Fleet Osquery Manager offers a robust open-source solution for maintaining secure servers and workstations. This detailed guide will take you through the process of installing and configuring Fleet Osquery Manager on Rocky Linux 9.
What is Fleet Osquery Manager?
Fleet is an open-source osquery manager that assists in maintaining secure servers, containers, and devices such as laptops and local computers. The key benefits of Fleet include programmable live queries, real-time visibility of servers, and streaming logs.
With Fleet, one can effectively identify vulnerabilities on devices. This includes outdated software, apps, packages, and device misconfigurations. Fleet is especially beneficial for IT industries, security, or any compliance monitoring devices.
Prerequisites for Fleet Osquery Manager Installation
Before you start the installation process, ensure that you have the following:
- A Linux server running Rocky Linux 9
- A non-root user with sudo/root administrator privileges
- An SELinux running on permissive mode
- A domain name pointed to the server IP address
- Generated and verified SSL/TLS certificates
Once you’re set up with these requirements, you’re ready to start the Fleet Osquery Manager installation.
Installing MySQL Server on Rocky Linux 9
In this step, you’ll install the MySQL server, which will be used to store data and information of the Fleet manager. The MySQL server can be installed from the official Rocky Linux repository using the following command:
sudo dnf install mysql-server
Start and enable the MySQL service using the systemctl command:
sudo systemctl start mysqld sudo systemctl enable mysqld
After starting the MySQL service, you can set up the MySQL server root password. For this, log in to MySQL shell and set up a password for the MySQL root user:
sudo mysql ALTER USER "root"@"localhost" IDENTIFIED WITH mysql_native_password BY "YourPassword"; exit
Next, secure your MySQL server deployment using ‘mysqlsecureinstallation’:
sudo mysql_secure_installation
Installing Redis Server on Rocky Linux 9
Redis server is used to ingest and queue the results of distributed queries, cache data, etc. Redis can be installed on Rocky Linux 9 by entering the following command:
sudo dnf install redis
Once installed, start and enable the Redis server:
sudo systemctl start redis sudo systemctl enable redis
Setting Up a MySQL Database and User
In this step, you will create a new MySQL database and user for Fleet Osquery Manager. Log in to MySQL shell and create a new database and user:
sudo mysql -u root -p CREATE DATABASE fleetdb; CREATE USER fleetadmin@localhost IDENTIFIED BY 'YourPassword'; GRANT ALL PRIVILEGES ON fleetdb.* TO fleetadmin@localhost WITH GRANT OPTION; FLUSH PRIVILEGES; exit
Downloading Fleet Osquery Manager
Fleet Osquery Manager is available as a single binary file. In this step, you’ll download the Fleet and Fleetctl binary package. First, add a new system user ‘fleet’:
sudo useradd -r -d /opt/fleet -s /usr/sbin/nologin fleet
Then, download the Fleet and Fleetctl package and extract them:
curl -LO https://github.com/fleetdm/fleet/releases/download/fleet-v4.26.0/fleet_v4.26.0_linux.tar.gz curl -LO https://github.com/fleetdm/fleet/releases/download/fleet-v4.26.0/fleetctl_v4.26.0_linux.tar.gz tar xf fleet_v4.26.0_linux.tar.gz tar xf fleetctl_v4.26.0_linux.tar.gz
Next, copy the binary files of Fleet and Fleetctl to the ‘/usr/bin’ directory:
cp fleet_v4.26.0_linux/fleet /usr/bin/ cp fleetctl_v4.26.0_linux/fleetctl /usr/bin/
Verify the Fleet and Fleetctl version:
fleet version
fleetctl --version
Lastly, initialize the database for your Fleet deployment:
fleet prepare db \ --mysql_address=127.0.0.1:3306 --mysql_database=fleetdb --mysql_username=fleetadmin --mysql_password=YourPassword
Configuring Fleet Osquery Manager
In this stage, you’ll create a new configuration directory for Fleet and modify the Fleet config file. Create a new directory ‘/etc/fleet/certs’ and a new config file ‘/etc/fleet/fleet.yml’:
mkdir -p /etc/fleet/certs touch /etc/fleet/fleet.yml
Next, copy your generated TLS certificates to the ‘/etc/fleet/certs’ directory and change the ownership of the Fleet configuration directory to the user and group ‘fleet’:
cp /etc/letsencrypt/live/YourDomain/fullchain.pem /etc/fleet/certs/ cp /etc/letsencrypt/live/YourDomain/privkey.pem /etc/fleet/certs/ sudo chown -R fleet:fleet /etc/fleet
Open the Fleet config file ‘/etc/fleet/fleet.yml’ and add the following lines:
mysql: address: 127.0.0.1:3306 database: fleetdb username: fleetadmin password: YourPassword redis: address: 127.0.0.1:6379 server: cert: /etc/fleet/certs/fullchain.pem key: /etc/fleet/certs/privkey.pem logging: json: true
This will configure Fleet with MySQL database server, Redis, and enable logging to json format.
Configuring Firewalld
In this section, you will open port 8080 (used by Fleet) on your system via Firewalld:
sudo firewall-cmd --add-port=8080/tcp --permanent sudo firewall-cmd --reload
Configuring Fleet Osquery Manager
With Fleet Osquery Manager running and port 8080 added to Firewalld, you can now set up the Fleet Osquery Manager deployment. Open your web browser and visit the domain of your Fleet Osquery Manager installation with TCP port 8080.
Adding Hosts via Orbit Osquery Runtime
In this step, you’ll learn how to generate an Orbit package installer for RHEL-based distributions and add a new host to Fleet via Orbit.
Setting Up Fleetctl for Managing Fleet
Fleetctl allows you to manage configurations, queries, and generate an osquery installer from the terminal. In this step, you’ll set up Fleetctl and connect to the Fleet Osquery Manager:
fleetctl config set --address https://YourDomain:8080 fleetctl login --email [email protected]
Conclusion
In this tutorial, you’ve installed Fleet Osquery Manager on a Rocky Linux 9 server. With this, you can now add new hosts to Fleet Osquery Manager via Orbit or manually by generating Fleet secret and TLS certificate.
As an additional note, if you’re looking for a reliable hosting service for your Fleet Osquery Manager, consider Shape.host. They offer efficient, scalable, and secure Cloud Linux VPS solutions, perfect for running applications like Fleet Osquery Manager.