empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 08:55:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Updating docs for enroll secret in system keystore (#16985)

Browse Source 
#13832
This commit is contained in:
Victor Lyuboslavsky 2024-02-23 11:39:17 -06:00 committed by GitHub
parent 64e76f6f10
commit ad6b16fa3e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
docs/Using Fleet/enroll-hosts.md
View File

@ -130,6 +130,7 @@ How to unenroll a host from Fleet:
- [Specifying update channels](#specifying-update-channels)
- [Testing osquery queries locally](#testing-osquery-queries-locally)
- [Finding fleetd logs](#finding-fleetd-logs)
- [Using system keystore for enroll secret](#using-system-keystore-for-enroll-secret)
- [Generating Windows installers using local WiX toolset](#generating-windows-installers-using-local-wix-toolset)
- [Experimental features](#experimental-features)
@ -294,6 +295,14 @@ If the `logger_path` agent configuration is set to `filesystem`, fleetd will sen
- macOS: /opt/orbit/osquery_log
- Linux: /opt/orbit/osquery_log
### Using system keystore for enroll secret
On macOS and Windows, fleetd will add the enroll secret to the system keystore (Keychain on macOS, Credential Manager on Windows) on launch. Subsequent launches will retrieve the enroll secret from the keystore.
System keystore access can be disabled via `--disable-keystore` flag for the `fleetctl package` command. On macOS, subsequent installations of fleetd must be signed by the same organization as the original installation to access the enroll secret in the keychain.
>**Note:** The keychain is not used on macOS when the enroll secret is provided via MDM profile. Keychain support when passing the enroll secret via MDM profile is coming soon.
### Generating Windows installers using local WiX toolset
`Applies only to Fleet Premium`