FleetDM Port mismatch

[adamphetamine]

Hi,
In the docs it indicates that fleet is active on port 8080. But in the so-allow docs, the so-allow function opens port 8090, which is correct please?

In addition, I when set fleet to be on port 8090, I can't get access via fleetctl-
If I use a remote computer to try to join fleetctl, I get the error message 'The Fleet instance is not set up yet'
I am unable to use the Manager node for fleetctl because I cannot understand the instructions. I'm guessing you need to install fleetctl manually on the Manager node?

fleet is running in SO, have not tested getting clients/ hosts connected.

References
Port 8080
https://docs.securityonion.net/en/2.3/fleet.html
port 8090
https://docs.securityonion.net/en/2.3/so-allow.html
'Fleet instance not set up yet'
#4064

[adamphetamine]

closing this because

• looks like nginx uses the public port 8090 and sends data via the proxy to 8080 internally

I couldn't find anything in the docs that mentions this explicitly, but in case you don't want to send yourself batty for hours on end, the config is in

/opt/so/saltstack/default/salt/nginx/etc/nginx.conf

Thanks to this hint on Server Fault-

https://serverfault.com/questions/1081384/how-do-you-edit-nginx-config-in-security-onion-2

So I still have an issue because 'Fleet instance not set up yet' but getting closer

[defensivedepth]

How are you setting up FleetDM with SO? You shouldnt have to deal with any of this stuff, just select the component when you install Security Onion and it will automatically set everything up for you.

[adamphetamine]

Thanks for the reply- I really don't know what I've done wrong, but in the last 3 days I am finally making progress.

Looks like maybe the 'fleet serve' command was never issued?
That could be the reason for 'Fleet instance not set up yet'
But Fleet web portal is working, I just can't find references to the error

can't get hosts connected because
'authentication handshake failed: x509: certificate is valid for sec, not sec.domain.com.au'

I suppose it needs the '--insecure' flags, but I've been looking at whether I can integrate letsencrypt somehow to get around this...
I'm happy to write up the solutions when I find them, but I am a bit overwhelmed

[defensivedepth]

During the Security Onion setup, all you should need to do is select osquery - as seen here: https://youtu.be/4OpInrItxo8?list=PLljFlTO9rB155aYBjHw2InKkSMLuhWpxH&t=382

And then download the osquery installers that are under Downloads in the Security Onion Console.