From eb4770f730a0a9dab3ff09624dad38dffa748437 Mon Sep 17 00:00:00 2001 From: Zachary Wasserman Date: Tue, 2 Apr 2019 05:31:09 -0700 Subject: [PATCH] Use host.docker.internal to connect test osqueryd instances (#2019) Newer versions of Docker support this hostname, which allows test osquery instances to be started with less configuration. --- tools/osquery/README.md | 7 ++-- tools/osquery/docker-compose.yml | 8 ----- tools/osquery/example_osquery.flags | 2 +- tools/osquery/kolide.crt | 35 +++++++++--------- tools/osquery/kolide.key | 55 +++++++++++++++-------------- 5 files changed, 49 insertions(+), 58 deletions(-) diff --git a/tools/osquery/README.md b/tools/osquery/README.md index 27bdfbc994..b74bbdd1ef 100644 --- a/tools/osquery/README.md +++ b/tools/osquery/README.md @@ -10,7 +10,7 @@ The files in this directory are intended to assist with Fleet development. * `example_osquery.flags`: An example osquery flagfile setting the config options that must be loaded before the full JSON config. -* `kolide.crt` & `kolide.key`: Self-signed SSL certificate & key useful for testing locally with `osqueryd`. Works with domains `localhost` and `dockerhost`. Should /never/ be used in production. +* `kolide.crt` & `kolide.key`: Self-signed SSL certificate & key useful for testing locally with `osqueryd`. Works with the domain `host.docker.internal` (exposed within docker containers as the host's IP). Should /never/ be used in production. ## Testing with containerized osqueryd @@ -21,15 +21,14 @@ Using Docker enables us to rapidly spin up and down pre-configured `osqueryd` in Docker and docker-compose are the only dependencies. The necessary container images will be pulled from Docker Cloud on first run. -Before using the following commands, set the environment variable `LOCALHOST` to the public IP (127.0.0.1 will not work) of the docker host machine. This will allow the containers to connect to the local Fleet server. You will also need to -set `KOLIDE_OSQUERY_VERSION` to either `1.8.2` or `latest` (currently 2.1.2) to indicate which version of osquery that you want to run on your +Set `KOLIDE_OSQUERY_VERSION` to either `1.8.2` or `latest` (currently 2.1.2) to indicate which version of osquery that you want to run on your containers. You will also need to set the environment variable `ENROLL_SECRET` to the value of your Fleet enroll secret (available on the manage hosts page, or via `fleetctl get enroll-secret`). ### Running osqueryd -The osqueryd instances are configured to use the TLS plugins at `$LOCALHOST:8080`. Using the `example_config.json` in this directory should configure Fleet with the appropriate settings for these `osqueryd` containers to connect. +The osqueryd instances are configured to use the TLS plugins at `host.docker.internal:8080`. Using the `example_osquery.flags` in this directory should configure Fleet with the appropriate settings for these `osqueryd` containers to connect. To start one instance each of Centos and Ubuntu `osqueryd`, use: diff --git a/tools/osquery/docker-compose.yml b/tools/osquery/docker-compose.yml index 34b0115a81..72e1ad01a2 100644 --- a/tools/osquery/docker-compose.yml +++ b/tools/osquery/docker-compose.yml @@ -7,8 +7,6 @@ services: volumes: - ./kolide.crt:/etc/osquery/kolide.crt - ./example_osquery.flags:/etc/osquery/osquery.flags - extra_hosts: - - "dockerhost:${LOCALHOST}" environment: ENROLL_SECRET: "${ENROLL_SECRET}" command: osqueryd --flagfile=/etc/osquery/osquery.flags @@ -22,8 +20,6 @@ services: volumes: - ./kolide.crt:/etc/osquery/kolide.crt - ./example_osquery.flags:/etc/osquery/osquery.flags - extra_hosts: - - "dockerhost:${LOCALHOST}" environment: ENROLL_SECRET: "${ENROLL_SECRET}" command: osqueryd --flagfile=/etc/osquery/osquery.flags @@ -37,8 +33,6 @@ services: volumes: - ./kolide.crt:/etc/osquery/kolide.crt - ./example_osquery.flags:/etc/osquery/osquery.flags - extra_hosts: - - "dockerhost:${LOCALHOST}" environment: ENROLL_SECRET: "${ENROLL_SECRET}" command: osqueryd --flagfile=/etc/osquery/osquery.flags @@ -52,8 +46,6 @@ services: volumes: - ./kolide.crt:/etc/osquery/kolide.crt - ./example_osquery.flags:/etc/osquery/osquery.flags - extra_hosts: - - "dockerhost:${LOCALHOST}" environment: ENROLL_SECRET: "${ENROLL_SECRET}" command: osqueryd --flagfile=/etc/osquery/osquery.flags diff --git a/tools/osquery/example_osquery.flags b/tools/osquery/example_osquery.flags index bd02119a77..9fe2b02c17 100644 --- a/tools/osquery/example_osquery.flags +++ b/tools/osquery/example_osquery.flags @@ -4,7 +4,7 @@ --debug --tls_dump=true ---tls_hostname=dockerhost:8080 +--tls_hostname=host.docker.internal:8080 --tls_server_certs=/etc/osquery/kolide.crt --enroll_secret_env=ENROLL_SECRET diff --git a/tools/osquery/kolide.crt b/tools/osquery/kolide.crt index df64546a6f..f617219e2b 100644 --- a/tools/osquery/kolide.crt +++ b/tools/osquery/kolide.crt @@ -1,20 +1,19 @@ -----BEGIN CERTIFICATE----- -MIIDSTCCAjGgAwIBAgIJANd+IKoI4t05MA0GCSqGSIb3DQEBCwUAMFExCzAJBgNV -BAYTAnVzMQswCQYDVQQIEwJrczEPMA0GA1UEBxMGa29saWRlMQ8wDQYDVQQKEwZr -b2xpZGUxEzARBgNVBAMTCmRvY2tlcmhvc3QwHhcNMTYwODAyMDAwNzM2WhcNNDMx -MjE5MDAwNzM2WjBRMQswCQYDVQQGEwJ1czELMAkGA1UECBMCa3MxDzANBgNVBAcT -BmtvbGlkZTEPMA0GA1UEChMGa29saWRlMRMwEQYDVQQDEwpkb2NrZXJob3N0MIIB -IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxbryecxRu8T3R9QX6tuBRDrV -3DTI9wHm0mDo/DTuMcPfaNXVqKPrk/ezQ+4bTrQzg/WInpuVgEsUV8dyzT9p04t8 -yKq2nFducIGuW9JR63M4lU8GVithKUeHqXE00OxsJXlU50RS69BURuFbPrLET6Er -wKQsiXPrd/Q0GuGekT/jmKOAUIvMwn7+rGaR3G/6CmxyulfRyqA45KZs+v1QtIof -YEP2xAZryIh8TsidPRHt20GfdfMcbQVXZzCCr2sdXgicozMo0ft93T47m6kNYlzc -w68ApgXbpp1iQaKt9H/ZtjlCWpDCA6KZC3AuDyaMdgOqJ7X7sVxfF2r/yZhK8wID -AQABoyQwIjAgBgNVHREEGTAXgglsb2NhbGhvc3SCCmRvY2tlcmhvc3QwDQYJKoZI -hvcNAQELBQADggEBAEqUfxeihatJg7l8tu2RQyCAja73+AyUUL5drnIaofXmvqfB -/PInzlVE8c4tela12N3tUCRnTxLWrGwbPvFPFhe9l8eX6Y8WVtJZhPABOB3R9M2m -YLM55udGZpBOuVUYzcb2KOGW1xHQXOwOODs2fvZQbm9rIQrEWpIUflLtOp7Fk7Up -hM8uKah2OEy/4tc0c5Nz83VmTVAhJX42c0NvYhJRQtSWudigdQnj7c1wYJHnCrXa -kOK1iIQktrEMyUVgScVXcOFpfwn1RHHaIcSTd4qqdhnI56e4YZeB58MClgJglBF8 -I6uHP/3vCSTAThWLUmzF1LQANxMBR0f3sTly7uI= +MIIDBjCCAe4CCQDjM7ghDw9OgDANBgkqhkiG9w0BAQsFADBFMQ4wDAYDVQQKDAVG +bGVldDEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxHTAbBgNVBAMMFGhvc3QuZG9ja2Vy +LmludGVybmFsMB4XDTE5MDMyNjE5MTQyN1oXDTQ2MDgxMDE5MTQyN1owRTEOMAwG +A1UECgwFRmxlZXQxFDASBgNVBAsMC0RldmVsb3BtZW50MR0wGwYDVQQDDBRob3N0 +LmRvY2tlci5pbnRlcm5hbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AOnDxrXtuB3VpmsExCVXboF0Llcfee4FF4Y0ifS75RjnLSXupZubQWHenBGmQ7qb +3eTBuw59HiTBkB5CZb79FpFyYrxMpXn+7dVJt2N9NnpKkVidqFXaVqTS9P84JQtt +LIPzyQlRFM482Y0RVfY1UnrWUTqze/wUpJP6xY+aPseIbnYvbsGtZ8PjrLMN+6z8 +f2Ef8Hr6uIR2mQe+qu43HuEkjbTnRi1ORj2fr4cSgoVd7FMhIy1yGEaUP4aerB3X +k1h4eOJa/Vd2eE3b3vXg7awAtdPJDWz4LjQCkgzeI5tej+TooAHM0gyun7EPSy+9 +2fgkAkEvY/dco6h+D0ULuNECAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAEhGq1t5G +ZyhXEYJrd92HHi6zyRQNlAoQ55utmE/tlNAq1e2k1uEKEeOmIFvaLpQ3ky2z1Aok +Qrn4+TYFcNN6vB99QxNVb3+hDm+hyKj0N7VvvYIX8ms/AUKZUaUahxM4gXDNky35 +l33IYgGmdcSzBiTkTCGABmtHwJ/QAPI1v6iWGXLQ42HNfCCflFHt5AtOs7Nfv0u5 +JsgkMVu+Vj9sOcdE+UtAJ/NQyV+kWFgzUtxdX8QX/NQVFqlNPVV4cRi8KMbBM1q+ +xN2o1vC27vM+5VWTr5sddU6MVJJXIIP4wfe+qbCnD8GE5+7j8XiUrOMsauiafaW2 +cdSv0nZ/WcEovw== -----END CERTIFICATE----- diff --git a/tools/osquery/kolide.key b/tools/osquery/kolide.key index 2a07da0d66..e5024c873c 100644 --- a/tools/osquery/kolide.key +++ b/tools/osquery/kolide.key @@ -1,27 +1,28 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAxbryecxRu8T3R9QX6tuBRDrV3DTI9wHm0mDo/DTuMcPfaNXV -qKPrk/ezQ+4bTrQzg/WInpuVgEsUV8dyzT9p04t8yKq2nFducIGuW9JR63M4lU8G -VithKUeHqXE00OxsJXlU50RS69BURuFbPrLET6ErwKQsiXPrd/Q0GuGekT/jmKOA -UIvMwn7+rGaR3G/6CmxyulfRyqA45KZs+v1QtIofYEP2xAZryIh8TsidPRHt20Gf -dfMcbQVXZzCCr2sdXgicozMo0ft93T47m6kNYlzcw68ApgXbpp1iQaKt9H/ZtjlC -WpDCA6KZC3AuDyaMdgOqJ7X7sVxfF2r/yZhK8wIDAQABAoIBABg7sTv8Log0u5my -BLxj6pPSIiO61GZxdTiTZ/qBAjBXMSpICseAT37y/KV2qSIcM7QYg4Xsy4XNrdCU -QR2mh/HFRqXRRlAi5wYi3puiSyfwFx81cDFfX6kPezDpDvAMCbUOCbnORdtgzPNi -6yvj/OtFdXdGp66w5krtQvWIcUabtpRnfwsXGtbTG5flR/bP+gsCBot7Qya5pzgt -Kwmetmcz+Pd0FT4KLo8dX3umtZ1iXahEEJsVtcERmz6O12FMW4iRPLAeW2akozoD -7uTsIPfFzpUvP7wZpDp4DdlgJ0xZsawjozi/3Ac5KlGXsFU78VMWLjwY1doChpax -a67pSgECgYEA9BGXgatu1LZhM+GSAzJIdJ7qoxo7kJp3xduwwLMDaX6/HRGnwcrh -gFonCOMr3RRpVpOsJrDpvX7Y1CEob50Ii8Q0sTeLiLyvqO7WyZpROnkIML5F949P -XXNJwY4yogwHEzDtdSz6DudQKQ05OUD0nkBymO1hP9SzXJUZfAlfyBkCgYEAz2Vz -aB/RTkvtRNUAaxeK76bJqnpQ0vkvJPPpVNyS4/Y6LMeQlUm8fHk4MFP07vHWpTg6 -7RFUTufR233OQn5goUCwDg365EIr5lAWlnCsSh4mkq7JQtzJ3GmAPTaPpH9ja4/W -BWOL1pUEXUqlC9oK9ujVXB6RW2OIWnA268Wr/OsCgYEAw0/0myryJTzRqm/fpbku -bEzj3aPXeM9z+5zj5EEdAOYR0BRZ1+Yf8NO0GxOX/XIhHcxM3iWC10bUA2WJc1AK -D7byp8KYYdMFCz4eGfTo/c7vM/qACSzgyRrCMic186GGY+AqljNo5FZNOpy/Z0bI -un8+dYy43xi6c+NJIo5p3LkCgYAeq8Yxc+MkTR49u7JgJA8r+eKBD628RZWvRVMQ -db5TcCqSTMEZEtqJHfQtUX07iRBRRsuQG6v4L1hduXEzbDUmI8bljTO5Zf/QA7AT -d35DR8o0jxy8gqJnskKAyvzbOuudEJx6F4qqpUcL9OoLoqdUdIJ5KRweA846cbXt -kEIrGQKBgQCgBlgdzJFL+9hXwqsk+vML6jXnnYFjK9i6fYcMEQ0p3Se1hxdjbDWa -bhs/+XVTCT1ke20esJQwpUJAudC9khkyzuHxEvd8m/dBxfcroYMu8oL4+ir8NhTM -9uMDvGZHn1+WxycsxHtd9wJSICthp28eFP+5DVfAeSUCIoOI6UQHxA== ------END RSA PRIVATE KEY----- +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDpw8a17bgd1aZr +BMQlV26BdC5XH3nuBReGNIn0u+UY5y0l7qWbm0Fh3pwRpkO6m93kwbsOfR4kwZAe +QmW+/RaRcmK8TKV5/u3VSbdjfTZ6SpFYnahV2lak0vT/OCULbSyD88kJURTOPNmN +EVX2NVJ61lE6s3v8FKST+sWPmj7HiG52L27BrWfD46yzDfus/H9hH/B6+riEdpkH +vqruNx7hJI2050YtTkY9n6+HEoKFXexTISMtchhGlD+Gnqwd15NYeHjiWv1XdnhN +29714O2sALXTyQ1s+C40ApIM3iObXo/k6KABzNIMrp+xD0svvdn4JAJBL2P3XKOo +fg9FC7jRAgMBAAECggEAPPViohqFgrIuHYY2qA4usO9dDjcVEq6dPdABkaJV0bKn +IVckNHm+CQmF5UxYKRdwO7ERWGvkKm2XaWyjH7Tb573OZZAPLsr9tjrs6bLDPAyp +7lPei9TN91lTriIz9tDXZOlzqUxNgqJ3kMPOiM/K3GF6+TXIxSmU6UnhrtroOBuq +K+o/qC5K8CnqpBhBQt6qtn/YdfbcABogRbwojnHRl068nMV9kJLp7/I5hgI8Vr+v +xMXI87wbL7kglcBZweG2EL//C31eSEVG2cW+0cIefQil0ZIPWgX0z5Oex2OD+cLL +E+FIp/waZ7plCiikNNMo+gm/4uy9iupxg+z5W71NyQKBgQD2OSTe8w2Ns9zzLIXC +5ZrFTa5LmTJ8bIv7/5kCS7fSGnoDPZvaRfnqzVEoCUp5D2N09NOJIsoNGrIGnMCc +q6HwGEzGwmOgtzYu1r2jC+6jlcJW4tMr8k52CRO3y3LvsYkmt6tYIBgMVoxIupce +QyBm5zVccyIvdhYhapgcSTJrtwKBgQDzC/30lTlBWsLiqLtfHAwM3YJgdVczJrbe +WDieUd8ywTVupDOhBSGwVGmXGLQE5G/eNfwlsBq2iij7H/WdkX6mD1YmnQJUit3x +0cPmDwWMo3vGLUUUI34WJ/2WSxdTtfaIcaFlV6S9Bp9B5K208kG/cZliqBWG1mtS +a/AdsdcPtwKBgFHan2pKzNet0qc4xuMK54/uCiJxtHnur/6/cwNzXpHHYYaQRa6j +kri/NtqjdBGYzwyDk4tEeH0wwbw3AkVTPYuO2H8/AlXccnPRyctZXSUe1TODRoaW +kATncZmpVfVfROQNLTYnvTbk0tAez7wsvqnW9UNdtyCmFidXw2er4cozAoGADuPK +MCTAODfGPrqVmBMQzez4Is6tg+24QFDpTxG2+dYKXvfiTdgRo0rYmTAjPzV7gQKP +qwNp74rxTck8c+XI+4VvAriVvvYu+LSgKsT60w3k9FQrqjsua08R4xZAnJlGPD+x +4pKG/imcsh2/YpmA26iq+/dOMk+KjacdM8SEZ2sCgYB/qypw7LpskkGA5ITODv5A +cAHVCCDMGNJiR4XpdOwHNAcd6EWjB/366/MwKfV24KnZH0RZe+pU2e4dP8miHNN0 +dFOpAokCD3Eh7LGDVM6bYkQabG3XTmN8g9a4V2e63n5Bl2HZx0Qp1bHEtqsOujpj +5G5maHPlTRoNlvk4BiEZDA== +-----END PRIVATE KEY-----