{"id":3978,"date":"2019-08-12T22:53:34","date_gmt":"2019-08-12T19:53:34","guid":{"rendered":"https:\/\/kifarunix.com\/?p=3978"},"modified":"2024-03-12T07:36:04","modified_gmt":"2024-03-12T04:36:04","slug":"install-kolide-fleet-osquery-fleet-manager-on-debian-10","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-kolide-fleet-osquery-fleet-manager-on-debian-10\/","title":{"rendered":"Install Kolide Fleet Osquery Fleet Manager on Debian 10"},"content":{"rendered":"\n

Welcome to our guide on how to install Kolide Fleet Osquery fleet manager on Debian 10. Kolide Fleet<\/a> is an opensource Osquery manager that expands the capabilities of osquery by enabling you to track, manage, and monitor entire osquery fleet.<\/p>\n\n\n\n

Kolide Fleet has retired. Check the new replacement, the Fleetdm Fleet.<\/p>\n\n\n\n

Install Fleet Osquery Manager on Ubuntu 20.04<\/a><\/p>\n\n\n\n

Installing Kolide Fleet Osquery Fleet Manager on Debian<\/h2>\n\n\n\n

Kolide Fleet is available as binary that can be just downloaded and installed by placing it on the binaries directory.<\/p>\n\n\n\n

Download Kolide Fleet<\/h3>\n\n\n\n

Run the command below to download Kolide Fleet zipped binary.<\/p>\n\n\n\n

wget https:\/\/github.com\/kolide\/fleet\/releases\/latest\/download\/fleet.zip -P \/tmp <\/code><\/pre>\n\n\n\n
Once the download is complete, extract the Kolide Fleet binaries for Linux platform.<\/p>\n\n\n\n
cd \/tmp\nunzip fleet.zip 'linux\/*' -d fleet<\/code><\/pre>\n\n\n\n
Install Kolide Fleet Binaries<\/h3>\n\n\n\n
The Kolide FLeet binaries, the fleet<\/strong> and fleetctl<\/strong> binaries are extracted to fleet\/linux<\/strong> directory.<\/p>\n\n\n\n
ls \/tmp\/fleet\/linux\/\n fleet  fleetctl<\/code><\/pre>\n\n\n\n
To install Kolide Fleet binaries, copy the binaries to \/usr\/bin<\/strong> directory.<\/p>\n\n\n\n
cp \/tmp\/fleet\/linux\/{fleet,fleetctl} \/usr\/bin\/<\/code><\/pre>\n\n\n\n
The Kolide Fleet binaries is now installed.<\/p>\n\n\n\n
ls \/usr\/bin\/fleet*\n\/usr\/bin\/fleet    \/usr\/bin\/fleetctl<\/code><\/pre>\n\n\n\n
Install and Configure Kolide Fleet Dependencies<\/h3>\n\n\n\n
Kolide Fleet requires MySQL for its database and Redis server for ingesting and queueing the results of distributed queries, cache data, etc.<\/p>\n\n\n\n
Install MySQL Database<\/h4>\n\n\n\n
Run the command install MySQL\/MariaDB server.<\/p>\n\n\n\n
apt install mariadb-server mariadb-client<\/code><\/pre>\n\n\n\n
Running MariaDB<\/h4>\n\n\n\n
MariaDB server is set to run and enabled to run on system boot upon installation. You can check the status;<\/p>\n\n\n\n
systemctl status mariadb<\/code><\/pre>\n\n\n\n
systemctl is-enabled mariadb<\/code><\/pre>\n\n\n\n
Run the initial MySQL security script, mysql_secure_installation<\/strong>, to remove anonymous database users, test tables, disable remote root login.<\/p>\n\n\n\n
Create Kolide Fleet Database and Database User<\/h4>\n\n\n\n
By default, MariaDB 10.3 uses unix_socket for authentication and hence, can login by just running, mysql -u root<\/strong>. If have however enabled password authentication, simply run;<\/p>\n\n\n\n
mysql -u root -p<\/code><\/pre>\n\n\n\n
Next, create the Kolide database and user with all grants on Kollide DB.<\/p>\n\n\n\n
create database kolide;\ngrant all on kolide.* to kolideadmin@localhost identified by 'StrongP@SS';\nflush privileges;\nexit<\/code><\/pre>\n\n\n\n
Install Redis<\/h3>\n\n\n\n
Run the command below to install Redis.<\/p>\n\n\n\n
apt install redis<\/code><\/pre>\n\n\n\n
Redis is set to start and enabled on system boot upon installation.<\/p>\n\n\n\n
Running Kolide Fleet Server<\/h3>\n\n\n\n
Once you have installed and setup all the prerequisites for Kolide Fleet, you need to initializing Fleet infrastructure using the fleet prepare db<\/code> as follows;<\/p>\n\n\n\n
fleet prepare db --mysql_address=127.0.0.1:3306 --mysql_database=kolide --mysql_username=kolideadmin --mysql_password=StrongP@SS<\/code><\/pre>\n\n\n\n
If the initialization is complete, you should get the output,<\/p>\n\n\n\n
Migrations completed.<\/code><\/pre>\n\n\n\n
Fleet serve is used to run the main HTTPS server. Hence, run the command below to generate self-signed certificates.<\/p>\n\n\n\n
DO NOT use wildcards certificate if you are using Self signed certificates as it causes enrollment issues.<\/strong><\/p>\n\n\n\n
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout \/etc\/ssl\/private\/kolide.key -out \/etc\/ssl\/certs\/kolide.cert<\/code><\/pre>\n\n\n\n
If you can, use the commercial TLS certificates.<\/p>\n\n\n\n
Generate a random Json Web Token<\/a> key for signing and verify session tokens. This will be required when running the fleet serve<\/strong> command for use with –auth_jwt_key<\/strong> option. It is however auto-generated when you do not provide this option with a random key value.<\/p>\n\n\n\n
Testing Kolide Fleet<\/h4>\n\n\n\n
Kolide Fleet is setup and thus you need to run the command below to verify that it can run successfully using the fleet serve<\/strong> command as shown below<\/p>\n\n\n\n
fleet serve --mysql_address=127.0.0.1:3306 --mysql_database=kolide --mysql_username=kolideadmin \\\n   --mysql_password=StrongP@SS --server_cert=\/etc\/ssl\/certs\/kolide.cert --server_key=\/etc\/ssl\/private\/kolide.key \\\n   --logging_json --auth_jwt_key=yi+\/uPJ0XvdrcEvTsZYKWz4oagO+8o57 <\/code><\/pre>\n\n\n\n
If all is well, you should see that Fleet server is now running on 0.0.0.0:8080<\/strong> and hence can be accessed on https:\/\/<server-IP>:8080<\/strong>.<\/p>\n\n\n\n
{\"component\":\"service\",\"err\":null,\"method\":\"ListUsers\",\"took\":\"433.897\u00b5s\",\"ts\":\"2019-08-12T18:00:49.89214441Z\",\"user\":\"none\"}\n{\"address\":\"0.0.0.0:8080\",\"msg\":\"listening\",\"transport\":\"https\",\"ts\":\"2019-08-12T18:00:49.894679501Z\"}<\/code><\/pre>\n\n\n\n
Create Kolide Fleet Systemd Service Unit<\/h3>\n\n\n\n
Once you have verified that Kolide Fleet is running fine, create a systemd service file.<\/p>\n\n\n\n
vim \/etc\/systemd\/system\/kolide-fleet.service<\/code><\/pre>\n\n\n\n
[Unit]\nDescription=Kolide Fleet Osquery Fleet Manager\nAfter=network.target\n\n[Service]\nLimitNOFILE=8192\nExecStart=\/usr\/bin\/fleet serve \\\n  --mysql_address=127.0.0.1:3306 \\\n  --mysql_database=kolide \\\n  --mysql_username=kolideadmin \\\n  --mysql_password=StrongP@SS \\\n  --redis_address=127.0.0.1:6379 \\\n  --server_cert=\/etc\/ssl\/certs\/kolide.cert \\\n  --server_key=\/etc\/ssl\/private\/kolide.key \\\n  --auth_jwt_key=yi+\/uPJ0XvdrcEvTsZYKWz4oagO+8o57 \\\n  --logging_json\nExecStop=kill -15 $(ps aux | grep \"fleet serve\" | grep -v grep | awk '{print$2}')\n\n[Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n
Save the file and reload systemd configurations.<\/p>\n\n\n\n
systemctl daemon-reload<\/code><\/pre>\n\n\n\n
Start and enable Kolide Fleet service.<\/p>\n\n\n\n
systemctl start kolide-fleet.service\nsystemctl enable kolide-fleet.service<\/code><\/pre>\n\n\n\n
Check the status;<\/p>\n\n\n\n
systemctl status kolide-fleet.service<\/code><\/pre>\n\n\n\n
\u25cf kolide-fleet.service - Kolide Fleet Osquery Fleet Manager\n   Loaded: loaded (\/etc\/systemd\/system\/kolide-fleet.service; enabled; vendor preset: enabled)\n   Active: active (running) since Mon 2019-08-12 21:16:32 EAT; 7min ago\n Main PID: 14406 (fleet)\n    Tasks: 7 (limit: 1150)\n   Memory: 14.1M\n   CGroup: \/system.slice\/kolide-fleet.service\n           \u2514\u250014406 \/usr\/bin\/fleet serve --mysql_address=127.0.0.1:3306 --mysql_database=kolide --mysql_username=kolideadmin --mysql_password=StrongP@SS --redis_address=127.0.\n\nAug 12 21:16:32 debian10.example.com systemd[1]: Started Kolide Fleet Osquery Fleet Manager.\nAug 12 21:16:32 debian10.example.com fleet[14406]: {\"component\":\"service\",\"err\":null,\"method\":\"ListUsers\",\"took\":\"272.605\u00b5s\",\"ts\":\"2019-08-12T18:16:32.206172973Z\",\"user\":\nAug 12 21:16:32 debian10.example.com fleet[14406]: {\"address\":\"0.0.0.0:8080\",\"msg\":\"listening\",\"transport\":\"https\",\"ts\":\"2019-08-12T18:16:32.208622615Z\"}<\/code><\/pre>\n\n\n\n
Access Kolide Fleet<\/h3>\n\n\n\n
Now that Kolide Fleet is running, you can access it on the browser using the URL https:\/\/<server-IP>:8080<\/strong>.<\/p>\n\n\n\n
\"Install<\/a><\/figure>\n\n\n\n
Create your fist Fleet account and by providing the username, password, email, organization name, confirm the fleet web address. Click submit and login to your Kolide Fleet server.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Adding New Hosts to Kolide<\/h3>\n\n\n\n
Next, you can begin by installing osquery on your Kolide Fleet server. We have already covered the installation of osquery on Debian 10 in our previous guide, see the link below;<\/p>\n\n\n\n
Install Osquery on Debian 10 Buster<\/a><\/p>\n\n\n\n
Once osquery is installed, add your host to Kolide by navigating to Hosts > Add New Hosts<\/strong>. When you click Add new host<\/strong>, a wizard like in below pops with the instructions on how to add hosts to flight instance.<\/p>\n\n\n
\n
\"Add<\/a><\/figure><\/div>\n\n\n
To enroll your osquery, you need the secret key and the TLS certificate. Hence, click reveal secret to see the key and click fetch flee certificate<\/strong> to download and install the certificate on the host as follows;<\/p>\n\n\n\n
NOTE that we are enrolling a localhost (Host running Kolide Fleet server itselft).<\/strong><\/p>\n\n\n\n
echo \"t3wa+W7C2S47AZ24\/ETi8xPXK2BuiLWO\" > \/var\/osquery\/secret<\/code><\/pre>\n\n\n\n
cp 192.168.43.62_8080.pem \/var\/osquery\/server.pem<\/code><\/pre>\n\n\n\n
Next, stop the osqueryd if it is running;<\/p>\n\n\n\n
systemctl stop osqueryd<\/code><\/pre>\n\n\n\n
Run osqueryd with the following options, replacing the –enroll_secret_path<\/strong> and –tls_server_certs<\/strong> accordingly.<\/p>\n\n\n\n
\/usr\/bin\/osqueryd --enroll_secret_path=\/var\/osquery\/enroll_secret \\\n--tls_server_certs=\/var\/osquery\/server.pem \\\n--tls_hostname=localhost:8080 \\\n--host_identifier=uuid \\\n--enroll_tls_endpoint=\/api\/v1\/osquery\/enroll \\\n--config_plugin=tls \\\n--config_tls_endpoint=\/api\/v1\/osquery\/config \\\n--config_refresh=10 \\\n--disable_distributed=false \\\n--distributed_plugin=tls \\\n--distributed_interval=3 \\\n--distributed_tls_max_attempts=3 \\\n--distributed_tls_read_endpoint=\/api\/v1\/osquery\/distributed\/read \\\n--distributed_tls_write_endpoint=\/api\/v1\/osquery\/distributed\/write \\\n--logger_plugin=tls \\\n--logger_tls_endpoint=\/api\/v1\/osquery\/log \\\n--logger_tls_period=10<\/code><\/pre>\n\n\n\n
If  all goes well, your host should be enrolled.<\/p>\n\n\n\n
\"kolide<\/a><\/figure>\n\n\n\n
Next, edit osqueryd service and add the options used above such such that the service configuration file looks like;<\/p>\n\n\n\n
cat \/lib\/systemd\/system\/osqueryd.service<\/code><\/pre>\n\n\n\n
[Unit]\nDescription=The osquery Daemon\nAfter=network.service syslog.service\n\n[Service]\nTimeoutStartSec=0\nEnvironmentFile=\/etc\/default\/osqueryd\nExecStartPre=\/bin\/sh -c \"if [ ! -f $FLAG_FILE ]; then touch $FLAG_FILE; fi\"\nExecStartPre=\/bin\/sh -c \"if [ -f $LOCAL_PIDFILE ]; then mv $LOCAL_PIDFILE $PIDFILE; fi\"\nExecStart=\/usr\/bin\/osqueryd \\\n  --flagfile $FLAG_FILE \\\n  --config_path $CONFIG_FILE \\\n  --enroll_secret_path=\/var\/osquery\/enroll_secret \\\n  --tls_server_certs=\/var\/osquery\/server.pem \\\n  --tls_hostname=localhost:8080 \\\n  --host_identifier=uuid \\\n  --enroll_tls_endpoint=\/api\/v1\/osquery\/enroll \\\n  --config_plugin=tls \\\n  --config_tls_endpoint=\/api\/v1\/osquery\/config \\\n  --config_refresh=10 \\\n  --disable_distributed=false \\\n  --distributed_plugin=tls \\\n  --distributed_interval=3 \\\n  --distributed_tls_max_attempts=3 \\\n  --distributed_tls_read_endpoint=\/api\/v1\/osquery\/distributed\/read \\\n  --distributed_tls_write_endpoint=\/api\/v1\/osquery\/distributed\/write \\\n  -logger_plugin=tls \\\n  --logger_tls_endpoint=\/api\/v1\/osquery\/log \\\n  --logger_tls_period=10\nRestart=on-failure\nKillMode=process\nKillSignal=SIGTERM\n\n[Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n
Reload system daemons.<\/p>\n\n\n\n
systemctl daemon-reload<\/code><\/pre>\n\n\n\n
Start osqueryd.<\/p>\n\n\n\n
systemctl start osqueryd<\/code><\/pre>\n\n\n\n
You can now query your host from Kolide Fleet server. For example, to query non system users with the query, select username,directory,uid,gid,shell from users where uid >= 1000;<\/strong><\/p>\n\n\n\n
\"Kolide<\/a><\/figure>\n\n\n\n
There you go. You have successfully setup Kolide Fleet Osquery Fleet Manager on Debian 10 Buster and you now add other fleets so that you can manage the querying from a single dashboard. Enjoy.<\/p>\n\n\n\n
Related Tutorials<\/h3>\n\n\n\n
Install and Setup Kolide Fleet on Ubuntu 18.04<\/a><\/p>\n\n\n\n
How to Install Osquery on Ubuntu 18.04<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Welcome to our guide on how to install Kolide Fleet Osquery fleet manager on Debian 10. Kolide Fleet is an opensource Osquery manager that expands<\/p>\n","protected":false},"author":1,"featured_media":8325,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,1070,1065],"tags":[1039,1071,1072,1066],"class_list":["post-3978","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-kolide","category-osquery","tag-debian-10-buster","tag-kolide","tag-kolide-fleet","tag-osquery","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/3978"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=3978"}],"version-history":[{"count":11,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/3978\/revisions"}],"predecessor-version":[{"id":21178,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/3978\/revisions\/21178"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/8325"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=3978"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=3978"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=3978"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}