when running ` tls dump` I see what appears to be html in th

Question

when running ` tls dump` I see what appears to be html in the output is that expected

Zach Zeid · Answer

while I m seeing the results go into kolide successfully from my test fleet I m also getting `tls negotiation` errors as well and I m attempting to figure out why that is

zwass · Answer

No That probably means that you ve configured osquery to hit the incorrect endpoints or your LB is serving HTML for some reason

zwass · Answer

Under normal conditions you will only see JSON in the ` tls dump` output

Zach Zeid · Answer

it s an AWS NLB so it s entirely possible

Zach Zeid · Answer

I see the html right after this ` 14 00 57 ~$ I0903 14 00 58 274202 23479 tls cpp 253 TLS HTTPS POST request to URI <https dev fleet sec xxxx org>`

Zach Zeid · Answer

It returns the node key just fine then a bunch of html

Zach Zeid · Answer

I can t imagine I m hitting incorrect endpoints given that the results from the queries are showing up

zwass · Answer

There s nothing after ` org`

zwass · Answer

Maybe you re missing `config tls endpoint`

Zach Zeid · Answer

I don t think so the test instance is pulling down configs and `config tls endpoint` is configured in the flags file It occurs to me that this is a result of the fleet server being behind a network gateway and that is what is returning the html

zwass · Answer

If you are hitting the root path then it s pulling down the login page

zwass · Answer

So you need to figure out why osqueryd is hitting that path

zwass · Answer

It s probably one of the ` endpoint` flags missing

Zach Zeid · Answer

```sudo osqueryd verbose tls dump tls hostname <http dev fleet sec xxx org|dev fleet sec xxx org> config plugin tls tls server certs etc osquery certs kolide fleet crt logger tls endpoint api v1 osquery log config tls endpoint api v1 osquery config logger plugin tls enroll tls endpoint api v1 osquery enroll enroll secret path etc osquery enroll secret```

Zach Zeid · Answer

I think I have all the endpoint flags defined

Zach Zeid · Answer

should the `tls hostname` be something else ``` tls hostname <http dev fleet sec xxx org|dev fleet sec xxx org>``` right now that s the url we use to get to the web ui

seph · Answer

Well what s the html

seph · Answer

Maybe it s telling you what s wrong

Zach Zeid · Answer

it s actually the html from the web ui

zwass · Answer

Yeah sounds like osquery is just hitting the root path and Fleet is serving the root path as expected

Zach Zeid · Answer

well the tls hostname is the same URL has the ui so I guess that s expected Not sure what would make them different

zwass · Answer

osquery is supposed to append the ` endpoint` flags to the hostname That s why I suggested checking that they are all configured properly

Zach Zeid · Answer

so it d be `<http dev fleet sec xxx org api v1 osquery config|dev fleet sec xxx org api v1 osquery config> enroll log ` right

Zach Zeid · Answer

I guess I don t understand afaik I have configured things correctly

zwass · Answer

Did you configure distributed read write

Zach Zeid · Answer

facepalm

Zach Zeid · Answer

that was set in my flags file but not when I was running osquery from the command line

zwass · Answer

Ah yeah that could explain it

Zach Zeid · Answer

the html was being generated because it wasn t hitting the distributed endpoints just the root hostname

zwass · Answer

Correct It would have just seen the login page because it wasn t hitting an api endpoint

Zach Zeid · Answer

are the distributed endpoints used mainly for ad hoc queries I don t see a ton in the docs about them

zwass · Answer

Yeah just for ad hoc queries

Zach Zeid · Answer

thumbsup Thank you this was helpful Would it be a correct statement to say if the distributed endpoints aren t configured then any ad hoc queries sent from fleet wouldn t make it to the hosts

zwass · Answer

Yes

zwass · Answer

And if you don t want ad hoc queries then you re best off setting ` disable distributed` which is the default so osquery doesn t even try

Zach Zeid · Answer

or in this case fleet has the ability to send that config to hosts as well

zwass · Answer

Yes I believe osquery will respect that flag if set in Fleet

Zach Zeid · Answer

Awesome thank you