Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
t
Tilman Bender
03/17/2022, 9:03 AMHm is therer a particular technical reason I would need to run fleetdm as root? I installed using the Ansible Playbook from FleetDMAutomation and found that although it created a user for fleet the service itself was still running as root
l
Lucas Rodriguez
03/17/2022, 12:30 PMHi Tilman! I believe so, the fleet server doesn't need to run as root. Which docs/scripts are you referring to?
t
Tilman Bender
03/17/2022, 12:36 PMHi Lucas, I used this repo: https://github.com/CptOfEvilMinions/FleetDM-Automation
more specific the ansible file deploy_fleetdm.yml
l
Lucas Rodriguez
03/17/2022, 12:42 PMAh, TIL about such community project.
@Benjamin Edwards might know more.
t
Tilman Bender
03/17/2022, 12:44 PMI believe it was even referenced from the fleetdm doucmentation
l
Lucas Rodriguez
03/17/2022, 12:50 PMIndeed, let's wait for Ben's feedback on this, he's an expert on the deployment side of Fleet.
b
Benjamin Edwards
03/17/2022, 1:09 PMI've seen it but I'm not very aware of the details. I don't see why you couldn't run fleet as a non root user. Especially inside of a container.
z
zwass
03/17/2022, 4:48 PM@CptOfEvilMinions maybe you have some thoughts? Or this could use an update?
👀 2
c
CptOfEvilMinions
03/17/2022, 4:53 PMLooking at the SystemD config, I can confirm that Fleet is running as root. Fleet should be running as the
fleetdm:ty: 1
z
zwass
03/17/2022, 4:59 PMAwesome, thanks for the quick response!
c
CptOfEvilMinions
03/19/2022, 4:58 PM@Tilman Bender I have updated my Github repo, specifically the SystemD config to run fleetdm as a non-root user.
Systemd config: https://github.com/CptOfEvilMinions/FleetDM-Automation/blob/main/conf/ansible/fleetdm/fleetdm-systemd.service
@Benjamin Edwards and @zwass I was looking for FleetDM systemd service configs on Google and came across this: https://github.com/kolide/fleet/blob/master/docs/infrastructure/systemd.md. FYI, looks like the FleetDM docs in Github have it running as root as well.
z
zwass
03/19/2022, 6:08 PMThank you!
I'm updating the Fleet docs: https://github.com/fleetdm/fleet/pull/4702
😛artyparrot: 1
t
Tilman Bender
03/21/2022, 8:22 AM@CptOfEvilMinions Thank you I had also tested that setting independently on Thursday. Seems to work fine.
🎉 1