https://github.com/osquery/osquery logo
Powered by
#kolide
Title
# kolide
j

Jerome

02/27/2020, 10:55 AM
Do you know what can cause the error 
PermissionDenied desc = Forbidden: HTTP status code 403
(complete log posted in thread) ? I've build kolide launcher on a macmini and I have this error. Few days ago, I've done it on a test mac machine and it works and still working. I've copied the exact same files to the macmini and still have the issue. Thus, it seems related to the machine but I can't figure out what is wrong
Copy code
{"caller":"interface.cpp:108","component":"osquery","msg":"I0227 11:37:40.831255 222240768 interface.cpp:108] Registering extension (kolide, 1571, version=, sdk=)","severity":"debug","ts":"2020-02-27T10:37:40.831346Z"}
{"caller":"publish_logs.go:157","err":"rpc error: code = PermissionDenied desc = Forbidden: HTTP status code 403; transport: received the unexpected content-type \"text/html\"","errcode":"","logType":"status","log_count":29,"message":"","method":"PublishLogs","reauth":false,"severity":"info","took":"22.289138ms","ts":"2020-02-27T10:37:40.846247Z","uuid":"dcdec1d3-caa7-4e7d-a428-2db643649535"}
{"caller":"extension.go:494","err":"sending status logs: writing logs: transport error sending logs: rpc error: code = PermissionDenied desc = Forbidden: HTTP status code 403; transport: received the unexpected content-type \"text/html\"","severity":"info","ts":"2020-02-27T10:37:40.846366Z"}
ok my bad, my issue is related to my nginx config (configured as reverse proxy)
s

seph

02/27/2020, 2:24 PM
Yep. Transport received unexpected content type is the key there.
g

galiagante

03/05/2020, 3:21 PM
Apologies for the late arrival.. but.. what correction to the nginx config was used to correct this issue?
j

Jerome

03/09/2020, 10:59 AM
I wanted to restrict access on WebUI and I set it up this on location 
/
but this was wrong because this is for all sub-locations too, therefore I set it up on location 
/api/v1/kolide/
because it is used only by WebUI
so this is depend on your config, if you have the same error this mean that your nginx have a restriction access somewhere
2 Views
Powered by