Test Fleet MDM for experimentation

[forderud]

Documentation request: fleetdm/fleet#32773

Instructions for local Docker deployment

1. Try Fleet
2. Start Docker
3. Run: %USERPROFILE%\.fleetctl\fleetctl preview
4. Email: admin@example.com , Password: preview1337#
5. Update "web address" on http://localhost:1337/settings/organization/webaddress (use IP from ipconfig)

Windows host MDM enrollment

• Download and unzip fleetctl.exe from https://github.com/fleetdm/fleet/releases to %USERPROFILE%\.fleetctl on the machine
• Windows MDM setup
• Generate certificate keypair using OpenSSL (bundled with git on windows)
  • "C:\Program Files\Git\usr\bin\openssl.exe" genrsa --traditional -out fleet-mdm-win-wstep.key 4096
  • "C:\Program Files\Git\usr\bin\openssl.exe" req -x509 -new -nodes -key fleet-mdm-win-wstep.key -sha256 -days 3652 -out fleet-mdm-win-wstep.crt -subj '/CN=Fleet Root CA/C=US/O=Fleet.'
• Copy fleet-mdm-win-wstep.crt and fleet-mdm-win-wstep.key to %USERPROFILE%\.fleet\preview
• Update docker-compose.yml with volume mounts and container paths:

services:
  fleet01:
    volumes:
      - ${USERPROFILE}\.fleet\preview\fleet-mdm-win-wstep.crt:/tmp/wstep.crt:ro
      - ${USERPROFILE}\.fleet\preview\fleet-mdm-win-wstep.key:/tmp/wstep.key:ro
    environment:
      FLEET_MDM_WINDOWS_WSTEP_IDENTITY_CERT: "/tmp/wstep.crt"
      FLEET_MDM_WINDOWS_WSTEP_IDENTITY_KEY: "/tmp/wstep.key"

• Set FLEET_MDM_WINDOWS_WSTEP_IDENTITY_CERT_BYTES and FLEET_MDM_WINDOWS_WSTEP_IDENTITY_KEY_BYTES parameters on Fleet server
• Pass variables through Docker in the docker-compose.yml file.

• Restart the containers:

cd %USERPROFILE%\.fleet\preview
docker compose down
docker compose up -d

• Press "Add Hosts" on http://localhost:1337/hosts/manage

Reported issues

• Try Fleet: setup Windows MDM fleetdm/fleet#29576
• Missing guide: How to try Windows MDM (fleetctl preview) fleetdm/fleet#32773

[forderud]

Scratch notes

services:
  # Normal Fleet server running TLS with a self-signed cert to handle the osquery connections.
  fleet01:
    environment:
      FLEET_MDM_WINDOWS_WSTEP_IDENTITY_CERT_BYTES: |
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
      FLEET_MDM_WINDOWS_WSTEP_IDENTITY_KEY_BYTES: |
        -----BEGIN RSA PRIVATE KEY-----
        ...
        -----END RSA PRIVATE KEY-----