https://github.com/osquery/osquery logo
#fleet
Title
# fleet
t

Tilman Bender

03/17/2022, 9:03 AM
Hm is therer a particular technical reason I would need to run fleetdm as root? I installed using the Ansible Playbook from FleetDMAutomation and found that although it created a user for fleet the service itself was still running as root
l

Lucas Rodriguez

03/17/2022, 12:30 PM
Hi Tilman! I believe so, the fleet server doesn't need to run as root. Which docs/scripts are you referring to?
t

Tilman Bender

03/17/2022, 12:36 PM
more specific the ansible file deploy_fleetdm.yml
l

Lucas Rodriguez

03/17/2022, 12:42 PM
Ah, TIL about such community project. @Benjamin Edwards might know more.
t

Tilman Bender

03/17/2022, 12:44 PM
I believe it was even referenced from the fleetdm doucmentation
l

Lucas Rodriguez

03/17/2022, 12:50 PM
Indeed, let's wait for Ben's feedback on this, he's an expert on the deployment side of Fleet.
b

Benjamin Edwards

03/17/2022, 1:09 PM
I've seen it but I'm not very aware of the details. I don't see why you couldn't run fleet as a non root user. Especially inside of a container.
z

zwass

03/17/2022, 4:48 PM
@CptOfEvilMinions maybe you have some thoughts? Or this could use an update?
👀 2
c

CptOfEvilMinions

03/17/2022, 4:53 PM
Looking at the SystemD config, I can confirm that Fleet is running as root. Fleet should be running as the
fleetdm
user created by the Ansible playbook. I can submit a PR later this week or early next to fix this. https://github.com/CptOfEvilMinions/FleetDM-Automation/blob/main/conf/ansible/fleetdm/fleetdm-systemd.service
ty 1
z

zwass

03/17/2022, 4:59 PM
Awesome, thanks for the quick response!
c

CptOfEvilMinions

03/19/2022, 4:58 PM
@Tilman Bender I have updated my Github repo, specifically the SystemD config to run fleetdm as a non-root user. Systemd config: https://github.com/CptOfEvilMinions/FleetDM-Automation/blob/main/conf/ansible/fleetdm/fleetdm-systemd.service
@Benjamin Edwards and @zwass I was looking for FleetDM systemd service configs on Google and came across this: https://github.com/kolide/fleet/blob/master/docs/infrastructure/systemd.md. FYI, looks like the FleetDM docs in Github have it running as root as well.
z

zwass

03/19/2022, 6:08 PM
Thank you! I'm updating the Fleet docs: https://github.com/fleetdm/fleet/pull/4702
🦜 1
t

Tilman Bender

03/21/2022, 8:22 AM
@CptOfEvilMinions Thank you I had also tested that setting independently on Thursday. Seems to work fine.
🎉 1
12 Views