Hello everyone! I am trying to deploy fleet on AWS but I am having problems with the agent. What I did: 1- create a RDS 2- create a Redis 3- create a self-signed certificate 4- create an EC2, download fleet and start it. 5- generate an installer to connect to Fleet But the host is never connected. I checked the connectivity between them and it is fine. So I am with some doubts: 1 - the installer should generate a process in my machine, right? I found nothing running with fleet in the name or osquery 2- is there a debug mode for the connector?

Hi Rafa!, a couple of questions 1. Which OS did you install the generated package? 2. If the Fleet URL serves a self-signed certificate (not trusted by your system's CA root bundle) then you will need to specify it when generating the package

fleetctl package ... --fleet-certificate=fleet.pem ...

, did you set such flag?

Hi Lucas! Fleet is running in Ubuntu 22.04 and the generated package in Ubuntu 20.04.4. I generate the package in the machine that I want to connect with: fleetctl package --type=deb --fleet-url=https://ip:8080 --enroll-secret=ASDASDASDASDASDASDASDASD --fleet-certificate=fleet_osquery.pem LHi

OK, once the package is generated, did you install it via

sudo dpkg --install

?

(I omit the true ip and enroll-secret)

OK, let's check logs then:

Good! Found something:

OK, osquery is complaining about the self-signed certificate (doesn't trust it).

But setting --fleet-certificate should solve this right?

Did you set

--fleet-certificate=fleet_osquery.pem

and it still doesn't work?

yeap... but I will do the process again .1 minute

OK, if it still doesn't work, then you can also try (from the Ubuntu agent):

$ curl --cacert ./fleet_osquery.pem <https://ip:8080/version>

(To check any issues with the generated certificate itself.)

Noob question:

openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout /tmp/server.key -out /tmp/server.cert -subj "/CN=SERVER_NAME" \
  -addext "subjectAltName=DNS:SERVER_NAME"

SERVER_NAME in my case would be the ec2 ip?

IIRC

subjectAltName=DNS:SERVER_NAME

it should actually be

subjectAltName=IP:$SERVER_IP

Thanks! And in the CN=SERVER_NAME ?

Try with the IP too

openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \ -keyout /tmp/server.key -out /tmp/server.cert -subj "/CN=$IP" \ -addext "subjectAltName=IP:$IP"

The curl command works now?

Yeap! curl --cacert ./fleet_.pem https://ip:8080/version

{
  "version": "4.16.0",
  "branch": "HEAD",
  "revision": "865ab32d03c37e8a74e811bc5ac697202f14e455",
  "go_version": "go1.17.8",
  "build_date": "2022-06-21",
  "build_user": "runner"
}

OK, and to double check, you re-generated the package with such cert and re-installed?

Yeap, I re-generated the package and use the pem download using UI

Do not provide the certificate

--fleet-certificate

when using

--insecure

root 3666950 19.6 0.0 713056 14312 ? Ssl 11:56 0:00 /opt/orbit/bin/orbit/orbit

(The

--insecure

mode creates a certificate in

/tmp/fleet.crt

.)

Yeap!

Orbit needs to create such cert on the fly

one more thing: when I installed the connector, from which file orbit read the configs?

Some configs can be set at

fleetctl package

generation time (see

fleetctl package --osquery-flagfile flagfile.txt

option), other options can be set via the Fleet UI (in the Settings -> "Global agent options").

Found it

OK

worked!

Cool. Glad to be of help!

Just one thing more: {"component":"http","err":"error in query ingestion || error in query ingestion || error in query ingestion || error in query ingestion || error in query ingestion || error in query ingestion || error in query ingestion || getting app config: selecting app config: context canceled","ingestion-err":"ingest detail query: selecting app config: context canceled","ip_addr":"IP:13576","level":"error","method":"POST","took":"15.562593584s","ts":"2022-06-30T164353.030188861Z","uri":"/api/v1/osquery/distributed/write","x_for_ip_addr":""}

context canceled

errors usually are due: • Slow database, and/or • Configured timeouts in osquery, a load balancer or database (

took

says 15s so a guess is that there's a 15s timeout somewhere)

strange

It might be an issue with websockets ("live queries" use websocket to connect to Fleet)

thanks!