-
Notifications
You must be signed in to change notification settings - Fork 402
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into 20059-fix-last_enrolled_at
- Loading branch information
Showing
340 changed files
with
9,921 additions
and
2,722 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,62 @@ | ||
# Certificates in fleetd | ||
|
||
There are three components in fleetd connecting to the Fleet server using TLS: `orbit`, `Fleet Desktop` and `osqueryd`. | ||
This article aims to describe how TLS CA root certificates are configured in fleetd to connect to a Fleet server securely. | ||
|
||
## Default | ||
|
||
The default behavior is using the `fleetctl package` command without the `--fleet-certificate` flag. | ||
|
||
- By default, `orbit` and `Fleet Desktop` will use the system's CA root store to connect to Fleet. | ||
- `osqueryd` doesn't support using the system's CA root store, it requires passing in a certificate file with the root CA store (via the `--tls_server_certs` flag). The `fleetctl` executable contains an embedded `certs.pem` file generated from https://curl.se/docs/caextract.html [0]. When generating a fleetd package with `fleetctl package` such embedded `certs.pem` file is added to the package [1]. Fleetd configures `osqueryd` to use the `certs.pem` file as CA root store by setting the `--tls_server_certs` argument to such path. | ||
|
||
## Using `--fleet-certificate` in `fleetctl package` | ||
|
||
When using `--fleet-certificate` in `fleetctl package`, such certificate file is used as a CA root store by `orbit`, `Fleet Desktop` and `osqueryd` (the system's CA store is not used when generating the fleetd package this way). | ||
|
||
## Issues with internal and/or intermediates certificates | ||
|
||
TLS clients require the CA root and all intermediate certificates that signed the leaf server certificate to be verified. | ||
This means that if the bundled certificate in fleetd [1] doesn't have intermediate certificates that signed the leaf certificate, then the Fleet server will have to be configured to serve the "fullchain". | ||
Here's a list of some scenarios assuming your Fleet server certificate has an intermediate signing certificate: | ||
- ✅ Using fullchain in the Fleet server and root CA only client side. | ||
- ✅ Using fullchain in the Fleet server and root+intermediate bundle client side. | ||
- ✅ Using the leaf certificate in the Fleet server and root+intermediate bundle client side. | ||
- ✅ Using the leaf certificate + intermediate bundle in the Fleet server and root CA only client side. | ||
- ❌ Using the leaf certificate in the Fleet server and root CA only client side. In this scenario the client side (fleetd) doesn't know of the intermediate certificate and thus cannot verify it. | ||
|
||
We've seen TLS certificate issues in the following configurations: (for more information see https://github.com/fleetdm/fleet/issues/6085): | ||
- Certificates signed by internal CA/intermediates. | ||
- Certificates issued by Let's Encrypt (that do not serve the fullchain certificate). | ||
|
||
When there are certificate issues you will see the following kind of errors in server logs: | ||
``` | ||
2024/07/05 15:03:52 http: TLS handshake error from <remote_ip>:<remote_port>: remote error: tls: bad certificate | ||
2024/07/05 15:03:53 http: TLS handshake error from <remote_ip>:<remote_port>: local error: tls: bad record MAC | ||
``` | ||
and the following kind of errors on the client side (fleetd): | ||
``` | ||
2024-07-05T15:04:52-03:00 DBG get config error="POST /api/fleet/orbit/config: Post \"https://fleet.example.com/api/fleet/orbit/config\": tls: failed to verify certificate: x509: certificate signed by unknown authority" | ||
``` | ||
``` | ||
W0705 15:16:44.739495 1251102656 init.cpp:760] Error reading config: Request error: certificate verify failed | ||
``` | ||
|
||
To troubleshoot issues with certificates you can use `fleetctl debug connection` command, e.g.: | ||
```sh | ||
fleetctl debug connection \ | ||
--fleet-certificate ./your-ca-root.pem \ | ||
https://fleet.example.com | ||
``` | ||
|
||
[0]: We have a Github CI action that runs daily that updates the [certs.pem on the repository](https://github.com/fleetdm/fleet/blob/main/orbit/pkg/packaging/certs.pem) whenever there's a new version of `cacert.pem` in https://curl.se/docs/caextract.html. Such file is embedded into the `fleetctl` executable and used when generating fleetd packages. | ||
[1]: The bundled certificate in fleetd is installed in `/opt/orbit` in macOS/Linux and `C:\Program Files\Orbit` on Windows. By default its name is `certs.pem`, but it will have a different name if the `--fleet-certificate` flag was used when generating the package (`fleetctl package`). | ||
|
||
|
||
<meta name="articleTitle" value="Certificates in fleetd"> | ||
<meta name="authorFullName" value="Lucas Manuel Rodriguez"> | ||
<meta name="authorGitHubUsername" value="lucasmrod"> | ||
<meta name="category" value="guides"> | ||
<meta name="publishedOn" value="2024-08-09"> | ||
<meta name="articleImageUrl" value="../website/assets/images/articles/apple-developer-certificates-on-linux-for-configuration-profile-signing-1600x900@2x.png"> | ||
<meta name="description" value="TLS certificates in fleetd"> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,155 @@ | ||
# Sysadmin diaries: lost device | ||
|
||
![Sysadmin diaries: lost device](../website/assets/images/articles/[email protected]) | ||
|
||
Picture this: an employee calls you in a panic from an airport halfway across the country. They have just realized they left their company-issued laptop on the plane. Cue the sinking feeling. The device contains sensitive company data, and the thought of it falling into the wrong hands is enough to induce a cold sweat. But fear not! With Fleet's Mobile Device Management (MDM) capabilities, you can handle this situation swiftly and securely. Let us walk through how to lock or wipe a lost device using Fleet remotely. | ||
|
||
|
||
## The scenario: a lost device | ||
|
||
Imagine you receive a call from Jamie, a sales executive who has just landed in Chicago for a crucial client meeting. In their rush to deplane, they accidentally leave their laptop in the seatback pocket. Realizing the mistake after reaching the terminal, Jamie calls you, anxious and stressed about the potential data breach. | ||
|
||
|
||
## Keep calm and use Fleet | ||
|
||
First, take a deep breath. Fleet has got you covered using MDM. You can remotely lock and wipe the lost device to ensure your company’s data remains secure. | ||
|
||
|
||
### Step 1: identify the device | ||
|
||
Start by identifying the device in Fleet. Navigate to the **Hosts** page in the Fleet web UI. Use the search functionality to quickly find Jamie’s laptop by entering the hostname or any other relevant identifier. | ||
|
||
|
||
### Step 2: remote lock | ||
|
||
|
||
#### Using the Fleet web UI | ||
|
||
1. Once you have located the device, click on it to open the **Host Overview** page. | ||
|
||
2. In the **Actions** menu, select **Lock**. | ||
|
||
3. A confirmation dialog will appear. Confirm that you want to lock the device. | ||
|
||
|
||
#### Using the Fleet API | ||
|
||
Alternatively, you can use the Fleet REST API to lock the device. Here is the API call you need to make: | ||
|
||
``` bash | ||
|
||
POST /api/v1/fleet/hosts/:id/lock | ||
|
||
``` | ||
|
||
Replace `:id` with Jamie’s laptop's actual ID. This command sends a signal to lock the device as soon as it comes online. For macOS, this requires MDM to be enabled. For Windows and Linux, scripts need to be enabled. | ||
|
||
If you wanted to call this from the command line, you could use `curl` with a command like this: | ||
|
||
```bash | ||
|
||
curl -X GET https://fleet.company.com/api/v1/fleet/hosts/123/lock -H "Authorization: Bearer <your_API_key>" | ||
|
||
``` | ||
|
||
|
||
#### Optional steps for macOS | ||
|
||
You can customize the locking message for macOS devices and set a PIN using an XML payload. Here is how: | ||
|
||
1. Create a file named `command-lock-macos-host.xml` with the following content: | ||
|
||
```xml | ||
|
||
<?xml version="1.0" encoding="UTF-8"?> | ||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | ||
<plist version="1.0"> | ||
<dict> | ||
<key>Command</key> | ||
<dict> | ||
<key>Message</key> | ||
<string>This device has been locked. Contact IT on (123) 456-7890.</string> | ||
<key>PIN</key> | ||
<string>123456</string> | ||
<key>RequestType</key> | ||
<string>DeviceLock</string> | ||
</dict> | ||
</dict> | ||
</plist> | ||
|
||
``` | ||
|
||
2. Customize the message and PIN as needed. | ||
|
||
3. Safely store the recovery PIN using a secure method like 1Password. | ||
|
||
4. Run the following command using the Fleet CLI tool, replacing `hostname` with the actual hostname in Fleet and the payload path with the file’s location: | ||
|
||
```bash | ||
|
||
fleetctl mdm run-command --hosts=hostname --payload=command-lock-macos-host.xml | ||
|
||
``` | ||
|
||
|
||
### Step 3: remote wipe (if necessary) | ||
|
||
If you determine the device is at a high risk of being compromised, you may decide to wipe it. This is a more drastic step, but sometimes, it is necessary to protect sensitive information. | ||
|
||
|
||
#### Using the Fleet web UI | ||
|
||
1. On the same **Host Overview** page, go to the **Actions** menu and select **Wipe**. | ||
|
||
2. Confirm the wipe action that appears in the dialog. | ||
|
||
|
||
#### Using the Fleet API | ||
|
||
To wipe the device via the API, use the following call: | ||
|
||
```bash | ||
|
||
POST /api/v1/fleet/hosts/:id/wipe | ||
|
||
``` | ||
|
||
Again, replace `:id` with the device’s ID. The wipe command will be executed once the device is online. MDM must be enabled for macOS and Windows, and scripts must be enabled for Linux. | ||
|
||
|
||
### Step 4: confirm and reassure | ||
|
||
After you have locked and potentially wiped the device, inform Jamie of the steps actioned. Reassure them that the company’s data is now secure and provide any further instructions they may need, such as getting a replacement device. | ||
|
||
|
||
### Unlocking macOS | ||
|
||
If the device is found and needs to be unlocked: | ||
|
||
|
||
|
||
1. Enter the security PIN (stored in Fleet, returned from the API call, or the XML file) in the device's input field. | ||
2. The device will open to the regular login screen and ask for a password. | ||
3. If the password is unavailable, select the option to enter the recovery key/disk encryption key (this option might be behind a ? icon). | ||
4. Retrieve the disk encryption key from Fleet’s web UI. | ||
5. Enter the disk encryption key on the laptop, which should prompt you to create a new password. | ||
6. You will then be logged into the default device profile, which allows you to complete any needed actions (e.g., wiping or recovering data). | ||
|
||
|
||
## Conclusion | ||
|
||
Losing a device is stressful, but Fleet’s MDM capabilities can help you manage it effectively. You can protect sensitive data and prevent unauthorized access by remotely locking or wiping the lost device. Remember, stay calm, and rely on Fleet to secure your endpoints. | ||
|
||
Fleet’s MDM features ensure that your data remains protected even if a device is lost. So, the next time you get that dreaded call, you will know exactly what to do. | ||
|
||
|
||
|
||
|
||
|
||
<meta name="articleTitle" value="Sysadmin diaries: lost device"> | ||
<meta name="authorFullName" value="JD Strong"> | ||
<meta name="authorGitHubUsername" value="spokanemac"> | ||
<meta name="category" value="guides"> | ||
<meta name="publishedOn" value="2024-07-09"> | ||
<meta name="articleImageUrl" value="../website/assets/images/articles/[email protected]"> | ||
<meta name="description" value="In this sysadmin diary, we explore what actions can be taken with Fleet when a device is lost."> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
* Added the database migrations to create the new `exclude` column for labels associated with MDM profiles (and declarations). | ||
* Added the API changes to support the `labels_include_all` and `labels_exclude_any` fields (and accept the deprecated `labels` field as an alias for `labels_include_all`). | ||
* Added `fleetctl gitops` and `fleetctl apply` support for `labels_include_all` and `labels_exclude_any` to configure a custom setting. | ||
* Updated the profile reconciliation logic to handle the new "exclude any" labels. | ||
* Fix bug where macOS declarations were stuck in "to be removed" state indefinitely. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,2 @@ | ||
- Update `fleetctl query --hosts` to work with hostnames, host UUIDs, and/or hardware serial numbers. | ||
- Clarify various help and error texts around host identifiers. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
- `fleetctl get mdm_commands` now returns 20 rows and supports `--host` `--type` filters to improve response time |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
* Improved the matching of `pkg` installer files to existing software |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
* Add host's display name to calendar event descriptions |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
- In maintenance windows using Google Calendar, calendar event is now recreated within 30 seconds if deleted or moved to the past. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
* Update empty state styles in 4 places, clean up |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
* Fix 3 UI bugs on the Software page |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
When osquery returns a serial number of -1 (default value), we keep the existing serial number in the database. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
* Added support for renewing SCEP certificates with custom enrollment profiles. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
- Added iOS/iPadOS builtin manual labels. IMPORTANT: Before migrating to this version, make sure to delete any labels with name "iOS" or "iPadOS". | ||
- Added aggregation of iOS/iPadOS OS versions. | ||
- Added change to custom profiles for iOS/iPadOS to go from 'pending' straight to 'verified' (skip 'verifying'). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
- Adds back the "Vulnerable" filter for the host details software table |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
* Improved the accuracy of the heuristic used to deterimine if a host is connected to Fleet via MDM by using osquery data for hosts that didn't send a Checkout message. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
- Add .yml and .yaml file type validation and error message to fleetctl apply |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
- Align the "View all hosts" links in the Software titles and versions tables. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
- Disable credential caching and reboot on Windows lock |
Oops, something went wrong.