Certificates allow us to verify that claim (identity) to ensure we aren’t entering our username and password for our bank account into a fake website. For example, any server on the internet could say they are your bank and host a copy of the website. When you browse the web you are only performing a one-way authentication which is verifying the server is who they claim to be. In order to understand how mutal TLS (mTLS) works, I am going to discuss how it works in the context of Osquery (the client) and Kolide + NGINX (the server). For this blog post, Vault will act as our certificate authority for our organization.
Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log. A secret is anything that you want to tightly control access to, such as API keys, passwords, or certificates. Vault is a tool for securely accessing secrets. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes. This allows you to write SQL-based queries to explore operating system data. Osquery exposes an operating system as a high-performance relational database. However, I think for the purpose of this blog post the graphic below provides a good overview of the mutual TLS communication and why it is a powerful mechanism in information security. DISCLAIMER Background What is Mutual TLS?Īs stated by Cloudflare, “Mutual TLS (mTLS) authentication ensures that traffic is both secure and trusted in both directions between a client and server.” For a more thorough deep dive on mutual TLS please visit this blog post. Please review the Hashicorp Vault, NGINX, and Kolide documetation for best practices. This blog post is a proof of concept (POC) for a homelab and does implement best practices for an enterprise environment. Mutual TLS is a mechanism that can be implemented to verify the identity of the server and clients.
#OSQUERY KOLIDE HOW TO#
This blog post will be demonstrating how to setup Kolide + Osquery with mutual TLS (mTLS). Do you know if your Osquery client is connecting to the right server? Do you know if your Kolide server is accepting requests from rogue devices? If you have answered “I don’t know” to either of these questions then this blog post is for you.
0 kommentar(er)
