Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity

Setting up and using Kolide (#1133)

Browse Source
This commit is contained in:
Mike Arpaia
2017-01-30 18:51:10 -07:00
committed by GitHub
parent f655ca5966
commit e17ab76cff
7 changed files with 820 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/images/add-new-host-modal.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 503 KiB

docs/infrastructure/README.md
+4 -2
View File
@@ -7,7 +7,7 @@ Kolide is an infrastructure instrumentation application which has it's own infra
- For information on installing osquery on hosts that you own, see our [Adding Hosts To Kolide](./adding-hosts-to-kolide.md) document, which compliments existing [osquery documentation](https://osquery.readthedocs.io/en/stable/).
- To add hosts to Kolide, you will need to provide a minimum set of configuration to the osquery agent on each host. These configurations are defined in the aforementioned [Adding Hosts To Kolide](./adding-hosts-to-kolide.md) document. If you'd like to further customize the osquery configurations and options, this can be done via the Kolide application UI. You can find more documentation on this feature in the [application documentation for this feature](../application/configuring-osquery-options.md).
- To manage osquery configurations at your organization, we strongly suggest using some form of configuration management tooling. For more information on configuration management, see the [Managing Client Configurations](./managing-client-configurations.md) document.
- To manage osquery configurations at your organization, we strongly suggest using some form of configuration management tooling. For more information on configuration management, see the [Managing Osquery Configurations](./managing-osquery-configurations.md) document.
## Installing Kolide and it's dependencies
@@ -15,4 +15,6 @@ The Kolide server has a few dependencies. To learn more about installing the Kol
## Managing a Kolide server
Running the Kolide server is a relatively simple process. We're prepared a brief guide to help you manage and maintain your Kolide server. Check out the [Running Kolide](./running-kolide.md) guide for more information.
Running the Kolide server is a relatively simple process. We're prepared a brief guide to help you manage and maintain your Kolide server. Check out the guide for setting up and running [Kolide on Ubuntu](./kolide-on-ubuntu.md) and [Kolide on CentOS](./kolide-on-centos.md).
For more information, you can also read the [Configuring The Kolide Binary](./configuring-the-kolide-binary.md) guide for information on how to configure and customize Kolide for your organization.
docs/infrastructure/configuring-the-kolide-binary.md
+459
View File
@@ -0,0 +1,459 @@
Configuring The Kolide Binary
=============================
For information on how to run the `kolide` binary, detailed usage information can be found by running `kolide --help`. This document is a more detailed version of the information presented in the help output text. If you prefer to use a CLI instead of a web browser, we hope that you like the binary interface to the Kolide application!
## High-level configuration overview
To get the most out of running the Kolide server, it is helpful to establish a mutual understanding of what the desired architecture looks like and what it's trying to accomplish.
Your Kolide server's two main purposes are:
- To serve as your [osquery TLS server](https://osquery.readthedocs.io/en/stable/deployment/remote/)
- To serve the [Kolide web application](https://kolide.co/product), which allows you to manage osquery configuration, query hosts, perform interesting analytics, etc.
The Kolide server allows you persist configuration, manage users, etc. Thus, it needs a database. Kolide uses MySQL and requires you to supply configurations to connect to a MySQL server. Kolide also uses Redis to perform some more high-speed data access action throughout the lifecycle of the application (for example, distributed query result ingestion). Thus, Kolide also requires that you supply Redis connention configurations.
Since Kolide is a web application, when you run Koldie there are some other configurations that are worth defining, such as:
- The TLS certificates that Kolide should use to terminate TLS.
- The [JWT](https://jwt.io/) Key which is used to sign and verify session tokens.
Since Kolide is an osquery TLS server, you are also able to define configurations that can customize your experience there, such as:
- The destination of the osquery status and result logs on the local filesystem
- Various details about the refresh/check-in intervals for your hosts
## Commands
The `kolide` binary contains several "commands". Similarly to how `git` has many commands (`git status`, `git commit`, etc), the `kolide` binary accepts the following commands:
- `kolide prepare db`
- `kolide serve`
- `kolide version`
- `kolide config_dump`
## Options
### How do you specify options?
In order of precedence, options can be specified via:
- A configuration file (in YAML format)
- Environment variables
- Command-line flags
For example, all of the following ways of launching Kolide are equivalent:
#### Using only CLI flags
```
$ /usr/bin/kolide serve \
--mysql_address=127.0.0.1:3306 \
--mysql_database=kolide \
--mysql_username=root \
--mysql_password=toor \
--redis_address=127.0.0.1:6379 \
--server_cert=/tmp/server.cert \
--server_key=/tmp/server.key \
--logging_json
```
#### Using only environment variables
```
$ KOLIDE_MYSQL_ADDRESS=127.0.0.1:3306 \
KOLIDE_MYSQL_DATABASE=kolide \
KOLIDE_MYSQL_USERNAME=root \
KOLIDE_MYSQL_PASSWORD=toor \
KOLIDE_REDIS_ADDRESS=127.0.0.1:6379 \
KOLIDE_SERVER_CERT=/tmp/server.cert \
KOLIDE_SERVER_KEY=/tmp/server.key \
KOLIDE_LOGGING_JSON=true \
/usr/bin/kolide serve
```
#### Using a config file
```
$ echo '
mysql:
address: 127.0.0.1:3306
database: kolide
username: root
password: toor
redis:
address: 127.0.0.1:6379
server:
cert: /tmp/server.cert
key: /tmp/server.key
logging:
json: true
' > /tmp/kolide.yml
$ kolide serve --config /tmp/kolide.yml
```
### What are the options?
Note that all option names can be converted consistently from flag name to environment variable and visa-versa. For example, the `--mysql_address` flag would be the `KOLIDE_MYSQL_ADDRESS`. Further, specifying the `mysql_address` option in the config would follow the pattern:
```
mysql:
address: 127.0.0.1:3306
```
Basically, just capitalize the option and prepend `KOLIDE_` to it in order to get the environment variable. The conversion works the same the opposite way.
#### MySQL
##### `mysql_address`
The address of the MySQL server which Kolide should connect to. Include the hostname and port.
- Default value: `localhost:3306`
- Environment variable: `KOLIDE_MYSQL_ADDRESS`
- Config file format:
```
mysql:
address: localhost:3306
```
##### `mysql_database`
The name of the MySQL database which Kolide will use.
- Default value: `kolide`
- Environment variable: `KOLIDE_MYSQL_DATABASE`
- Config file format:
```
mysql:
database: kolide
```
##### `mysql_username`
The username to use when connecting to the MySQL instance.
- Default value: `kolide`
- Environment variable: `KOLIDE_MYSQL_USERNAME`
- Config file format:
```
mysql:
username: kolide
```
##### `mysql_password`
The password to use when connecting to the MySQL instance.
- Default value: `kolide`
- Environment variable: `KOLIDE_MYSQL_PASSWORD`
- Config file format:
```
mysql:
password: kolide
```
#### Redis
##### `redis_address`
The address of the Redis server which Kolide should connect to. Include the hostname and port.
- Default value: `localhost:3306`
- Default value: `localhost:6379`
- Environment variable: `KOLIDE_REDIS_ADDRESS`
- Config file format:
```
redis:
address: 127.0.0.1:7369
```
##### `redis_password`
The password to use when connecting to the Redis instance.
- Default value: `<empty>`
- Environment variable: `KOLIDE_REDIS_PASSWORD`
- Config file format:
```
redis:
password: foobar
```
#### Server
##### `server_address`
The address to serve the Kolide webserver.
- Default value: `0.0.0.0:8080`
- Environment variable: `KOLIDE_SERVER_ADDRESS`
- Config file format:
```
server:
address: 0.0.0.0:443
```
##### `server_cert`
The TLS cert to use when terminating TLS.
- Default value: `./tools/osquery/kolide.crt`
- Environment variable: `KOLIDE_SERVER_CERT`
- Config file format:
```
server:
cert: /tmp/kolide.crt
```
##### `server_key`
The TLS key to use when terminating TLS.
- Default value: `./tools/osquery/kolide.key`
- Environment variable: `KOLIDE_SERVER_KEY`
- Config file format:
```
server:
key: /tmp/kolide.key
```
##### `server_tls`
Whether or not the server should be served over TLS.
- Default value: `true`
- Environment variable: `KOLIDE_SERVER_TLS`
- Config file format:
```
server:
tls: false
```
#### Auth
##### `auth_jwt_key`
The [JWT](https://jwt.io/) key to use when signing and validating session keys.
- Default value: `CHANGEME`
- Environment variable: `KOLIDE_AUTH_JWT_KEY`
- Config file format:
```
auth:
jwt_key: JVnKw7CaUdJjZwYAqDgUHVYP
```
##### `auth_bcrypt_cost`
The bcrypt cost to use when hashing user passwords.
- Default value: `12`
- Environment variable: `KOLIDE_AUTH_BCRYT_COST`
- Config file format:
```
auth:
bcrypt_cost: 14
```
##### `auth_salt_key_size`
The key size of the salt which is generated when hashing user passwords.
- Default value: `24`
- Environment variable: `KOLIDE_AUTH_SALT_KEY_SIZE`
- Config file format:
```
auth:
salt_key_size: 36
```
#### App
##### `app_web_address`
- Default value: `0.0.0.0:8080`
- Environment variable: `KOLIDE_APP_WEB_ADDRESS`
- Config file format
```
app:
web_address: 0.0.0.0:443
```
##### `app_token_key`
- Default value: `CHANGEME`
- Environment variable: `KOLIDE_APP_TOKEN_KEY`
- Config file format
```
app:
token_key: JVnKw7CaUdJjZwYAqDgUHVYP
```
##### `app_token_key_size`
- Default value: `24`
- Environment variable: `KOLIDE_APP_TOKEN_KEY_SIZE`
- Config file format:
```
app:
token_key_size: 36
```
##### `app_invite_token_validity_period`
How long invite tokens should be valid for.
- Default value: `5 days`
- Environment variable: `KOLIDE_APP_TOKEN_VALIDITY_PERIOD`
- Config file format:
```
app:
invite_token_validity_period: 1d
```
#### Session
##### `session_key_size`
The size of the session key.
- Default value: `64`
- Environment variable: `KOLIDE_SESSION_KEY_SIZE`
- Config file format:
```
session:
key_size: 48
```
##### `session_duration`
The amount of time that a session should last for.
- Default value: `90 days`
- Environment variable: `KOLIDE_SESSION_DURATION`
- Config file format:
```
session:
duration: 30d
```
#### Osquery
##### `osquery_node_key_size`
The size of the node key which is negotiated with `osqueryd` clients.
- Default value: `24`
- Environment variable: `KOLIDE_OSQUERY_NODE_KEY_SIZE`
- Config file format:
```
osquery:
node_key_size: 36
```
##### `osquery_status_log_file`
The path which osquery status logs will be logged to.
- Default value: `/tmp/osquery_status`
- Environment variable: `KOLIDE_OSQUERY_STATUS_LOG_FILE`
- Config file format:
```
osquery:
status_log_file: /var/log/osquery/status.log
```
##### `osquery_result_log_file`
The path which osquery result logs will be logged to.
- Default value: `/tmp/osquery_result`
- Environment variable: `KOLIDE_OSQUERY_RESULT_LOG_FILE`
- Config file format:
```
osquery:
result_log_file: /var/log/osquery/result.log
```
##### `osquery_label_update_interval`
The interval at which Kolide will ask osquery agents to update their results for label queries.
- Default value: `1h`
- Environment variable: `KOLIDE_OSQUERY_LABEL_UPDATE_INTERVAL`
- Config file format:
```
osquery:
label_query_update_interval: 30m
```
#### Logging
##### `logging_debug`
Whether or not to enable debug logging.
- Default value: `false`
- Environment variable: `KOLIDE_LOGGING_DEBUG`
- Config file format:
```
logging:
debug: true
```
##### `logging_json`
Whether or not to log in JSON.
- Default value: `false`
- Environment variable: `KOLIDE_LOGGING_JSON`
- Config file format:
```
logging:
json: true
```
##### `logging_disable_banner`
Whether or not to log the welcome banner.
- Default value: `false`
- Environment variable: `KOLIDE_LOGGING_DISABLE_BANNER`
- Config file format:
```
logging:
diable_banner: true
```
docs/infrastructure/kolide-on-centos.md
+183
View File
@@ -0,0 +1,183 @@
Kolide on CentOS
================
In this guide, we're going to install Kolide and all of it's application dependencies on a CentOS 7.1 server. Once we have Kolide up and running, we're going to install osquery on that same CentOS 7.1 host and enroll it in Kolide. This should give you a good understanding of both how to install Kolide as well as how to install and configure osquery such that it can communicate with Kolide.
## Setting up a host
Acquiring an Ubuntu host to use for this guide is largely an exercise for the reader. If you don't have an Ubuntu host readily available, feel free to use [Vagrant](https://www.vagrantup.com/). In a clean, temporary directory, you can run the following to create a vagrant box, start it, and log into it:
```
$ echo 'Vagrant.configure("2") do |config|
config.vm.box = "bento/centos-7.1"
config.vm.network "forwarded_port", guest: 8080, host: 8080
end' > Vagrantfile
$ vagrant up
$ vagrant ssh
```
## Installing Kolide
To install Kolide, go to the [GitHub Releases Page](https://github.com/kolide/kolide-ose/releases) to select the most recent deb package. You can install it on your host by using:
```
$ wget https://github.com/kolide/kolide-ose/releases/download/1.0.0-rc1/kolide-1.0.0_rc1-1.x86_64.rpm
$ sudo rpm -i kolide-1.0.0_rc1-1.x86_64.rpm
```
## Installing and configuring dependencies
### MySQL
To install the MySQL server files, run the following:
```
$ wget http://repo.mysql.com/mysql-community-release-el7-5.noarch.rpm
$ sudo rpm -i mysql-community-release-el7-5.noarch.rpm
$ sudo yum update
$ sudo yum install mysql-server
```
To start the MySQL service:
```
$ sudo systemctl start mysqld
```
Let's set a password for the MySQL root user.
For MySQL 5.7.6 and newer, use the following command:
```
echo 'ALTER USER "root"@"localhost" IDENTIFIED BY "toor";' | mysql -u root
```
For MySQL 5.7.5 and older, use:
```
echo 'SET PASSWORD FOR "root"@"localhost" = PASSWORD("toor");' | mysql -u root
```
It's also worth creating a MySQL database for us to use at this point. Run the following to create the `kolide` database in MySQL. Note that you will be prompted for the password you created above.
```
$ echo 'CREATE DATABASE kolide;' | mysql -u root -p
```
### Redis
To install the Redis server files, run the following:
```
$ sudo rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
$ sudo yum install redis
```
To start the Redis server in the background, you can run the following:
```
$ sudo service redis start
```
## Running the Kolide server
Now that we have installed Kolide, MySQL, and Redis, we are ready to launch Kolide! First, we must "prepare" the database. We do this via `kolide prepare db`:
```
$ /usr/bin/kolide prepare db \
--mysql_address=127.0.0.1:3306 \
--mysql_database=kolide \
--mysql_username=root \
--mysql_password=toor
```
The output should look like:
```
OK 20161118193812_CreateTableAppConfigs.go
OK 20161118211713_CreateTableDistributedQueryCampaignTargets.go
...
OK 20170124230432_CreateTableEmailChanges.go
goose: no migrations to run. current version: 20170124230432
OK 20161223115449_InsertOsqueryOptions.go
OK 20161229171615_InsertBuiltinLabels.go
goose: no migrations to run. current version: 20161229171615
```
Before we can run the server, we need to generate some TLS keying material. If you already have tooling for generating valid TLS certificates, then you are encouraged to use that instead. You will need a TLS certificate and key for running the Kolide server. If you'd like to generate self-signed certificates, you can do this via:
```
$ openssl genrsa -out /tmp/server.key 4096
$ openssl req -new -key /tmp/server.key -out /tmp/server.csr
$ openssl x509 -req -days 366 -in /tmp/server.csr -signkey /tmp/server.key -out /tmp/server.cert
```
You should now have three new files in `/tmp`:
- `/tmp/server.cert`
- `/tmp/server.key`
- `/tmp/server.csr`
Now we are ready to run the server! We do this via `kolide serve`:
```
$ /usr/bin/kolide serve \
--mysql_address=127.0.0.1:3306 \
--mysql_database=kolide \
--mysql_username=root \
--mysql_password=toor \
--redis_address=127.0.0.1:6379 \
--server_cert=/tmp/server.cert \
--server_key=/tmp/server.key \
--logging_json
```
Now, if you go to [https://localhost:8080](https://localhost:8080) in your local browser, you should be redirected to [https://localhost:8080/setup](https://localhost:8080/setup) where you can create your first Kolide user account.
## Installing and running osquery
> Note that this whole process is outlined in more detail in the [Adding Hosts To Kolide](./adding-hosts-to-kolide.md) document. The steps are repeated here for the sake of a continuous tutorial.
To install osquery on CentOS, you can run the following:
```
$ sudo rpm -ivh https://osquery-packages.s3.amazonaws.com/centos7/noarch/osquery-s3-centos7-repo-1-0.0.noarch.rpm
$ sudo yum install osquery
```
You will need to set the osquery enroll secret and osquery server certificate. If you head over to the manage hosts page on your Kolide instance (which should be [https://localhost:8080/hosts/manage](https://localhost:8080/hosts/manage)), you should be able to click "Add New Hosts" and see a modal like the following:
![Add New Host](../images/add-new-host-modal.png)
If you select "Fetch Kolide Certificate", your browser will download the appropriate file to your downloads directory (to a file probably called `localhost-8080.pem`). Copy this file to your Ubuntu host at `/var/osquery/server.pem`.
You can also select "Reveal Secret" on that modal and the enrollment secret for your Kolide instance will be revealed. Copy that text and create a file with it's contents:
```
$ echo 'LQWzGg9+/yaxxcBUMY7VruDGsJRYULw8' > /var/osquery/enroll_secret
```
Now you're ready to run the `osqueryd` binary:
```
sudo /usr/bin/osqueryd \
--enroll_secret_path=/var/osquery/enroll_secret \
--tls_server_certs=/var/osquery/server.pem \
--tls_hostname=localhost:8080 \
--host_identifier=hostname \
--enroll_tls_endpoint=/api/v1/osquery/enroll \
--config_plugin=tls \
--config_tls_endpoint=/api/v1/osquery/config \
--config_tls_refresh=10 \
--disable_distributed=false \
--distributed_plugin=tls \
--distributed_interval=3 \
--distributed_tls_max_attempts=3 \
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read \
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write \
--logger_plugin=tls \
--logger_tls_endpoint=/api/v1/osquery/log \
--logger_tls_period=10
```
If you go back to [https://localhost:8080/hosts/manage](https://localhost:8080/hosts/manage), you should have a host successfully enrolled in Kolide! For information on how to further use the Kolide application, see the [Application Documentation](../application/README.md).
docs/infrastructure/kolide-on-ubuntu.md
+172
View File
@@ -0,0 +1,172 @@
Kolide on Ubuntu
================
In this guide, we're going to install Kolide and all of it's application dependencies on an Ubuntu 16.04 LTS server. Once we have Kolide up and running, we're going to install osquery on that same Ubuntu 16.04 host and enroll it in Kolide. This should give you a good understanding of both how to install Kolide as well as how to install and configure osquery such that it can communicate with Kolide.
## Setting up a host
Acquiring an Ubuntu host to use for this guide is largely an exercise for the reader. If you don't have an Ubuntu host readily available, feel free to use [Vagrant](https://www.vagrantup.com/). In a clean, temporary directory, you can run the following to create a vagrant box, start it, and log into it:
```
$ echo 'Vagrant.configure("2") do |config|
config.vm.box = "bento/ubuntu-16.04"
config.vm.network "forwarded_port", guest: 8080, host: 8080
end' > Vagrantfile
$ vagrant up
$ vagrant ssh
```
## Installing Kolide
To install Kolide, go to the [GitHub Releases Page](https://github.com/kolide/kolide-ose/releases) to select the most recent deb package. You can install it on your host by using:
```
$ wget https://github.com/kolide/kolide-ose/releases/download/1.0.0-rc1/kolide_1.0.0-rc1_amd64.deb
$ sudo dpkg -i kolide_1.0.0-rc1_amd64.deb
```
## Installing and configuring dependencies
### MySQL
To install the MySQL server files, run the following:
```
$ sudo apt-get install mysql-server -y
```
When asked for MySQL's root password, enter `toor` for the sake of this tutorial if you are having trouble thinking of a better password for the MySQL root user.
After installing `mysql-server`, the `mysqld` server should be running. You can verify this by running the following:
```
$ ps aux | grep mysqld
mysql 13158 3.1 14.4 1105320 146408 ? Ssl 21:36 0:00 /usr/sbin/mysqld
```
It's also worth creating a MySQL database for us to use at this point. Run the following to create the `kolide` database in MySQL. Note that you will be prompted for the password you created above.
```
$ echo 'CREATE DATABASE kolide;' | mysql -u root -p
```
### Redis
To install the Redis server files, run the following:
```
$ sudo apt-get install redis-server -y
```
To start the Redis server in the background, you can run the following:
```
$ sudo redis-server &
```
Note that this isn't a very robust way to run a Redis server. Digital Ocean has written a very nice [community tutorial](https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-redis-on-ubuntu-16-04) on installing and running Redis in a more productionalized way.
## Running the Kolide server
Now that we have installed Kolide, MySQL, and Redis, we are ready to launch Kolide! First, we must "prepare" the database. We do this via `kolide prepare db`:
```
$ /usr/bin/kolide prepare db \
--mysql_address=127.0.0.1:3306 \
--mysql_database=kolide \
--mysql_username=root \
--mysql_password=toor
```
The output should look like:
```
OK 20161118193812_CreateTableAppConfigs.go
OK 20161118211713_CreateTableDistributedQueryCampaignTargets.go
...
OK 20170124230432_CreateTableEmailChanges.go
goose: no migrations to run. current version: 20170124230432
OK 20161223115449_InsertOsqueryOptions.go
OK 20161229171615_InsertBuiltinLabels.go
goose: no migrations to run. current version: 20161229171615
```
Before we can run the server, we need to generate some TLS keying material. If you already have tooling for generating valid TLS certificates, then you are encouraged to use that instead. You will need a TLS certificate and key for running the Kolide server. If you'd like to generate self-signed certificates, you can do this via:
```
$ openssl genrsa -out /tmp/server.key 4096
$ openssl req -new -key /tmp/server.key -out /tmp/server.csr
$ openssl x509 -req -days 366 -in /tmp/server.csr -signkey /tmp/server.key -out /tmp/server.cert
```
You should now have three new files in `/tmp`:
- `/tmp/server.cert`
- `/tmp/server.key`
- `/tmp/server.csr`
Now we are ready to run the server! We do this via `kolide serve`:
```
$ /usr/bin/kolide serve \
--mysql_address=127.0.0.1:3306 \
--mysql_database=kolide \
--mysql_username=root \
--mysql_password=toor \
--redis_address=127.0.0.1:6379 \
--server_cert=/tmp/server.cert \
--server_key=/tmp/server.key \
--logging_json
```
Now, if you go to [https://localhost:8080](https://localhost:8080) in your local browser, you should be redirected to [https://localhost:8080/setup](https://localhost:8080/setup) where you can create your first Kolide user account.
## Installing and running osquery
> Note that this whole process is outlined in more detail in the [Adding Hosts To Kolide](./adding-hosts-to-kolide.md) document. The steps are repeated here for the sake of a continuous tutorial.
To install osquery on Ubuntu, you can run the following:
```
$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B
$ sudo add-apt-repository "deb [arch=amd64] https://osquery-packages.s3.amazonaws.com/xenial xenial main"
$ sudo apt-get update
$ sudo apt-get install osquery
```
You will need to set the osquery enroll secret and osquery server certificate. If you head over to the manage hosts page on your Kolide instance (which should be [https://localhost:8080/hosts/manage](https://localhost:8080/hosts/manage)), you should be able to click "Add New Hosts" and see a modal like the following:
![Add New Host](../images/add-new-host-modal.png)
If you select "Fetch Kolide Certificate", your browser will download the appropriate file to your downloads directory (to a file probably called `localhost-8080.pem`). Copy this file to your Ubuntu host at `/var/osquery/server.pem`.
You can also select "Reveal Secret" on that modal and the enrollment secret for your Kolide instance will be revealed. Copy that text and create a file with it's contents:
```
$ echo 'LQWzGg9+/yaxxcBUMY7VruDGsJRYULw8' > /var/osquery/enroll_secret
```
Now you're ready to run the `osqueryd` binary:
```
sudo /usr/bin/osqueryd \
--enroll_secret_path=/var/osquery/enroll_secret \
--tls_server_certs=/var/osquery/server.pem \
--tls_hostname=localhost:8080 \
--host_identifier=hostname \
--enroll_tls_endpoint=/api/v1/osquery/enroll \
--config_plugin=tls \
--config_tls_endpoint=/api/v1/osquery/config \
--config_tls_refresh=10 \
--disable_distributed=false \
--distributed_plugin=tls \
--distributed_interval=3 \
--distributed_tls_max_attempts=3 \
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read \
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write \
--logger_plugin=tls \
--logger_tls_endpoint=/api/v1/osquery/log \
--logger_tls_period=10
```
If you go back to [https://localhost:8080/hosts/manage](https://localhost:8080/hosts/manage), you should have a host successfully enrolled in Kolide! For information on how to further use the Kolide application, see the [Application Documentation](../application/README.md).
docs/infrastructure/managing-client-configurations.md → docs/infrastructure/managing-osquery-configurations.md
+2 -2
View File
@@ -1,4 +1,4 @@
Managing Client Configurations
==============================
Managing Osquery Configurations
===============================
We recommend that you use an infrastructure configuration management tool to manage these osquery configurations consistently across your environment. If you're unsure about what configuration management tools your organization uses, contact your company's system administrators. If you are evaluating new solutions for this problem, the founders of Kolide have successfully managed configurations in large production environments using [Chef](https://www.chef.io/chef/) and [Puppet](https://puppet.com/).
docs/infrastructure/running-kolide.md
-2
View File
@@ -1,2 +0,0 @@
Running Kolide
==============