Testing Velociraptor under FreeBSD 13

[Carlos Lopez]

Hi all,

With the good news that velociraptor now supports FreeBSD I decided to give it a try. At this earlier stage, I have not noticed anything that could be wrong, except one param for client config file.

I have tried to define new option like this:

writeback_freebsd: /usr/local/etc/velociraptor/velociraptor.writeback.yaml

… but it fails with the following error:

Starting velociraptor.
velociraptor: error: Unable to load config file: yaml: unmarshal errors:
line 33: field writeback_freebsd not found in type proto.ClientConfig
/usr/local/etc/rc.d/velociraptor: WARNING: failed to start velociraptor


When I changed the writeback_freebsd option to writeback_linux, everything worked and the file was placed in the directory specified in writeback_linux.

Wouldn't it be better to define specific options for FreeBSD or, failing that, generic Unix options? IMO, it is confused, actually.


Best regards,
C. L. Martinez