Commit Graph
7381 Commits
Author SHA1 Message Date
Juan Fernandez 4c2ddba2e4 Clean out-of-date NVD results. (#10514)
Keep the vulnerabilities detected via NVD and stored in the DB in sync. with the results from the NVD vulnerability process.
2023-04-03 13:45:18 -04:00
Katheryn Satterlee 96c2e46acd Update agent_options.overrides (#10939)
Corrected indentation for `agent_options.overrides` and added contents
to `agent_options.config.options`.

Documentation-only change.
2023-04-03 11:55:00 -05:00
dependabot[bot] 977d871bc5 Bump alpine from 3.17.2 to 3.17.3 (#10868)
Bumps alpine from 3.17.2 to 3.17.3.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=alpine&package-manager=docker&previous-version=3.17.2&new-version=3.17.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-03 11:37:22 -04:00
gillespi314 d3bbed34ec Fix unreleased UI bugs in login page, top nav, and default team (#10928) 2023-04-03 10:13:57 -05:00
KanchiMoe 23fe4bc718 lifecycle_rule on aws_s3_bucket is deprecated on loadtesting/firehose.tf (#10929)
`lifecycle_rule` on `aws_s3_bucket` is a deprecated argument.

Highlighted in this job:
https://github.com/fleetdm/fleet/actions/runs/4583725754/jobs/8094753489#step:4:57
2023-04-01 19:37:59 -04:00
KanchiMoe 2612ce7647 lifecycle_rule on aws_s3_bucket is deprecated on dogfood/firehose.tf (#10926)
`lifecycle_rule` on `aws_s3_bucket` is a deprecated argument.

Highlighted on this job:
https://github.com/fleetdm/fleet/actions/runs/4570054990/jobs/8066956394#step:4:56
2023-04-01 10:44:33 -04:00
Eric 4bfd886667 Website: Pre-fill launch-party form from personalized email links (#10907)
https://fleetdm.slack.com/archives/C01ALP02RB5/p1680103400723359

Changes:
- Updated `imagine/view-launch-party.js` to accept optional inputs
provided via a query string parameter and send two variables to the
page: `showFormOnPageLoad` and `formDataToPrefill`.
- Updated the launch-party page script to use the variables sent from
the view action to show the form when the page loads and pre-fill the
form inputs.
- Updated the launch-party waitlist form's submit button to say "RSVP"
if form inputs are pre-filled.
2023-03-31 15:58:49 -05:00
Jacob Shandling 79a1f68b4d Delete unused component (#10892) 2023-03-31 13:52:33 -07:00
Zachary Winnerman 14f9c14a84 Fix rds deprecations in loadtesting (#10922)
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).

Closes #10869
2023-03-31 16:11:21 -04:00
Mike McNeil 9316f58dff Clean up bizops rituals (#10920) 2023-03-31 14:21:39 -05:00
Mike McNeil 3542967cab Updates from latest hours report (#10919) 2023-03-31 13:37:12 -05:00
Zach Wasserman 2b10108fff Add namecheap to tools we use (#10908) 2023-03-31 10:47:50 -07:00
gillespi314 a7fb9039b2 Update UI to handle "No team" filters (#10706) 2023-03-31 12:40:14 -05:00
Roberto Dip a23b437f17 Revert "rename CleanupHostDiskEncryptionKeysTable migration (#10903)" (#10915) 2023-03-31 12:14:50 -05:00
Dave Herder 9d9ba843f0 Update README.md (#10914)
Added Account Plan documentation steps on transition of prospect to
customer.
2023-03-31 09:12:03 -07:00
Roberto Dip f253475b32 fix osquery query used to determine MDM disk encryption status (#10901) 2023-03-31 10:45:25 -05:00
Roberto Dip cc57016f02 rename CleanupHostDiskEncryptionKeysTable migration (#10903) 2023-03-31 10:44:41 -05:00
Juan Fernandez 62b3f9e672 Add missing prop to third party payload preview (#10904)
Add missing prop to third party payload preview
2023-03-31 11:26:48 -04:00
Artemis Tosini 9f908ba02c Improve documentation on GeoIP databases (#10190)
As part of my on-call I'm looking through issues that require
documentation. I saw one about GeoIP in #8570 and wrote an overview of
how to set it up and why you would want to use GeoIP.
2023-03-31 10:53:31 -04:00
Benjamin Edwards 879d02c219 add simple go osquery extension & readme to register orbit tables (#10795)
closes https://github.com/fleetdm/fleet/issues/10708

New osquery extension & readme that describes how to build and get
osqueryd to autoload.
2023-03-31 10:39:13 -04:00
Mo Zhu 7c126b4cfb MDM docs: Update macOS updates
- Add table to make Nudge behavior more readable
- Add image to better illustrate end user experience
2023-03-31 10:05:53 -04:00
RachelElysia 93dfa82fa3 Fleet UI: API only badge (#10881) 2023-03-31 09:19:40 -04:00
KanchiMoe 56187894e6 firehose.tf acl argument on aws_s3_bucket is deprecated (#10906)
The `acl` argument on `aws_s3_bucket` is deprecated, as noted by the
warning on this job:
https://github.com/fleetdm/fleet/actions/runs/4568874872/jobs/8064463410#step:4:54
2023-03-30 19:58:21 -04:00
Mike McNeil 33de0b7328 Explain why the weird “CEO sees all the consultant hours thing (#10842) 2023-03-30 17:58:26 -05:00
Patagonia121 2370caf3f1 Update preferred pronoun adding underscore (#10902) 2023-03-30 17:11:11 -05:00
Zay Hanlon 42732f4c1e Create senior-customer-success-manager.md (#10813)
Sr CSM role
(Did I do this right????)
2023-03-30 17:04:40 -05:00
KanchiMoe c56677af10 firehose.tf lifecycle_rule on "osquery-results" is deprecated (#10898)
`lifecycle_rule` on s3 buckets is deprecated, as noted by the warning on
this job:
https://github.com/fleetdm/fleet/actions/runs/4568578149/jobs/8063810135#step:4:54
2023-03-30 16:54:59 -04:00
Eric 2e2469cc9c Website: Update GitHub webhook to trigger Zapier automation (#10807)
Closes: #10247

Changes:
- Updated `receive-from-github.js` to send a POST request to Zapier when
there is a new version of Fleet published.
2023-03-30 14:50:44 -05:00
Robert Fairburn e44be70600 Include execution policy for sentry secret (#10894) 2023-03-30 13:59:37 -05:00
Zachary WinnermanandRachelElysia b5e37ce056 Rebase sandcastle onto main (#10317)
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).

---------

Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
2023-03-30 11:22:41 -07:00
Zach Wasserman 70a429327f Use proper name for ALB policy (#10889)
Fixes issue from #10887.
2023-03-30 11:15:30 -07:00
Zach Wasserman 24533da337 Require TLS 1.2 in Terraform ALB listener (#10887)
This should fix tfsec
https://aquasecurity.github.io/tfsec/v1.0.8/checks/aws/elb/use-secure-tls-policy/
by configuring
https://registry.terraform.io/modules/terraform-aws-modules/alb/aws/6.4.0#input_listener_ssl_policy_default.
2023-03-30 10:52:42 -07:00
Robert Fairburn fc84da1a36 Add Sentry secret to dogfood (#10859) 2023-03-30 12:51:12 -05:00
Robert Fairburn 0de8b58f60 Goreleaser quay push to use docker instead of podman (#10830)
This is to resolve #10693 and looks to work when it triggered on the
branch.
2023-03-30 12:46:39 -05:00
Robert Fairburn 8561b74177 Helm chart to allow mysql TLS w/o client certs (#10794)
This will allow MySQL TLS to be enabled for fleet in the helm chart with
a self-signed CA but without requiring client certs to be utilized. It
should be backwards compatible with previous values.yaml files that had
these TLS values specified, but might require someone to uncomment them
if they did not explicitly define them in their own values.

Note: this resolves #8207
2023-03-30 12:45:22 -05:00
Sharon Katz f42ea50cff 18.9.57.1 (#10861) 2023-03-30 13:31:55 -04:00
Roberto Dip 729c1e4042 automatically create DEP JSON profiles if none is set. (#10871)
#9569
2023-03-30 14:25:30 -03:00
Gabriel Hernandez cb582042cc Fix disk encryption banner displaying incorrectly on My Device page (#10875)
relates to #10786 

This fixes an issue where users would see the incorrect disk encryption
banners on the my device page. This included a change to the ingestion
logic of the `directIngestDiskEncryptionKeyDarwin` method to take into
account if a host was already being encrypted with filevault locally.

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2023-03-30 17:15:45 +01:00
Katheryn Satterlee af6b2559e9 Updating security link (#10882)
Documentation-only change:

Updated link and description for security section of Using-Fleet README
2023-03-30 11:13:26 -05:00
Eric 6bce17976d Website: Update GitHub webhook to use gpt-4 for generated haikus (#10854)
Changes:
- Changed the model used to generate haikus for closed issues.
2023-03-30 10:05:03 -05:00
Gabriel Hernandez 963d628588 move out manage host filters into their own component (#10749)
# Checklist for submitter

This removes the filtering UI from the manage hosts page. Currently it
keeps the same code (I felt it was too risky to move out the code AND do
a big rewrite) but I have other work still in progress where I try to
improve the code for filtering.

Basically this is the first step to making the code for creating and
maintaining filters a bit easier.

- [x] Manual QA for all new/changed functionality
2023-03-30 15:29:54 +01:00
Luke Heath d425367c9e Update MDM FAQ (#10857)
- Clarify which endpoint needs to be exposed to public to use MDM features
2023-03-30 10:02:49 -04:00
Benjamin Edwards 72fc98a5ac override the websocket upgrader checkorigin func to return true (#10841) 2023-03-30 08:09:47 -04:00
Luke HeathandMike McNeil 25c431da27 Add new infrastructure product group (#10852)
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
2023-03-29 22:49:02 -05:00
Sharon Katz 5f42f39019 CIS_WIN_18.9.47.9.x (#10791) 2023-03-29 16:10:15 -04:00
Eric 4510cb2bc8 Website: Add HubSpot script tag to layouts (#10863)
Changes:
- Added a HubSpot script tag to fleetdm.com

.
2023-03-29 13:20:26 -05:00
Mo Zhu 2ae011b962 clarify blank username attribute is global (#10836)
Came from https://github.com/fleetdm/fleet/issues/8119
2023-03-29 10:12:04 -07:00
RachelElysia a21c96330b CIS - WIN10 - 19.7.28 to 19.7.47 (#10781) 2023-03-29 12:53:55 -04:00
Mike McNeil 66e39d2b6f Fix accidental smooshing of content in #10846 (#10858)
Fix accidental smooshing of content in #10846
2023-03-29 11:43:32 -05:00
Roberto Dip 9896d591c4 ensure duplicates are removed before enforcing collations (#10814)
Related to #10787, this tries to find in the tables with High likelihood
described in the issue.

This successfully accounts for unique keys that contain leading/trailing
whitespace and are using a collation with a pad attribute set to `NO
PAD` (considers whitespace as any other character instead of ignoring
it)

I haven't found a way to successfully detect the same scenario for
special unicode characters, for example:

```
mysql> SELECT TABLE_NAME, TABLE_COLLATION FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = 'software';
+------------+--------------------+
| TABLE_NAME | TABLE_COLLATION    |
+------------+--------------------+
| software   | utf8mb4_general_ci |
+------------+--------------------+
1 row in set (0.01 sec)

mysql> select vendor COLLATE utf8mb4_unicode_ci from software where name = 'zchunk-libs' GROUP BY vendor COLLATE utf8mb4_unicode_ci;
+-----------------------------------+
| vendor COLLATE utf8mb4_unicode_ci |
+-----------------------------------+
| vendor                            |
| vendor?                           |
+-----------------------------------+
2 rows in set (0.01 sec)

mysql> ALTER TABLE `software` CONVERT TO CHARACTER SET `utf8mb4` COLLATE `utf8mb4_unicode_ci`;
ERROR 1062 (23000): Duplicate entry 'zchunk-libs-1.2.1-rpm_packages--vendor\2007-x86_64' for key 'unq_name'
```
> **Note** that `?`  in "vendor?" is an unicode character
2023-03-29 13:31:24 -03:00