Commit graph

124 commits

Author SHA1 Message Date
jacobshandling
61a79f536b
Include Linux disk encryption status in configuration profiles aggregate status response when applicable, fix disk encryption/MDM configuration order-of-operations issues, add integration tests for LUKS (#24114)
## Addresses #24112, #24116, #23587

**For #24112, Counts included:**
<img width="1392" alt="Screenshot 2024-11-22 at 5 31 06 PM"
src="https://github.com/user-attachments/assets/2bb306d7-1130-4106-aef8-475b8be1f6b2">

- [x] Include counts when disk encryption is enforced
- [x] Exclude counts when disk encryption isn't enforced
__
- [x] Added/updated tests

---------

Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
2024-11-25 08:34:43 -06:00
jacobshandling
096d67dd5a
Linux disk encryption: frontend changes, backend missing private key errors, remove disk encryption endpoints dependence on MDM being enabled (#23714)
## Addresses #22702,  #23713, #23756, #23746, #23747, and #23876
_-Note that much of this code as is will render as expected only once
integrated with the backend or if manipulated manually for testing
purposes_

**Frontend**:
- Update banners on my device page, tests
- Build new logic for calling endpoint to trigger linux key escrow on
clicking `Create key`
- Add `CreateLinuxKeyModal` to inform user of next steps after clicking
`Create key`
- Update banners on host details page, tests
- Update the Controls > OS settings section with new logic related to
linux disk encryption
- Expect and include counts of Linux hosts in aggregate disk encryption
stats UI
- Add "Linux" column to the disk encryption table
- Show disk encryption related UI for supported Linux platforms
- TODO: confirm platform string matching functionality in manual e2e
testing
- Expand capabilities of `SectionHeader` component, apply to new UI
- Flash "missing private key" error, with clickable link, when trying to
update disk encryption enabled while no server private key is present.
- TODO: QA this once other endpoints on Controls > Disk encryption are
enabled even when MDM not turned on
- Update Disk encryption key modal copy


-Other TODO:
  - Confirm when integrated with API:
    - Aggregate disk encryption counts
    - Disk encryption table Linux column
    - Show disk encryption key action on host details page when expected
    - Opens Disk encryption key modal, displays key as expected
  
**Backend**:
- For "No team" and teams, error when trying to update disk encryption
enabled while no server private key is present.
- Remove requirement of mdm being enabled for use of various endpoints
related to Linux disk encryption
- Update tests


_________
**Host details and my device page banners**

![banners](https://github.com/user-attachments/assets/b76fbfbd-0969-40eb-b8b1-9fd0d4fd0f4f)

**Create key modal**
<img width="1799" alt="create-key-modal"
src="https://github.com/user-attachments/assets/81a55ccb-b6b9-4eb6-b2ff-a463c60724c0">

**Enabling disk encryption**

![turning-on-enforcement](https://github.com/user-attachments/assets/005010b9-2238-46f8-9579-f07823898a78)

**Disk encryption: Fleet free**
<img width="1912" alt="free"
src="https://github.com/user-attachments/assets/9f9cace3-8955-47c2-87d9-24ff9387ac1a">

**Custom settings: turn on MDM**
<img width="1912" alt="turn on mdm"
src="https://github.com/user-attachments/assets/4d3ad47b-4035-4d93-86f0-dc2691b38bb4">

**Device status indicators**

![host-status-indicators](https://github.com/user-attachments/assets/5fc72c1e-816b-45b3-a650-5c1fcc48f09e)

**Encryption key action and modal**

![de-key-action-and-modal](https://github.com/user-attachments/assets/632f7b2c-c07e-4e30-87ef-e6437ae42a78)



- [x] Changes file added for user-visible changes in `changes/`
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
  - [ ] Full e2e testing to do when integrated with backend

---------

Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
2024-11-20 11:58:47 -08:00
gillespi314
28e4cf6cf7 Merge branch 'main' into feat-include-any-label 2024-11-14 08:33:03 -06:00
Zach Wasserman
8c21dff636
Add capability to serve YARA rules via authenticated Fleet endpoints (#23343)
Implements the Fleet side of #14899

- Add new endpoints to update and retrieve yara rules
- Add support in fleetctl for applying the rules

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`.
  See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.
- [x] Added/updated tests
- [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes
- [x] If database migrations are included, checked table schema to confirm autoupdate
- For database migrations:
  - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration.
  - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects.
  - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Manual QA for all new/changed functionality
2024-11-13 09:01:08 -08:00
Ian Littman
d746b9179a
Record activity when activity automations are enabled/edited/disabled (#23477)
#21709, re-roll/expansion of work done by @ilpianista in #21368

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality

---------

Co-authored-by: Andrea Scarpino <andrea@scarpino.dev>
2024-11-08 09:07:56 -06:00
Dante Catalfamo
aa3fd29c13
Profile Labels Include Any CLI (#23434)
#22576


Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
2024-11-05 15:13:44 -05:00
Lucas Manuel Rodriguez
f16c941d89
Fix PATCH /api/latest/fleet/config to not clear VPP token/team associations when not set (#23175)
#23174

PS: Make sure to render the diff without whitespace changes.
![Screenshot 2024-10-24 at 10 58
47 AM](https://github.com/user-attachments/assets/fb36c995-206c-4a15-8bf2-6b375c5cc565)


- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-10-25 10:01:18 -03:00
Tim Lee
d69100940e
Add config for custom MDM URL (#22878) 2024-10-22 11:05:35 -06:00
Victor Lyuboslavsky
383d03cd6d
GitOps support for NDES SCEP proxy config. (#22918)
#22124

# Demo
<div>
<a href="https://www.loom.com/share/ad30efda816e4bf3abca0eab92b6e928">
      <p>[Demo] NDES SCEP proxy gitops #21955 - Watch Video</p>
    </a>
<a href="https://www.loom.com/share/ad30efda816e4bf3abca0eab92b6e928">
<img style="max-width:300px;"
src="https://cdn.loom.com/sessions/thumbnails/ad30efda816e4bf3abca0eab92b6e928-33b1f073da294133-full-play.gif">
    </a>
  </div>

# Checklist for submitter
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-10-16 11:12:48 -05:00
Victor Lyuboslavsky
808d6a0007
Added activity feed items for NDES SCEP proxy config. (#22902)
For #21955 (the story has a video demo of core functionality)

Follow up for PR #22542

# Checklist for submitter

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-10-14 15:55:52 -05:00
Victor Lyuboslavsky
d083033361
Added fleet variable validation at profile upload. (#22864)
For #21955 (the story has a video demo of core functionality)

Follow up for PR #22542

# Checklist for submitter
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-10-11 11:15:11 -05:00
Victor Lyuboslavsky
567803955e
NDES SCEP proxy backend (#22542)
#21955

<div>
<a href="https://www.loom.com/share/ba40b440502845d2861fd3ec7611bade">
<p>[Demo] Deploy SCEP certificates from Network Device Enrollment
Service (NDES) #21955 - Watch Video</p>
    </a>
<a href="https://www.loom.com/share/ba40b440502845d2861fd3ec7611bade">
<img style="max-width:300px;"
src="https://cdn.loom.com/sessions/thumbnails/ba40b440502845d2861fd3ec7611bade-84f2d88c9f5106c2-full-play.gif">
    </a>
  </div>

Note: A few remaining subtasks will be done in a follow-up PR. See
#22123 for a detailed list.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-10-09 13:47:27 -05:00
Jahziel Villasana-Espinoza
80f0fd8889
fix: reset token team assignments to defaults (#22326)
> Related issue: #22198

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-10-01 10:26:16 -04:00
Dante Catalfamo
8ad0d59016
Add clearer error for VPP token constraint failure (#21967)
#21890
2024-09-11 14:11:28 -04:00
Dante Catalfamo
299a9e1008
Improve error message for controls.windows_enable_and_configure (#21944)
#21402
2024-09-10 11:25:11 -04:00
Roberto Dip
4eb9cf72ad
MABM: fixes and re-enable integration tests (#21834)
for #21309, this also fixes a few bugs found along the way

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-09-05 14:10:35 -03:00
Martin Angers
73222541da
MABM: fix non-integrations skipped tests part 2 (#21805) 2024-09-04 15:17:32 -04:00
Martin Angers
a16733e02f
MABM: fix/update non-integration MABM-related skipped tests (#21799) 2024-09-04 10:08:22 -04:00
Jahziel Villasana-Espinoza
a00559e732
feat: enable multiple ABM and VPP tokens (#21693)
> Related issue: #9956 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Manual QA for all new/changed functionality

---------

Co-authored-by: Martin Angers <martin.n.angers@gmail.com>
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
Co-authored-by: Roberto Dip <rroperzh@gmail.com>
Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
Co-authored-by: Dante Catalfamo <43040593+dantecatalfamo@users.noreply.github.com>
Co-authored-by: Roberto Dip <dip.jesusr@gmail.com>
2024-08-29 18:51:46 -04:00
Lucas Manuel Rodriguez
70d4558448
Backend support for iOS/iPadOS OS updates (#20649)
#20469 and #20471

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
2024-07-24 14:34:23 -03:00
Martin Angers
c10a4d3f7b
CP Exclude Labels: API changes (#19846) 2024-06-25 15:26:28 -04:00
Roberto Dip
1cc13a09fb
🧹 friday cleanup party: substitute deprecated import of go-kit (#19774)
`go-kit/kit/log` was deprecated and generating warnings

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Manual QA for all new/changed functionality
2024-06-17 10:27:31 -03:00
Victor Lyuboslavsky
cfe9657f75
fleetctl gitops --dry-run now errors on duplicate (or conflicting) global/team enroll secrets. (#19344)
#19152
`fleetctl gitops --dry-run` now errors on duplicate (or conflicting)
global/team enroll secrets.

- One check is done on the backend to check against existing secrets
- Another check is done in fleetctl to detect duplicate secrets coming
in

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-05-31 07:01:13 -05:00
Lucas Manuel Rodriguez
cdf2a0c47c
iPhone/iPad support (#19221)
#18119

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [x] Added/updated tests
- [X] Manual QA for all new/changed functionality

---------

Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
Co-authored-by: Jacob Shandling <61553566+jacobshandling@users.noreply.github.com>
Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
2024-05-28 19:17:14 -03:00
Victor Lyuboslavsky
addbceece0
Activity feed webhooks backend (#19261)
This is a redo of the already-approved PR
https://github.com/fleetdm/fleet/pull/19125

The difference is that this merge is into main as opposed to the feature
branch.
2024-05-24 11:25:27 -05:00
Lucas Manuel Rodriguez
1b26129465
Delete expired activities in cleanup cron (#18441)
#16989

API draft PR: #17809.
UI draft PR: #18243.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- ~[ ] If database migrations are included, checked table schema to
confirm autoupdate~
- ~For database migrations:~
- ~[ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.~
- ~[ ] Confirmed that updating the timestamps is acceptable, and will
not cause unwanted side effects.~
- ~[ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).~
- [X] Manual QA for all new/changed functionality
  - ~For Orbit and Fleet Desktop changes:~
- ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.~
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2024-04-26 07:22:31 -03:00
Martin Angers
47279ca2a9 Fix conflicts 2024-04-15 16:10:10 -04:00
Roberto Dip
f827a4727e
use license.IsPremium to check for premium licenses (#18141)
a license can be considered premium for trials, this replaces
occurrences that used comparison operators to check for premium
licences.
2024-04-09 11:15:22 -03:00
Martin Angers
5aca3f01b7 Call update of DDM macos updates only if premium 2024-04-03 16:25:37 -04:00
Martin Angers
17f76087c2 Call update of mdm ddm profile after macos updates change 2024-04-03 16:08:22 -04:00
Martin Angers
b449900602 Regenerate schema.sql 2024-03-27 08:19:21 -04:00
Victor Lyuboslavsky
d3e1716572
Calendar config API endpoints bug fixes. (#17640)
Bug fixes for frontend
- google_calendar can be nil for global config to indicate that it
should not change
- `fleet/teams/:id` endpoint now working
2024-03-26 13:39:36 -05:00
Victor Lyuboslavsky
1c311b73be
Fleet in your calendar configs (#17462)
Sub-task for #17230 

# Configuration changes
App configuration:
```yaml
integrations:
  google_calendar:
    - email: name@service-account.com
      private_key: ***
      domain: fleetdm.com
```
Team configuration:
```yaml
integrations:
  google_calendar:
    email: name@service-account.com
    enable_calendar_events: true
    policies:
      - name: My policy
        id: 12
    webhook_url: https://example.com/policy-remediation
```

Note: Policy is looked up by name when configuration is set. The policy
id is set/updated by the server for internal use.

# Checklist for submitter
<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-03-26 13:39:36 -05:00
Martin Angers
74d60dca4d
Update/fix/add tests for puppet-related flow (preassign+match) (#17859) 2024-03-26 13:41:40 -04:00
Martin Angers
994040b1c9
Send DeviceConfigured MDM command after DEP enrollment (#17737) 2024-03-25 13:25:29 -04:00
Martin Angers
b0ab7bbdc4
Add enable_release_device_manually setting to team and no-team (#17698) 2024-03-19 13:21:16 -04:00
Martin Angers
b95e723275
Fix handling of enable_disk_encryption: null in PATCH /config (#17212) 2024-02-27 15:43:31 -05:00
Roberto Dip
7d00d5a41e
feature: target profiles by labels (#16202)
for #14715

---------

Co-authored-by: Martin Angers <martin.n.angers@gmail.com>
Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
Co-authored-by: Jahziel Villasana-Espinoza <jahziel@fleetdm.com>
2024-01-26 11:00:58 -05:00
Roberto Dip
5fe65d414c
allow to configure a custom configuration_web_url (#16175)
for #15633
2024-01-17 19:47:04 -03:00
Lucas Manuel Rodriguez
417f45fc61
Move external dependency fleetdm/kolide-kit to monorepo (#15861)
#15556

We will need to pay attention when releasing fleet (the github actions
were modified to use the local file now).

Should be reviewed by commits (first commit is the actual adding of the
`version.go` file)

- [X] Manual QA for all new/changed functionality

Manually tested the following:
- `Settings -> My account` on the UI and checked the `/version` endpoint
response. (Or also visiting https://localhost:8080/version on a
browser).
- Ran `make fleetctl fleet`, `./build/fleetctl --version` and
`./build/fleet version`.
2024-01-02 18:22:52 -03:00
Martin Angers
8b7d1a7e47
Remove Windows MDM feature flag (#15167)
For #14959 

---------

Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
2023-12-07 14:24:32 -03:00
Martin Angers
2f927df4f0
Implement Windows OS Updates (feature branch). (#15359) 2023-11-29 11:07:24 -05:00
Martin Angers
0b5eedb801
Fix edge case of AppConfig changes getting lost in cached mysql. (#15352) 2023-11-29 10:09:37 -05:00
Roberto Dip
f439432fae
feature: windows profiles (#15349) 2023-11-29 09:32:42 -05:00
Roberto Dip
9c7b740b03
disable windows profiles feature in the back-end (#15278)
per discussion in slack, reverting relevant user-facing changes for
#13281
2023-11-27 16:08:52 -03:00
Roberto Dip
319b64f368
allow to set mdm.windows_settings.custom_settings in configs (#15145)
for #14361 this adds the bits related to saving a slice of strings with
paths to configuration profiles.

---------

Co-authored-by: Martin Angers <martin.n.angers@gmail.com>
Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
2023-11-15 13:58:46 -03:00
Martin Angers
b2ab4553cc
Validate that WSTEP is configured before enabling Windows MDM (#14858)
#14446 

~~Note that the fix requires a frontend change too, so this should not
be merged before the frontend is also ready.~~ Frontend
[PR](https://github.com/fleetdm/fleet/pull/14971) is ready.
2023-11-09 10:08:54 -03:00
Jahziel Villasana-Espinoza
c570ef1e21
feat: make analytics always true for premium customers (#14607)
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2023-10-27 11:41:18 -04:00
gillespi314
c10ee875f2
Fix validations for applying MDM config changes (#14517) 2023-10-26 15:48:32 -05:00
Roberto Dip
9ffa11c25d
Feat: saved scripts (#14409)
For #9537
2023-10-10 19:00:45 -03:00