fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
2.99k stars 415 forks source link

MDM bootstrap package and fleetd should be always delivered when an ABM host enrolls #12482

Closed roperzh closed 1 year ago

roperzh commented 1 year ago

Fleet version: 4.32.0

🧑‍💻  Expected behavior

A host that's assigned to Fleet in ABM always receives a bootstrap package

💥  Actual behavior

A host that was enrolled into Fleet but was wiped didn't receive the bootstrap package

👣 Reproduction steps

  1. Enroll an ABM host using DEP
  2. Verify that fleetd and the bootstrap package are installed
  3. Reset the device to factory settings
  4. Enroll the device again
  5. Note how fleetd and the bootstrap package are not delivered
roperzh commented 1 year ago

@mna @gillespi314 we need a reliable way to detect manual vs automatic enrollments. We currently rely on setting host_mdm.installed_from_dep when we ingest a host from ABM, but this doesn't cover all cases, for example: a host that's reset to factory settings (like this case)

I have two solutions in mind, I would love to hear your input before choosing one:

  1. Add a query parameter to the enroll URL we set in the enrollment profile, something like enrollment_type=manual
  2. Assume that if we have a row in the host_dep_assignments, the host is automatically enrolling.

2 is way simpler, but less precise (a host assigned to Fleet in ABM could still be manually enrolling)

1 is more precise but will include a not-so-simple migration and taking into account things like profile assignment in ABM.

What do you think?

fleet-release commented 1 year ago

MDM package flows, Fresh like a stream in the clouds, Always delivered.

roperzh commented 1 year ago

reopening, I think this was unintentionally closed

xpkoala commented 1 year ago

Tested and fixed!

fleet-release commented 1 year ago

Fleet delivers care, Even to wiped devices, Clouds hold no lost hosts.