search

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
2.93k stars 409 forks source link

Support for iptables rules #15651

Open zayhanlon opened 9 months ago

zayhanlon commented 9 months ago

Problem

As an administrator of Fleet, I have Linux hosts that only have default iptables rules today. I need them to have a certain set of rules, but ip_tables was deprecated in osquery and moved to nftables. newer linux distributions have moved from iptables to nftables. Osquery cannot parse the native nftables interfaces.

I would like to get iptables rules with Fleet.

customer-rocher - https://fleetdm.slack.com/archives/C04JD2Z4M1B/p1694467903019529 customer-ufa - https://fleetdm.slack.com/archives/C01QH02FV1N/p1693265256405769

Potential solutions

  1. osquery repo issue: https://github.com/osquery/osquery/issues/7323
noahtalerman commented 9 months ago

Hey @zwass do you know how we would approach this? Do we need to add a new table to get iptable rules?

noahtalerman commented 8 months ago

@zayhanlon heads up, this didn't make the 3 week drafting timeline so we're removing it from the drafting board. Bringing back to feature fest.

zwass commented 8 months ago

Generally I imagine the customers are actually using the new nftables and so this issue would apply: https://github.com/osquery/osquery/issues/7323

noahtalerman commented 8 months ago

Zach: We might have to implement a new nftables table (or more than one table) because the data might be different. It might not map to the existing iptables table columns.

Zach: Check out alf- and lxd- tables as potential examples.

noahtalerman commented 7 months ago

Hey @Patagonia121 heads up, this customer request didn't make it through drafting in the current design sprint.

Bringing it back to feature fest.

noahtalerman commented 6 months ago

Hey @Patagonia121, heads up, we didn't have the space to take this one on in the current design sprint (4.48).

Please feel free to bring this back to the next feature fest if it's still relevant to the customers.

noahtalerman commented 5 months ago

Hey @zwass, do you have the capacity to drive this one?

noahtalerman commented 5 months ago

cc @Patagonia121 ^^

noahtalerman commented 5 months ago

@Patagonia121 we discussed this during the last feature fest.

Let's see if Zach can help us PM this one.

Removing from feature fest.

nonpunctual commented 4 months ago

@noahtalerman @zwass @eashaw

For reference: https://github.com/fleetdm/fleet/issues/4410 - iptables table was removed.

osquery has now re-added the iptables table again to their schema: https://www.osquery.io/schema/5.12.1/#iptables

Does this mean we don't have to do anything to add iptables into the Fleet schema as we fully adopt core osquery? Is there something we need to do to enable it because it was removed?

If the iptables table will magically reappear on a future fleetd update this issue can be closed.

zwass commented 4 months ago

I'm not sure why iptables table was brought back but I think there is still work to do here. Modern Linux is not using iptables and we need to build an nftables table. A customer of ours actually has a POC for this which I will help bring to production.

nonpunctual commented 4 months ago

@zwass @noahtalerman i think adding the additional table is great but as for iptables (which our customer has explicitly said they want) will it come back into Fleet & fleetd & the table docs because it is in osquery core? If not, customer is requesting that it be enabled. Thanks.

zwass commented 4 months ago

AFAICT the iptables table was never removed (see the git history with no changes in the last 7 years https://github.com/osquery/osquery/commits/master/specs/linux/iptables.table)... I see the linked issue above where the documentation was removed from the Fleet UI at Mike's request. I'm guessing because iptables is generally not used anymore?

I don't think we have capabilities to remove core osquery tables from fleetd so I'm guessing it's just not showing in the Fleet UI but should work on any version of Fleet/fleetd. Is that incorrect?

@nonpunctual If we have customers that want to use this table, I agree that we should bring it back into the schema Fleet publishes -- and include a note indicating that it's only for legacy systems.

nonpunctual commented 4 months ago

@zwass @noahtalerman

2 updates on this:

1) customer-domon deploys vanilla osquery with Fleet. Queries using iptables work in his environment. I think this confirms what Zach said about the table still working?

2) I am going to enroll a proxmox Ubuntu instance but right at the moment I can't enroll any of my Ubuntu test VMs so I don't know if an iptables query using fleetd osquery will work. Can someone check please?

zwass commented 4 months ago

@nonpunctual can we sync up to debug why you can't enroll VMs?

nonpunctual commented 4 months ago

@noahtalerman @zwass I am going to be using proxmox but the reason I don't have any Ubuntu VMs enrolled is I have an Apple SIlicon Mac & the Fleet stuff isn't compiled for arm64. Also the Ubuntu fleetctl package for Linux seems not to work even in x86 emulation on arm64.

Here is a list of issues related to not supporting arm64:

https://github.com/fleetdm/fleet/issues/1031 https://github.com/fleetdm/fleet/issues/1845 https://github.com/fleetdm/fleet/issues/2466 https://github.com/fleetdm/fleet/issues/4420 https://github.com/fleetdm/fleet/issues/4430 https://github.com/fleetdm/fleet/issues/8257 https://github.com/fleetdm/fleet/issues/8904 https://github.com/fleetdm/fleet/issues/9047 https://github.com/fleetdm/fleet/issues/10864 https://github.com/fleetdm/fleet/issues/18532

Thanks.

noahtalerman commented 1 week ago

Zay: What’s the general ask - I want to validate Linux host firewall operation and configuration.

nonpunctual commented 1 week ago

@noahtalerman please see @zwass comment https://github.com/fleetdm/fleet/issues/15651#issuecomment-2103124916

The table is currently listed in the osquery schema docs. Because we include osquery core (unless I am misunderstanding Zach) all we need to do is make it visible & add it to our data table docs. customer-domon has need for this.

I also agree w Zach that we should either enhance this table for nftables support or make new separate one for this. Obviously, there's a need for both. Thanks. cc @zayhanlon

zayhanlon commented 1 week ago

@nonpunctual i discussed this with noah this morning, and we are in agreement that we're okay to make it visible again (at the time, Mo/Mike agreed to hide it because we were receiving a bunch of bug reports about the table not working) with the caveat that there are notes about the limitations of where it's supported. can you own updating the note for the table when it's published?

@eashaw can you unhide the iptables table? https://github.com/fleetdm/fleet/blob/main/schema/tables/iptables.yml

approved by @noahtalerman

eashaw commented 1 week ago

@zayhanlon @nonpunctual I just merged a PR that unhides the iptables table (https://github.com/fleetdm/fleet/pull/21956)