Try turning on ` verbose tls dump` so you can take a look at

Question

Try turning on ` verbose tls dump` so you can take a look at the enroll secret `osqueryd` is sending

Marquis Carroll · Answer

it is saying unknown flag verbose

seph · Answer

You re using launcher Set ` debug`

Marquis Carroll · Answer

so it says `Access the debug endpoints at debug token= lt token gt ` and it keeps saying invalid enroll secret so should I specify that token in the fleet serve command

zwass · Answer

< seph> does ` debug` in Launcher do the equivalent of ` tls dump` IIRC it doesn t and maybe that s a feature we should add

zwass · Answer

< Marquis Carroll> can you show how you are passing the enroll secret to Launcher

seph · Answer

< zwass> I m pretty sure launcher will spit out a bunch of the GRPC keyvals in debug mode for example Might not be quite the same as ` tls dump`

zwass · Answer

Ah yep there it is < Marquis Carroll> do you not see some verbose logging from the Launcher after you do this

zwass · Answer

And it looks like the log level ought to be set to debug as expected

Marquis Carroll · Answer

2019 03 12 20 53 39 http TLS handshake error from 18 144 10 151 58526 remote error tls bad certificate ts=2019 03 12T20 53 39 218616575Z component=service method=EnrollAgent ip addr=50 250 240 122 54526 err= invalid enroll secret took=474 263µs ts=2019 03 12T20 53 39 31946333Z component=service method=EnrollAgent ip addr=73 241 44 152 58464 err= invalid enroll secret took=350 727µs ts=2019 03 12T20 53 39 470571067Z component=service method=EnrollAgent ip addr=50 250 240 122 64529 err= invalid enroll secret took=369 348µs ts=2019 03 12T20 53 39 490243029Z component=service method=EnrollAgent ip addr=50 250 240 122 56752 err= invalid enroll secret took=370 503µs ts=2019 03 12T20 53 39 867942698Z component=service method=EnrollAgent ip addr=50 250 240 122 62248 err= invalid enroll secret took=469 252µs ts=2019 03 12T20 53 39 931933402Z component=service method=EnrollAgent ip addr=50 250 240 122 62787 err= invalid enroll secret took=367 483µs ts=2019 03 12T20 53 40 01105259Z component=service method=EnrollAgent ip addr=50 250 240 122 55971 err= invalid enroll secret took=498 988µs ts=2019 03 12T20 53 40 114621591Z component=service method=EnrollAgent ip addr=50 250 240 122 64528 err= invalid enroll secret took=449 531µs ts=2019 03 12T20 53 40 344274782Z component=service method=EnrollAgent ip addr=73 241 44 152 58464 err= invalid enroll secret took=506 132µs ts=2019 03 12T20 53 40 556290574Z component=service method=EnrollAgent ip addr=50 250 240 122 64529 err= invalid enroll secret took=506 369µs ^Cts=2019 03 12T20 53 40 577545964Z terminated=null

Marquis Carroll · Answer

That s what I am getting on debug

Marquis Carroll · Answer

I am doing ` usr bin fleet serve mysql address=127 0 0 1 3306 mysql database=kolide mysql username=user mysql password=password redis address=127 0 0 1 6379 server cert= tmp kolide cert server key= tmp server key auth jwt key lt key gt debug`

Marquis Carroll · Answer

I took the private key that was generated with the server and re keyed the ssl cert I already have and copied that over to the server

zwass · Answer

You need to add debug to the launcher

Marquis Carroll · Answer

Marquiss MBP launcher marquis$ build package builder make hostname= enroll secret=key extension version nightly targets linux systemd deb package version 1 debug caller level go 63 level debug msg starting download span id 215b011b3211615b trace id 21e8ff2a2a4bb67a98109cf7a589e96f trace is sampled false ts 2019 03 12T21 16 13 165013Z url caller level go 63 level debug msg starting download span id 9f80287a3b86fb60 trace id 7b7e9603cade7eaf76aba26d42cf3998 trace is sampled false ts 2019 03 12T21 16 14 353114Z url caller level go 63 level debug msg starting download span id 1da64fd944fb9566 trace id 9b6caa07bb49a6b3d48bb40e1da8659d trace is sampled false ts 2019 03 12T21 16 14 857145Z url

Marquis Carroll · Answer

that s what it says

zwass · Answer

You need to run this flag with launcher I advise waiting to use package builder until you have your launcher configuration working properly

Marquis Carroll · Answer

Marquiss MBP launcher marquis$ build launcher hostname= enroll secret=secret debug caller launcher go 192 msg using default system root directory path var folders 2v x95 2hh924z3xr2qc7mc025w0000gn T launcher root severity info ts 2019 03 13T15 55 36 64843Z caller client grpc go 111 cert pinning false msg dialing grpc server server severity info tls secure true transport secure true ts 2019 03 13T15 55 36 649114Z build fc7ddfb27a34dd2265c2d2f6a82a2180e557444c caller launcher go 276 msg started kolide launcher severity info ts 2019 03 13T15 55 36 677103Z version 0 9 2 dirty caller query target updater go 26 msg query target updater interrupted severity info ts 2019 03 13T15 55 36 677304Z caller query target updater go 21 msg query target updater started severity info ts 2019 03 13T15 55 36 677247Z caller extension go 110 err launching osquery instance starting instance could not calculate osquery file paths extension path does not exist Users marquis go src github com kolide launcher build osquery extension ext stat Users marquis go src github com kolide launcher build osquery extension ext no such file or directory msg extension interrupted severity info stack stat Users marquis go src github com kolide launcher build osquery extension ext no such file or directory nextension path does not exist Users marquis go src github com kolide launcher build osquery extension ext

Marquis Carroll · Answer

Runner launchOsqueryInstance n t Users marquis go src github com kolide launcher pkg osquery runtime runtime go 433 not calculate osquery file paths

Marquis Carroll · Answer

Runner launchOsqueryInstance n t Users marquis go src github com kolide launcher pkg osquery runtime runtime go 435 instance osquery instance nmain createExtensionRuntime func1 n t Users marquis go src github com kolide launcher cmd launcher extension go 83

Marquis Carroll · Answer

That s what I got

Marquis Carroll · Answer

Got it working