Howdy folks Anyone around who could help me out with enrolli

Question

Howdy folks Anyone around who could help me out with enrolling a windows endpoint with fleet

Tim · Answer

I might be able to help out What issues are you running into

dlachmann · Answer

< Tim> I m trying to enroll my Windows machine with the tls plugin however I m getting an error message

dlachmann · Answer

Here s my command osqueryd exe enroll secret env=Tnr xxxxxxxxx enroll tls endpoint=x x x x 8080 tls server certs=C ProgramData osquery certs x x x x 8080 pem verbose host identifier=HOST 27 config tls refresh=10 disable distributed=false distributed plugin=tls distributed interval=3 distributed tls max attempts=3

dlachmann · Answer

Here s what I m seeing I0607 08 42 28 572372 2504 tls cpp 240 TLS HTTPS POST request to URI <https x x x x 8080>

dlachmann · Answer

W0607 08 42 29 052740 2504 tls enroll cpp 67 Failed enrollment request to <https x x x x 8080> Cannot parse JSON Invalid value Offset 0 retrying

Tim · Answer

IS your server running ok IS there a different host with that identifier Maybe try it without specifying a host identifier

Tim · Answer

oh and for the error are you parsing json anywhere on the host for this

Tim · Answer

actually you re missing a few flags ``` enroll tls endpoint= api v1 osquery enroll config plugin=tls config tls endpoint= api v1 osquery config ```

dlachmann · Answer

osqueryd exe enroll secret env=Tnr Tl0zB2vySH9x1DEIcA4kS0cXw5yI tls hostname=x x x x 8080 tls server certs=C ProgramData osquery certs x x x x 8080 pem verbose host identifier=HOST 27 config tls refresh=10 disable distributed=false distributed plugin=tls distributed interval=3 distributed tls max attempts=3 enroll tls endpoint= api v1 osquery enroll config plugin=tls config tls endpoint= api v1 osquery config

dlachmann · Answer

Command with the new flags

dlachmann · Answer

Failed enrollment request to <https 192 168 2 183 8080 api v1 osquery enroll> No node key returned from TLS enroll plugin retrying

dlachmann · Answer

^ New error message

Tim · Answer

I haven t used the enroll secret env flag I use the enroll secret path one but your secret might be getting passed wrong Try adding ``` verbose``` and ``` tls dump``` flags for troubleshooting

dlachmann · Answer

error invalid enroll secret node invalid true

dlachmann · Answer

I ll try doing enroll secret path

Tim · Answer

try copying just your enroll secret placing it in a file then adding the ``` enroll secret path=C PATH TO FILE```

dlachmann · Answer

Working Awesome thank you so much

dlachmann · Answer

Another question though this will only work when I run it it command line right

Tim · Answer

Np and that depends If you put a flagfile with all this in it in the default path for the service flagfile then it will work whenever the osqueryd service starts Or you could alter the default osqueryd service and point it to wherever you want for a flagfile

dlachmann · Answer

So I got osquery to connect to fleet with a flagfile I created and specified when running osqueryi exe flagfile= lt FLAGFILE gt

dlachmann · Answer

Unsure as to how to point it at the flag file when running it as a windows service though

dlachmann · Answer

Nevermind I read your last message a bit closer and understood

dlachmann · Answer

Thanks so much for your help

dlachmann · Answer

heart