https://github.com/osquery/osquery logo
Join Slack
Powered by
Where does the package builder get its binaries? D...
# kolide
k
Where does the package builder get its binaries? Do I need to provide an own server? What kind of server?
s
If you don’t specify, it pulls them from Kolide’s Notary servers
k
Does that mean that if I DON'T provide a 
hostname
parameter it will take some default? And then I will get 
osquery
installed from there?
s
No. 
hostname
has no default (see the link above).
hostname
is the URL of the Fleet or other osquery management server where it retrieves its configuration from and sends the logs to
k
oh, so it is not the server "serving" the binaries
s
No. That is specified by 
notary_url
k
AAAAAH! That makes things much clearer! Thanks @sundsta
Can the packge builder be used without a 
hostname
? Does this make any sense at all?
I managed to build a package on my manjaro with target 
linux-systemd-pacman
. I could install it with 
sudo pacman -U <package>
, and I can start it via 
sudo systemctl start launcher.launcher
- but I do not have any osquery installed or running with that....I still must be doing and understanding something very badly...
z
If you don't want a central server (like Fleet) managing the osquery configurations (and receiving the logs), you might just want to build a package with plain 
osqueryd
. You then need to figure out how you want to get the logs off the endpoint.
k
That sounds like what I want to do! So how do I build a packge with plain 
osqueryd
?
z
k
🙏
s
You might be able to patch package-builder, but it is oriented to packaging launcher, osquery, and launchers config to talk to a fleet manager.
k
Thanks @seph, this is very explicit and clear.
So after looking at @zwass’s link, and having built a package, I have a very concrete question:
With that link I was able to build a package for linux, from where I was building it. My ideal situation is to get the auto-updater function with the launcher for 
osqueryd
, 
osqueryi
and 
osqueryctl,
without the need of any fleet or other gRPC server. Is this possible?
z
I think it's possible, though you'll have to patch the code in Launcher that starts osquery to use different config and logging plugins.
s
Maybe. But not without work. I feel compelled to suggest you also look at SaaS vendors here. Kolide, for example. But anyhow, Launcher has some built in update functionality. Extracting that into a standalone tool would be hard. You may as well write your own at that point. Launcher only knows how to speak grpc or jsonrpc. You could do some work to have launcher manage osquery. and have osquery connect directly to something. Or not connect anywhere. But you’ll have to figure that out
k
I see, thank you very much for your support guys
Open in Slack
PreviousNext
Powered by