How do we rebuild the osquery installers after changing "url_base" in global.sls?

[jtgreen-cse]

How do we rebuild the fleet installers after changing "url_base" in global.sls?

I'm assuming there's a special salt spell/incantation/chant.

[defensivedepth]

I have updated the docs to include that incantation: ;)

https://docs.securityonion.net/en/2.3/osquery.html#agents

Be sure that the output of that command looks correct. It will take up to 5 minutes to rebuild the packages - you will need to refresh the Downloads page to see the new ones once they are generated.

[jtgreen-cse]

I got it all working using a combination of url_base and setting fleet_custom_hostname, seems that makes a cert the agents are happy with. I believe there's nothing wrong with how everything is implemented (maybe an edge case isn't covered concerning only IPs), I just wasn't setting fleet_custom_hostname.

[defensivedepth]

Can you walk me through the flow of changes in regards to url_base? What is was originally set to, etc? I would like to make sure there isn't a deeper issue here.

[jtgreen-cse]

First I changed url_base to an IP, leaving fleet_custom_hostname empty. This sets the launcher to go to the url_base in the flags, but the nginx cert doesn't contain the url_base IP/hostname, so the launcher fails since the x509 cert is invalid according to launcher.

I then switched the url_base to a domain AND set fleet_custom_hostname to the same domain, this adds the fleet hostname to the nginx cert, and the launcher obviously gets the same url_base hostname, this works since the cert is valid and is what launcher is expecting.

I didn't try setting the url_base and fleet_custom_hostname to an IP. Judging by how the ssl state manages the cert with DNS: and IP Address: dunno if it would work with just and IP.

Might be worth managing a separate fleet cert?

[SanibelJack]

I'm having the same issue... What command do you run to change the url_base and fleet_custom_hostname

Thx
Jack

[chrismengle]

Thank you for this discussion, it helped me immensely and otherwise I would be stuck.
Problem in Windows event log:
Log Name: Application
Source: launcher
Details: transport: authentication handshake failed: x509: certificate is valid for <IP ADDRESS 1>, not <IP ADDRESS 2>
Steps to resolution

1. Set fleet_custom_hostname by editing /opt/so/saltstack/local/pillar/global.sls (set same IP as url_base)
2. Moved fleet.* and managerssl.* files in /etc/pki to a backup directory
3. Ran sudo salt-call state.apply fleet.event_gen-packages (this may not be needed depending if you have the correct launcher.flags, roots.pem, and secret configuration)
4. Ran so-fleet-restart
5. Ran so-nginx-restart
   Note: I believe restarting nginx auto-generated the new certs, I could be wrong about that because I ran so man commands trying to resolve this I lost track. Attempting salt-call state.apply ssl.init only produced ssl.init_state_not_allowed errors in my case.

[osborng]

I am experiencing the same issue (transport authentication handshake failed x509 certificate is valid for "internalhost" not "externalhost") and no matter what changes I make, the certificate never gets updated and still uses the internal hostname (or IP if I set the base_url to the IP). The packages are being regenerated successfully with "salt-call state.apply fleet.event_gen-packages". I've tried updating the fleet_custom_hostname and running "salt-call state.apply fleet.event_update-custom-hostname", then regenerating the packages again, but still have the same issue. Is there a step I'm missing (maybe an SSL salt command)?

[UMHB-InfoSec]

I finally got this to work! Had to run your steps several times slightly tweaking the Global.sls file... But it works now.

Can you elaborate on what you did? What tweaks did you make?

Did you update the fleet_hostname too?

[shatteredsword]

3. Ran "salt-call state.apply ssl.init", which recreated the certificates I removed in the previous step

This step fails for me. I get this result:

[ERROR   ] Failure!
local:
----------
          ID: ssl.init_state_not_allowed
    Function: test.fail_without_changes
      Result: False
     Comment: Failure!
     Started: 19:19:13.421582
    Duration: 0.979 ms
     Changes:

Summary for local
------------
Succeeded: 0
Failed:    1
------------
Total states run:     1
Total run time:   0.979 ms

[dougburks]

If you get init_state_not_allowed that usually means that you are running the command on the wrong node. Try running that command on your manager.

[presianbg]

@dougburks I'm having the exact same issue:

[ERROR   ] Failure!
local:
----------
          ID: ssl.init_state_not_allowed
    Function: test.fail_without_changes
      Result: False
     Comment: Failure!
     Started: 19:16:05.877075
    Duration: 2.8 ms
     Changes:   

Summary for local
------------
Succeeded: 0
Failed:    1
------------
Total states run:     1
Total run time:   2.800 ms

This is on our manager node.

[defensivedepth]

@presianbg @shatteredsword Please create a new Discussion with details pertaining to your issue.