com/fleetdm/osquery-in-a-box#run-osquery
jby
12/01/2020, 3:36 PMDec 01 16:54:14 LIN5W2V3Z2.trioptima.local osqueryd[111674]: osqueryd started [version=4.5.1]
Dec 01 16:54:17 LIN5W2V3Z2.trioptima.local systemd[1]: osqueryd.service: Main process exited, code=exited, status=78/CONFIG
Dec 01 16:54:17 LIN5W2V3Z2.trioptima.local systemd[1]: osqueryd.service: Failed with result 'exit-code'.
Dec 01 16:54:17 LIN5W2V3Z2.trioptima.local audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=osqueryd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
/var/log/osquery/osqueryd.INFO
says:
I1201 16:50:57.000754 111287 events.cpp:867] Event publisher not enabled: auditeventpublisher: Publisher disabled via configuration
I1201 16:50:57.000955 111287 events.cpp:867] Event publisher not enabled: syslog: Publisher disabled via configuration
I1201 16:50:57.001091 111287 events.cpp:1126] Error registering subscriber: apparmor_events: Subscriber disabled via configuration
I1201 16:50:57.001191 111287 events.cpp:1126] Error registering subscriber: process_file_events: Subscriber disabled via configuration
I1201 16:50:57.001235 111287 events.cpp:1126] Error registering subscriber: selinux_events: Subscriber disabled via configuration
I1201 16:50:57.001278 111287 events.cpp:1126] Error registering subscriber: socket_events: Subscriber disabled via configuration
I1201 16:50:57.001502 111287 main.cpp:105] Not starting the distributed query service: Distributed query service not enabled.
I1201 16:50:57.001571 111295 events.cpp:786] Starting event publisher run loop: inotify
I1201 16:50:57.001605 111296 events.cpp:786] Starting event publisher run loop: udev
I1201 16:50:57.001598 111287 dispatcher.cpp:78] Adding new service: SchedulerRunner (0x55f0ab28c6b8) to thread: 140484973627136 (0x55f0ab268240) in process 111287
E1201 17:12:14.111375 112857 shutdown.cpp:69] Cannot activate tls
zwass
12/01/2020, 4:13 PM--insecure
.jby
12/01/2020, 4:23 PMsystemctl
to start it… 😞Noah Talerman
12/02/2020, 3:38 PMjby
12/02/2020, 3:40 PMNoah Talerman
12/02/2020, 3:49 PMjby
12/02/2020, 3:52 PMNoah Talerman
12/02/2020, 3:55 PMjby
12/02/2020, 4:33 PMNoah Talerman
12/02/2020, 8:12 PMjby
12/02/2020, 8:16 PMNoah Talerman
12/09/2020, 9:56 PMzwass
12/09/2020, 10:02 PMjby
12/10/2020, 5:28 AMzwass
12/10/2020, 4:26 PMfleetctl user create
. We have some changes coming in the next release (today) that will make this more clear. Please let us know what you hear from the exchange admin.jby
12/10/2020, 4:28 PM