Skip to content

Instantly share code, notes, and snippets.

@Jackbennett
Last active April 16, 2018 22:03
Show Gist options
  • Save Jackbennett/e3260e954ad3d9f26e9a5e58660fb8d6 to your computer and use it in GitHub Desktop.
Save Jackbennett/e3260e954ad3d9f26e9a5e58660fb8d6 to your computer and use it in GitHub Desktop.
debugging TLS issue with osquery
osquery.flags ->
--enroll_secret_path=c:\programdata\osquery\heroku.secret
--tls_server_certs=c:\programdata\osquery\demoapponherokuapp.com.pem
--tls_hostname=demoapponherokuapp.com
--host_identifier=hostname
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_tls_refresh=10
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
jbennett $ .\osqueryd\osqueryd.exe --verbose --tls_dump --flagfile .\osquery.flags
I0208 14:19:09.878975 2708 init.cpp:380] osquery initialized [version=2.11.2]
I0208 14:19:09.990751 2708 system.cpp:344] Found stale process for osqueryd (3604)
I0208 14:19:09.991757 2708 system.cpp:377] Writing osqueryd pid (3220) to \ProgramData\osquery\osqueryd.pidfile
I0208 14:19:09.994717 2708 extensions.cpp:300] Could not autoload extensions: Failed reading: \ProgramData\osquery\extensions.load
I0208 14:19:10.058359 7364 watcher.cpp:549] osqueryd watcher (3220) executing worker (7172)
I0208 14:19:10.105185 8500 init.cpp:377] osquery worker initialized [watcher=3220]
I0208 14:19:10.120802 8500 rocksdb.cpp:132] Opening RocksDB handle: \ProgramData\osquery\osquery.db
I0208 14:19:10.174966 6544 interface.cpp:338] Extension manager service starting: \\.\pipe\osquery.em
I0208 14:19:10.253082 7692 events.cpp:746] Starting event publisher run loop: windows_event_log
I0208 14:19:10.253082 8500 main.cpp:106] Not starting the distributed query service: Distributed query service not enabled.
I0208 14:20:00.473304 2976 database.cpp:119] Resetting the database plugin: rocksdb
I0208 14:20:00.473304 2976 rocksdb.cpp:132] Opening RocksDB handle: \ProgramData\osquery\osquery.db
// Direct use of paramters over flagfile
$ .\osqueryd\osqueryd.exe --verbose --tls_dump --enroll_secret_path=c:\programdata\osquery\heroku.secret --tls_server_certs=c:\programdata\osquery\test-fleet.herokuapp.com.pem --tls_hostname=myherokutestapp.herokuapp.com:443 --host_identifier=hostname --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_tls_refresh=10 --disable_distributed=false --distributed_plugin=tls --distributed_interval=10 --distributed_tls_max_attempts=3 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls --logger_tls_endpoint=/api/v1/osquery/log --logger_tls_period=10
I0208 14:32:33.242455 5968 init.cpp:380] osquery initialized [version=2.11.2]
I0208 14:32:33.334389 5968 system.cpp:344] Found stale process for osqueryd (9876)
I0208 14:32:33.334389 5968 system.cpp:377] Writing osqueryd pid (2928) to \ProgramData\osquery\osqueryd.pidfile
I0208 14:32:33.351397 5968 extensions.cpp:300] Could not autoload extensions: Failed reading: \ProgramData\osquery\extensions.load
I0208 14:32:33.407657 3128 watcher.cpp:549] osqueryd watcher (2928) executing worker (3156)
I0208 14:32:33.470058 2336 init.cpp:377] osquery worker initialized [watcher=2928]
I0208 14:32:33.485776 2336 rocksdb.cpp:132] Opening RocksDB handle: \ProgramData\osquery\osquery.db
I0208 14:32:33.521971 4128 interface.cpp:338] Extension manager service starting: \\.\pipe\osquery.em
I0208 14:32:33.521971 2336 tls_enroll.cpp:63] TLSEnrollPlugin requesting a node enroll key from: https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll
I0208 14:32:33.588241 7456 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109
I0208 14:32:33.603744 7456 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed
I0208 14:32:33.603744 4244 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109
I0208 14:32:33.603744 4244 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed
I0208 14:32:34.689064 2336 tls.cpp:198] TLS/HTTPS POST request to URI: https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll
{"enroll_secret":"","host_identifier":"testPC","platform_type":"2","host_details":{"os_version":{"build":"16299","codename":"Windows 10 Enterprise","major":"10","minor":"0","name":"Microsoft Windows 10 Enterprise","platform":"windows","platform_like":"windows","version":"10.0.16299"},"osquery_info":{"build_distro":"windows10","build_platform":"windows","config_hash":"","config_valid":"0","extensions":"active","instance_id":"fbdb55c6-0d0a-42b1-9555-a","pid":"3156","start_time":"1518100353","uuid":"03000200-0400-0500-0006-a","version":"2.11.2","watcher":"2928"},"platform_info":{"revision":"4.6","vendor":"American Megatrends Inc.","version":"F5"},"system_info":{"computer_name":"testPC","cpu_brand":"AMD A8-7600 Radeon R7, 10 Compute Cores 4C+6G \u0000","cpu_logical_cores":"4","cpu_physical_cores":"2","cpu_subtype":"-1","cpu_type":"x86_64","hardware_model":"To be filled by O.E.M.","hardware_serial":"To be filled by O.E.M.","hardware_vendor":"Gigabyte Technology Co., Ltd.","hardware_version":"-1","hostname":"testPC.BHS.INTERNAL","local_hostname":"testPC","physical_memory":"7436816384","uuid":"03000200-0400-0500-0006-a"}}}
W0208 14:32:35.360852 2336 tls_enroll.cpp:70] Failed enrollment request to https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll (Request error: short read) retrying...
I0208 14:32:36.422719 4740 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109
I0208 14:32:36.422719 4740 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed
I0208 14:32:36.422719 4752 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109
I0208 14:32:36.438349 4752 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed
I0208 14:32:37.520140 2336 tls.cpp:198] TLS/HTTPS POST request to URI: https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll
{"enroll_secret":"rvHrqStn1kMUO6T5uaTBpjzE3++zCPIh","host_identifier":"testPC","platform_type":"2","host_details":{"os_version":{"build":"16299","codename":"Windows 10 Enterprise","major":"10","minor":"0","name":"Microsoft Windows 10 Enterprise","platform":"windows","platform_like":"windows","version":"10.0.16299"},"osquery_info":{"build_distro":"windows10","build_platform":"windows","config_hash":"","config_valid":"0","extensions":"active","instance_id":"fbdb55c6-0d0a-42b1-9555-a","pid":"3156","start_time":"1518100353","uuid":"03000200-0400-0500-0006-a","version":"2.11.2","watcher":"2928"},"platform_info":{"revision":"4.6","vendor":"American Megatrends Inc.","version":"F5"},"system_info":{"computer_name":"testPC","cpu_brand":"AMD A8-7600 Radeon R7, 10 Compute Cores 4C+6G \u0000","cpu_logical_cores":"4","cpu_physical_cores":"2","cpu_subtype":"-1","cpu_type":"x86_64","hardware_model":"To be filled by O.E.M.","hardware_serial":"To be filled by O.E.M.","hardware_vendor":"Gigabyte Technology Co., Ltd.","hardware_version":"-1","hostname":"testPC.BHS.INTERNAL","local_hostname":"testPC","physical_memory":"7436816384","uuid":"03000200-0400-0500-0006-a"}}}
W0208 14:32:37.535724 2336 tls_enroll.cpp:70] Failed enrollment request to https://myherokutestapp.herokuapp.com:443/api/v1/osquery/enroll (Request error: short read) retrying...
@ankurpshah
Copy link

@Jackbennett I am also facing the same issue as above. Any solution?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment