Here's what I performed:
puppetmaster1:
cleared ssl directory. sudo rm -rf /etc/puppetlabs/puppet/ssl
stopped services. puppet resource service puppet ensure=stopped, puppet resource service puppetserver ensure=stopped
regenerate CA. puppetserver ca setup
new ca is generated and will be used to different puppet masters
run puppet & puppetserver service. puppet resource service puppet ensure=running, puppet resource service puppetserver ensure=running
Downloaded .pem files using sftp. (/ssl/certs/ca.pem, /ssl/certs/puppetmaster1.local.pem, /ssl/crl.pem, /ssl/ca/ca_crl.pem, /ssl/ca/ca_crt.pem)
Downloaded .pem files will be uploaded to different puppet masters to use the same CA
puppetmaster2:
cleared ssl directory. sudo rm -rf /etc/puppetlabs/puppet/ssl
stopped services. puppet resource service puppet ensure=stopped, puppet resource service puppetserver ensure=stopped
regenerate CA. puppetserver ca setup
run puppet & puppetserver service. puppet resource service puppet ensure=running, puppet resource service puppetserver ensure=running
Upload .pem files from puppetmaster1 using sftp.
Overwrite .pem files from .pem files of puppetmaster1 (/ssl/certs/ca.pem, /ssl/certs/puppetmaster1.local.pem, /ssl/crl.pem, /ssl/ca/ca_crl.pem, /ssl/ca/ca_crt.pem)
Error is showing:
Related
I have Puppet master and Puppet agent, and the agent succeed to communicate with the master. Now I want to use other machine as my Puppet master. I create another Puppet master, called master-2, and run in the agent:
sudo puppet agent -t --server master-2
that cause to error:
certificate verify failed: [self signed certificate in certificate
chain for /CN=Puppet CA: master-2]
I copied the folder /var/lib/puppet/ssl from master to master-2, and now the above command succeeded.
Is there a way to prevent an agent communication with the first master? How I can remove the first master certificates from the agent and add a new certificates of master-2?
Create new clean master-2, and copy two files from master-2 to agent:
Copy file "/var/lib/puppet/ssl/ca/ca_crt.pem" from master-2 to agent, and save it as "/var/lib/puppet/ssl/certs/ca.pem".
Copy file "/var/lib/puppet/ssl/ca/ca_crl.pem" from master-2 to agent, ans save it as "/var/lib/puppet/ssl/crl.pem".
Delete old certificates in agent:
sudo find /var/lib/puppet/ssl -name <hostname>.pem -delete
Step 1 : Edit your agent's puppet.conf and add the new puppet master details in the [agent] section like below
[agent]
server=
Step 2 (optional) : If you are not copying the masters ssl certificate folder (/var/lib/puppet/ssl) , your agnet will now try to contact the server master2 and request a new certificate .You can sign the new certificate in your CA server using
puppet cert sign
command
I am trying to setup puppet master and puppet agent in aws ec2 instances-linux ami. when i run my puppet agent to generate the certificate for the master to sign i encounter the below error.
Puppet Master:
[root#ip-10-**-*-*** /]# sudo yum install puppet-server
[root#ip-10-**-*-*** /] sudo service puppetmaster start
Starting puppetmaster: [ OK ]
Puppet Agent:
[root#ip-10-**-*-*** /]# sudo yum install puppet
[root#ip-10-**-*-*** /]
File excerpt /etc/puppet/puppet.conf
[main]
server = hostname
[root#ip-10-**-*-*** /] sudo service puppet start
Starting puppet: [ OK ]
[root#ip-10-**-*-*** /]# puppet agent -t
info: Creating a new SSL key for ip-10-**-*-***.dev.abc.net
info: Caching certificate for ca
info: Creating a new SSL certificate request for ip-10-**-*-***.dev.abc.net
info: Certificate Request fingerprint (md5): C2:F0:B1:2C:19:39:9E:D6:39:24:18:28
Exiting; no certificate found and waitforcert is disabled
Puppet Master:
[root#ip-10-**-*-*** /]# puppet cert list
"ip-10-**-*-***.dev.abc.net" (C2:F0:B1:2C:19:39:9E:D6:39:24:18:28:F6:DA:5D:FE)
[root#ip-10-**-*-*** /]# puppet cert sign ip-10-**-*-***.dev.abc.net
notice: Signed certificate request for ip-10-**-*-***.dev.abc.net
notice: Removing file Puppet::SSL::CertificateRequest ip-10-**-*-***.dev.abc.net at '/var/lib/puppet/ssl/ca/requests/ip-10-**-*-***.dev.abc.net.pem'
Puppet Agent:
[root#ip-10-**-*-*** /]# puppet agent -t
info: Caching certificate for ip-10-**-*-***.dev.abc.net
err: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate signature failure for /CN=ip-10-**-*-***.dev.abc.net]
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run
err: Could not send report: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate signature failure for /CN=ip-10-**-*-***.dev.abc.net]
Can anyone please help me resolve this issue.
Yes, I know this is an old post. It still needs an answer, as I am having the same issue -- been working it for a few weeks now. I cannot guarantee yet that mine is working correctly all the time. Here are some steps I have taken. I hope they are helpful to others.
I am running Puppet Enterprise 2018.1.4. Puppet Agent 5.5.6 on RHEL 7.4.
1) The SSL routine uses a time stamp. Ensure the time is the same between Master & Client.
2) clean/remove the agent cert from the Master AND the Client. On my RHEL, the Client cert is is in /etc/puppetlabs/puppet/ssl/* -- remove any files with the agent name in here.
3) Make sure your puppet enabled on your agent: puppet agent --enable
4) If a client does not contact the puppet master "for a while" the master will drop the client from it's node list, but NOT remove the cert. In theory, the master SHOULD return the node to an active status.
5) Can you run the puppet agent on the master & get the expected results? If not -> problem with puppet code, otherwise, problem with agent.
6) Is puppet.conf configured correctly? Under the [main] section, do you have the server entry correct? Under [agent] are you set to the correct environment? Is noop set to true?
7) It is possible that you have an error in a puppet module that is causeing the agent to exit quietly. Run puppet parser validate on all of your .pp files
8) Can the master resolve the IP address of the master and the client? Can the client resolve the the IP address of the master and the client? Is resolv.conf set correctly on both hosts?
9) hostnames of the client & master should be correct. Each server should know it's shortname, FQDN and IP. On RHEL, I run: hostname; hostname -f; and hostname -i, respectively.
10) File permissions on all the directories & modules should be correct. Check out a working module, see it's owner, group & permissions. Ensure your module is the same.
11) Only root/admin can correctly run puppet agent.
12) On RHEL, the logs are under /var/log/puppet. Do you see any errors there?
13) run puppet agent with the --debug or the --trace option in addition to -t. Pipe this output to a file and see if you can spot any errors.
14) Can you force the master to run the puppet agent on the client successfully?
Many of these things have been narrowing down my issue. I don't know yet if it is fixed, as It takes a while for a node to drop out. Hopefully these will fix your issue.
Puppet Enterprise appeared to be installed on my ubuntu 14.04 server:
root#puppet:/# puppet --version
3.8.5 (Puppet Enterprise 3.8.4)
However, the puppet service is not running:
root#puppet:/# service puppet status
puppet: unrecognized service
The Puppet server seems to be working as well, as I can execute following command on the puppet master:
root#puppet:/# puppet resource package nginx
package { 'nginx':
ensure => '1.4.6-1ubuntu3.4',
Puppet cert list is empty as well even after running 'puppet agent -t' on a node:
root#puppet:/# puppet cert list
root#puppet:/#
The puppet service is called pe-puppet and not puppet on PE 3.x.
puppet cert list only displays the outstanding cert requests. You want puppet cert list --all to display the signed certs. https://docs.puppet.com/puppet/latest/reference/man/cert.html
service puppetmaster status
this will show the status of the puppet on the master machine
service puppet status
this will show the status on the slave/agent machine
We have several servers working with puppet as agents today, but I'm having a problem with a new server running CentOS 7. Normally I would update the /etc/sysconfig/puppet file with the puppet master name and then start the daemon and move to signing the certificate on the master. However, puppet agent doesn't appear to be reading the server = myhost.domain in my config file.
I get the following error in /var/log/messages:
puppet-agent[11133]: Could not request certificate: getaddrinfo: Name or service not known
I tried:
myserver:root$ puppet agent --configprint server
puppet
myserver:root$
but the /etc/sysconfig/puppet file has:
PUPPET_SERVER=myserver.domain.com
Can you please help me understand why puppet agent doesn't get the server from the config file?
The /etc/sysconfig/puppet file is not typically read by the Puppet agent. (I'm not very familiar with CentOS operations, but I suppose that this location might hold some settings that are external to the process, such as environment, command line switches etc.)
You will want to use the proper puppet configuration file:
/etc/puppet/puppet.conf for Puppet 3.x and earlier
/etc/puppetlabs/puppet.conf for Puppet 4.x
so ran the following:
"puppet agent --no-daemonize --verbose --onetime --server puppetmaster.xxx.com"
this started puppet properly, requested certificate and I was able to sign on master. Then added:
server = puppetmaster.xxx.com
to /etc/puppet/puppet.conf and "systemctl restart puppet"
and it worked. Thanks for posts here and other places.
I'm new to puppet, but picking it up quickly. Today, I'm running into an issue when trying to run the following:
$ puppet agent --no-daemonize --verbose --onetime
**err: Could not request certificate: getaddrinfo: Name or service not known
Exiting; failed to retrieve certificate and waitforcert is disabled**
It would appear the agent doesn't know what server to connect to. I could just specify --server on the command line, but that will be of no use to me when this runs as a daemon in production, so instead, I specify the server name in /etc/puppet/puppet.conf like so:
[main]
server = puppet.<my domain>
I do have a DNS entry for puppet.<my domain> and if I dig puppet.<my domain>, I see that the name resolves correctly.
All puppet documentation I have read states that the agent tries to connect to a puppet master at puppet by default and your options are host file trickery or do the right thing, create a CNAME in DNS, and edit the puppet.conf accordingly, which I have done.
So what am I missing? Any help is greatly appreciated!
D'oh! Need to sudo to do this! Then everything works.
I had to use the --server flag:
sudo puppet agent --server=puppet.example.org
I actually had the same error but I was using the two learning puppet vm and trying run the 'puppet agent --test' command.
I solved the problem by opening the file /etc/hosts on both the master and the agent vm and the line
***.***.***.*** learn.localdomain learn puppet.localdomain puppet
The ip address (the asterisks) was originally some random number. I had to change this number on both vm so that it was the ip address of the master node.
So I guess for experienced users my advice is to check the /etc/hosts file to make sure that the ip addresses in here for the master and agent not only match but are the same as the ip address of the master.
for other noobs like me my advice is to read the documentation more clearly. This was a step in the 'setting up an agent vm' process the I totally missed xD
In my case I was getting same error but it was due to the cert which should been signed to node on puppetmaster server.
to check pending certs run following:
puppet cert list
"node.domain.com" (SHA256) 8D:E5:8A:2*******"
sign the cert to node:
puppet cert sign node.domain.com
Had the same issue today on puppet 2.6 on CentOS 6.4
All I did to resolve the issue was to check the usual stuff such as hosts and resolv.conf to ensure they were as expected (compared with a working server) and then;
Removed /var/lib/puppet directory rm -rf /var/lib/puppet
Cleared the certificate on the puppet master puppetca --clean
servername
Restarted the network service network restart
Re-ran puppet
Even though the resolv.conf was identical to the working server, puppet updated resolv.conf and immediately re-signed the certificate and replaced all the puppet lib files.
Everything was fine after that.