Fleet Osquery Manager offers a robust open-source solution for maintaining secure servers and workstations. This detailed guide will take you through the process of installing and configuring Fleet Osquery Manager on Rocky Linux 9.

What is Fleet Osquery Manager?

Fleet is an open-source osquery manager that assists in maintaining secure servers, containers, and devices such as laptops and local computers. The key benefits of Fleet include programmable live queries, real-time visibility of servers, and streaming logs.

With Fleet, one can effectively identify vulnerabilities on devices. This includes outdated software, apps, packages, and device misconfigurations. Fleet is especially beneficial for IT industries, security, or any compliance monitoring devices.

Prerequisites for Fleet Osquery Manager Installation

Before you start the installation process, ensure that you have the following:

1. A Linux server running Rocky Linux 9
2. A non-root user with sudo/root administrator privileges
3. An SELinux running on permissive mode
4. A domain name pointed to the server IP address
5. Generated and verified SSL/TLS certificates

Once you’re set up with these requirements, you’re ready to start the Fleet Osquery Manager installation.

Installing MySQL Server on Rocky Linux 9

In this step, you’ll install the MySQL server, which will be used to store data and information of the Fleet manager. The MySQL server can be installed from the official Rocky Linux repository using the following command:

sudo dnf install mysql-server

Start and enable the MySQL service using the systemctl command:

sudo systemctl start mysqld
sudo systemctl enable mysqld

After starting the MySQL service, you can set up the MySQL server root password. For this, log in to MySQL shell and set up a password for the MySQL root user:

sudo mysql
ALTER USER "root"@"localhost" IDENTIFIED WITH mysql_native_password BY "YourPassword";
exit

Next, secure your MySQL server deployment using ‘mysqlsecureinstallation’:

sudo mysql_secure_installation

Installing Redis Server on Rocky Linux 9

Redis server is used to ingest and queue the results of distributed queries, cache data, etc. Redis can be installed on Rocky Linux 9 by entering the following command:

sudo dnf install redis

Once installed, start and enable the Redis server:

sudo systemctl start redis
sudo systemctl enable redis

Setting Up a MySQL Database and User

In this step, you will create a new MySQL database and user for Fleet Osquery Manager. Log in to MySQL shell and create a new database and user:

sudo mysql -u root -p
CREATE DATABASE fleetdb;
CREATE USER fleetadmin@localhost IDENTIFIED BY 'YourPassword';
GRANT ALL PRIVILEGES ON fleetdb.* TO fleetadmin@localhost WITH GRANT OPTION;
FLUSH PRIVILEGES;
exit

Downloading Fleet Osquery Manager

Fleet Osquery Manager is available as a single binary file. In this step, you’ll download the Fleet and Fleetctl binary package. First, add a new system user ‘fleet’:

sudo useradd -r -d /opt/fleet -s /usr/sbin/nologin fleet

Then, download the Fleet and Fleetctl package and extract them:

curl -LO https://github.com/fleetdm/fleet/releases/download/fleet-v4.26.0/fleet_v4.26.0_linux.tar.gz
curl -LO https://github.com/fleetdm/fleet/releases/download/fleet-v4.26.0/fleetctl_v4.26.0_linux.tar.gz
tar xf fleet_v4.26.0_linux.tar.gz
tar xf fleetctl_v4.26.0_linux.tar.gz

Next, copy the binary files of Fleet and Fleetctl to the ‘/usr/bin’ directory:

cp fleet_v4.26.0_linux/fleet /usr/bin/
cp fleetctl_v4.26.0_linux/fleetctl /usr/bin/

Verify the Fleet and Fleetctl version:

fleet version
fleetctl --version

Lastly, initialize the database for your Fleet deployment:

fleet prepare db \
--mysql_address=127.0.0.1:3306 --mysql_database=fleetdb --mysql_username=fleetadmin --mysql_password=YourPassword

Configuring Fleet Osquery Manager

In this stage, you’ll create a new configuration directory for Fleet and modify the Fleet config file. Create a new directory ‘/etc/fleet/certs’ and a new config file ‘/etc/fleet/fleet.yml’:

mkdir -p /etc/fleet/certs
touch /etc/fleet/fleet.yml

Next, copy your generated TLS certificates to the ‘/etc/fleet/certs’ directory and change the ownership of the Fleet configuration directory to the user and group ‘fleet’:

cp /etc/letsencrypt/live/YourDomain/fullchain.pem /etc/fleet/certs/
cp /etc/letsencrypt/live/YourDomain/privkey.pem /etc/fleet/certs/
sudo chown -R fleet:fleet /etc/fleet

Open the Fleet config file ‘/etc/fleet/fleet.yml’ and add the following lines:

mysql:
  address: 127.0.0.1:3306
  database: fleetdb
  username: fleetadmin
  password: YourPassword
redis:
  address: 127.0.0.1:6379
server:
  cert: /etc/fleet/certs/fullchain.pem
  key: /etc/fleet/certs/privkey.pem
logging:
  json: true

This will configure Fleet with MySQL database server, Redis, and enable logging to json format.

Configuring Firewalld

In this section, you will open port 8080 (used by Fleet) on your system via Firewalld:

sudo firewall-cmd --add-port=8080/tcp --permanent
sudo firewall-cmd --reload

Configuring Fleet Osquery Manager

With Fleet Osquery Manager running and port 8080 added to Firewalld, you can now set up the Fleet Osquery Manager deployment. Open your web browser and visit the domain of your Fleet Osquery Manager installation with TCP port 8080.

Adding Hosts via Orbit Osquery Runtime

In this step, you’ll learn how to generate an Orbit package installer for RHEL-based distributions and add a new host to Fleet via Orbit.

Setting Up Fleetctl for Managing Fleet

Fleetctl allows you to manage configurations, queries, and generate an osquery installer from the terminal. In this step, you’ll set up Fleetctl and connect to the Fleet Osquery Manager:

fleetctl config set --address https://YourDomain:8080
fleetctl login --email [email protected]

Conclusion

In this tutorial, you’ve installed Fleet Osquery Manager on a Rocky Linux 9 server. With this, you can now add new hosts to Fleet Osquery Manager via Orbit or manually by generating Fleet secret and TLS certificate.

As an additional note, if you’re looking for a reliable hosting service for your Fleet Osquery Manager, consider Shape.host. They offer efficient, scalable, and secure Cloud Linux VPS solutions, perfect for running applications like Fleet Osquery Manager.

Christian Wells