Merge branch 'main' into feat-include-any-label
This commit is contained in:
gillespi314
@@ -49,6 +49,7 @@ What else should contributors [keep in mind](https://fleetdm.com/handbook/compan
|
||||
- [ ] Changes to paid features or tiers: TODO <!-- Specify changes in pricing-features-table.yml as a PR to reference docs release branch. Remove this checkbox and specify "Fleet Free" or "Fleet Premium" if there are no changes to the pricing page necessary. -->
|
||||
- [ ] Other reference documentation changes: TODO <!-- Any other reference doc changes? Specify changes as a PR to reference docs release branch. Put "No changes" if there are no changes necessary. -->
|
||||
- [ ] Once shipped, requester has been notified
|
||||
- [ ] Once shipped, dogfooding issue has been filed
|
||||
|
||||
### Engineering
|
||||
- [ ] Feature guide changes: TODO <!-- Specify if a new feature guide is required at fleetdm.com/guides, or if a previous guide should be updated to reflect feature changes. -->
|
||||
|
||||
@@ -15,6 +15,10 @@ defaults:
|
||||
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
||||
shell: bash
|
||||
|
||||
env:
|
||||
AWS_REGION: us-east-2
|
||||
AWS_IAM_ROLE: arn:aws:iam::160035666661:role/github-actions-role
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
@@ -23,7 +27,7 @@ jobs:
|
||||
runs-on: ubuntu-22.04
|
||||
environment: Docker Hub
|
||||
permissions:
|
||||
contents: write
|
||||
id-token: write # for aws-actions/configure-aws-credentials
|
||||
steps:
|
||||
- name: Harden Runner
|
||||
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
|
||||
@@ -33,6 +37,11 @@ jobs:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
|
||||
|
||||
- uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
|
||||
with:
|
||||
role-to-assume: ${{env.AWS_IAM_ROLE}}
|
||||
aws-region: ${{ env.AWS_REGION }}
|
||||
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
|
||||
with:
|
||||
@@ -58,6 +67,9 @@ jobs:
|
||||
|
||||
- name: Run Trivy vulnerability scanner on fleetdm/wix
|
||||
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
|
||||
env:
|
||||
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
|
||||
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
|
||||
with:
|
||||
image-ref: "fleetdm/wix"
|
||||
format: "table"
|
||||
@@ -68,6 +80,9 @@ jobs:
|
||||
|
||||
- name: Run Trivy vulnerability scanner on fleetdm/bomutils
|
||||
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
|
||||
env:
|
||||
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
|
||||
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
|
||||
with:
|
||||
image-ref: "fleetdm/bomutils"
|
||||
format: "table"
|
||||
@@ -78,6 +93,9 @@ jobs:
|
||||
|
||||
- name: Run Trivy vulnerability scanner on fleetdm/fleetctl
|
||||
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
|
||||
env:
|
||||
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
|
||||
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
|
||||
with:
|
||||
image-ref: "fleetdm/fleetctl"
|
||||
format: "table"
|
||||
|
||||
@@ -35,21 +35,38 @@ jobs:
|
||||
egress-policy: audit
|
||||
|
||||
- name: Check remote timestamp.json file
|
||||
id: check_timestamp
|
||||
run: |
|
||||
expires=$(curl -s http://tuf.fleetctl.com/timestamp.json | jq -r '.signed.expires' | cut -c 1-10)
|
||||
today=$(date "+%Y-%m-%d")
|
||||
warning_at=$(date -d "$today + 4 day" "+%Y-%m-%d")
|
||||
expires_sec=$(date -d "$expires" "+%s")
|
||||
warning_at_sec=$(date -d "$warning_at" "+%s")
|
||||
|
||||
|
||||
if [ "$expires_sec" -le "$warning_at_sec" ]; then
|
||||
exit 1
|
||||
echo "timestamp_warn=true" >> ${GITHUB_OUTPUT}
|
||||
else
|
||||
exit 0
|
||||
echo "timestamp_warn=false" >> ${GITHUB_OUTPUT}
|
||||
fi
|
||||
|
||||
- name: Slack Notification
|
||||
if: failure()
|
||||
- name: Check remote root.json file
|
||||
id: check_root
|
||||
run: |
|
||||
expires=$(curl -s http://tuf.fleetctl.com/root.json | jq -r '.signed.expires' | cut -c 1-10)
|
||||
today=$(date "+%Y-%m-%d")
|
||||
warning_at=$(date -d "$today + 30 day" "+%Y-%m-%d")
|
||||
expires_sec=$(date -d "$expires" "+%s")
|
||||
warning_at_sec=$(date -d "$warning_at" "+%s")
|
||||
|
||||
if [ "$expires_sec" -le "$warning_at_sec" ]; then
|
||||
echo "root_warn=true" >> ${GITHUB_OUTPUT}
|
||||
else
|
||||
echo "root_warn=false" >> ${GITHUB_OUTPUT}
|
||||
fi
|
||||
|
||||
|
||||
- name: Slack Timestamp Notification
|
||||
if: ${{ steps.check_timestamp.outputs.timestamp_warn == 'true' }}
|
||||
uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
|
||||
with:
|
||||
payload: |
|
||||
@@ -68,3 +85,25 @@ jobs:
|
||||
env:
|
||||
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
|
||||
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
|
||||
|
||||
- name: Slack Root Notification
|
||||
if: ${{ steps.check_root.outputs.root_warn == 'true' }}
|
||||
uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
|
||||
with:
|
||||
payload: |
|
||||
{
|
||||
"text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}",
|
||||
"blocks": [
|
||||
{
|
||||
"type": "section",
|
||||
"text": {
|
||||
"type": "mrkdwn",
|
||||
"text": "⚠️ TUF root.json is about to expire or has already expired\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
env:
|
||||
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
|
||||
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
|
||||
|
||||
|
||||
@@ -100,7 +100,10 @@ jobs:
|
||||
env:
|
||||
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
|
||||
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
|
||||
# first we'll scale everything down and create the new task definitions
|
||||
# Note: This will cause the geolite2 image to be built twice, but that cannot be avoided without refactoring the terraform to not tag it based upon timestamp.
|
||||
- name: Terraform Apply Free
|
||||
id: apply-free
|
||||
run: terraform apply -target=module.free -target=module.migrations_free -target=module.geolite2 -auto-approve
|
||||
- name: Terraform Apply
|
||||
id: apply
|
||||
run: terraform apply -auto-approve
|
||||
|
||||
@@ -22,12 +22,17 @@ defaults:
|
||||
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
||||
shell: bash
|
||||
|
||||
env:
|
||||
AWS_REGION: us-east-2
|
||||
AWS_IAM_ROLE: arn:aws:iam::160035666661:role/github-actions-role
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
trivy:
|
||||
permissions:
|
||||
id-token: write # for aws-actions/configure-aws-credentials
|
||||
contents: read # for actions/checkout to fetch code
|
||||
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
|
||||
name: Trivy sarif report
|
||||
@@ -40,10 +45,18 @@ jobs:
|
||||
egress-policy: audit
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
|
||||
- uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
|
||||
with:
|
||||
role-to-assume: ${{env.AWS_IAM_ROLE}}
|
||||
aws-region: ${{ env.AWS_REGION }}
|
||||
|
||||
- name: Run Trivy vulnerability scanner in repo mode
|
||||
uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d # 0.18.0
|
||||
env:
|
||||
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
|
||||
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
|
||||
with:
|
||||
scan-type: "fs"
|
||||
ignore-unfixed: false
|
||||
|
||||
@@ -12,9 +12,9 @@ jobs:
|
||||
pull-requests: write # for peter-evans/create-pull-request to create a PR
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v4
|
||||
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
|
||||
with:
|
||||
python-version: "3.x"
|
||||
- name: Install dependencies
|
||||
@@ -22,7 +22,7 @@ jobs:
|
||||
- name: Update Osquery versions in UI
|
||||
run: python .github/scripts/update_osquery_versions.py
|
||||
- name: PR changes
|
||||
uses: peter-evans/create-pull-request@v5
|
||||
uses: peter-evans/create-pull-request@4e1beaa7521e8b457b572c090b25bd3db56bf1c5 # v5.0.3
|
||||
with:
|
||||
commit-message: Update MIN_OSQUERY_VERSION_OPTIONS
|
||||
title: "Fleet UI: Update osquery version options"
|
||||
|
||||
+4
-3
@@ -2,7 +2,7 @@
|
||||
*.exe
|
||||
|
||||
# output directories
|
||||
build
|
||||
/build
|
||||
vendor
|
||||
node_modules
|
||||
dist
|
||||
@@ -41,6 +41,7 @@ charts/fleet/charts
|
||||
|
||||
#editors
|
||||
.idea
|
||||
.swp
|
||||
|
||||
# Fleet local development DB backups
|
||||
backup.sql.gz
|
||||
@@ -87,9 +88,9 @@ macoffice_rel_notes/
|
||||
|
||||
# residual files when running the build-windows tool
|
||||
orbit/cmd/desktop/manifest.xml
|
||||
orbit/cmd/desktop/resource.syso
|
||||
orbit/cmd/desktop/resource_windows.syso
|
||||
orbit/cmd/orbit/manifest.xml
|
||||
orbit/cmd/orbit/resource.syso
|
||||
orbit/cmd/orbit/resource_windows.syso
|
||||
|
||||
# Residual files from osqueryd loadtests.
|
||||
osquery_worker_*.jpg
|
||||
|
||||
+121
-49
@@ -1,80 +1,152 @@
|
||||
## Fleet 4.59.0 (Nov 12, 2024)
|
||||
|
||||
### Endpoint operations
|
||||
- Updated OpenTelemetry libraries to latest versions. This includes the following changes when OpenTelemetry is enabled:
|
||||
- MySQL spans outside of HTTPS transactions are now logged.
|
||||
- Renamed MySQL spans to include the query, for easier tracking/debugging.
|
||||
- Added capability for fleetd to report vital errors to Fleet server, such as when Fleet Desktop is unable to start.
|
||||
|
||||
### Device management (MDM)
|
||||
- Added UI for adding a setup experience script.
|
||||
- Added UI for the install software setup experience.
|
||||
- Added software experience software title selection API.
|
||||
- Added database migrations to support Setup Experience.
|
||||
- Added support to `fleetctl gitops` to specify a setup experience script to run and software to install, for a team or no team.
|
||||
- Added an Orbit endpoint (`POST /orbit/setup_experience/status`) for checking the status of a macOS host's setup experience steps.
|
||||
- Added service to track install status.
|
||||
- Added ability to connect a SCEP NDES proxy.
|
||||
- Added SCEP proxy for Windows NDES (Network Device Enrollment Service) AD CS server, which allows devices to request certificates.
|
||||
- Added error message on the My Device page when MDM is off for the host.
|
||||
- Added a config field to the UI for custom MDM URLs.
|
||||
- Added integration to queue setup experience software installation on automatic enrollment.
|
||||
- Added a validation to prevent removing a software package or a VPP app from a team if that software is selected to be installed during the setup experience.
|
||||
- Updated user permissions to allow gitops users to run MDM commands.
|
||||
- Updated to remove a pending MDM device if it was deleted from current ABM.
|
||||
- Updated to ensure details for a software installation run are available and accurate even after the corresponding installer has been edited or deleted.
|
||||
- **NOTE:** The database migration included with this update backfills installer data into installation details based on the currently uploaded installer. If you want to backfill data from activities (which will be more comprehensive and accurate than the migration default, but may take awhile as the entire activities table will be scanned), run this database query _after_ running database migrations:
|
||||
```sql
|
||||
UPDATE host_software_installs i
|
||||
JOIN activities a ON a.activity_type = 'installed_software'
|
||||
AND i.execution_id = a.details->>"$.install_uuid"
|
||||
SET i.software_title_name = COALESCE(a.details->>"$.software_title", i.software_title_name),
|
||||
i.installer_filename = COALESCE(a.details->>"$.software_package", i.installer_filename),
|
||||
i.updated_at = i.updated_at
|
||||
```
|
||||
- The above query is optional, and is unnecessary if no software installers have been edited.
|
||||
|
||||
### Vulnerability management
|
||||
- Added filtering Software OS view to show only OSes from a particular platform (Windows, macOS, Linux, etc.)
|
||||
- Fixed issue where the vulnerabilities cron failed to complete due to a large temporary table creation when calculating host issue counts.
|
||||
- Fixed Debian python package false positive vulnerabilities by removing duplicate entries for Debian python packages installed by dpkg and renaming remaining pip installed packages to match OVAL definitions.
|
||||
|
||||
### Bug fixes and improvements
|
||||
- Fixed the ADE enrollment release device processing for hosts running an old fleetd version.
|
||||
- Fixed an issue with the BYOD enrollment page where it sometimes would show a 404 page.
|
||||
- Fixed issue where macOS and Linux scripts failed to timeout on long running commands.
|
||||
- Fixed bug in ABM renewal process that caused upload of new token to fail.
|
||||
- Fixed blank install status when retrieving install details from the activity feed when the installer package has been updated or the software has since been removed from the host.
|
||||
- Fixed the svg icon for Edge.
|
||||
- Fixed frontend error when trying to view install details for an install with a blank status.
|
||||
- Fixed loading state for the profile status aggregate UI.
|
||||
- Fixed incorrect character set header on manual Mac enrollment config download.
|
||||
- Fixed `fleetctl gitops` to support VPP apps, along with setting the VPP apps to install during the setup experience.
|
||||
- Fixed bug where `PATCH /api/latest/fleet/config` was incorrectly clearing VPP token<->team associations.
|
||||
- Fixed issue when trying to download the manual enrollment profile when device token is expired. We now show an error for this case.
|
||||
- Fixed a bug where DDM declarations would remaing "pending" forever if they were deleted from Fleet before being sent to hosts.
|
||||
- Fixed a bug where policy failures of a host were not being cleared in the host details page after configuring the host to not run any policies.
|
||||
- Fixed iOS and iPadOS device release during the ADE enrollment flow.
|
||||
- Ignored `--delete-other-teams` flag in `fleetctl gitops` command for non-Premium license users.
|
||||
- Switched Nudge deadline time for OS upgrades on macOS pre-14 hosts from 04:00 UTC to 20:00 UTC.
|
||||
- Added a more descriptive error message when install or uninstall details do not exist for an activity.
|
||||
- Updated to allow FLEET_REDIS_ADDRESS to include a `redis://` prefix. Allowed formats are: `redis://host:port` or `host:port`.
|
||||
- Documented that Microsoft enrollments have less fields filled in the `mdm_enrolled` activity due to how this MDM enrollment flow is implemented.
|
||||
- Updated UI to make entire rows of the Disk encryption table clickable.
|
||||
- Updated software install activities from policy automations to be authored by "Fleet", store policy ID and name on each activity.
|
||||
- Updated tooltip for bootstrap package and VPP app statuses in UI.
|
||||
- Added created_at/updated_at timestamps on user create endpoint.
|
||||
- Updated UI notifications so that clicking in the horizontal dimension of a flash message, outside of the message itself, and always hide flash messages when changing routes.
|
||||
- Filtered out VPP apps on non-MDM enrolled devices.
|
||||
- Explicitly set line heights on "add profile" messages so they are consistent cross-browser.
|
||||
- Deprecated the worker-based job to release macOS devices automatically after the setup experience, replace it with the fleetd-specific "/status" endpoint that is polled by the Setup Experience dialog controlled by Fleet during the setup flow.
|
||||
- Improved UI feedback when user attempts and fails to reset password.
|
||||
|
||||
## Fleet 4.58.0 (Oct 17, 2024)
|
||||
|
||||
**Endpoint Operations:**
|
||||
|
||||
* Added builtin label for Fedora Linux. **Warning:** Migrations will fail if a pre-existing 'Fedora Linux' label exists. To resolve, delete the existing 'Fedora Linux' label.
|
||||
* Added ability to trigger script run on policy failure.
|
||||
* Updated GitOps script and software installer relative paths to now always relative to the file they're in. This change breaks existing YAML files that had to account for previous inconsistent behavior (e.g. script paths declared in no-team.yml being relative to default.yaml one directory up).
|
||||
* Improved performance for host details and Fleet Desktop, particularly in environments using high volumes of live queries.
|
||||
* Updated activity cleanup job to remove all expired live queries to improve API performance in environment using large volumes of live queries. To note, the cleanup cron may take longer on the first run after upgrade.
|
||||
* Added an event for when a policy automation triggers a script run in the activity feed.
|
||||
* Added battery status to Windows host details.
|
||||
- Added builtin label for Fedora Linux. **Warning:** Migrations will fail if a pre-existing 'Fedora Linux' label exists. To resolve, delete the existing 'Fedora Linux' label.
|
||||
- Added ability to trigger script run on policy failure.
|
||||
- Updated GitOps script and software installer relative paths to now always relative to the file they're in. This change breaks existing YAML files that had to account for previous inconsistent behavior (e.g. script paths declared in no-team.yml being relative to default.yaml one directory up).
|
||||
- Improved performance for host details and Fleet Desktop, particularly in environments using high volumes of live queries.
|
||||
- Updated activity cleanup job to remove all expired live queries to improve API performance in environment using large volumes of live queries. To note, the cleanup cron may take longer on the first run after upgrade.
|
||||
- Added an event for when a policy automation triggers a script run in the activity feed.
|
||||
- Added battery status to Windows host details.
|
||||
|
||||
**Device Management (MDM):**
|
||||
|
||||
* Added the `POST /software/fleet_maintained_apps` endpoint for adding Fleet-maintained apps.
|
||||
* Added the `GET /software/fleet_maintained_apps/{app_id}` endpoint to retrieve details of a Fleet-maintained app.
|
||||
* Added API endpoint to list team available Fleet-maintained apps.
|
||||
* Added UI for managing Fleet-maintained apps.
|
||||
* Updated add software modal to be seperate pages in Fleet UI.
|
||||
* Added support for uploading RPM packages.
|
||||
* Updated the request timeouts for software installer edits to be the same as initial software installer uploads.
|
||||
* Updated UI for software uploads to include upload progress bar.
|
||||
* Improved performance of SQL queries used to determine MDM profile status for Apple hosts.
|
||||
- Added the `POST /software/fleet_maintained_apps` endpoint for adding Fleet-maintained apps.
|
||||
- Added the `GET /software/fleet_maintained_apps/{app_id}` endpoint to retrieve details of a Fleet-maintained app.
|
||||
- Added API endpoint to list team available Fleet-maintained apps.
|
||||
- Added UI for managing Fleet-maintained apps.
|
||||
- Updated add software modal to be seperate pages in Fleet UI.
|
||||
- Added support for uploading RPM packages.
|
||||
- Updated the request timeouts for software installer edits to be the same as initial software installer uploads.
|
||||
- Updated UI for software uploads to include upload progress bar.
|
||||
- Improved performance of SQL queries used to determine MDM profile status for Apple hosts.
|
||||
|
||||
**Vulnerability Management:**
|
||||
|
||||
* Fixed MSRC feed pulls (for NVD release builds) in environments where GitHub access is authenticated.
|
||||
- Fixed MSRC feed pulls (for NVD release builds) in environments where GitHub access is authenticated.
|
||||
|
||||
**Bug fixes and improvements:**
|
||||
|
||||
* Added the 'Unsupported screen size' UI on the My device page.
|
||||
* Removed redundant built in label filter pills.
|
||||
* Updated success messages for lock, unlock, and wipe commands in the UI.
|
||||
* Restricted width of policy description wrappers for better UI.
|
||||
* Updated host details about section to condense information into fewer columns at smaller widths.
|
||||
* Hid CVSS severity column from Fleet Free software details > vulnerabilities sections.
|
||||
* Updated UI to remove leading/trailing whitespace when creating or editing team or query names.
|
||||
* Added UI improvements when selecting live query targets (e.g. styling, closing behavior).
|
||||
* Updated API to return 409 instead of 500 when trying to delete an installer associated with a policy automation.
|
||||
* Updated battery health definitions to be defined as cycle counts greater than 1000 or max capacity falling under 80% of designed capacity for macOS and Windows.
|
||||
* Added information on how battery health is defined to the UI.
|
||||
* Updated UI to surface duplicate label name error to user.
|
||||
* Fixed software uninstaller script for `pkg`s to only remove '.app' directories installed by the package.
|
||||
* Fixed "no rows" error when adding a software installer that matches an existing title's name and source but not its bundle ID.
|
||||
* Fixed an issue with the migration adding support for multiple VPP tokens that would happen if a token is removed prior to upgrading Fleet.
|
||||
* Fixed UI flow for observers to easily query hosts from the host details page.
|
||||
* Fixed bug with label display names always sentence casing.
|
||||
* Fixed a bug where a profile wouldn't be removed from a host if it was deleted or if the host was moved to another team before the profile was installed on the host.
|
||||
* Fixed a bug where removing a VPP or ABM token from a GitOps YAML file would leave the team assignments unchanged.
|
||||
* Fixed host software filter bug that resets dropdown filter on table changes (pagination, order by column, etc).
|
||||
* Fixed UI bug: Edit team name closes modal.
|
||||
* Fixed UI so that switching vulnerability search types does not cause page re-render.
|
||||
* Fixed UI policy automation truncation when selecting software to auto-install.
|
||||
* Fixed UI design bug where software package file name was not displayed as expected.
|
||||
* Fixed a small UI bug where a button overlapped some copy.
|
||||
* Fixed software icon for chrome packages.
|
||||
- Added the 'Unsupported screen size' UI on the My device page.
|
||||
- Removed redundant built in label filter pills.
|
||||
- Updated success messages for lock, unlock, and wipe commands in the UI.
|
||||
- Restricted width of policy description wrappers for better UI.
|
||||
- Updated host details about section to condense information into fewer columns at smaller widths.
|
||||
- Hid CVSS severity column from Fleet Free software details > vulnerabilities sections.
|
||||
- Updated UI to remove leading/trailing whitespace when creating or editing team or query names.
|
||||
- Added UI improvements when selecting live query targets (e.g. styling, closing behavior).
|
||||
- Updated API to return 409 instead of 500 when trying to delete an installer associated with a policy automation.
|
||||
- Updated battery health definitions to be defined as cycle counts greater than 1000 or max capacity falling under 80% of designed capacity for macOS and Windows.
|
||||
- Added information on how battery health is defined to the UI.
|
||||
- Updated UI to surface duplicate label name error to user.
|
||||
- Fixed software uninstaller script for `pkg`s to only remove '.app' directories installed by the package.
|
||||
- Fixed "no rows" error when adding a software installer that matches an existing title's name and source but not its bundle ID.
|
||||
- Fixed an issue with the migration adding support for multiple VPP tokens that would happen if a token is removed prior to upgrading Fleet.
|
||||
- Fixed UI flow for observers to easily query hosts from the host details page.
|
||||
- Fixed bug with label display names always sentence casing.
|
||||
- Fixed a bug where a profile wouldn't be removed from a host if it was deleted or if the host was moved to another team before the profile was installed on the host.
|
||||
- Fixed a bug where removing a VPP or ABM token from a GitOps YAML file would leave the team assignments unchanged.
|
||||
- Fixed host software filter bug that resets dropdown filter on table changes (pagination, order by column, etc).
|
||||
- Fixed UI bug: Edit team name closes modal.
|
||||
- Fixed UI so that switching vulnerability search types does not cause page re-render.
|
||||
- Fixed UI policy automation truncation when selecting software to auto-install.
|
||||
- Fixed UI design bug where software package file name was not displayed as expected.
|
||||
- Fixed a small UI bug where a button overlapped some copy.
|
||||
- Fixed software icon for chrome packages.
|
||||
|
||||
## Fleet 4.57.3 (Oct 11, 2024)
|
||||
|
||||
### Bug fixes
|
||||
|
||||
* Fixed Orbit configuration endpoint returning 500 for Macs running Rapid Security Response macOS releases that are enrolled in OS major version enforcement.
|
||||
- Fixed Orbit configuration endpoint returning 500 for Macs running Rapid Security Response macOS releases that are enrolled in OS major version enforcement.
|
||||
|
||||
## Fleet 4.57.2 (Oct 03, 2024)
|
||||
|
||||
### Bug fixes
|
||||
|
||||
* Fixed software uninstaller script for `pkg`s to only remove '.app' directories installed by the package.
|
||||
- Fixed software uninstaller script for `pkg`s to only remove '.app' directories installed by the package.
|
||||
|
||||
## Fleet 4.57.1 (Oct 01, 2024)
|
||||
|
||||
### Bug fixes
|
||||
|
||||
* Improved performance of SQL queries used to determine MDM profile status for Apple hosts.
|
||||
* Ensured request timeouts for software installer edits were just as high as for initial software installer uploads.
|
||||
* Fixed an issue with the migration that added support for multiple VPP tokens, which would happen if a token was removed prior to upgrading Fleet.
|
||||
* Fixed a "no rows" error when adding a software installer that matched an existing title's name and source but not its bundle ID.
|
||||
- Improved performance of SQL queries used to determine MDM profile status for Apple hosts.
|
||||
- Ensured request timeouts for software installer edits were just as high as for initial software installer uploads.
|
||||
- Fixed an issue with the migration that added support for multiple VPP tokens, which would happen if a token was removed prior to upgrading Fleet.
|
||||
- Fixed a "no rows" error when adding a software installer that matched an existing title's name and source but not its bundle ID.
|
||||
|
||||
## Fleet 4.57.0 (Sep 23, 2024)
|
||||
|
||||
|
||||
@@ -59,7 +59,6 @@ go.mod @fleetdm/go
|
||||
/infrastructure/ @rfairburn @ksatter @lukeheath @edwardsb @georgekarrv
|
||||
/charts/ @rfairburn @ksatter @lukeheath @edwardsb @georgekarrv
|
||||
/terraform/ @rfairburn @ksatter @lukeheath @edwardsb @georgekarrv
|
||||
/it-and-security/ @noahtalerman @lukeheath @getvictor
|
||||
|
||||
##############################################################################################
|
||||
# ⚗️ Reference, config surface, built-in queries, API, and other documentation.
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
# Configuring an Alternative Apple MDM URL
|
||||
|
||||
Fleet [v4.59.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.59.0) allows setting an alternative MDM URL helps organizations differentiate MDM traffic from other Fleet traffic, allowing the application of network rules specific to MDM communications. The `mdm.apple_server_url` configuration specifies the URL that Apple devices use to communicate with your Fleet instance for MDM purposes. This configuration is optional; if not set, MDM will default to using the Fleet Server URL.
|
||||
|
||||
However, be aware that changing this URL after devices have been enrolled in MDM requires those devices to be re-enrolled into MDM.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
* Fleet v4.59.0
|
||||
|
||||
## Step-by-Step Instructions
|
||||
|
||||
1. Prepare Your DNS
|
||||
|
||||
Create a DNS record Fleet can use for Apple MDM traffic
|
||||
|
||||
**Example:**
|
||||
* Fleet Server URL: `https://fleet.example.com 104.21.82.73`
|
||||
* Apple Server URL: `https://fleet-mdm.example.com 104.21.82.73`
|
||||
|
||||
Both URLs should point to the same IP address to ensure seamless handling of both MDM and non-MDM traffic.
|
||||
|
||||
2. Configure the Apple Server URL in Fleet
|
||||
|
||||
Via the Fleet UI:
|
||||
|
||||
* **Access Fleet UI**: Navigate to **Settings > Organization settings > Apple Server URL**.
|
||||
* **Set the URL**: Enter your MDM Apple Server URL.
|
||||
* **Apply Changes**: Run the following command to apply your changes:
|
||||
|
||||
Via GitOps:
|
||||
|
||||
```yaml
|
||||
org_settings:
|
||||
mdm:
|
||||
apple_server_url: "https://mdm.example.com"
|
||||
```
|
||||
|
||||
See the [GitOps reference documentation](https://fleetdm.com/docs/configuration/yaml-files#policies) for an example.
|
||||
|
||||
## Conclusion
|
||||
|
||||
The Apple Server URL is an optional configuration that allows you to route MDM traffic through a separate URL, which can be beneficial for monitoring and controlling MDM traffic separately from other Fleet communications.
|
||||
|
||||
**Important**: Be sure to set the Apple Server URL **before** enrolling devices to avoid the need for device MDM re-enrollment.
|
||||
|
||||
<meta name="articleTitle" value="Configuring an Alternative Apple MDM URL">
|
||||
<meta name="authorFullName" value="Tim Lee">
|
||||
<meta name="authorGitHubUsername" value="mostlikelee">
|
||||
<meta name="category" value="guides">
|
||||
<meta name="publishedOn" value="2024-11-01">
|
||||
<meta name="description" value="A guide on configuring an alternative Apple MDM URL in Fleet for better traffic management.">
|
||||
```
|
||||
@@ -4,7 +4,7 @@ Fleet [v4.57.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.57.0) int
|
||||
|
||||
Fleet allows its users to upload trusted software installation files to be installed and used on hosts. This installation could be conditioned on a failure of a specific Fleet Policy.
|
||||
|
||||
> Currently, custom packages and Fleet-maintained apps can be automatically installed. (macOS App Store apps [coming soon](https://github.com/fleetdm/fleet/issues/23115))
|
||||
> Currently, Fleet-maintained apps can be automatically installed on macOS hosts and custom packages can be automatically installed on macOS, Windows, and Linux hosts. (macOS App Store apps [coming soon](https://github.com/fleetdm/fleet/issues/23115))
|
||||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
@@ -6,13 +6,9 @@
|
||||
|
||||
Staying ahead of technological innovations is crucial for individuals and organizations. Google Chrome, one of the most widely used web browsers, continually evolves to incorporate new features, including artificial intelligence (AI). This article will guide you through detecting if AI capabilities have been enabled in Chrome on macOS using Fleet.
|
||||
|
||||
## Introduction to Chrome AI innovations
|
||||
|
||||
Google Chrome has integrated AI to enhance user experience by providing intelligent suggestions, improving search results, and offering in-browser assistance. Visit the [Chrome AI Innovations page](https://www.google.com/chrome/ai-innovations/) for more information.
|
||||
|
||||
## Using Fleet to discover AI features in Chrome
|
||||
|
||||
Fleet, a comprehensive device management and security tool, allows organizations to monitor installed software configurations and enabled features on endpoints and servers. Investigating this data enables Fleet admins to build SQL queries for detection.
|
||||
Google Chrome has integrated AI to enhance user experience by providing intelligent suggestions, improving search results, and offering in-browser assistance. Visit the [Chrome AI Innovations page](https://www.google.com/chrome/ai-innovations/) for more information.
|
||||
|
||||
### Step 1: Understanding Chrome's preferences JSON file
|
||||
|
||||
|
||||
@@ -0,0 +1,106 @@
|
||||
# Fleet 4.59.0 | Install apps during new Mac boot, connect end users to Wi-Fi, custom URL for Apple MDM
|
||||
|
||||
|
||||
|
||||
Fleet 4.59.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.59.0) or continue reading to get the highlights.
|
||||
For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs.
|
||||
|
||||
## Highlights
|
||||
- Install apps and run scripts during new Mac boot
|
||||
- Automatically connect end users to Wi-Fi
|
||||
- Custom URL for Apple MDM
|
||||
|
||||
### Install apps during new Mac boot
|
||||
|
||||
Using Fleet, you can now block a user’s screen while software installs or scripts run during macOS Setup Assistant. This prevents users from accessing the desktop before required configurations are enforced, improving security and guaranteeing that all workstations meet organizational standards before use. Learn more in the guide [here](https://fleetdm.com/guides/macos-setup-experience).
|
||||
|
||||
### Automatically connect end users to Wi-Fi
|
||||
|
||||
With Fleet, you can now install a SCEP certificate from NDES on all macOS hosts as part of the Wi-Fi/Ethernet configuration profile. This ensures seamless and secure network access for end users. Learn more in the guide [here](https://fleetdm.com/guides/ndes-scep-proxy).
|
||||
|
||||
### Custom URL for Apple MDM
|
||||
|
||||
Fleet now provides the ability to set an alternative MDM URL to help organizations differentiate MDM traffic from other Fleet traffic, allowing the application of network rules specific to MDM communications. Learn more in the guide [here](https://fleetdm.com/guides/alternate-apple-mdm-url).
|
||||
|
||||
## Changes
|
||||
|
||||
### Endpoint operations
|
||||
- Updated OpenTelemetry libraries to latest versions. This includes the following changes when OpenTelemetry is enabled:
|
||||
- MySQL spans outside of HTTPS transactions are now logged.
|
||||
- Renamed MySQL spans to include the query, for easier tracking/debugging.
|
||||
- Added capability for fleetd to report vital errors to Fleet server, such as when Fleet Desktop is unable to start.
|
||||
|
||||
### Device management (MDM)
|
||||
- Added UI for adding a setup experience script.
|
||||
- Added UI for the install software setup experience.
|
||||
- Added software experience software title selection API.
|
||||
- Added database migrations to support Setup Experience.
|
||||
- Added support to `fleetctl gitops` to specify a setup experience script to run and software to install, for a team or no team.
|
||||
- Added an Orbit endpoint (`POST /orbit/setup_experience/status`) for checking the status of a macOS host's setup experience steps.
|
||||
- Added service to track install status.
|
||||
- Added ability to connect a SCEP NDES proxy.
|
||||
- Added SCEP proxy for Windows NDES (Network Device Enrollment Service) AD CS server, which allows devices to request certificates.
|
||||
- Added error message on the My Device page when MDM is off for the host.
|
||||
- Added a config field to the UI for custom MDM URLs.
|
||||
- Added integration to queue setup experience software installation on automatic enrollment.
|
||||
- Added a validation to prevent removing a software package or a VPP app from a team if that software is selected to be installed during the setup experience.
|
||||
- Updated user permissions to allow gitops users to run MDM commands.
|
||||
- Updated to remove a pending MDM device if it was deleted from current ABM.
|
||||
- Updated to ensure details for a software installation run are available and accurate even after the corresponding installer has been edited or deleted.
|
||||
- **NOTE:** The database migration included with this update backfills installer data into installation details based on the currently uploaded installer. If you want to backfill data from activities (which will be more comprehensive and accurate than the migration default, but may take awhile as the entire activities table will be scanned), run this database query _after_ running database migrations:
|
||||
```sql
|
||||
UPDATE host_software_installs i
|
||||
JOIN activities a ON a.activity_type = 'installed_software'
|
||||
AND i.execution_id = a.details->>"$.install_uuid"
|
||||
SET i.software_title_name = COALESCE(a.details->>"$.software_title", i.software_title_name),
|
||||
i.installer_filename = COALESCE(a.details->>"$.software_package", i.installer_filename),
|
||||
i.updated_at = i.updated_at
|
||||
```
|
||||
- The above query is optional, and is unnecessary if no software installers have been edited.
|
||||
|
||||
### Vulnerability management
|
||||
- Added filtering Software OS view to show only OSes from a particular platform (Windows, macOS, Linux, etc.)
|
||||
- Fixed issue where the vulnerabilities cron failed to complete due to a large temporary table creation when calculating host issue counts.
|
||||
- Fixed Debian python package false positive vulnerabilities by removing duplicate entries for Debian python packages installed by dpkg and renaming remaining pip installed packages to match OVAL definitions.
|
||||
|
||||
### Bug fixes and improvements
|
||||
- Fixed the ADE enrollment release device processing for hosts running an old fleetd version.
|
||||
- Fixed an issue with the BYOD enrollment page where it sometimes would show a 404 page.
|
||||
- Fixed issue where macOS and Linux scripts failed to timeout on long running commands.
|
||||
- Fixed bug in ABM renewal process that caused upload of new token to fail.
|
||||
- Fixed blank install status when retrieving install details from the activity feed when the installer package has been updated or the software has since been removed from the host.
|
||||
- Fixed the svg icon for Edge.
|
||||
- Fixed frontend error when trying to view install details for an install with a blank status.
|
||||
- Fixed loading state for the profile status aggregate UI.
|
||||
- Fixed incorrect character set header on manual Mac enrollment config download.
|
||||
- Fixed `fleetctl gitops` to support VPP apps, along with setting the VPP apps to install during the setup experience.
|
||||
- Fixed bug where `PATCH /api/latest/fleet/config` was incorrectly clearing VPP token<->team associations.
|
||||
- Fixed issue when trying to download the manual enrollment profile when device token is expired. We now show an error for this case.
|
||||
- Fixed a bug where DDM declarations would remaing "pending" forever if they were deleted from Fleet before being sent to hosts.
|
||||
- Fixed a bug where policy failures of a host were not being cleared in the host details page after configuring the host to not run any policies.
|
||||
- Fixed iOS and iPadOS device release during the ADE enrollment flow.
|
||||
- Ignored `--delete-other-teams` flag in `fleetctl gitops` command for non-Premium license users.
|
||||
- Switched Nudge deadline time for OS upgrades on macOS pre-14 hosts from 04:00 UTC to 20:00 UTC.
|
||||
- Added a more descriptive error message when install or uninstall details do not exist for an activity.
|
||||
- Updated to allow FLEET_REDIS_ADDRESS to include a `redis://` prefix. Allowed formats are: `redis://host:port` or `host:port`.
|
||||
- Documented that Microsoft enrollments have less fields filled in the `mdm_enrolled` activity due to how this MDM enrollment flow is implemented.
|
||||
- Updated UI to make entire rows of the Disk encryption table clickable.
|
||||
- Updated software install activities from policy automations to be authored by "Fleet", store policy ID and name on each activity.
|
||||
- Updated tooltip for bootstrap package and VPP app statuses in UI.
|
||||
- Added created_at/updated_at timestamps on user create endpoint.
|
||||
- Updated UI notifications so that clicking in the horizontal dimension of a flash message, outside of the message itself, and always hide flash messages when changing routes.
|
||||
- Filtered out VPP apps on non-MDM enrolled devices.
|
||||
- Explicitly set line heights on "add profile" messages so they are consistent cross-browser.
|
||||
- Deprecated the worker-based job to release macOS devices automatically after the setup experience, replace it with the fleetd-specific "/status" endpoint that is polled by the Setup Experience dialog controlled by Fleet during the setup flow.
|
||||
- Improved UI feedback when user attempts and fails to reset password.
|
||||
|
||||
## Ready to upgrade?
|
||||
|
||||
Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.58.0.
|
||||
|
||||
<meta name="category" value="releases">
|
||||
<meta name="authorFullName" value="Noah Talerman">
|
||||
<meta name="authorGitHubUsername" value="noahtalerman">
|
||||
<meta name="publishedOn" value="2024-11-12">
|
||||
<meta name="articleTitle" value="Fleet 4.59.0 | Install apps during new Mac boot, connect end users to Wi-Fi">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.59.0-1600x900@2x.png">
|
||||
@@ -85,7 +85,7 @@ To log in to your Fleet instance, run the following commands:
|
||||
1. Set the Fleet instance address
|
||||
|
||||
```sh
|
||||
> fleetctl config set --address https://fleet.example.com
|
||||
> fleetctl config set --address 'https://fleet.example.com'
|
||||
[+] Set the address config key to "https://fleet.example.com" in the "default" context
|
||||
```
|
||||
|
||||
@@ -128,12 +128,12 @@ An API-only user does not have access to the Fleet UI. Instead, it's only purpos
|
||||
|
||||
### Create API-only user
|
||||
|
||||
Before creating the API-only user, log in to fleetctl as an admin. See [authentication](https://#authentication) above for details.
|
||||
Before creating the API-only user, log in to fleetctl as an admin. See [authentication](#authentication) above for details.
|
||||
|
||||
To create your new API-only user, use `fleetctl user create`:
|
||||
|
||||
```sh
|
||||
fleetctl user create --name "API User" --email api@example.com --password temp@pass123 --api-only
|
||||
fleetctl user create --name 'API User' --email 'api@example.com' --password 'temp@pass123' --api-only
|
||||
```
|
||||
|
||||
You'll then receive an API token:
|
||||
@@ -149,13 +149,13 @@ Success! The API token for your new user is: <TOKEN>
|
||||
An API-only user can be given the same permissions as a regular user. The default access level is **Observer**. You can specify what level of access the new user should have using the `--global-role` flag:
|
||||
|
||||
```sh
|
||||
fleetctl user create --name "API User" --email api@example.com --password temp@pass123 --api-only --global-role admin
|
||||
fleetctl user create --name 'API User' --email 'api@example.com' --password 'temp@pass123' --api-only --global-role 'admin'
|
||||
```
|
||||
|
||||
On Fleet Premium, use the `--team <team_id>:<role>` to create an API-only user on a team:
|
||||
|
||||
```sh
|
||||
fleetctl user create --name "API User" --email api@example.com --password temp@pass123 --api-only --team 4: gitops
|
||||
fleetctl user create --name 'API User' --email 'api@example.com' --password 'temp@pass123' --api-only --team 4: gitops
|
||||
```
|
||||
|
||||
#### Changing permissions
|
||||
@@ -168,7 +168,7 @@ To change the role of a current user, log into the Fleet UI as an admin and navi
|
||||
To use fleetctl with your regular user account but occasionally use your API-only user for specific cases, you can set up your fleetctl config with a new `context` to hold the credentials of your API-only user:
|
||||
|
||||
```sh
|
||||
fleetctl config set --address https://dogfood.fleetdm.com --context api
|
||||
fleetctl config set --address 'https://dogfood.fleetdm.com' --context api
|
||||
[+] Context "api" not found, creating it with default values
|
||||
[+] Set the address config key to "https://dogfood.fleetdm.com" in the "api" context
|
||||
```
|
||||
@@ -176,7 +176,7 @@ fleetctl config set --address https://dogfood.fleetdm.com --context api
|
||||
From there on, you can use the `--context api` flag whenever you need to use the API-only user's identity, rather than logging in and out to switch accounts:
|
||||
|
||||
```sh
|
||||
fleetctl login --context admin
|
||||
fleetctl login --context 'admin'
|
||||
Log in using the admin Fleet credentials.
|
||||
Email: admin@example.com
|
||||
Password:
|
||||
|
||||
@@ -0,0 +1,117 @@
|
||||
# Fleetd authentication
|
||||
|
||||
Fleetd is the agent that runs on the endpoints and communicates with Fleet to periodically send device data and to execute management tasks.
|
||||
|
||||
Fleetd is supported on macOS x86_64 and Apple Silicon (using universal binaries), Windows and Linux (x86_64), and Linux arm64.
|
||||
|
||||
The fleetd agent contains three components:
|
||||
- [orbit](https://github.com/fleetdm/fleet/tree/main/orbit): This is the main daemon/service that starts all components on the endpoint.
|
||||
- [osquery](https://github.com/osquery/osquery): Provides the endpoint with SQL-powered instrumentation, monitoring, and analytics.
|
||||
- [Fleet desktop](https://fleetdm.com/guides/fleet-desktop#basic-article): This is the tray icon app to interface with users of the (Desktop) endpoint. This component can be disabled/missing on some endpoints (e.g. for servers without GUI).
|
||||
|
||||
This document aims to explain how all three components authenticate to Fleet servers.
|
||||
|
||||
## TLS
|
||||
|
||||
All fleetd components communicate to Fleet using HTTPS.
|
||||
|
||||
> Fleetd also supports mTLS, more on this below.
|
||||
|
||||
## Enrollment to Fleet
|
||||
|
||||
Endpoints use "enroll secrets" to authenticate to Fleet during the enrollment process.
|
||||
- On Fleet free you can define multiple enroll secrets.
|
||||
- On Fleet premium you can define multiple enroll secrets globally ("No team") and multiple enroll secrets for each team. Fleet will automatically join the device to the team that corresponds to the enroll secret.
|
||||
|
||||
Enroll secrets are generated randomly by Fleet (if not provided) or can be defined by the admin.
|
||||
The enroll secrets randomly generated by Fleet are 24 bytes long, base64 encoded.
|
||||
|
||||
Enroll secrets are only used for authentication during the enrollment process. Once the endpoint is enrolled to Fleet, the device will use "node keys" for authentication, more on this below.
|
||||
|
||||
### Fleetd package generation
|
||||
|
||||
When generating a fleetd package using `fleetctl`, the admin provides an "enroll secret":
|
||||
```sh
|
||||
fleetctl package --type=pkg \
|
||||
--fleet-desktop \
|
||||
--fleet-url=... \
|
||||
--enroll-secret=...
|
||||
```
|
||||
|
||||
The "Fleet URL" and "Enroll secret" are embedded into the generated package.
|
||||
|
||||
To learn more about `fleetctl package` to generate fleetd packages see [Enroll hosts](https://fleetdm.com/guides/enroll-hosts#basic-article).
|
||||
|
||||
## Enrollment process in fleetd
|
||||
|
||||
When installing a fleetd package the `orbit` binary is executed.
|
||||
`orbit` runs as `root` on macOS/Linux and as a `SYSTEM` service on Windows.
|
||||
|
||||
During installation, the enroll secret is placed as a text file only accessible to `root`/`SYSTEM`.
|
||||
When `orbit` starts for the first time, it will attempt to enroll to Fleet using the enroll secret.
|
||||
If the enroll secret is valid, then the Fleet server will generate a random "orbit node key" and return it to `orbit`.
|
||||
The `orbit` process will store such "node key" on a text file only accessible to `root`/`SYSTEM`.
|
||||
After enrollment, the "orbit node key" will be used to authenticate orbit related requests to Fleet.
|
||||
|
||||
The `orbit` process will start the `osquery` daemon (that also runs as `root`/`SYSTEM`).
|
||||
The `osquery` daemon will enroll to Fleet using the same enroll secret used by `orbit`.
|
||||
Similarly, if the enroll secret is valid, then the Fleet server will generate a random "osquery node key" and return it to `osquery`.
|
||||
`osquery` will store such "node key" on its internal RocksDB database file, only accessible to `root`/`SYSTEM`.
|
||||
After enrollment, the "osquery node key" will be used to authenticate osquery related requests to Fleet.
|
||||
|
||||
The Fleet server uses the "Hardware UUID" of the endpoint to tie the `orbit` and `osquery` processes (to be identified as one "host" in Fleet). Users can alternatively use `--host-identifier=instance` flag in fleetd to support systems that have duplicate hardware UUIDs like cloned VMs.
|
||||
|
||||
On macOS and Windows, once the `orbit` and `osquery` enrollment process is completes, the enroll secret is removed from the file system and stored in the Apple keychain and Windows credentials manager respectively.
|
||||
We currently don't support moving the enroll secret to a secret storage on Linux. Thus after enrollment, the enroll secret will remain in `/etc/default/orbit` (file only accessible to `root`).
|
||||
|
||||
After starting `osquery`, the `orbit` process will also start the `Fleet desktop` tray application.
|
||||
Such application runs as the Desktop GUI user (it does not run as `root`/`SYSTEM`).
|
||||
Before starting `Fleet desktop`, `orbit` will set a random "Fleet desktop token" and send it to Fleet server via the `orbit` authenticated communication channel.
|
||||
The `orbit` process stores such token on a file accessible to the GUI user and `Fleet desktop` will use the token to authenticate requests to Fleet. When the user clicks on "My device" on the tray icon menu, `Fleet desktop` will open the default browser on a URL that contains the "Fleet desktop token" on its URL path. For this very reason, the "Fleet desktop token" is rotated every hour (by the `orbit` process).
|
||||
|
||||
Here's a diagram to summarize fleetd communication channels after enrollment (more on "tuf.fleetctl.com" below):
|
||||
```mermaid
|
||||
graph LR;
|
||||
|
||||
tuf["tuf.fleetctl.com"];
|
||||
|
||||
subgraph fleetd;
|
||||
orbit;
|
||||
osquery;
|
||||
desktop[Fleet desktop];
|
||||
end;
|
||||
|
||||
server[Fleet];
|
||||
|
||||
orbit -- HTTPS w/ orbit node key --> server;
|
||||
osquery -- HTTPS w/ osquery node key --> server;
|
||||
desktop -- HTTPS w/ Fleet desktop token --> server;
|
||||
|
||||
orbit -- HTTPS + The Update Framework --> tuf;
|
||||
```
|
||||
|
||||
## Fleetd auto updates
|
||||
|
||||
`orbit` uses the [The Update Framework](https://theupdateframework.io/) to perform secure auto-updates.
|
||||
By default, `orbit` has public root keys embedded in it to only trust updates published and signed in Fleet's TUF repository https://tuf.fleetctl.com (via HTTPS).
|
||||
|
||||
fleetd can also be customized to use a user-controlled "TUF" server.
|
||||
More information can be found on orbit's Github [README](https://github.com/fleetdm/fleet/tree/main/orbit).
|
||||
|
||||
## TLS with custom CA certificates
|
||||
|
||||
By default, fleetd uses the OS root CA certificate store and also embeds the [Mozilla CA certificate store](https://curl.se/docs/caextract.html).
|
||||
fleetd also supports setting custom root CA certificates that will be used to communicate to Fleet and the TUF server.
|
||||
More information can be found on the [Certificates in fleetd]((https://fleetdm.com/guides/certificates-in-fleetd#basic-article) guide.
|
||||
|
||||
## mTLS
|
||||
|
||||
> The Fleet server does not provide support for mTLS.
|
||||
> Users that want to use mTLS on their endpoints must setup a load balancer or TLS terminator like AWS's ELB or nginx that support mTLS.
|
||||
|
||||
The fleetd agent does provide basic support for mTLS. See the [Using mTLS](https://fleetdm.com/guides/enroll-hosts#using-mtls) guide.
|
||||
|
||||
## ADE and Autopilot MDM flow
|
||||
|
||||
When your macOS/Windows endpoints enroll to Fleet via MDM protocols, Fleet will send a command to automatically install fleetd on the enrolled endpoints.
|
||||
Fleet will also send a configuration profile to automatically configure the "enroll secret" and "Fleet URL" so that the enrollment process documented above can take place.
|
||||
@@ -0,0 +1,89 @@
|
||||
# How to use policies for patch management in Fleet
|
||||
|
||||
|
||||
|
||||
Policies in Fleet enable IT admins to query devices and get quick yes or no answers about the status of their endpoints. Powered by the flexibility of osquery, the policies engine has become an invaluable part of the IT toolkit, simplifying the management of devices at scale.
|
||||
|
||||
Initially, Fleet’s policies allowed for automated responses, like firing a webhook on a policy failure or creating a ticket in your ITSM system. While effective, these actions were limited by the capabilities of your existing tools to process and act on these notifications.
|
||||
|
||||
## Enter patch management
|
||||
|
||||
Fleet’s policy capabilities have evolved beyond notification-based responses. With the release of Fleet v4.57, the policies engine now supports a game-changing feature: automated software installation on a policy failure. This addition transforms the policies engine into a dynamic tool for streamlined patch management.
|
||||
|
||||
In this article, we’ll explore how to leverage this new feature to automate patching across your environment. This will free up valuable IT resources to focus on high-impact tasks while enhancing end-user support.
|
||||
|
||||
## Why it matters
|
||||
|
||||
Around 60% of data breaches in 2023 involved vulnerabilities for which patches were available but not applied, underscoring the impact of delayed patch management.1
|
||||
|
||||
Regular updates often include bug fixes that improve stability and enhance user experience, allowing employees to work without disruptions. These updates also make sure compatibility with other applications, preventing integration issues that could impact workflows.
|
||||
|
||||
Additionally, updated software often includes new features that can ultimately help teams work more efficiently and effectively.
|
||||
|
||||
## Let’s get started
|
||||
|
||||
In this article, we will be using Google Chrome to demonstrate the functionality, and I already have the latest version’s .pkg downloaded locally.
|
||||
|
||||
Select the team you want the policy to run on. Navigate to **Software > Add Software**. Here you can use one of Fleet’s maintained apps, add from VPP or Custom Package. We will use Custom Package in this example and upload the Google Chrome.pkg mentioned previously. After upload, there are a couple of options for pre/post-install queries and scripts - you can read more about those options [here](https://fleetdm.com/guides/deploy-software-packages).
|
||||
|
||||
Navigate to **Policies**, select the team you want the policy to run in.
|
||||
|
||||
Assume we want to bring all devices in this team to the latest version of Chrome we uploaded to Fleet, which as of writing this, is 130.0.6723.70.
|
||||
|
||||
Your policy query would look something like this:
|
||||
|
||||
```sh
|
||||
SELECT 1 FROM apps WHERE bundle_identifier = 'com.google.Chrome' AND bundle_short_version < '130.0.6723.70'
|
||||
```
|
||||
|
||||
This means any evaluation of this policy, where the version is less than 130.0.6723.70, will result in a failure and thus kick off the automation.
|
||||
|
||||
Save and give it an intuitive name, we recommend something like:
|
||||
|
||||
_macOS - Update Google Chrome to Latest_
|
||||
|
||||
With the policy set, we can tie in the automation. Back on the main policy page, select **Manage automations > Install software**.
|
||||
|
||||
The module will show the policies available for that team. Check the box to turn on automation, and from the dropdown, select the software that will be installed on the failure. The dropdown will show all available software in that team - plus its supported OS and version.
|
||||
|
||||
And that’s it! Policies are evaluated across all online hosts every hour, or when a device is refetched manually. Any machine that fails this policy will install the Chrome version that was set in the policy.
|
||||
|
||||
## What else can we do?
|
||||
|
||||
This functionality unlocks many use cases for an IT admin to help manage their fleet. Another use case for this feature is to support a zero-touch deployment of devices and ensure that critical business and productivity software is installed from the first boot.
|
||||
|
||||
A simple query like such:
|
||||
|
||||
```sh
|
||||
SELECT 1 FROM apps WHERE bundle_identifier = ‘com.tinyspeck.slackmacgap’
|
||||
```
|
||||
|
||||
would deploy Slack to your endpoints the moment it comes out of the box, ensuring your users are ready to hit the ground running from day 1.
|
||||
|
||||
## Via the API
|
||||
|
||||
Fleet Premium customers can leverage the REST API to upload software packages and set policy automations using the software_title_id field.
|
||||
|
||||
Info about the [Upload software](https://fleetdm.com/docs/rest-api/rest-api#add-package) and [Team policy](https://fleetdm.com/docs/rest-api/rest-api#add-team-policy) API docs are available in the documentation.
|
||||
|
||||
## Curious about GitOps?
|
||||
|
||||
Fleet's flexible API and support for a GitOps life cycle means this entire process can be stored and managed in code, further unlocking audibility, collaboration, and security. Know who made changes, when, and why—without being tied to vendor-specific methods.
|
||||
|
||||
Nest an **install_software** block in the policy you want to automate and ensure the path to the software matches the same path referenced in the team configuration file under the software block. Check out the [GitOps reference documentation](https://fleetdm.com/docs/configuration/yaml-files#policies) for more details.
|
||||
|
||||
## Want to know more?
|
||||
|
||||
Reach out for more information and a demo, or explore Fleet's detailed [documentation](https://fleetdm.com/docs/get-started/why-fleet).
|
||||
|
||||
Sources
|
||||
|
||||
1. https://www.automox.com/blog/bad-cyber-hygiene-breaches-tied-to-unpatched-vulnerabilities
|
||||
|
||||
<meta name="articleTitle" value="How to use policies for patch management in Fleet">
|
||||
<meta name="authorFullName" value="Harrison Ravazzolo">
|
||||
<meta name="authorGitHubUsername" value="harrisonravazzolo">
|
||||
<meta name="category" value="guides">
|
||||
<meta name="publishedOn" value="2024-11-07">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/sysadmin-diaries-1600x900@2x.png">
|
||||
<meta name="description" value="This guide explores automating patching across your environment.">
|
||||
@@ -0,0 +1,148 @@
|
||||
# Connect end users to Wi-Fi with Simple Certificate Enrollment Protocol (SCEP)
|
||||
|
||||
Fleet [v4.59.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.59.0) introduces support for helping your end users connect to Wi-Fi by adding your SCEP server. Fleet currently supports Microsoft's Network Device Enrollment Service (NDES) as a SCEP server.
|
||||
|
||||
This guide will walk you through configuring and using NDES with Fleet acting as a SCEP proxy.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
* Fleet Premium with admin permissions.
|
||||
* Fleet [v4.59.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.59.0) or greater.
|
||||
* Apple MDM enabled.
|
||||
* A Windows Server with AD CS (Active Directory Certificate Services) and NDES installed and configured, including the certificate templates for the certificates you want to enroll for.
|
||||
* The default password cache size for NDES is five passwords. Increase this value to account for the number of devices you expect to enroll simultaneously, including devices that may be offline and need to enroll when they come online.
|
||||
|
||||
## Step-by-step instructions
|
||||
|
||||
### 1. Add SCEP in Fleet
|
||||
|
||||
Go to the Fleet web interface, navigate to `Settings`, go to the `Integrations` tab, and click `Mobile device management (MDM)`. Scroll down to `Simple Certificate Enrollment Protocol (SCEP)` and click `Add SCEP`.
|
||||
|
||||
|
||||
|
||||
### 2. Configure NDES SCEP settings
|
||||
|
||||
You will need to provide the SCEP URL that accepts the SCEP protocol. You'll also need to give the admin URL with the associated username and password to get the one-time challenge passwords for SCEP enrollment.
|
||||
|
||||
|
||||
|
||||
Note:
|
||||
* The example paths end with `/certsrv/mscep/mscep.dll` and `/certsrv/mscep_admin/` respectively. These path suffixes are the default paths for NDES on Windows Server 2022 and should only be changed if you have customized the paths on your server.
|
||||
* When saving the configuration, Fleet will attempt to connect to the SCEP server to verify the connection, including retrieving a one-time challenge password. This validation also occurs when adding a new SCEP configuration or updating an existing one via API and GitOps, including dry runs. Please ensure the NDES password cache size is large enough to accommodate this validation.
|
||||
|
||||
### 3. Create a SCEP configuration profile
|
||||
|
||||
Create a configuration profile in Fleet that includes the SCEP payload. In the profile, you will need to set `$FLEET_VAR_NDES_SCEP_CHALLENGE` as the `Challenge` and `$FLEET_VAR_NDES_SCEP_PROXY_URL` as the `URL`.
|
||||
|
||||
Adjust the `Subject` values according to your organization's needs. You may set `$FLEET_VAR_HOST_END_USER_EMAIL_IDP` if the hosts were enrolled into Fleet MDM using an IdP (Identity Provider). You can also use any of the [Apple profile variables](https://support.apple.com/en-my/guide/deployment/dep04666af94/1/web/1.0) to uniquely identify your device.
|
||||
|
||||
Example profile:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<dict>
|
||||
<key>Challenge</key>
|
||||
<string>$FLEET_VAR_NDES_SCEP_CHALLENGE</string>
|
||||
<key>Key Type</key>
|
||||
<string>RSA</string>
|
||||
<key>Key Usage</key>
|
||||
<integer>5</integer>
|
||||
<key>Keysize</key>
|
||||
<integer>2048</integer>
|
||||
<key>Subject</key>
|
||||
<array>
|
||||
<array>
|
||||
<array>
|
||||
<string>CN</string>
|
||||
<string>%SerialNumber% WIFI $FLEET_VAR_HOST_END_USER_EMAIL_IDP</string>
|
||||
</array>
|
||||
</array>
|
||||
<array>
|
||||
<array>
|
||||
<string>OU</string>
|
||||
<string>FLEET DEVICE MANAGEMENT</string>
|
||||
</array>
|
||||
</array>
|
||||
</array>
|
||||
<key>URL</key>
|
||||
<string>$FLEET_VAR_NDES_SCEP_PROXY_URL</string>
|
||||
</dict>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>WIFI SCEP</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.apple.security.scep.9DCC35A5-72F9-42B7-9A98-7AD9A9CCA3AC</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.security.scep</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>9DCC35A5-72F9-42B7-9A98-7AD9A9CCA3AC</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>SCEP proxy cert</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>Fleet.WiFi</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>4CD1BD65-1D2C-4E9E-9E18-9BCD400CDEDC</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
Upload the profile to Fleet in **Controls** > **OS Settings** > **Custom settings**.
|
||||
|
||||
When sending the profile to hosts, Fleet will replace the `$FLEET_VAR_NDES_SCEP_CHALLENGE`, `$FLEET_VAR_NDES_SCEP_PROXY_URL`, and `$FLEET_VAR_HOST_END_USER_EMAIL_IDP` variables with the proper values. Any errors will appear as a `Failed` status in the host's `OS settings`.
|
||||
|
||||
|
||||
|
||||
> Note: If the uploaded profile is signed, Fleet will replace the variables and invalidate the signature.
|
||||
|
||||
## How does it work?
|
||||
|
||||
The SCEP proxy in Fleet acts as a middleman between the device and the NDES server. When a device requests a certificate, the SCEP proxy forwards the request to the NDES server, retrieves the certificate, and sends it back to the device. In addition, the SCEP proxy:
|
||||
|
||||
- Retrieves the one-time challenge password from the NDES server.
|
||||
The NDES admin password is encrypted in Fleet's database by the [server private key](https://fleetdm.com/docs/configuration/fleet-server-configuration#server-private-key). It cannot be retrieved via the API or the web interface.
|
||||
Retrieving passwords for many devices may cause a bottleneck. To avoid long wait times, we recommend a gradual rollout of SCEP profiles.
|
||||
- Restarting the NDES service will clear the password cache and may cause outstanding SCEP profiles to fail.
|
||||
- Resend the profile to the device if the one-time challenge password has expired.
|
||||
- If the device has been offline and the one-time challenge password is more than 60 minutes old, the SCEP proxy assumes the password has expired and will resend the profile to the device with a new one-time challenge password.
|
||||
|
||||
The issued certificate will appear in the System Keychain on macOS. During the profile installation, the OS generates several temporary certificates needed for the SCEP protocol. These certificates may be briefly visible in the Keychain Access app on macOS. The CA certificate must also be installed and marked as trusted on the device for the issued certificate to appear as trusted. The IT admin can send the CA certificate in a separate [CertificateRoot profile](https://developer.apple.com/documentation/devicemanagement/certificateroot?language=objc).
|
||||
|
||||
## Use case: connecting to a corporate WiFi network
|
||||
|
||||
A common use case for SCEP is connecting devices to a corporate WiFi network. This involves creating a profile with SCEP and WiFi payloads and linking them together. Here's how you can use Fleet's SCEP proxy to achieve this:
|
||||
|
||||
1. Send the root CA certificate to the device using a [CertificateRoot profile](https://developer.apple.com/documentation/devicemanagement/certificateroot?language=objc).
|
||||
2. Create a profile with a SCEP payload and a [WiFi payload](https://developer.apple.com/documentation/devicemanagement/wifi?language=objc), and send it to the device.
|
||||
- The `PayloadCertificateUUID` in the WiFi payload should reference the `PayloadUUID` of the SCEP payload.
|
||||
|
||||
|
||||
|
||||
## Assumptions and limitations
|
||||
* NDES SCEP proxy is currently supported for macOS devices via Apple config profiles. Support for DDM (Declarative Device Management) is coming soon, as is support for iOS, iPadOS, Windows, and Linux.
|
||||
* Certificate renewal is coming soon.
|
||||
* Fleet server assumes a one-time challenge password expiration time of 60 minutes.
|
||||
|
||||
## Conclusion
|
||||
|
||||
Fleet's NDES SCEP proxy feature allows your devices to receive certificates from your certificate authority's NDES service. This feature simplifies managing certificates on your devices and enables a secure and efficient way to connect them to your corporate network.
|
||||
|
||||
<meta name="articleTitle" value="Connect end users to Wi-Fi with Simple Certificate Enrollment Protocol (SCEP)">
|
||||
<meta name="authorFullName" value="Victor Lyuboslavsky">
|
||||
<meta name="authorGitHubUsername" value="getvictor">
|
||||
<meta name="category" value="guides">
|
||||
<meta name="publishedOn" value="2024-10-30">
|
||||
<meta name="description" value="Learn how to help your end users connect to Wi-Fi by adding your SCEP server">
|
||||
@@ -20,11 +20,11 @@ Install [Fleet's Puppet module](https://forge.puppet.com/modules/fleetdm/fleetdm
|
||||
|
||||
### Step 2: configure Puppet to talk to Fleet using Heira
|
||||
|
||||
1. In Fleet, create an API-only user with the GitOps role. Instructions for creating an API-only user are [here](./fleetctl-CLI.md#create-an-api-only-user).
|
||||
1. In Fleet, create an API-only user with the GitOps role. Instructions for creating an API-only user are
|
||||
[here](https://fleetdm.com/guides/fleetctl#create-api-only-user).
|
||||
|
||||
2. Get the API token for your new API-only user. Learn how [here](./fleetctl-CLI.md#get-the-api-token-of-an-api-only-user).
|
||||
|
||||
3. Set `fleetdm::host` and `fleetdm::token` values to your Fleet server's URL and the API token respectively. Here's an example of the Hiera YAML:
|
||||
2. Set the `fleetdm::token` and `fleetdm::host` values to the API token of your API-only user and
|
||||
your Fleet server's URL, respectively. Here's an example of the Hiera YAML:
|
||||
|
||||
```yaml
|
||||
fleetdm::host: https://fleet.example.com
|
||||
@@ -99,11 +99,11 @@ Set the `ensure` parameter to `absent` to create teams that exclude specific pro
|
||||
|
||||
For more examples check out the `examples/` folder in Fleet's GitHub repository [here](https://github.com/fleetdm/fleet/tree/main/ee/tools/puppet/fleetdm/examples).
|
||||
|
||||
> Note that all teams created by Puppet inherit the bootstrap package, macOS Setup Assistant settings, and end user authentication settings from "No team." Learn more about these [here](./mdm-setup.md). In addition all teams automatically enable disk encryption. Learn more about disk encryption [here](./MDM-disk-encryption.md).
|
||||
> Note that all teams created by Puppet inherit the bootstrap package, macOS Setup Assistant settings, and end user authentication settings from "No team." Learn more about these [here](https://fleetdm.com/guides/macos-setup-experience). In addition all teams automatically enable disk encryption. Learn more about disk encryption [here](https://fleetdm.com/guides/enforce-disk-encryption).
|
||||
|
||||
## Release host
|
||||
|
||||
If you set `await_device_configured` to `true` in your [macOS Setup Assistant settings](./mdm-setup.md#macos-setup-assistant), you can use the `fleetdm::release_device` function to release the host from the Setup Assistant.
|
||||
If you set `enable_release_device_manually` to `true` in your [macOS setup experience](https://fleetdm.com/docs/rest-api/rest-api#configure-setup-experience), you can use the `fleetdm::release_device` function to release the host from the Setup Assistant.
|
||||
|
||||
Here's what your Puppet code, with error handling, will look like:
|
||||
|
||||
@@ -149,7 +149,7 @@ if $err != '' {
|
||||
}
|
||||
```
|
||||
|
||||
The above example includes the XML payload for the `EnableRemoteDesktop` MDM command. Learn more about creating the payload for other custom commands [here](./MDM-commands.md).
|
||||
The above example includes the XML payload for the `EnableRemoteDesktop` MDM command. Learn more about creating the payload for other custom commands [here](https://fleetdm.com/guides/mdm-commands).
|
||||
|
||||
<meta name="category" value="guides">
|
||||
<meta name="authorGitHubUsername" value="noahtalerman">
|
||||
|
||||
@@ -93,7 +93,7 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines.
|
||||
| Edit [MDM settings](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ |
|
||||
| Edit [MDM settings for teams](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ |
|
||||
| View all [MDM settings](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ |
|
||||
| Edit setup experience (end user authentication, bootstrap package, Setup Assistant)\* | | | ✅ | ✅ | ✅ |
|
||||
| Edit [macOS setup experience]([https://fleetdm.com/docs/](https://fleetdm.com/guides/macos-setup-experience#basic-article))\* | | | ✅ | ✅ | ✅ |
|
||||
| Edit end user license agreement (EULA)\* | | | | ✅ | |
|
||||
| Run scripts on hosts | | | ✅ | ✅ | |
|
||||
| View saved scripts\* | ✅ | ✅ | ✅ | ✅ | |
|
||||
@@ -163,11 +163,7 @@ Users with access to multiple teams can be assigned different roles for each tea
|
||||
| Execute MDM commands on macOS and Windows hosts* | | | ✅ | ✅ | |
|
||||
| View results of MDM commands executed on macOS and Windows hosts* | ✅ | ✅ | ✅ | ✅ | |
|
||||
| Edit [team MDM settings](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ |
|
||||
| View/download MDM macOS setup assistant | | | ✅ | ✅ | |
|
||||
| Edit/upload MDM macOS setup assistant | | | ✅ | ✅ | ✅ |
|
||||
| View metadata of MDM macOS bootstrap packages | | | ✅ | ✅ | |
|
||||
| Edit/upload MDM macOS bootstrap packages | | | ✅ | ✅ | ✅ |
|
||||
| Enable/disable MDM macOS setup end user authentication | | | ✅ | ✅ | ✅ |
|
||||
| Edit [macOS setup experience]([https://fleetdm.com/docs/](https://fleetdm.com/guides/macos-setup-experience#basic-article))\* | | | ✅ | ✅ | ✅ |
|
||||
| Run scripts on hosts | | | ✅ | ✅ | |
|
||||
| View saved scripts | ✅ | ✅ | ✅ | ✅ | |
|
||||
| Edit/upload saved scripts | | | ✅ | ✅ | |
|
||||
|
||||
@@ -57,6 +57,12 @@ If you would like to use Fleet's Windows MDM features, the following endpoints n
|
||||
- `/api/mdm/microsoft/auth`: If you use automatic enrollment, authenticates end users during out-of-the-box Windows setup.
|
||||
- See the [section 3.2 on the MS-MDE2 specification](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mde2/27ed8c2c-0140-41ce-b2fa-c3d1a793ab4a) for more details.
|
||||
|
||||
### SCEP proxy
|
||||
|
||||
If you would like to use Fleet as a SCEP proxy, the following endpoint needs to be exposed:
|
||||
|
||||
- `/mdm/scep/proxy/*`: Allows hosts to obtain a SCEP certificate from a configured SCEP server.
|
||||
|
||||
## Advanced
|
||||
|
||||
The `/api/*/fleet/*` endpoints accessed by the fleetd agent can use mTLS with the certificate provided via the `--fleet-tls-client-certificate` flag in the `fleetctl package` command.
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
* Added capability for Fleet to serve yara rules to agents over HTTPS authenticated via node key (requires osquery 5.14+).
|
||||
@@ -1 +0,0 @@
|
||||
- fixed issue where macOS and Linux scripts failed to timeout on long running commands
|
||||
@@ -1 +0,0 @@
|
||||
Allow filtering Software OS view to show only OSes from a particular platform (Windows, macOS, Linux, etc.)
|
||||
@@ -0,0 +1 @@
|
||||
* Improved memory usage of the Fleet server when uploading a large software installer file. Note that the installer will now use (temporary) disk space and sufficient storage space is required.
|
||||
@@ -1 +0,0 @@
|
||||
- fix loading state for the profile status aggregate UI
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed a bug where policy failures of a host were not being cleared in the host details page after configuring the host to not run any policies.
|
||||
@@ -1,14 +0,0 @@
|
||||
* Ensure details for a software installation run are available and accurate even after the corresponding installer has been edited or deleted
|
||||
|
||||
NOTE: The database migration included with this update backfills installer data into installation details based on the currently uploaded installer. To backfill data from activities (which will be more comprehensive and accurate than the migration default, but may take awhile as the entire activities table will be scanned), run this database query _after_ running database migrations:
|
||||
|
||||
```sql
|
||||
UPDATE host_software_installs i
|
||||
JOIN activities a ON a.activity_type = 'installed_software'
|
||||
AND i.execution_id = a.details->>"$.install_uuid"
|
||||
SET i.software_title_name = COALESCE(a.details->>"$.software_title", i.software_title_name),
|
||||
i.installer_filename = COALESCE(a.details->>"$.software_package", i.installer_filename),
|
||||
i.updated_at = i.updated_at
|
||||
```
|
||||
|
||||
The above query is optional, and is unnecessary if no software installers have been edited.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated tooltip for bootstrap package and VPP app statuses in UI.
|
||||
@@ -0,0 +1 @@
|
||||
* Generate an activity when activity automations are enabled, edited, or disabled.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated user permissions to allow gitops users to run MDM commands.
|
||||
@@ -0,0 +1 @@
|
||||
* Cancelled pending script executions when a script is edited or deleted.
|
||||
@@ -1 +0,0 @@
|
||||
Added SCEP proxy for Windows NDES (Network Device Enrollment Service) AD CS server, which allows devices to request certificates.
|
||||
@@ -1 +0,0 @@
|
||||
* Switched Nudge deadline time for OS upgrades on macOS pre-14 hosts from 04:00 UTC to 20:00 UTC
|
||||
@@ -1 +0,0 @@
|
||||
- add error message on the My Device page when mdm is off for the host
|
||||
@@ -1 +0,0 @@
|
||||
- Add ability to connect a SCEP NDES proxy
|
||||
@@ -0,0 +1 @@
|
||||
* GitOps: Fixed path resolution for installer queries and scripts to always be relative to where the query file or script is referenced. This change breaks existing YAML files that had to account for previous inconsistent behavior (e.g. installers in a subdirectory referencing scripts elsewhere).
|
||||
@@ -1 +0,0 @@
|
||||
- Addressed Debian python package false positive vulnerabilities by removing duplicate entries for Debian python packages installed by dpkg and renaming remaining pip installed packages to match OVAL definitions.
|
||||
@@ -0,0 +1 @@
|
||||
- Creating a query allow users to turn on/off automations while being transparent of the current log destination
|
||||
@@ -1,2 +0,0 @@
|
||||
- fix issue when trying to download the manual enrollment profile when device token is expired. We
|
||||
now show an error for this case.
|
||||
@@ -1 +0,0 @@
|
||||
Remove a pending MDM device if it was deleted from current ABM
|
||||
@@ -0,0 +1,2 @@
|
||||
- Updates GitOps to return an error if the deprecated `apple_bm_default_team` key is used and there
|
||||
are more than 1 ABM tokens in Fleet.
|
||||
@@ -1 +0,0 @@
|
||||
- fixed issue where the vulnerabilities cron failed to complete due to a large temporary table creation when calculating host issue counts
|
||||
@@ -1 +0,0 @@
|
||||
- add UI for the isntall software setup experience
|
||||
@@ -1 +0,0 @@
|
||||
- add UI for adding a setup experience script
|
||||
@@ -1 +0,0 @@
|
||||
- Add database migrations to support Setup Experience
|
||||
@@ -1 +0,0 @@
|
||||
- Add software experience software title selection API
|
||||
@@ -1 +0,0 @@
|
||||
- Add integration to queue setup experience software installation on automatic enrollment
|
||||
@@ -1 +0,0 @@
|
||||
- Add service to track install status
|
||||
@@ -1 +0,0 @@
|
||||
* Added a validation to prevent removing a software package or a VPP app from a team if that software is selected to be installed during the setup experience.
|
||||
@@ -1 +0,0 @@
|
||||
* Added support to `fleetctl gitops` to specify a setup experience script to run and software to install, for a team or no team.
|
||||
@@ -1 +0,0 @@
|
||||
* Set created_at/updated_at timestamps on user create endpoint
|
||||
@@ -1 +0,0 @@
|
||||
* Show software install activities from policy automations as authored by "Fleet", store policy ID and name on each activity
|
||||
@@ -0,0 +1 @@
|
||||
- Reboot linux machine on unlock to work around GDM bug on Ubuntu 24.04
|
||||
@@ -0,0 +1 @@
|
||||
- Users can view scripts in the UI (from both the scripts page and host details page) without downloading them
|
||||
@@ -1 +0,0 @@
|
||||
* Documented that Microsoft enrollments have less fields filled in the `mdm_enrolled` activity due to how this MDM enrollment flow is implemented.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Adds an Orbit endpoint (`POST /orbit/setup_experience/status`) for checking the status of a macOS
|
||||
host's setup experience steps.
|
||||
@@ -1,4 +0,0 @@
|
||||
* Allow clicking in the horizontal dimension of a flash message, outside of the message itself, and
|
||||
always hide flash messages when changing routes.
|
||||
* Refactor `renderFlash` and associated logic to by default dismiss the rendered message on page
|
||||
change. Provide optional `persistOnPageChange` option to allow overriding this behavior.
|
||||
@@ -1 +0,0 @@
|
||||
* Add a config field to the UI for custom MDM URLs
|
||||
@@ -0,0 +1 @@
|
||||
- Fix some cases where Fleet Maintained Apps generated incorrect uninstall scripts
|
||||
@@ -1 +0,0 @@
|
||||
* Deprecated the worker-based job to release macOS devices automatically after the setup experience, replace it with the fleetd-specific "/status" endpoint that is polled by the Setup Experience dialog controlled by Fleet during the setup flow.
|
||||
@@ -0,0 +1 @@
|
||||
- Add support for deb packages compressed with zstd
|
||||
@@ -1 +0,0 @@
|
||||
- fix the svg icon for Edge
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed bug in ABM renewal process that caused upload of new token to fail.
|
||||
@@ -1 +0,0 @@
|
||||
* Added a more descriptive error message when install or uninstall details do not exist for an activity
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed `fleetctl gitops` to support VPP apps, along with setting the VPP apps to install during the setup experience.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Fixes a bug where DDM declarations would remaing "pending" forever if they were deleted
|
||||
from Fleet before being sent to hosts.
|
||||
@@ -0,0 +1 @@
|
||||
- Fleet UI: Disable accessibility via keyboard for forms that are disabled via a slider
|
||||
@@ -0,0 +1,2 @@
|
||||
* Set a more elegant minimum height for the Add hosts > ChromeOS > Policy for extension field,
|
||||
avoiding a scrollbar.
|
||||
@@ -1 +0,0 @@
|
||||
Ignore `--delete-other-teams` flag in `fleetctl gitops` command for non-Premium license users.
|
||||
@@ -1 +0,0 @@
|
||||
Allow FLEET_REDIS_ADDRESS to include a `redis://` prefix. Allowed formats are: `redis://host:port` or `host:port`
|
||||
@@ -1 +0,0 @@
|
||||
* Fix frontend error when trying to view install details for an install with a blank status
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed blank install status when retrieving install details from the activity feed when the installer package has been updated or the software has since been removed from the host.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed bug where `PATCH /api/latest/fleet/config` was incorrectly clearing VPP token<->team associations.
|
||||
@@ -1,3 +0,0 @@
|
||||
Updated OpenTelemetry libraries to latest versions. This includes the following changes when OpenTelemetry is enabled:
|
||||
- MySQL spans outside of HTTPS transactions are now logged.
|
||||
- Renamed MySQL spans to include the query, for easier tracking/debugging.
|
||||
@@ -1 +0,0 @@
|
||||
- Filter out VPP apps on non-MDM enrolled devices
|
||||
@@ -0,0 +1 @@
|
||||
Fixed issue with uploading macOS software packages that do not have a top level Distribution.xml, but do have a top level PackageInfo.xml. For example, Okta Verify.app
|
||||
@@ -1 +0,0 @@
|
||||
* Explicitly set line heights on "add profile" messages so they are consistent cross-browser
|
||||
@@ -1 +0,0 @@
|
||||
* Make entire rows of the Disk encryption table clickable
|
||||
@@ -0,0 +1,2 @@
|
||||
- Fixes a bug where users would be allowed to attempt an install of an App Store app on a host that
|
||||
was not MDM enrolled.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed iOS and iPadOS device release during the ADE enrollment flow, which was broken by changes made to support the new setup experience for macOS.
|
||||
@@ -1 +0,0 @@
|
||||
* Have the UI inform the user why they could not update their password
|
||||
@@ -1 +0,0 @@
|
||||
Added capability for fleetd to report vital errors to Fleet server, such as when Fleet Desktop is unable to start.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed the ADE enrollment release device processing for hosts running an old fleetd version.
|
||||
@@ -0,0 +1 @@
|
||||
* Updated software batch endpoint status code from 200 (OK) to 202 (Accepted)
|
||||
@@ -0,0 +1 @@
|
||||
Added better handling of timeout and insufficient permissions errors in NDES SCEP proxy.
|
||||
@@ -0,0 +1 @@
|
||||
* Fixed a bug where the create and update label endpoints could return outdated information in a deployment using a mysql replica.
|
||||
@@ -0,0 +1 @@
|
||||
- Fleet UI: Prompt user to reenter the password if SCEP/NDES url or username has changed
|
||||
@@ -0,0 +1 @@
|
||||
* Dismiss error flash on the my device page when navigating to another URL.
|
||||
@@ -1 +0,0 @@
|
||||
- fix an issue with the byod enrollment page where it sometimes would show a 404 page.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed incorrect character set header on manual Mac enrollment config download
|
||||
@@ -4,11 +4,11 @@ name: fleet
|
||||
keywords:
|
||||
- fleet
|
||||
- osquery
|
||||
version: v6.2.0
|
||||
version: v6.2.1
|
||||
home: https://github.com/fleetdm/fleet
|
||||
sources:
|
||||
- https://github.com/fleetdm/fleet.git
|
||||
appVersion: v4.58.0
|
||||
appVersion: v4.59.0
|
||||
dependencies:
|
||||
- name: mysql
|
||||
condition: mysql.enabled
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
hostName: fleet.localhost
|
||||
replicas: 3 # The number of Fleet instances to deploy
|
||||
imageRepository: fleetdm/fleet
|
||||
imageTag: v4.58.0 # Version of Fleet to deploy
|
||||
imageTag: v4.59.0 # Version of Fleet to deploy
|
||||
podAnnotations: {} # Additional annotations to add to the Fleet pod
|
||||
serviceAccountAnnotations: {} # Additional annotations to add to the Fleet service account
|
||||
resources:
|
||||
|
||||
@@ -162,6 +162,7 @@ func gitopsCommand() *cli.Command {
|
||||
// name.) Because teams can be created/deleted during the same gitops run, we
|
||||
// grab some information to help us determine allowed/restricted actions and
|
||||
// when to perform the associations.
|
||||
|
||||
if isGlobalConfig && totalFilenames > 1 && !(totalFilenames == 2 && noTeamPresent) && isPremium {
|
||||
abmTeams, hasMissingABMTeam, usesLegacyABMConfig, err = checkABMTeamAssignments(config, fleetClient)
|
||||
if err != nil {
|
||||
@@ -298,6 +299,15 @@ func checkABMTeamAssignments(config *spec.GitOps, fleetClient *service.Client) (
|
||||
return nil, false, false, errors.New(fleet.AppleABMDefaultTeamDeprecatedMessage)
|
||||
}
|
||||
|
||||
abmToks, err := fleetClient.ListABMTokens()
|
||||
if err != nil {
|
||||
return nil, false, false, err
|
||||
}
|
||||
|
||||
if hasLegacyConfig && len(abmToks) > 1 {
|
||||
return nil, false, false, errors.New(fleet.AppleABMDefaultTeamDeprecatedMessage)
|
||||
}
|
||||
|
||||
if !hasLegacyConfig && !hasNewConfig {
|
||||
return nil, false, false, nil
|
||||
}
|
||||
|
||||
+25
-20
@@ -1875,6 +1875,8 @@ func TestGitOpsTeamSofwareInstallers(t *testing.T) {
|
||||
// commenting out, results in the process getting killed on CI and on some machines
|
||||
// {"testdata/gitops/team_software_installer_too_large.yml", "The maximum file size is 3 GB"},
|
||||
{"testdata/gitops/team_software_installer_valid.yml", ""},
|
||||
{"testdata/gitops/team_software_installer_subdir.yml", ""},
|
||||
{"testdata/gitops/subdir/team_software_installer_valid.yml", ""},
|
||||
{"testdata/gitops/team_software_installer_valid_apply.yml", ""},
|
||||
{"testdata/gitops/team_software_installer_pre_condition_multiple_queries.yml", "should have only one query."},
|
||||
{"testdata/gitops/team_software_installer_pre_condition_multiple_queries_apply.yml", "should have only one query."},
|
||||
@@ -1957,6 +1959,8 @@ func TestGitOpsNoTeamSoftwareInstallers(t *testing.T) {
|
||||
// commenting out, results in the process getting killed on CI and on some machines
|
||||
// {"testdata/gitops/no_team_software_installer_too_large.yml", "The maximum file size is 3 GB"},
|
||||
{"testdata/gitops/no_team_software_installer_valid.yml", ""},
|
||||
{"testdata/gitops/no_team_software_installer_subdir.yml", ""},
|
||||
{"testdata/gitops/subdir/no_team_software_installer_valid.yml", ""},
|
||||
{"testdata/gitops/no_team_software_installer_pre_condition_multiple_queries.yml", "should have only one query."},
|
||||
{"testdata/gitops/no_team_software_installer_pre_condition_not_found.yml", "no such file or directory"},
|
||||
{"testdata/gitops/no_team_software_installer_install_not_found.yml", "no such file or directory"},
|
||||
@@ -2603,26 +2607,27 @@ software:
|
||||
assert.Contains(t, out, "[!] gitops succeeded")
|
||||
},
|
||||
},
|
||||
// {
|
||||
// name: "deprecated config with two tokens in the db fails",
|
||||
// cfgs: []string{
|
||||
// global("apple_bm_default_team: 💻 Workstations"),
|
||||
// workstations,
|
||||
// },
|
||||
// tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Second Token LLC"}},
|
||||
// dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
|
||||
// require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
|
||||
// assert.Empty(t, appCfg.MDM.AppleBussinessManager.Value)
|
||||
// assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
|
||||
// assert.NotContains(t, out, "[!] gitops dry run succeeded")
|
||||
// },
|
||||
// realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
|
||||
// require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
|
||||
// assert.Empty(t, appCfg.MDM.AppleBussinessManager.Value)
|
||||
// assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
|
||||
// assert.NotContains(t, out, "[!] gitops dry run succeeded")
|
||||
// },
|
||||
// },
|
||||
{
|
||||
name: "deprecated config with two tokens in the db fails",
|
||||
cfgs: []string{
|
||||
global("apple_bm_default_team: 💻 Workstations"),
|
||||
workstations,
|
||||
},
|
||||
tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Second Token LLC"}},
|
||||
dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
|
||||
t.Logf("got: %s", out)
|
||||
require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
|
||||
assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
|
||||
assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
|
||||
assert.NotContains(t, out, "[!] gitops dry run succeeded")
|
||||
},
|
||||
realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
|
||||
require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
|
||||
assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
|
||||
assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
|
||||
assert.NotContains(t, out, "[!] gitops succeeded")
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "new key all valid",
|
||||
cfgs: []string{
|
||||
|
||||
+4
-4
@@ -1,9 +1,9 @@
|
||||
url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
|
||||
install_script:
|
||||
path: lib/install_ruby.sh
|
||||
path: ./install_ruby.sh
|
||||
pre_install_query:
|
||||
path: lib/query_ruby.yml
|
||||
path: ./query_ruby.yml
|
||||
post_install_script:
|
||||
path: lib/post_install_ruby.sh
|
||||
path: ./post_install_ruby.sh
|
||||
uninstall_script:
|
||||
path: lib/uninstall_ruby.sh
|
||||
path: ./uninstall_ruby.sh
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
name: No team
|
||||
controls:
|
||||
policies:
|
||||
software:
|
||||
packages:
|
||||
- path: subdir/installer.yml
|
||||
@@ -0,0 +1,9 @@
|
||||
url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
|
||||
install_script:
|
||||
path: ../lib/install_ruby.sh
|
||||
pre_install_query:
|
||||
path: ../lib/query_ruby.yml
|
||||
post_install_script:
|
||||
path: ../lib/post_install_ruby.sh
|
||||
uninstall_script:
|
||||
path: ../lib/uninstall_ruby.sh
|
||||
@@ -0,0 +1,16 @@
|
||||
name: No team
|
||||
controls:
|
||||
policies:
|
||||
software:
|
||||
packages:
|
||||
- url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
|
||||
install_script:
|
||||
path: ../lib/install_ruby.sh
|
||||
pre_install_query:
|
||||
path: ../lib/query_ruby.yml
|
||||
post_install_script:
|
||||
path: ../lib/post_install_ruby.sh
|
||||
uninstall_script:
|
||||
path: ../lib/uninstall_ruby.sh
|
||||
- url: ${SOFTWARE_INSTALLER_URL}/other.deb
|
||||
self_service: true
|
||||
@@ -0,0 +1,27 @@
|
||||
name: "${TEST_TEAM_NAME}"
|
||||
team_settings:
|
||||
secrets:
|
||||
- secret: "ABC"
|
||||
features:
|
||||
enable_host_users: true
|
||||
enable_software_inventory: true
|
||||
host_expiry_settings:
|
||||
host_expiry_enabled: true
|
||||
host_expiry_window: 30
|
||||
agent_options:
|
||||
controls:
|
||||
policies:
|
||||
queries:
|
||||
software:
|
||||
packages:
|
||||
- url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
|
||||
install_script:
|
||||
path: ../lib/install_ruby.sh
|
||||
pre_install_query:
|
||||
path: ../lib/query_ruby.yml
|
||||
post_install_script:
|
||||
path: ../lib/post_install_ruby.sh
|
||||
uninstall_script:
|
||||
path: ../lib/uninstall_ruby.sh
|
||||
- url: ${SOFTWARE_INSTALLER_URL}/other.deb
|
||||
self_service: true
|
||||
@@ -0,0 +1,17 @@
|
||||
name: "${TEST_TEAM_NAME}"
|
||||
team_settings:
|
||||
secrets:
|
||||
- secret: "ABC"
|
||||
features:
|
||||
enable_host_users: true
|
||||
enable_software_inventory: true
|
||||
host_expiry_settings:
|
||||
host_expiry_enabled: true
|
||||
host_expiry_window: 30
|
||||
agent_options:
|
||||
controls:
|
||||
policies:
|
||||
queries:
|
||||
software:
|
||||
packages:
|
||||
- path: ./subdir/installer.yml
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user