Jerome
03/09/2020, 3:32 PMdisable_tables
seems ignored by Kolide Fleet.
I did tests with osquery binary only and this works as expected but when I use Kolide Fleet, the options is ignored and queries return results. As it works with the osquery binary, the issue seems to be on Kolide Fleet. Is there a bug here or did I miss something? Kolide Fleet might not support it yet?zwass
03/09/2020, 5:06 PM--verbose --tls_dump
turned on so you can verify what config it is receiving?seph
03/09/2020, 6:10 PMJerome
03/09/2020, 6:28 PM{"node_key":"XXX"}
{
"decorators": {
"always": [
"SELECT user AS username FROM logged_in_users WHERE user \u003c\u003e '' ORDER BY time LIMIT 1;"
],
"load": [
"SELECT uuid AS host_uuid FROM system_info;",
"SELECT hostname AS hostname FROM system_info;",
"SELECT hardware_serial as host_sn FROM system_info;"
]
},
"options": {
"config_refresh": 120,
"disable_distributed": false,
"disable_tables": "dns_resolvers,curl,ulimit_info,user_ssh_keys,wifi_status,wifi_networks,shell_history,logged_in_users",
"distributed_interval": 10,
"distributed_plugin": "tls",
"distributed_tls_max_attempts": 3,
"distributed_tls_read_endpoint": "/api/v1/osquery/distributed/read",
"distributed_tls_write_endpoint": "/api/v1/osquery/distributed/write",
"logger_plugin": "tls",
"logger_snapshot_event_type": true,
"logger_tls_endpoint": "/api/v1/osquery/log",
"logger_tls_period": 10,
"pack_delimiter": "/",
"utc": true
},
"packs": {
"TEST": {
"queries": {
"[compliance] (Unix) Disk encryption status": {
"query": "SELECT de.encrypted AS compliant FROM mounts m join disk_encryption de ON m.device_alias = de.name WHERE m.path = '/'",
"interval": 500,
"platform": "linux",
"snapshot": true,
"removed": false
}
}
}
}
}
zwass
03/09/2020, 6:34 PMJerome
03/09/2020, 6:40 PMseph
03/09/2020, 6:57 PMJerome
03/09/2020, 7:04 PMmars 09 20:01:32 PC-Jerome launcher[16460]: {"caller":"distributed.cpp:117","component":"osquery","level":"stderr","msg":"I0309 20:01:32.340546 16515 distributed.cpp:117] Executing distributed query: kolide_distributed_query_68: SELECT * FROM dns_resolvers","severity":"info","ts":"2020-03-09T19:01:32.34081041Z"}
seph
03/09/2020, 7:05 PMJerome
03/09/2020, 7:11 PMdisable_tablse
is correctseph
03/09/2020, 7:14 PMJerome
03/09/2020, 7:18 PMenable_tables
here are the parameters started with Kolide Fleet:
{
"arg0": "/usr/local/launcher/bin/osqueryd-updates/1582883866/osqueryd",
"args": "/usr/local/launcher/bin/osqueryd-updates/1582883866/osqueryd --pidfile=/var/launcher/fleet.xxx.com-8080/osquery.pid --database_path=/var/launcher/fleet.xxx.com-8080/osquery.db --extensions_socket=/var/launcher/fleet.xxx.com-8080/osquery.sock --extensions_autoload=/var/launcher/fleet.xxx.com-8080/osquery.autoload --extensions_timeout=10 --config_plugin=kolide_grpc --logger_plugin=kolide_grpc --distributed_plugin=kolide_grpc --disable_distributed=false --distributed_interval=5 --pack_delimiter=: --host_identifier=uuid --force=true --disable_watchdog --utc --config_refresh=300 --config_accelerated_refresh=30",
"caller": "runtime.go:546",
"msg": "launching osqueryd",
"severity": "info",
"ts": "2020-03-09T19:01:11.233209135Z"
}
When I start osquery with /usr/local/launcher/bin/osqueryd-updates/1582883866/osqueryd --flagfile osquery.flags
this works.
Here are the flags:
--insecure
--tls_server_certs=/etc/osquery/fleet.xxx.com_8090.pem
--tls_hostname=<http://fleet.xxx.com:8080|fleet.xxx.com:8080>
--enroll_secret_path=/etc/osquery/enrollment_secret
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=10
--host_identifier=uuid
seph
03/09/2020, 7:21 PMJerome
03/09/2020, 7:56 PMconfig_tls_endpoint (this is empty for Kolide Fleet)
extensions_autoload
extensions_socket
Does the extensions could be in cause?seph
03/09/2020, 8:18 PMJerome
03/09/2020, 8:50 PMseph
03/09/2020, 9:41 PMJerome
03/10/2020, 7:49 AMenable_tables
, working as expected with osqueryd standalone but not with kolide launcherconfig_tls_endpoint
and `enroll_tls_endpoint`are empty when I use Kolide Launcher when I query osquery_flags table