[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法二(失敗)

[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法二(失敗)

2026-09-03

https://github.com/Velocidex/velociraptor/releases

2026-08-10釋出0.77.2版，目前最新版

https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2

Client

https://docs.velociraptor.app/docs/deployment/clients/

執行velociraptor-v0.77.2-windows-amd64.msi (不是 .exe)，安裝畫面一閃而過，檢查發現安裝到C:\Program Files\Velociraptor 目錄

其中 client.config.yaml 內容

## Velociraptor client configuration. (0) !!! This file is an invalid client configuration that is included by the Velociraptor install MSI. You should replace this file with a valid configuration as created by the Velociraptor configuration wizard. If you installed the default Velociraptor MSI, this file will be installed in "C:\Program files\Velociraptor\client.config.yaml". However since the file is not valid, Velociraptor will refuse to start until it is replaced with a valid file. You can replace the file after installtion using group policy scheduled tasks. Alternatively you can repack a valid configuration into the original MSI, which will replace this file and allow the MSI to install a valid configuration file. Use the following command line: ``` velociraptor config repack --msi velociraptor-windows.msi client.config.yaml output.msi ``` NOTE: We recommend you sign the MSI after repacking it. Repacking the MSI will invalidate the signature! Following is a sequence of space characters to pad out the Config file allowing larger configuration files to be repacked. ## Velociraptor client configuration (0x800) ## Velociraptor client configuration (0x1000) ## Velociraptor client configuration (0x1800) ## Velociraptor client configuration (0x2000) ## Velociraptor client configuration (0x2800) ## Velociraptor client configuration (0x3000) ## Velociraptor client configuration (0x3800) ## Velociraptor client configuration (0x4000) ## Velociraptor client configuration (0x4800) ## Velociraptor client configuration (0x5000) ## Velociraptor client configuration (0x5800) # End

此檔案是 Velociraptor 安裝 MSI 中包含的無效客戶端設定檔。

您應該將此檔案替換為 Velociraptor 設定精靈建立的有效設定檔。

如果您安裝的是預設的 Velociraptor MSI，則此檔案將安裝在「C:\Program files\Velociraptor\client.config.yaml」中。

但是，由於此檔案無效，Velociraptor 將拒絕啟動，

直到將其替換為有效文件為止。您可以使用群組原則在安裝後安排一個任務來取代此檔案。

或者，您可以將有效的設定檔重新打包到原始 MSI 中，這將替換此文件，並允許 MSI 安裝有效的設定檔。

使用以下命令列：

velociraptor config repack --msi velociraptor-windows.msi client.config.yaml output.msi

注意：我們建議您在重新打包後對 MSI 進行簽名。重新打包 MSI 檔案會使簽章失效！

以下是一串空格，用於填充配置文件，

以便可以重新打包更大的設定檔。

## Velociraptor client configuration (0x800) ## Velociraptor client configuration (0x1000) ## Velociraptor client configuration (0x1800) ## Velociraptor client configuration (0x2000) ## Velociraptor client configuration (0x2800) ## Velociraptor client configuration (0x3000) ## Velociraptor client configuration (0x3800) ## Velociraptor client configuration (0x4000) ## Velociraptor client configuration (0x4800) ## Velociraptor client configuration (0x5000) ## Velociraptor client configuration (0x5800) # End C:\Program Files\Velociraptor>velociraptor config repack --msi velociraptor-windows.msi client.config.yaml output.msi [INFO] 2026-09-03T08:50:52+08:00 _ __ __ _ __ [INFO] 2026-09-03T08:50:52+08:00 | | / /__ / /___ _____(_)________ _____ / /_____ _____ [INFO] 2026-09-03T08:50:52+08:00 | | / / _ \/ / __ \/ ___/ / ___/ __ `/ __ \/ __/ __ \/ ___/ [INFO] 2026-09-03T08:50:52+08:00 | |/ / __/ / /_/ / /__/ / / / /_/ / /_/ / /_/ /_/ / / [INFO] 2026-09-03T08:50:52+08:00 |___/\___/_/\____/\___/_/_/ \__,_/ .___/\__/\____/_/ [INFO] 2026-09-03T08:50:52+08:00 /_/ [INFO] 2026-09-03T08:50:52+08:00 Digging deeper! https://www.velocidex.com [INFO] 2026-09-03T08:50:52+08:00 This is Velociraptor 0.77.2 built on 2026-08-10T01:03:30Z (c0c9dd609) [INFO] 2026-09-03T08:50:52+08:00 Starting Org Manager service. [INFO] 2026-09-03T08:50:52+08:00 Starting services for Org <root> (root) [INFO] 2026-09-03T08:50:52+08:00 Starting Journal service for Org <root> (root). [INFO] 2026-09-03T08:50:52+08:00 Starting user manager service for org root [INFO] 2026-09-03T08:50:52+08:00 Starting the notification service for Org <root> (root). [INFO] 2026-09-03T08:50:52+08:00 Installing Dummy inventory_service. Will download tools to temp directory. [INFO] 2026-09-03T08:50:52+08:00 Starting repository manager for Org <root> (root) [INFO] 2026-09-03T08:50:53+08:00 Loaded 421 built in artifacts in 155.7785ms [ERROR] 2026-09-03T08:50:53+08:00 client_repack: Provided config file not valid: LiteralLoader: yaml: line 19: mapping values are not allowed in this context [ { "RepackInfo": null } ][DEBUG] 2026-09-03T08:50:53+08:00 Query Stats: {"RowsScanned":1,"PluginsCalled":1,"FunctionsCalled":1,"ProtocolSearch":0,"ScopeCopy":3} [INFO] 2026-09-03T08:50:53+08:00 Exiting notification service for Org <root> (root)! velociraptor: error: config repack: client_repack: Provided config file not valid: LiteralLoader: yaml: line 19: mapping values are not allowed in this context C:\Program Files\Velociraptor>

ㄧ檢視說明

檢視client.config.yaml內容依舊。

失敗，待研究，待續

(待續)

[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法一 (失敗)

[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法一 (失敗)

2026-09-02

https://github.com/Velocidex/velociraptor/releases

2026-08-10釋出0.77.2版，目前最新版

https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2

velociraptor-v0.77.2-windows-amd64.exe

Client

https://docs.velociraptor.app/docs/deployment/clients/

檢視版本

C:\velociraptor>velociraptor.exe version name: velociraptor version: 0.77.2 commit: c0c9dd609 build_time: "2026-08-10T01:03:30Z" compiler: go1.25.3 system: windows architecture: amd64 C:\velociraptor>

檢視說明

C:\velociraptor>velociraptor.exe --help usage: velociraptor [<flags>] <command> [<args> ...] An advanced incident response and monitoring agent. Flags: -h, --[no-]help Show context-sensitive help (also try --help-long and --help-man). --remap=REMAP A remapping configuration file for dead disk analysis. --[no-]nobanner Suppress the Velociraptor banner --org=ORG Org ID to show --[no-]debug Enables debug and profile server. --debug_port=6060 Port for the debug server. -c, --config=CONFIG The configuration file. --embedded_config=EMBEDDED_CONFIG Extract the embedded configuration from this file. -a, --api_config=API_CONFIG The API configuration file. --runas=RUNAS Run as this username's ACLs -D, --definitions=DEFINITIONS A directory containing artifact definitions --[no-]nocolor Disable color output -v, --[no-]verbose Enabled verbose logging. --profile=PROFILE Write profiling information to this file. --profile_duration=PROFILE_DURATION Generate a profile file for each period in seconds. --trace=TRACE Write trace information to this file. --[no-]trace_vql Enable VQL tracing. --logfile=LOGFILE Write to this file as well --tempdir=TEMPDIR Write all temp files to this directory --mutant=MUTANT When specified we use this mutant to ensure only one copy of the client is allowed to run. --[no-]prompt Present a prompt before exit --max_wait=10 Maximum time to queue results. --timezone=TIMEZONE Default encoding timezone (e.g. Australia/Brisbane). If not set we use UTC -r, --run=RUN Run an artifact as a CLI tool. Commands: help [<command>...] artifacts list [<flags>] [<regex>] show <name> collect [<flags>] <artifact_name>... fetch --flow_id=FLOW_ID --output=OUTPUT [<flags>] reformat [<flags>] <paths>... verify [<flags>] <paths>... client [<flags>] config show [<flags>] client api_client --name=NAME [<flags>] <output> generate [<flags>] rotate_keys [<flags>] reissue_certs [<flags>] frontend repack [<flags>] <config_file> <output> csv [<flags>] <files>... deaddisk [<flags>] <output> debian [<flags>] server [<flags>] client [<flags>] frontend [<flags>] fs [<flags>] ls [<path>] cp <path> <dumpdir> cat <path> zcat <chunk_path> <file_path> rm <path> golden [<flags>] <directory> acl show [<flags>] <principal> grant [<flags>] <principal> [<policy>] gui [<flags>] hunts reconstruct service [<flags>] install remove start stop pause continue collector [<flags>] [<spec_file>] decrypt [<flags>] <collection> [<output>] pool_client [<flags>] query [<flags>] <queries>... rpm [<flags>] client [<flags>] server [<flags>] server_service install remove start stop pause continue tools show [<file>] rm <name> upload --name=NAME [<flags>] [<path>] unzip [<flags>] <file> [<members>] user add --role=ROLE <username> [<password>] show [<flags>] <username> version vql list export [<old_file>] C:\velociraptor>

產生設定檔 (Enter 表示選擇)

cd C:\Velociraptor velociraptor.exe config generate -i

下圖，設定帳號、密碼　

下圖，沒有其他帳號、密碼，可以直接Enter通過

下圖，如果要修改設定檔案

version: name: velociraptor version: 0.77.2 commit: c0c9dd609 build_time: "2026-08-10T01:03:30Z" compiler: go1.25.3 system: windows architecture: amd64 Client: server_urls: - https://localhost:8000/ ca_certificate: | -----BEGIN CERTIFICATE----- MIIDTDCCAjSgAwIBAgIRALrEXWp8RVj4E+luaSFVZVQwDQYJKoZIhvcNAQELBQAw GjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMB4XDTI2MDkwMjAyNDg1NFoXDTM2 MDgzMDAyNDg1NFowGjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMIIBIjANBgkq hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5OhVcgFUtkH3DLhdNQQQfIk854xl6OY/ 7xWzzAMwzMU1kpmuqtJO0WBvR48Y1QZ4d7Me5KR/75HiN+Hx+zDk6SBGX5IZLYNf 2NvHeONjmjWFhWPmoNj6KT2uN5F5mIjLmA8ujY9ySkl1E3E/mZmsIyq9mbsxio32 U52OX8+pu+PWHe8IhsvUjR73RgRIcuWl9IrgvWv4MXJwPJuGty0tMlowHUczlMw7 tJ86U+SaxOPRLQoIKvbjgjjSv/7YMysb4g24X4DRYaACKvJzGX2LuM69DuojOoSu z10IZ4Szp1EZZrjB1JxyLksXgtcYUAv1+waRGGdJu3xZRi1Q5BYcbQIDAQABo4GM MIGJMA4GA1UdDwEB/wQEAwICpDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH AwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVYkRz7YxTckKWP8KJuDHgoMP zVAwKAYDVR0RBCEwH4IdVmVsb2NpcmFwdG9yX2NhLnZlbG9jaWRleC5jb20wDQYJ KoZIhvcNAQELBQADggEBAKcI9Pop70xRpzu2v9Hi5hQdSGQEAGqqXwjuVUrzlF6W Z+uFfFn5x4zOTU1tzxRG0a3uyePbPTGAJs0Jp4v/w7VX+pXs2H87k2ohBtdsAKGY ZWYMmReNURtNdm22Lo9h7nZ4C5v7Y/S00D3u1PxpQV4dYBbDA+4MgGV0SGqppMdi aldMPxyrfVk8PyuAZJq/rIPz4FGWKmf6dVqlKzmkcuRvtCrhv1sMyLVmn2z0QFK/ pIsfgRmF0LEMh1Vn3ouDZXsp7jTRjpyibSB2S2UTDKINXsmuDAk71iD0YWfEMuRL Prwgj5rwrY+smEUz+d/ElznxRAGqcl5O+kUxc3oim2k= -----END CERTIFICATE----- nonce: X67UA31K0vY= writeback_darwin: /etc/velociraptor.writeback.yaml writeback_linux: /etc/velociraptor.writeback.yaml writeback_windows: $ProgramFiles\Velociraptor\velociraptor.writeback.yaml level2_writeback_suffix: .bak tempdir_windows: $ProgramFiles\Velociraptor\Tools max_poll: 60 nanny_max_connection_delay: 600 windows_installer: service_name: Velociraptor install_path: $ProgramFiles\Velociraptor\Velociraptor.exe service_description: Velociraptor service darwin_installer: service_name: com.velocidex.velociraptor install_path: /usr/local/bin/velociraptor server_version: version: 0.77.2 commit: c0c9dd609 build_time: "2026-08-10T01:03:30Z" use_self_signed_ssl: true max_upload_size: 5242880 local_buffer: memory_size: 52428800 disk_size: 1073741824 filename_linux: /var/tmp/Velociraptor_Buffer.bin filename_windows: $TEMP/Velociraptor_Buffer.bin filename_darwin: /var/tmp/Velociraptor_Buffer.bin API: bind_address: 127.0.0.1 bind_port: 8001 bind_scheme: tcp GUI: bind_address: 127.0.0.1 bind_port: 8889 gw_certificate: | -----BEGIN CERTIFICATE----- MIIDQjCCAiqgAwIBAgIRAIDS/dSpcucP88AV4qgKP+gwDQYJKoZIhvcNAQELBQAw GjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMB4XDTI2MDkwMjAyNDg1NFoXDTM2 MDgzMDAyNDg1NFowKTEVMBMGA1UEChMMVmVsb2NpcmFwdG9yMRAwDgYDVQQDDAdH UlBDX0dXMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1UXYPvIsQsrL 6L4ME/kYaUX5XaBqjMil8i1aBK0U8Aw9ErCM/E1MTnRMj9GVzRjjsumOosZvbkyU tW5dOBqtuaN/2c0aISe0YQwlUY/tAHO2NOYML9JOgC8Qs+/W+iuR4X4zXJOSoNzv 4m86IfGpFH61v/O8kJTCYEkcSHJYZeybQhiHOSLaF+EAgj9yJqFDld9PoRr16LoS dAKIymazzs0hhYP69FAaBxzzQAk65sMXQ7vWpyCdEbtDqn4Puenn9dcJPlBVb2i9 YbQILi/gWU9jFju6tTeT/qUTGsKMrEiTB3g0SJrIZzEkg+J3VAD8luIU2UpHBmyW uldoHiJtQwIDAQABo3QwcjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYB BQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUVYkRz7Yx TckKWP8KJuDHgoMPzVAwEgYDVR0RBAswCYIHR1JQQ19HVzANBgkqhkiG9w0BAQsF AAOCAQEAYpXqwuJZFxAy1jiZvg05bdw753+vj/B/xCu5NH0UwTIjcMeHyaG4f8x4 NNhPiRVvGkQkxWavHDHQ3B9zc4cOIeBaGhLf1N3TPzy+uHXga/azDxAHCa+El68n 2N1wjtiVU7VA/nHUDTwlS2ZaVYY9sktAAfsQTxxP2k2gtggC7Erajk21HmmQAcyH 59V4xfvaSX0tQlWtkTuUcwAnAOiQPJsqDj/jSLDj3orzEt2GLvt5PYwtgS+GwCUS P8nCgeMy+rBPD3ZzRfzmx7oteZaHszU0eHmzAPLiKtLk6oh3rXRA2J2V8GG8N3aC kinJsVtlbjDxvPP65v3n18kTDAfT8A== -----END CERTIFICATE----- gw_private_key: | -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEA1UXYPvIsQsrL6L4ME/kYaUX5XaBqjMil8i1aBK0U8Aw9ErCM /E1MTnRMj9GVzRjjsumOosZvbkyUtW5dOBqtuaN/2c0aISe0YQwlUY/tAHO2NOYM L9JOgC8Qs+/W+iuR4X4zXJOSoNzv4m86IfGpFH61v/O8kJTCYEkcSHJYZeybQhiH OSLaF+EAgj9yJqFDld9PoRr16LoSdAKIymazzs0hhYP69FAaBxzzQAk65sMXQ7vW pyCdEbtDqn4Puenn9dcJPlBVb2i9YbQILi/gWU9jFju6tTeT/qUTGsKMrEiTB3g0 SJrIZzEkg+J3VAD8luIU2UpHBmyWuldoHiJtQwIDAQABAoIBAEqu3iZQvKIZDOWw I1+dI2i9+bBJG/a3zrCrI/IuP/49cueIDp7NXLK+dA8KyAfdtuKweePTVDMOOyb7 gkZCxWIT+JHnCkbg9f/j9m+E1GwLmRsWEd9vKFEn6hPwoVnShw+tF0RMYxTUuWYU KAm568kDBBc3PWltxlFcWLyf2ge6euDmiF+6901kZA/r2lhxIUuHgUAGRF8l20ke fPxQvI42C67FRFdnolWOQ5zqJnimX6fq3AyHfnfVf47nCqjNEQJslvTA1cZCu68b KHyDT97oJ2eVzjCcpTgpxcd2Qb6uWqAntaSBeyyKXqEU4mjebIBcHhFu2CYe17iY u6dl6B0CgYEA3tjene4Yn68HDGzoIxm6dGXQLIfDSuVAYtZps/zpw5UaiVRmSf8v WwQ/wyikvpw6WKML+PjVmg6p1t9ryKmXHgKIjd39Afmt8SsJrvt+JlADUQj4hDSE 8HLyDv+HSK13ou3oInAp83CxEeUJSqukn1AHiOGiBP5ho6l+W1PQWg8CgYEA9QBW YZW9nw/jgKjr82dfuHPEJR4iICK8BmxsS0aZpaN3r79eqAJloAmUA+Yt+9sFJBbz ixMCp8WtY4e6XWuEmnJ/4JYwe7j3RlbnqROYt/nNfIuUH0G8VCtcHqtRvY/9qP+N I2JacpCmVQ3g9e8w3JFsTawSi/d3dfbHgB6g/Y0CgYBgO4ze7GvLwVys2/be+YRQ MYtVP4dxN1C3ndnltOkJ4cCk30KQ39cGWe5jC5EhEvwLPNW1vVcYgQ6M0MyNydaN ShDIGr3gdX7M74Xt/4K5bsIP42zWQovJ/glTurskAmzwegZNoNws2VRN4vdBPKAJ gBjQ3ocF2wg1EcOUErydtwKBgCFq0V1wGjQW67YB1GUXxYOYLrnNWWQ+uJy7ry25 TH2+RTXwiU2rPgdNJyY9ACqpHhNlGgTvK96MZPD9c1sIrkaOtYiBk81cVkX+1oxG Qv9dED0boLF+utxUKbV5MqYDfNrPOIYKBUI5HqbdRMDmxihfoYEaplD3CRFK/r0n 8FeFAoGAdl3Nq9QVT0B+xAfovXm0fs1lDCvhKupEVfmByLYMTnLFCLFo3oKo2hxd b9OfUb7IeZnvXvbPc3vBzbZeYRqePW7CLWc4y5ft2A+SHcNmJCv/67Cppz3wP03s uIJ/hkNQFaThzHETQcTjL5WZCU38YA2kmdss3nhCumM7zLRti+g= -----END RSA PRIVATE KEY----- public_url: https://localhost:8889/app/index.html links: - text: Documentation url: https://docs.velociraptor.app/ icon_url: data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI1MyIgaGVpZ2h0PSI2MyIgdmVyc2lvbj0iMS4xIiB2aWV3Qm94PSIwIDAgNTMgNjMiPjxwYXRoIGQ9Ik0yNyAzYy0zIDItMTMgOC0yMyAxMGw2IDMyYTEwMyAxMDMgMCAwIDAgMTcgMTZsNi01IDExLTExIDYtMzJDMzkgMTEgMzAgNSAyNyAzeiIgZmlsbD0iI2ZmZiIgZmlsbC1ydWxlPSJldmVub2RkIi8+PHBhdGggZD0iTTI2IDBDMjMgMiAxMiA4IDAgMTBjMSA3IDUgMzIgNyAzNWExMTMgMTEzIDAgMCAwIDE5IDE4bDctNiAxMi0xMmMyLTMgNi0yOCA4LTM1QzQwIDggMjkgMiAyNiAwWm0wIDU1LTYtNC04LTktNS0yNnYtMWwyLTFjOC0xIDE2LTYgMTYtNmwxLTEgMSAxczggNSAxNyA2bDEgMXYxcy0zIDIzLTUgMjZsLTggOWMtMiAyLTQgNC02IDR6IiBmaWxsPSIjYWIwMDAwIiBmaWxsLW9wYWNpdHk9IjEiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjxwYXRoIGQ9Ik0zOSAxOWExMzQ3IDEzNDcgMCAwIDEtMTMgMjZoLTJMMTQgMTloM2wyIDEgMSAxdjFhMjUwIDI1MCAwIDAgMSA2IDE3IDUyODkgNTI4OSAwIDAgMCA5LTIwaDR6IiBmaWxsPSIjMDAwIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiIHN0cm9rZT0iIzAwMCIgc3Ryb2tlLWRhc2hhcnJheT0ibm9uZSIgc3Ryb2tlLWxpbmVjYXA9ImJ1dHQiIHN0cm9rZS1saW5lam9pbj0ibWl0ZXIiIHN0cm9rZS13aWR0aD0iMSIvPjwvc3ZnPg== type: sidebar new_tab: true initial_users: - name: admin password_hash: cc13df84c2dd35e9b409138cb8912c8bf0bc3b4eda7fda11fdb08c60a7f134e7 password_salt: 518645ed9359fee7b2ba5484406bda0d81f7b8be0c0fe075d19a7b5b757ef5a5 authenticator: type: Basic CA: private_key: | -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEA5OhVcgFUtkH3DLhdNQQQfIk854xl6OY/7xWzzAMwzMU1kpmu qtJO0WBvR48Y1QZ4d7Me5KR/75HiN+Hx+zDk6SBGX5IZLYNf2NvHeONjmjWFhWPm oNj6KT2uN5F5mIjLmA8ujY9ySkl1E3E/mZmsIyq9mbsxio32U52OX8+pu+PWHe8I hsvUjR73RgRIcuWl9IrgvWv4MXJwPJuGty0tMlowHUczlMw7tJ86U+SaxOPRLQoI KvbjgjjSv/7YMysb4g24X4DRYaACKvJzGX2LuM69DuojOoSuz10IZ4Szp1EZZrjB 1JxyLksXgtcYUAv1+waRGGdJu3xZRi1Q5BYcbQIDAQABAoIBACeywlTL9crI/GUk mSePXaOXcmxOvULLobVfTGf6eq1cmzqiM/hUkk49/PaKUtpo7Z4GvroU7EoaQQMD iKGRXHWwvvumnP63bLkxfnHQ765oD1Cvn2jwUEw0MgFZlZ62RKbJpT9wK/hFrovx ZUAIdmG/8RNW81PN5HUiWzVzEILwv7Fi4aCBnsHOW0T0TBee33sHL3w8PH2fQ0XS EeWJuLTEOATkk6UIHXpFWRtvhMRgvUFxh1Y90XBxhIJrA+t4Qonwcal+MCHz91sB atn2Yhjhb23HjlobRSif9kJPpaLmzvxBf7ZcG6pDSKSC+jCcu4lTWjSB3jYKOCen S78ZTkECgYEA7ooEqY0PF5rKeTXthvUzs+VV0N+0Kdc0za3jFjmD7+XnMZs6Q7dm jjXx9ZSYFyxLtVF5TPQrh4dWSPdGYjvaoUC2HSLXeKq1v/Az6V2RLcmwtW3IKbAh 8CvmgjeUcpTmmvA3M0Z9zpKcmOuu+T39Qdk113OEonzAGNoU7QABci0CgYEA9anU Wop2zSST/yJZO9p7k5AfyydCRZAeHYNa6PfiRoctFFei05KOU81M1HiPXaPg4siq x4dKfaoDnwIx88deTvaeJJ9TJpWoDHRaowrTFpbuIyBL/uADS0eRmbQgkaZXpOSJ BjL+DV2vnI6vYMDqyq1Xce0BRP4duYTMo6We+0ECgYEAtifTU56STdY4k8MotYx9 hPy2QaDytZjPi9kjto8JP6Lyn6EIJzngKOzs7jogwmFjFv02ghtbOk2RCHs71jwa wlTmPO2kWVMTI5VMLwLyoGKKfKFu3tbPs9XyWrISvEUUrHCP1qoX3C19RBGGNnKt +SDjyrk+Kc7V6qRuomUEtakCgYA2IbL6NHKTJ5E48e+pwa3jSSnIUSFIRMZuCGi6 1wxUMCsdxWXKqwuTqbRZSSuGHbtLHZ6MEuK2KAVeP1SUfATq72rPdRAUe3upKuZh 8NusqZtVwCMeyWvQZbfOn6NhlL7RRc5vwEK83Tz6CXLZpgjWmjWfk/LoqfoQzBNv p+oNQQKBgQDYHvucRGrTG6DQtfYNhl2LUKhmwKM0aSDF2NB2rrUtwnNg5jor/WIE 7cH9rg9FuBvF6Xfy3BKXB0VpX9csEzdEVHrFWPlfJpyHfmpmM1ANoUDPVPma3S/b hizBK1RnyseirVelx5cl2ZhPM1W9Y6vhTCJQYnhhP4tQHaWEVi7PoQ== -----END RSA PRIVATE KEY----- Frontend: hostname: localhost bind_address: 0.0.0.0 bind_port: 8000 certificate: | -----BEGIN CERTIFICATE----- MIIDVzCCAj+gAwIBAgIQUNs2ryX1dxf3TmfZ79AT8jANBgkqhkiG9w0BAQsFADAa MRgwFgYDVQQKEw9WZWxvY2lyYXB0b3IgQ0EwHhcNMjYwOTAyMDI0ODU0WhcNMzYw ODMwMDI0ODU0WjA0MRUwEwYDVQQKEwxWZWxvY2lyYXB0b3IxGzAZBgNVBAMTElZl bG9jaXJhcHRvclNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB APyL4VOSOSWOtVNp76efcnOQC93MlV8LWENXTg7EI4Q+61dDymy9+YVSKJBnezgj WOIiyGWPChzFQTF16ykT0vE/sdAoauD5v2AQPuGjHSNJ2HxeoHmvvBni3P8RW6Z0 sXWsr7I3oL4NKVLElECYFC+MEYaEm83WoRrVl/ouFLxO/L3RneeZrJtoPYLYKgLT m3KdaEYhtvAermlkEm9o+smWrtb6BRrF+Ev9RrBr8eZSFRrNffFYBbFrKjVgZTV5 pfpaa6Ztt6O3xpBZu0SLb4Igs//yWFn9oboPYH+3UeyRngiwfEu3GY7LlltQVz/v pcw4oISOlHWyRAb8G1VB8WECAwEAAaN/MH0wDgYDVR0PAQH/BAQDAgWgMB0GA1Ud JQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQY MBaAFFWJEc+2MU3JClj/Cibgx4KDD81QMB0GA1UdEQQWMBSCElZlbG9jaXJhcHRv clNlcnZlcjANBgkqhkiG9w0BAQsFAAOCAQEAleTJ8HHlvTepfigdqKKE79agfZWT Lrjyc0qkOoHBKTBibRaquPR8FRw5mynh5uM6m54ga+EpBCXRId0pnUOy7IlxJzX4 IWnA3ThzH5XkdY89PGlyXXaLLKBtr9toHHyx0hnObLviyIC2sPpjk/04SEtuzpq5 Fv7HZgQZqeum0sTS7O+X7p+EoBEElxqDUI207L7vvzR9qMRBwazPuq/svbQ0vWJL HWOvHxxJqVE/876x3XOduX/c5XtBrEPSf1TKEyidP2WxuaS37VGMtmYVH1m/gDK8 odEm5xDVCE1nXN9i88Jvm4BJOrLNZZDP9y8MrcR7aXyS94Tp6/sRPgVOhQ== -----END CERTIFICATE----- private_key: | -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEA/IvhU5I5JY61U2nvp59yc5AL3cyVXwtYQ1dODsQjhD7rV0PK bL35hVIokGd7OCNY4iLIZY8KHMVBMXXrKRPS8T+x0Chq4Pm/YBA+4aMdI0nYfF6g ea+8GeLc/xFbpnSxdayvsjegvg0pUsSUQJgUL4wRhoSbzdahGtWX+i4UvE78vdGd 55msm2g9gtgqAtObcp1oRiG28B6uaWQSb2j6yZau1voFGsX4S/1GsGvx5lIVGs19 8VgFsWsqNWBlNXml+lprpm23o7fGkFm7RItvgiCz//JYWf2hug9gf7dR7JGeCLB8 S7cZjsuWW1BXP++lzDighI6UdbJEBvwbVUHxYQIDAQABAoIBAAeD7VLtm28VOIBt f0jqGrklZKHO0Wwxcl4HL3sTaUmP7LRsO1sWIg0KSP69xqt4VhRlvetTgwxTmVaG Q6xO/2G+PX8uTDIQHrRamHnIWLj3LgHs738zzh5ka+dyMbl8G4LBGCSZbIUmAHOb 05N12YLc+wKqcfobFJbrcNGwtaHKwNFYSF7boE1PT0iWSRbcdMjm0MUI7jw3ugPO RLKeStO4NTx5vf0kyaLfLT6CN5fLNjLt1FJA81yZ6N9/Ht/wj18u1eQlMTrGvrQM hrki24BRzoTxPDuLH5Wcyddb2qsi0yTgDTzcVShuHRJyjs8VIU4Rf+QFFWz52Sks VKE6ZOkCgYEA/t3W77yTxKRW+FSHLUiIdZ6lRnHt1PNjP1y8MeeY4k7mkHnZBWZW yQuKBitBFkYx05iD1hJJ8R51ND/D7kW+qEWqtIthlozBddHFWdvw5tQU9izhis0H QSaT6NxDFsqUDFhzRqQeQd3gPy0qeDw3EBVwRuzbxTZSTBvko1tJRh8CgYEA/atm LeMXPP0oFbY9cfHege/rc5CY5Pgm1G3gZQIkwUiIH7WPW3S2itlK3Cc30D9x663C ODdFxPJjoGaRtGdlHLfGRjHeHIIhKIajxLBGwZlYL0LHADQwnY+irFoyNdb5VPYW 9AIEAQ2MICsQTSqDYXiZDDoystWMfiVsFMOC2H8CgYBBu+e+x215T0WbIPoIZOfF JljMVYAY53lWk016tZgJ7n2rD7I4oU+K5O4Bb1CHNS2OvIxsPyVRCiECi9u17ckh z24ayMQvtzgCcksrRP3aGyMY5zR4vy66z/9gFMc87pzGnl2E/7lKFbbLtJN6lVVC UbU2pcp9D+ij9qG+vEGm0wKBgQDis+2LkOpRvUW3sbjUPn7GzW41R8L8zrGVI+Vp IDNM8c+F1zMZXwNMr8lxWzNMT4c2Q4HRz8PwsVdMIJ6TBdydf7gZP7Pq8nlDyKBP xeJWXv8qrZk/m2TfS2Dse2doKomF3rDAvZRqhHr4vMPC0v27fJX7EYABx0vZ6QPg wqILbQKBgQCgdFhfm8eFnqA+yevabQXKXCSKlUCjOpPuXSEz66YpPqSjQiMCzsHr qDs1QhLZNcNC/pPTeZhnDDRLqu8lrgorZrbKvMEynqrkcad9H0thesZXbQREmBbZ X3jH3s8OwzF7wXxApHRvl/e4LoDDM/HixLvd0ibWmod4e2zT1PgJSQ== -----END RSA PRIVATE KEY----- default_client_monitoring_artifacts: - Generic.Client.Stats GRPC_pool_max_size: 100 GRPC_pool_max_wait: 60 resources: connections_per_second: 100 notifications_per_second: 30 max_upload_size: 104857600 expected_clients: 30000 Datastore: implementation: FileBaseDataStore location: /opt/velociraptor filestore_directory: /opt/velociraptor compression: zlib Logging: output_directory: /opt/velociraptor/logs separate_logs_per_component: true debug: disabled: true info: rotation_time: 604800 max_age: 31536000 error: rotation_time: 604800 max_age: 31536000 Monitoring: bind_address: 127.0.0.1 bind_port: 8003 api_config: {} obfuscation_nonce: J0Vrd60ffVE= defaults: hunt_expiry_hours: 168 notebook_cell_timeout_min: 10 security: certificate_validity_days: 3650

如果你要讓其他電腦的 Agent 連進來

Frontend: bind_address: 127.0.0.1

需要改成：

Frontend: bind_address: 0.0.0.0

GUI 也要允許遠端

GUI: bind_address: 127.0.0.1

需要改成：

GUI: bind_address: 0.0.0.0

測試設定檔案

cd /d C:\Velociraptor velociraptor.exe --config server.config.yaml frontend -v

結果

C:\velociraptor>velociraptor.exe --config server.config.yaml frontend -v [INFO] 2026-09-02T03:01:04Z _ __ __ _ __ [INFO] 2026-09-02T03:01:04Z | | / /__ / /___ _____(_)________ _____ / /_____ _____ [INFO] 2026-09-02T03:01:04Z | | / / _ \/ / __ \/ ___/ / ___/ __ `/ __ \/ __/ __ \/ ___/ [INFO] 2026-09-02T03:01:04Z | |/ / __/ / /_/ / /__/ / / / /_/ / /_/ / /_/ /_/ / / [INFO] 2026-09-02T03:01:04Z |___/\___/_/\____/\___/_/_/ \__,_/ .___/\__/\____/_/ [INFO] 2026-09-02T03:01:04Z /_/ [INFO] 2026-09-02T03:01:04Z Digging deeper! https://www.velocidex.com [INFO] 2026-09-02T03:01:04Z This is Velociraptor 0.77.2 built on 2026-08-10T01:03:30Z (c0c9dd609) [INFO] 2026-09-02T03:01:04Z Loading config from file server.config.yaml [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\Velociraptor [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorFrontend [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorClient [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorGUI [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\Velociraptor [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorAPI [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorAudit [INFO] 2026-09-02T03:01:04Z Starting Frontend. {"build_time":"2026-08-10T01:03:30Z","commit":"c0c9dd609","version":"0.77.2"} [ERROR] 2026-09-02T03:01:04Z Unable to write to configured temp dir C:\Program Files\Velociraptor\Tools - falling back to C:\Users\ADMINI~1\AppData\Local\Temp [INFO] 2026-09-02T03:01:04Z Setting temp directory to C:\Users\ADMINI~1\AppData\Local\Temp [INFO] 2026-09-02T03:01:04Z Starting Org Manager service. [INFO] 2026-09-02T03:01:04Z Starting services for Org <root> (root) [INFO] 2026-09-02T03:01:04Z Frontend: Server will be master. [INFO] 2026-09-02T03:01:04Z Starting Backup Services for Org <root> (root) every 24h0m0s [INFO] 2026-09-02T03:01:04Z Filestore implementation FileBaseDataStore. [INFO] 2026-09-02T03:01:04Z Starting Journal service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z Starting user manager service for org root [INFO] 2026-09-02T03:01:04Z UserManagerService: Watching for events from Server.Internal.UserManager [INFO] 2026-09-02T03:01:04Z Starting Server Scheduler Service [INFO] 2026-09-02T03:01:04Z Starting the notification service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z NotificationService: Watching for events from Server.Internal.Ping [INFO] 2026-09-02T03:01:04Z NotificationService: Watching for events from Server.Internal.Pong [INFO] 2026-09-02T03:01:04Z NotificationService: Watching for events from Server.Internal.Notifications [INFO] 2026-09-02T03:01:04Z ClientInfo Manager Rebuilding snapshot for org Org <root> (root) from legacy records - this might take a while. [DEBUG] 2026-09-02T03:01:04Z ClientInfo Manager Rebuilt 0 clients from Legacy data. [INFO] 2026-09-02T03:01:04Z Starting Client Info service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from Server.Internal.ClientTasks [INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from Server.Internal.ClientScheduled [INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from Server.Internal.ClientPing [INFO] 2026-09-02T03:01:04Z InventoryService: Watching for events from Server.Internal.Inventory [INFO] 2026-09-02T03:01:04Z Starting Inventory Service for Org <root> (root) [INFO] 2026-09-02T03:01:04Z InventoryService: Reloading inventory from file for org root [INFO] 2026-09-02T03:01:04Z Starting repository manager for Org <root> (root) [INFO] 2026-09-02T03:01:04Z RepositoryManager: Watching for events from Server.Internal.ArtifactModification [INFO] 2026-09-02T03:01:04Z Loaded 421 built in artifacts in 119.298ms [INFO] 2026-09-02T03:01:04Z Loaded 0 custom artifacts in 0s [WARNING] 2026-09-02T11:01:04+08:00 Unable to store inventory - will run with an in memory one. [INFO] 2026-09-02T03:01:04Z Starting hunt manager service for Org <root> (root) with rate limit 30/s. [WARNING] 2026-09-02T11:01:04+08:00 Unable to store inventory - will run with an in memory one. [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from Server.Internal.HuntModification [WARNING] 2026-09-02T11:01:04+08:00 Unable to store inventory - will run with an in memory one. [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from System.Hunt.Participation [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from Server.Internal.Label [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from Server.Internal.Interrogation [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z Starting Enrollment service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z InterrogationService for Generic.Client.Info/BasicInformation: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z InterrogationService for Custom.Generic.Client.Info/BasicInformation: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z InterrogationService: Watching for events from Server.Internal.Enrollment [INFO] 2026-09-02T03:01:04Z HuntDispatcher: Watching for events from Server.Internal.HuntUpdate [INFO] 2026-09-02T03:01:04Z Starting Hunt Dispatcher Service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z Starting Indexing Service for Org <root> (root). Refreshing every 5m0s [DEBUG] 2026-09-02T03:01:04Z Indexing service search index loaded 0 items in 0s [INFO] 2026-09-02T03:01:04Z Starting VFS writing service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z VFSService for System.VFS.ListDirectory: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z VFSService for System.VFS.ListDirectory/Stats: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z VFSService for System.VFS.DownloadFile: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z Labeler: Watching for events from Server.Internal.Label [INFO] 2026-09-02T03:01:04Z Starting Server Artifact Runner Service for Org <root> (root) [INFO] 2026-09-02T03:01:04Z Starting Label service. [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_1 [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_0 [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_2 [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_3 [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_4 [DEBUG] 2026-09-02T03:01:04Z Reloading client monitoring tables from datastore [INFO] 2026-09-02T03:01:04Z Starting Client Monitoring Service for Org <root> (root) [INFO] 2026-09-02T03:01:04Z Creating default Client Monitoring Service [INFO] 2026-09-02T03:01:04Z client_monitoring_service: Watching for events from Server.Internal.ArtifactModification [INFO] 2026-09-02T03:01:04Z client_monitoring_service: Watching for events from Server.Internal.MetadataModifications [DEBUG] 2026-09-02T03:01:04Z Query Stats: {"RowsScanned":0,"PluginsCalled":0,"FunctionsCalled":0,"ProtocolSearch":0,"ScopeCopy":0} [DEBUG] 2026-09-02T03:01:04Z Query Stats: {"RowsScanned":0,"PluginsCalled":0,"FunctionsCalled":0,"ProtocolSearch":0,"ScopeCopy":0} [DEBUG] 2026-09-02T03:01:04Z Query Stats: {"RowsScanned":0,"PluginsCalled":0,"FunctionsCalled":0,"ProtocolSearch":0,"ScopeCopy":0} [INFO] 2026-09-02T03:01:04Z Exiting notification service for Org <root> (root)! [INFO] 2026-09-02T03:01:04Z Stopping watch for System.VFS.DownloadFile for Org <root> (root) (VFSService) [INFO] 2026-09-02T03:01:04Z Stopping watch for System.VFS.ListDirectory for Org <root> (root) (VFSService) [INFO] 2026-09-02T03:01:04Z Stopping watch for System.VFS.ListDirectory/Stats for Org <root> (root) (VFSService) velociraptor.exe: error: frontend: starting frontend: mkdir \\?\\opt: The system cannot find the file specified. C:\velociraptor>

執行

velociraptor.exe --config C:\Velociraptor\server.config.yaml frontend

C:\velociraptor>velociraptor.exe --config C:\Velociraptor\server.config.yaml frontend [ERROR] 2026-09-02T03:03:15Z Unable to write to configured temp dir C:\Program Files\Velociraptor\Tools - falling back to C:\Users\ADMINI~1\AppData\Local\Temp velociraptor.exe: error: frontend: starting frontend: mkdir \\?\\opt: The system cannot find the file specified. C:\velociraptor>

失敗，待續

(待續)

[研究]比較 velociraptor 和 Wazuh

[研究]比較 velociraptor  和 Wazuh

2026-09-02

項目	Velociraptor	Wazuh
核心定位	DFIR / Endpoint Visibility / Threat Hunting	SIEM + HIDS/XDR + Security Monitoring
最強功能	主機調查、鑑識、Threat Hunting	日誌集中、告警、規則分析、FIM
Agent	✅ Windows/Linux/macOS	✅ Windows/Linux/macOS
Server	Windows/Linux	Linux 為主
Web Dashboard	✅	✅
即時監控	✅	✅
Windows Event Log	⭐⭐⭐⭐⭐	⭐⭐⭐⭐⭐
Sysmon	⭐⭐⭐⭐⭐	⭐⭐⭐⭐⭐
目錄/檔案監控 FIM	⭐⭐⭐⭐	⭐⭐⭐⭐⭐
檔案新增/修改/刪除	✅	✅
Registry 監控	⭐⭐⭐⭐⭐	⭐⭐⭐⭐
Process 監控	⭐⭐⭐⭐⭐	⭐⭐⭐⭐⭐
Network Connection	⭐⭐⭐⭐⭐	⭐⭐⭐⭐
IOC 搜尋	⭐⭐⭐⭐⭐	⭐⭐⭐⭐
Threat Hunting	⭐⭐⭐⭐⭐	⭐⭐⭐
Digital Forensics	⭐⭐⭐⭐⭐	⭐⭐⭐
YARA	⭐⭐⭐⭐⭐	⭐⭐⭐⭐
Artifact 查詢	⭐⭐⭐⭐⭐	⭐⭐
VQL 查詢	⭐⭐⭐⭐⭐	❌
SIEM	⭐⭐	⭐⭐⭐⭐⭐
Log Collection	⭐⭐⭐	⭐⭐⭐⭐⭐
Correlation / Rules	⭐⭐⭐	⭐⭐⭐⭐⭐
Compliance	⭐⭐⭐	⭐⭐⭐⭐⭐
Vulnerability Detection	⭐⭐	⭐⭐⭐⭐⭐
Dashboard	⭐⭐⭐⭐	⭐⭐⭐⭐⭐
Alert / Email	⭐⭐⭐	⭐⭐⭐⭐⭐
多台主機集中管理	⭐⭐⭐⭐	⭐⭐⭐⭐⭐
事件長期保存/搜尋	⭐⭐⭐	⭐⭐⭐⭐⭐
自動化 Response	⭐⭐⭐⭐⭐	⭐⭐⭐⭐
Incident Response	⭐⭐⭐⭐⭐	⭐⭐⭐⭐
上手難度	中～高	中
Free / Open Source	✅	✅

一句話區分

Wazuh：「很多台 Server/PC 發生什麼安全事件？集中收集、分析、告警。」

Velociraptor：「這台被懷疑入侵的 Windows Server 到底發生了什麼？我要深入查證。」

(完)

[研究]Velociraptor 0.77.2(迅猛龍) Server (ubuntu 26.04 LTS) 架設方法

[研究]velociraptor 0.77.2(迅猛龍) Server (ubuntu 26.04 LTS) 架設方法

2026-08-31

https://github.com/Velocidex/velociraptor/releases

2026-08-10釋出0.77.2版，目前最新版

https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2

user1@ubuntu2604lts:~$ ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:0c:29:b9:e6:9b brd ff:ff:ff:ff:ff:ff inet 192.168.128.134/24 brd 192.168.128.255 scope global dynamic noprefixroute ens33 valid_lft 1628sec preferred_lft 1628sec inet6 fe80::20c:29ff:feb9:e69b/64 scope link noprefixroute valid_lft forever preferred_lft forever user1@ubuntu2604lts:~$

user1@ubuntu2604lts:~$ hostnamectl Static hostname: ubuntu2604lts Icon name: computer-vm Chassis: vm 🖴 Chassis Asset Tag: No Asset Tag Machine ID: e2b0e97fcf7c4aa6bc9993ab9fc10e3a Boot ID: b5c85e3686d94c87a38acbbfd3f278b0 AF_VSOCK CID: 1270474395 Virtualization: vmware Operating System: Ubuntu 26.04 LTS Kernel: Linux 7.0.0-30-generic Architecture: x86-64 Hardware Vendor: VMware, Inc. Hardware Model: VMware Virtual Platform Hardware Version: None Firmware Version: 6.00 Firmware Date: Tue 2026-02-17 Firmware Age: 6month 1w 5d user1@ubuntu2604lts:~$

安裝

sudo apt update sudo apt upgrade -y sudo apt install -y curl wget unzip ca-certificates wget https://github.com/Velocidex/velociraptor/releases/download/v0.77.2/velociraptor-v0.77.2-linux-amd64 chmod +x velociraptor-v0.77.2-linux-amd64 sudo mv velociraptor-v0.77.2-linux-amd64 /usr/local/bin/velociraptor velociraptor version sudo mkdir -p /opt/velociraptor cd /opt/velociraptor sudo velociraptor config generate -i

檢視版本

user1@ubuntu2604lts:~$ velociraptor version name: velociraptor version: 0.77.2 commit: c0c9dd609 build_time: "2026-08-10T00:58:52Z" compiler: go1.25.3 system: linux architecture: amd64 user1@ubuntu2604lts:~$

sudo velociraptor config generate -i產生設定檔案

下圖，設定稍後要用的帳號、密碼

下圖，如果新增沒有其他帳號，都 Enter 過去

user1@ubuntu2604lts:/opt/velociraptor$ ls -ln total 16 -rw------- 1 0 0 12949 Aug 31 15:47 server.config.yaml user1@ubuntu2604lts:/opt/velociraptor$

設定權限

sudo chown -R user1:user1 /opt/velociraptor

建立 systemd Service

sudo nano /etc/systemd/system/velociraptor.service

增加文字，然後按下 Ctrl-O 寫出檔案

[Unit] Description=Velociraptor Server After=network.target [Service] Type=simple User=root WorkingDirectory=/opt/velociraptor ExecStart=/usr/local/bin/velociraptor --config /opt/velociraptor/server.config.yaml frontend Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target

下圖，寫出檔案了

下圖，Ctrl-X 跳出

啟動、設定開機自動啟動、顯示目前狀態

ser1@ubuntu2604lts:/opt/velociraptor$ sudo systemctl daemon-reload user1@ubuntu2604lts:/opt/velociraptor$ sudo systemctl start velociraptor user1@ubuntu2604lts:/opt/velociraptor$ sudo systemctl enable velociraptor Created symlink '/etc/systemd/system/multi-user.target.wants/velociraptor.service' → '/etc/systemd/system/velociraptor.service'. user1@ubuntu2604lts:/opt/velociraptor$ sudo systemctl status velociraptor ● velociraptor.service - Velociraptor Server Loaded: loaded (/etc/systemd/system/velociraptor.service; enabled; preset:> Active: activating (auto-restart) (Result: exit-code) since Mon 2026-08-31> Invocation: ebdddd66ca294135aaf1273f19abf73b Process: 21849 ExecStart=/usr/local/bin/velociraptor --config /opt/velocira> Main PID: 21849 (code=exited, status=1/FAILURE) Mem peak: 20.9M CPU: 68ms user1@ubuntu2604lts:/opt/velociraptor$

檢視防火牆，若為 inactive 未啟動防火牆，不管

user1@ubuntu2604lts:/opt/velociraptor$ sudo ufw status Status: inactive user1@ubuntu2604lts:/opt/velociraptor$

若為 active，新增規則

user1@ubuntu2604lts:/opt/velociraptor$ sudo ufw allow 8000/tcp Rules updated Rules updated (v6) user1@ubuntu2604lts:/opt/velociraptor$ sudo ufw allow 8889/tcp Rules updated Rules updated (v6) user1@ubuntu2604lts:/opt/velociraptor$

瀏覽器登入 (必須 localhost)

https://192.168.128.134:8889

https://localhost:8889

user1@ubuntu2604lts:/opt/velociraptor$ cat server.config.yaml version: name: velociraptor version: 0.77.2 commit: c0c9dd609 build_time: "2026-08-10T00:58:52Z" compiler: go1.25.3 system: linux architecture: amd64 Client: server_urls: - https://localhost:8000/ ca_certificate: | -----BEGIN CERTIFICATE----- MIIDTDCCAjSgAwIBAgIRAJZUvKNBPglKoYrray6i49swDQYJKoZIhvcNAQELBQAw GjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMB4XDTI2MDgzMTA4NTIzN1oXDTM2 MDgyODA4NTIzN1owGjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMIIBIjANBgkq hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvc4edVyHFXvluxZA9rmo7OrYNsjUM8Us wJvRl2KhzNIbp/ck23Fm9VvfJJpVGeaBZnBzPhFv2v9P7fPLa/whMBFDRO4FpxWg 6NEH4eK5NUP9VOQXAuGGdWhRM7inejMCqR1qpRLGqV2+XK6zwq3jFckM2tWXkbeW Z2gRogzkxKfKxpfMZc5dQS2HyXx6Qi3ChvsTUz6I3KPbE/Zmi/LVvvi34MfzamLe rqcHwp49rfw6OdQIkKk4VJRjSVMesyOvaHEL0LMGxE3iHjNQc+xbFLvO+54t5XGx aGQXC2WcWtacJbOy9GoozjOxDtOELcVEoxJiRJQSeHaOF0AmDEXmKQIDAQABo4GM MIGJMA4GA1UdDwEB/wQEAwICpDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH AwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU+Pg8jJukn6TU1uvx5qjQFTDh SzowKAYDVR0RBCEwH4IdVmVsb2NpcmFwdG9yX2NhLnZlbG9jaWRleC5jb20wDQYJ KoZIhvcNAQELBQADggEBAJjTcNcll5jPwLNOanC85CI15VO5IIFo6lR8E+tWYJr3 rGXYHFM58ABtn993WEQL3TqyO6WTJqprf75hj1I4tHizZBiWCekhOVlvljiauQFF gKStCl/OprkJxJBrGyZZD7zM7AqgoUkFTuhpfOsQvQB6jiEe9Mz/FNl59gX+CBNk pKwEhzEJ8qIbCthqRwUZxMSLRNDDuxkoPzlMJhwz+EXVjeAzvPA5mtUQ60WXHwJ1 gFP7XJEno8YrtVhvPbMaTu7v9Rxufd4PJhNtEqRN+jBrIu9J3LNNQWt2a+Bc2rIC CiQthE9UZ2meOjfc+C3n8/T963LrxxPPQFjqRnOyt8w= -----END CERTIFICATE----- nonce: FQMUNn9yCYU= writeback_darwin: /etc/velociraptor.writeback.yaml writeback_linux: /etc/velociraptor.writeback.yaml writeback_windows: $ProgramFiles\Velociraptor\velociraptor.writeback.yaml level2_writeback_suffix: .bak tempdir_windows: $ProgramFiles\Velociraptor\Tools max_poll: 60 nanny_max_connection_delay: 600 windows_installer: service_name: Velociraptor install_path: $ProgramFiles\Velociraptor\Velociraptor.exe service_description: Velociraptor service darwin_installer: service_name: com.velocidex.velociraptor install_path: /usr/local/bin/velociraptor server_version: version: 0.77.2 commit: c0c9dd609 build_time: "2026-08-10T00:58:52Z" use_self_signed_ssl: true max_upload_size: 5242880 local_buffer: memory_size: 52428800 disk_size: 1073741824 filename_linux: /var/tmp/Velociraptor_Buffer.bin filename_windows: $TEMP/Velociraptor_Buffer.bin filename_darwin: /var/tmp/Velociraptor_Buffer.bin API: bind_address: 127.0.0.1 bind_port: 8001 bind_scheme: tcp GUI: bind_address: 127.0.0.1 bind_port: 8889 gw_certificate: | -----BEGIN CERTIFICATE----- MIIDQjCCAiqgAwIBAgIRAPUl2bKuwdTkhigpWdzRLxgwDQYJKoZIhvcNAQELBQAw GjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMB4XDTI2MDgzMTA4NTIzN1oXDTM2 MDgyODA4NTIzN1owKTEVMBMGA1UEChMMVmVsb2NpcmFwdG9yMRAwDgYDVQQDDAdH UlBDX0dXMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt4+Zh/RKeBZh pHSm1CLN4CKhWrlkjWSUlPhCq6Q8ZOmGQeswUqyRWAOkmPmfzJvf+bmuIQqEKTbV P2jE7JJShH1GN/oulzkAJdKkZ/mQojEsMzMeXg3BqFuTnWnjgey0Vh0pWxeKKx3b Hi44xLJeN5ODB4cTQdo5PQJ3RqrbT35HYnftWKdmempr6zhFr/6cyNQhOqGUQbFT i/0JhHdjiiSUhLA4wwUPPKLTkvhP5ngRV6R4pQ2VN/YDQOLQGerV0b9OExbRW5h0 LtbxBHXQ939M/aq6dxejlgTrrHaiGMVd2I7mkLasZnyfqQ6UzCFHISSxy6r60pk5 TGcmwOWfDQIDAQABo3QwcjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYB BQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU+Pg8jJuk n6TU1uvx5qjQFTDhSzowEgYDVR0RBAswCYIHR1JQQ19HVzANBgkqhkiG9w0BAQsF AAOCAQEAoc2Qs+kU13LJmiodHoZYVRneRN3GFk54qmXTR+jGISDObG8HLa6VGKil m/SXX2bJR2lAQW6ZXdaBJJMu1yuzFQm8/YuykkNAdn9cg6XBLURmGQn06vA0xSBf BZz4HYzbJohZNiUb/htzapoPy+wy9AFg3q5tuhteaE1U4JAo6HKfBqGd+lzKaqwW xCefbDxo7iRqTI1RW2SqyutTT+18vtSMypGjyrEs8rYjLdG4N8Q7GvvmkQ1K+8kT U3WaR0gFPoeJYPlIVRAOaN4WdUFQSThCcw6ZNEFeRl+qMFQzwsprN2jn6Fznl+jb 3Ath5wAewU0euy6LDATE6ghzrX5GZA== -----END CERTIFICATE----- gw_private_key: | -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAt4+Zh/RKeBZhpHSm1CLN4CKhWrlkjWSUlPhCq6Q8ZOmGQesw UqyRWAOkmPmfzJvf+bmuIQqEKTbVP2jE7JJShH1GN/oulzkAJdKkZ/mQojEsMzMe Xg3BqFuTnWnjgey0Vh0pWxeKKx3bHi44xLJeN5ODB4cTQdo5PQJ3RqrbT35HYnft WKdmempr6zhFr/6cyNQhOqGUQbFTi/0JhHdjiiSUhLA4wwUPPKLTkvhP5ngRV6R4 pQ2VN/YDQOLQGerV0b9OExbRW5h0LtbxBHXQ939M/aq6dxejlgTrrHaiGMVd2I7m kLasZnyfqQ6UzCFHISSxy6r60pk5TGcmwOWfDQIDAQABAoIBAAmx+nx9US+dkwOy K5uZyQD1I0uc7iwvq09g+3iAYLY9xVsW9oLvXW/mJVv1F1UhyIcyoPlaylc477N9 L6WFJvmbekl7m9ld592Xjhp1yodejISZxxlVpaxkRdwzGxKiM3Y27RfEGwai+Y9T BqmQ+Dv8PRf5MPGx+oL37d/cJ2A/5sHm74qziWVxC8bKoyl/s+gTZSR2gyeoc2Xh F9wb4iH0SWp7lfsnS48/1JlHVrZHObpq73yzXNyWFBUdGK5Evn5EEoc9m6Fk/ymB 0dOBwjyujIJlgxonwPx+VOtgg7PXDdusIRb3szXbCU1OPGtg/oQOtwVCGTMsqyqO LVKg37ECgYEA6odNx7Mhjr3sNLbkKItDEUSoLmdPZ9JN8/4tbXyq+oJNiZ0WoGDQ o2Yx1H5BA7eWxokKhffBJl66pv44gX5o2mpVhJ7O2WwcbU8hxmaXvhltyMpvWxC9 QiWR7QcDFc2GXweymkk/QaxRTYdpB5spdbR11QGKlAvnPpYBtc7IL6UCgYEAyF3B 32o0OYIb1mhTho7oL0Wn/oVlgSO5FaWpnX6g3nxA2MeAtiuawtgTmcoiuEx3m6rx OTiku3icv5tJ642JGXdrgM5QHPzJh2jl6oJi6xVUZVPO4PWBmqBP+5lA4cxa3L4A qkVDaZOoHE2Jd+uadLdmHt8fEsdL7mtOHfGxlUkCgYEAsnlO7obaJbdQVnlLvbLk 0fJOjimeWuLG4cPvLB+wOb0JZoz92AR1IbO2ff+qWDrQ6bsGIBb/jMSQBF73/0uE XZqIA8mangjQxTpv+HzAQzE0w5WSEln1vK28lAU/CsuB0zWXbCQLmF2a7YX7nocs kN9IwFVQ8QLx8kXTfVikLOUCgYAg4ZoGUwR9B4gP+JD0fRFHaLP4BeYxei5OiiA6 s2Qs/tEZgivyOVetcA5PZ6eo/QuH5Vau4EfQaCu5Gf/YgyKjpkBjI/hruWRNL37D rGAVWiu+cTF7I28AdByMGotWQtYKcbfkOXelpNCqzGKp5mUzkEFXAaC00TX5y2xH Z7mP2QKBgAdH4DyqatblIRBuAN75EhRopQalG4hEvaLXfFQ9XU16bVF48cDXF0HE Hmv9OB417EJMAJGWaajl9/IIm9rhcI2ElEl+CWpwWYoBbCk09kJ40GfWYQLb0bnm XlUzNhofWjx/wOsMYnh71NDjhC9eGjV9YKqtFb0hw17x0hpWZ8cY -----END RSA PRIVATE KEY----- public_url: https://localhost:8889/app/index.html links: - text: Documentation url: https://docs.velociraptor.app/ icon_url: data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI1MyIgaGVpZ2h0PSI2MyIgdmVyc2lvbj0iMS4xIiB2aWV3Qm94PSIwIDAgNTMgNjMiPjxwYXRoIGQ9Ik0yNyAzYy0zIDItMTMgOC0yMyAxMGw2IDMyYTEwMyAxMDMgMCAwIDAgMTcgMTZsNi01IDExLTExIDYtMzJDMzkgMTEgMzAgNSAyNyAzeiIgZmlsbD0iI2ZmZiIgZmlsbC1ydWxlPSJldmVub2RkIi8+PHBhdGggZD0iTTI2IDBDMjMgMiAxMiA4IDAgMTBjMSA3IDUgMzIgNyAzNWExMTMgMTEzIDAgMCAwIDE5IDE4bDctNiAxMi0xMmMyLTMgNi0yOCA4LTM1QzQwIDggMjkgMiAyNiAwWm0wIDU1LTYtNC04LTktNS0yNnYtMWwyLTFjOC0xIDE2LTYgMTYtNmwxLTEgMSAxczggNSAxNyA2bDEgMXYxcy0zIDIzLTUgMjZsLTggOWMtMiAyLTQgNC02IDR6IiBmaWxsPSIjYWIwMDAwIiBmaWxsLW9wYWNpdHk9IjEiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjxwYXRoIGQ9Ik0zOSAxOWExMzQ3IDEzNDcgMCAwIDEtMTMgMjZoLTJMMTQgMTloM2wyIDEgMSAxdjFhMjUwIDI1MCAwIDAgMSA2IDE3IDUyODkgNTI4OSAwIDAgMCA5LTIwaDR6IiBmaWxsPSIjMDAwIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiIHN0cm9rZT0iIzAwMCIgc3Ryb2tlLWRhc2hhcnJheT0ibm9uZSIgc3Ryb2tlLWxpbmVjYXA9ImJ1dHQiIHN0cm9rZS1saW5lam9pbj0ibWl0ZXIiIHN0cm9rZS13aWR0aD0iMSIvPjwvc3ZnPg== type: sidebar new_tab: true initial_users: - name: admin password_hash: c5af7c7177eaea7b586ad35fab2e168966e82c8e28c0dc594c0105091917c6f5 password_salt: 96ca7e1c335966238b8cf0bd051fab9b760e5ac456da3991ea4f6c1d84dc9dc2 authenticator: type: Basic CA: private_key: | -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAvc4edVyHFXvluxZA9rmo7OrYNsjUM8UswJvRl2KhzNIbp/ck 23Fm9VvfJJpVGeaBZnBzPhFv2v9P7fPLa/whMBFDRO4FpxWg6NEH4eK5NUP9VOQX AuGGdWhRM7inejMCqR1qpRLGqV2+XK6zwq3jFckM2tWXkbeWZ2gRogzkxKfKxpfM Zc5dQS2HyXx6Qi3ChvsTUz6I3KPbE/Zmi/LVvvi34MfzamLerqcHwp49rfw6OdQI kKk4VJRjSVMesyOvaHEL0LMGxE3iHjNQc+xbFLvO+54t5XGxaGQXC2WcWtacJbOy 9GoozjOxDtOELcVEoxJiRJQSeHaOF0AmDEXmKQIDAQABAoIBABRYz8ASCrMdZIux P4aTcY3wQPxifAkOtpTxPz8kxiaQUYGoh0108y4TSrEAUGYl5TJHlLsPIHgQDY/7 Jg/t59rgxt7RS07VjTnYCqnG5cbVgodCqkrXRVQ5uha60U1SwZLCggevIxfN4lXK LqAMhv7zXgrpgcWPsjJkoBtImY+RI6qxDlnosI8SNrVjhpzgJnBmVrLVEWmcVtQy 0yaT15Ms+e6Bp7nV5Coi+fzoEqB8kQiCKuz1x5wd5wjII1zZdoTfnEdAGHWXcI5W Cpw8Q5bTaOPhH7FrTOG52KOZ4Hf2ddxAOpp94zCSmf/TEuGj9doffJq/n8hIX5f0 K63GL+cCgYEA9fdI6chrytWLg0YdCaYzo/FDhWAKMOaccyze0N2Md/itMg7H0gG+ n41IykuxIVl+uNlK2Ou5y5+6NGg/M6EiITetQ1MY9c5VIJkTybEeXuhjCZcN6kzH 9SZoLsfCcJas6uHRuTTdoUZkaDhai5P00J5O33H+c+ahJ8BBGgb+5YMCgYEAxYxT YkLCssll3YnLsvxnBfNRYHfi4EDiDvRZp02LzS9rM8d8GsukJ87+SuDVQqSl+EYX oJl8a+1CSG8qCADLjt7dNjsWbIGXGEnoH5MhElfIHqzgJzotgUM28WA0abxwwRu5 Wgwys5Fv51Se4MfE664i+NtuQ7aTipWbReMjoeMCgYBO2jHj0L7Nzdvl/8o7V67i dewhjAJ4XtX1DoN4Di6EH5LWo2pn5utHlzGouM9WU6yOcgrOs/NiVhiJyInKcXPR llnTZYZw9u7PfoObe06zOmjVoDlzzZ2k9+UaaivpkERrIG3tpAcRNtHln3tXl906 LCY4+ACNA3jSl43HXErHJQKBgEIE6YD3KrYxVFe7S1YfwBZfAJ0qs6maRXIV+zhM VCJYbI07Z6BU2iFrrdQ8W0kQWV8lnZPQd6JiAjrO288c5Op0VJ1hFddhX6uAV5Dl zLGioICP6cFyUe7XFa+JJTsI/O2sZD9RwEf+nNVElGwulwLkiU99ldYPWDOCWAf9 JtVdAoGBAIS/83oQhFtxMM3iRUYpEhZm1fU0fAoHR2jmn8lZlW1o1/3lFXWVRMFC wZKWW+P1L45kf1Ymo7R6MgNGxfKxEBLpKFuM7rWF7SCEMwqT7R1t1JUzJ1g+CSmH 4br7lEM9JIRAr8W+5ON/2qyTYl7D/dPMNXQKCHL2pmeTkNGMunDk -----END RSA PRIVATE KEY----- Frontend: hostname: localhost bind_address: 0.0.0.0 bind_port: 8000 certificate: | -----BEGIN CERTIFICATE----- MIIDWDCCAkCgAwIBAgIRAKUx/2P2EOmm4oZCQ52QMOQwDQYJKoZIhvcNAQELBQAw GjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMB4XDTI2MDgzMTA4NTIzN1oXDTM2 MDgyODA4NTIzN1owNDEVMBMGA1UEChMMVmVsb2NpcmFwdG9yMRswGQYDVQQDExJW ZWxvY2lyYXB0b3JTZXJ2ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCjoSGnJEQTtEWjvSF5+BHwlSYQtUOO6jK6EozFnW+lmFLApNGm6YxSROJ1ylQM wSkIDSVZ48fFLTtln5Hq5zubxIwVwh1Ul0BN6c4JkBogZvywG5UKukzYraLi9h8E HKMrTp32/Ipbmfs61evz2cAkjmswN0g3hLAQRvJgpD4lih5YaVlvlpzw2okLDR31 wl2GqLjUugM4GHI8AQm/c2g0fiEBHfM4mnDvqFCOKqMJcFW4zBOtRNV+09FohIbn +ABdwzPm9WshVWbPFAurEuzeUXXhyWU+ZRFw+1H7LN18q7fl/UqhTyzcaZ4868iO g8/YbspGH3KEQEapFxy3y8+pAgMBAAGjfzB9MA4GA1UdDwEB/wQEAwIFoDAdBgNV HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAfBgNVHSME GDAWgBT4+DyMm6SfpNTW6/HmqNAVMOFLOjAdBgNVHREEFjAUghJWZWxvY2lyYXB0 b3JTZXJ2ZXIwDQYJKoZIhvcNAQELBQADggEBAEh4Puj+1W7Vur+vz5mYbm8QvDEV jU5PwvC/VfjxI4m3LuXYIUgWBMf5nW9m6yJB5SeBMxsb57TRz2lUgBj3BnpMcz3e 9PkDKN1+q5mJRU8dWQeM0Q8rdXkr0qh7fYm5nUuV6JAZJx5q5GZUNO/u1imuw9NM XWWuoscKggFQlJF9Jv1qIoUOcs6K9M2igOBP9aGXWTAzurgSjIIAFop8SbXUk6DR lMBD6XGxIlan9GmO054XTNZR9Cx6co7bdAccbG/FrGRvtbjzIzloAZMdhnI8m9kn Aw5NMfvTxNzgkqJKDFpKd/Hn2moYSOgi+vbDO/TseWN7v4WVIBWWEs2J5wU= -----END CERTIFICATE----- private_key: | -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAo6EhpyREE7RFo70hefgR8JUmELVDjuoyuhKMxZ1vpZhSwKTR pumMUkTidcpUDMEpCA0lWePHxS07ZZ+R6uc7m8SMFcIdVJdATenOCZAaIGb8sBuV CrpM2K2i4vYfBByjK06d9vyKW5n7OtXr89nAJI5rMDdIN4SwEEbyYKQ+JYoeWGlZ b5ac8NqJCw0d9cJdhqi41LoDOBhyPAEJv3NoNH4hAR3zOJpw76hQjiqjCXBVuMwT rUTVftPRaISG5/gAXcMz5vVrIVVmzxQLqxLs3lF14cllPmURcPtR+yzdfKu35f1K oU8s3GmePOvIjoPP2G7KRh9yhEBGqRcct8vPqQIDAQABAoIBAAW4VUfVgbe6npCZ xPjRjjb9z8XXwFPXpgxRJ7Ckz0lXqNTpLhcKpQgfNldtykBj5D5Oz1Z0GwCukxv7 VwuCJ9hLJ6Z/Ea1qWCohGT3GVtN5Ji412KD2YEdW0pHijrUDF0UlS2pd66xGFr04 yzXMD+Z3QBIAbLrcHZeEE2cDdtSzEAkWC8XoaQtUIcL71wvRv+17hu7CanyCB94c 1JWzF/63zg4e31GIuIvNT7NipTFB3OHZEvt2hj9e7foNTfHu2kzi/gSb02KuBKoj jwwcaPgSwKLF6z19tWr84G+AGKanUdgA2vGGbaX+QngM/u5f3++Zs/k8fAiCd9I0 ZLNhTD0CgYEA09fz3G8jSYwiT7jgqSSu6NlY5tdgc5GKCPkKYyXChQjmewUkaTCB of7fGlFeUzeiBYMuAIbTht4cv+g/UhdNOMMWkcWQodkjqrQUwHIFfmWKZmQ04hz5 V5oG+CNCKxxQjXQfTwHOW9oIVsDfEXFBTwR5ubwWF4HbQGDsMMlIC2cCgYEAxbx0 f5O0lpRNRvDHjOET7lZwETQQdGTn/GjEEM6xQbmGzP2MGFhSrnoh4OabTe5LOY7n ZXGWjKf1YZ8w+z3ceogXsUKZMZeY8g8grwuFxK6rC76NP16MlpAwa64Q5T8sESe0 TynMOP5eGUz0W455x9evYq0SfPq9fKcfwg3Ncm8CgYBx9mLB2yfokPKEYLi7RXiy 2vnwdTz17v2LBi6IV+/lEXysAYAs9mNGeo4a4lsT+YG35XIB5oY0r5hXxOELkG2C c7DYiqfb6aw+UNI5FR3PeWCS5KVuXpfkgH/vTUhzWLAc6LNPFXGmCA0kXm2iPIMd txKk0IIx8zG32Gw3cpDHUQKBgQC9Ok0Obc6rL38IfZGp6xeExWl3vShmCs7LCYNg Rjzxldc/wwBXp+ZwHGbhcC59lKaejXg550rYjj9QTeS0+o1NIYHy27X49IekVf/E JDW+dB0yHwfS9et6hsAfvDNk/2BvhlySSYCrphltAuzx1VYLfgfUWaZQvi+p49GL hmPutwKBgQC88qm8X7LnKN/Q1/mK48Rx2x5kaZ7NAH2gTwb20S2bdWLazQ/NWYww TFSFqpQttp3dYKg+fUOwIdDpdie3Tfv4+4Nwsq5Alpj3G/1jf+7Cmp2TGlQ0aKC/ vl4gvvzLXgfGeyuZEznOH19F/rwXcCiOdBs0TC9Wfc9jJXzpuDhbhg== -----END RSA PRIVATE KEY----- default_client_monitoring_artifacts: - Generic.Client.Stats GRPC_pool_max_size: 100 GRPC_pool_max_wait: 60 resources: connections_per_second: 100 notifications_per_second: 30 max_upload_size: 104857600 expected_clients: 30000 Datastore: implementation: FileBaseDataStore location: /opt/velociraptor filestore_directory: /opt/velociraptor compression: zlib Logging: output_directory: /opt/velociraptor/logs separate_logs_per_component: true debug: disabled: true info: rotation_time: 604800 max_age: 31536000 error: rotation_time: 604800 max_age: 31536000 Monitoring: bind_address: 127.0.0.1 bind_port: 8003 api_config: {} obfuscation_nonce: ggnsBONQSvU= defaults: hunt_expiry_hours: 168 notebook_cell_timeout_min: 10 security: certificate_validity_days: 3650 user1@ubuntu2604lts:/opt/velociraptor$

(完)