Rafa
06/30/2022, 1:48 PMLucas Rodriguez
06/30/2022, 1:53 PMfleetctl package ... --fleet-certificate=fleet.pem ...
, did you set such flag?Rafa
06/30/2022, 1:57 PMLucas Rodriguez
06/30/2022, 1:58 PMsudo dpkg --install
?Rafa
06/30/2022, 1:58 PMLucas Rodriguez
06/30/2022, 1:59 PMsudo vim /var/log/syslog
(vim or other text editor, and look for orbit/osquery logs)Rafa
06/30/2022, 2:02 PMLucas Rodriguez
06/30/2022, 2:03 PMRafa
06/30/2022, 2:04 PMLucas Rodriguez
06/30/2022, 2:04 PM--fleet-certificate=fleet_osquery.pem
and it still doesn't work?Rafa
06/30/2022, 2:05 PMLucas Rodriguez
06/30/2022, 2:10 PM$ curl --cacert ./fleet_osquery.pem <https://ip:8080/version>
(To check any issues with the generated certificate itself.)Rafa
06/30/2022, 2:22 PMopenssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
-keyout /tmp/server.key -out /tmp/server.cert -subj "/CN=SERVER_NAME" \
-addext "subjectAltName=DNS:SERVER_NAME"
SERVER_NAME in my case would be the ec2 ip?Lucas Rodriguez
06/30/2022, 2:25 PMsubjectAltName=DNS:SERVER_NAME
it should actually be subjectAltName=IP:$SERVER_IP
Rafa
06/30/2022, 2:26 PMLucas Rodriguez
06/30/2022, 2:27 PMRafa
06/30/2022, 2:34 PMLucas Rodriguez
06/30/2022, 2:37 PMRafa
06/30/2022, 2:44 PM{
"version": "4.16.0",
"branch": "HEAD",
"revision": "865ab32d03c37e8a74e811bc5ac697202f14e455",
"go_version": "go1.17.8",
"build_date": "2022-06-21",
"build_user": "runner"
}
Lucas Rodriguez
06/30/2022, 2:45 PMfleetctl package ... --insecure ...
(which will fix any certificate errors but it's not recommended for production environments.)
I can suggest the above and then, once all it's working and tested, configure a proper certificate (not self-signed) for Fleet.Rafa
06/30/2022, 2:50 PMLucas Rodriguez
06/30/2022, 2:52 PM--fleet-certificate
when using --insecure
/tmp
, right?)Rafa
06/30/2022, 2:56 PMLucas Rodriguez
06/30/2022, 2:59 PM--insecure
mode creates a certificate in /tmp/fleet.crt
.)Rafa
06/30/2022, 3:01 PMLucas Rodriguez
06/30/2022, 3:03 PMRafa
06/30/2022, 3:37 PMLucas Rodriguez
06/30/2022, 3:42 PMfleetctl package
generation time (see fleetctl package --osquery-flagfile flagfile.txt
option), other options can be set via the Fleet UI (in the Settings -> "Global agent options").Rafa
06/30/2022, 3:48 PMLucas Rodriguez
06/30/2022, 3:50 PMRafa
06/30/2022, 3:56 PMLucas Rodriguez
06/30/2022, 3:56 PMRafa
06/30/2022, 4:45 PMLucas Rodriguez
06/30/2022, 5:07 PMcontext canceled
errors usually are due:
• Slow database, and/or
• Configured timeouts in osquery, a load balancer or database (took
says 15s so a guess is that there's a 15s timeout somewhere)Rafa
06/30/2022, 5:28 PMLucas Rodriguez
06/30/2022, 6:13 PMRafa
06/30/2022, 6:22 PM