Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
g
grant seltzer
03/16/2020, 9:34 PMAnd if it doesn’t, does the enrollment secret provide enough security to connect fleet and hosts on an untrusted network?
z
zwass
03/16/2020, 10:10 PMThere is no support currently. You could front the Fleet server with a proxy that does mTLS.
I'd also be happy to do a consulting engagement to add this.
Most folks consider enroll secret + node keys to be sufficient.
➕ 1
s
sundsta
03/16/2020, 10:54 PMIf anything, I’m very interested if any rogue hosts enroll in my Fleet
s
stefanmaerz
03/17/2020, 12:43 PMIm curious: what would a rogue osquery host do when attached to Fleet?
➕ 1
g
grant seltzer
03/17/2020, 1:12 PMPretend to be a host that they’re not
but yea I don’t think it’s the biggest worry in the world, was just curious
s
stefanmaerz
03/17/2020, 2:51 PM^^^That makes sense. Take offline the legit host and stand up a bad one that shows nothing is wrong