>
>
> >>>
> >>>
> >>>>> not really…
> >>>>>
> >>>>> /var/log/apache2/error_log (this is all I get after my 'mark' and
> restarting apache after changing the files back to SSL
> >>>>> [Tue Aug 09 12:37:57 2011] [notice] Apache/2.2.14 (Ubuntu)
> Phusion_Passenger/3.0.7 mod_ssl/2.2.14 OpenSSL/0.9.8k configured –
> resuming normal operations
> >>>>>
> /var/www/foreman/vendor/plugins/acts_as_audited/lib/acts_as_audited.rb:37:
> warning: already initialized constant CALLBACKS
> >>>>>
> >>>>> foreman/log/production.log
> >>>>> # Logfile created on Wed Aug 03 09:58:33 -0700 2011**
> has_many_polymorphs: rails environment detected
> >>>>> ** has_many_polymorphs: preloading parent model Usergroup
> >>>>> ** has_many_polymorphs: preloading parent model Usergroup
> >>>>>
> >>>>>
> >>>>> Processing ReportsController#create to yml (for 127.0.1.1 at
> 2011-08-09 12:38:39) [POST]
> >>>>> Parameters: {"report"=>"[FILTERED]", "format"=>"yml",
> "action"=>"create", "controller"=>"reports"}
> >>>>> processing report for ubuntu26.ttinet
> >>>>> Completed in 1847ms (View: 1, DB: 769) | 200 OK [
> https://ubuntu.ttinet/reports/create?format=yml]
> >>>>> ** has_many_polymorphs: rails environment detected
> >>>>> ** has_many_polymorphs: preloading parent model Usergroup
> >>>>> ** has_many_polymorphs: preloading parent model Usergroup
> >>>>>
> >>>>>
> >>>>> Processing ReportsController#create to yml (for 127.0.1.1 at
> 2011-08-09 12:38:39) [POST]
> >>>>> Parameters: {"report"=>"[FILTERED]", "format"=>"yml",
> "action"=>"create", "controller"=>"reports"}
> >>>>> processing report for ubuntu.ttinet
> >>>>> Sent mail to craig.white@ttiltd.com
> >>>>> Completed in 3070ms (View: 2, DB: 1111) | 200 OK [
> https://ubuntu.ttinet/reports/create?format=yml]
> >>>>
> >>>> it sounds to me like you are not getting to foreman at all… maybe
> >>>> apache ssl is blocking you? (try with curl -v to see whats going on).
> >>> ----
> >>> I think that is sort of what is happening.
> >>>
> >>> I configured
> >>> - /etc/puppet/node.rb (from foreman) - use https instead of http
> >>> -
> /usr/local/lib/ruby/gems/1.8/gems/puppet-2.6.9//lib/puppet/reports/foreman.rb
> - use https instead of http
> >>> - /var/www/foreman/config/settings.yaml - uncommented :require_ssl:
> true
> >>> - /etc/apache2/sites-available/foreman.conf - uncommented out all of
> the SSL Directives
> >>> - restarted apache2 service
> >>>
> >>> anyway…
> >>>
> >>> curl -k -v https://ubuntu.ttinet:8142/node/ubuntu.ttinet?format=yml
> >>> * About to connect() to ubuntu.ttinet port 8142 (#0)
> >>> * Trying 127.0.1.1… connected
> >>> * Connected to ubuntu.ttinet (127.0.1.1) port 8142 (#0)
> >>> * successfully set certificate verify locations:
> >>> * CAfile: none
> >>> CApath: /etc/ssl/certs
> >>> * SSLv3, TLS handshake, Client hello (1):
> >>> * SSLv3, TLS handshake, Server hello (2):
> >>> * SSLv3, TLS handshake, CERT (11):
> >>> * SSLv3, TLS handshake, Server key exchange (12):
> >>> * SSLv3, TLS handshake, Request CERT (13):
> >>> * SSLv3, TLS handshake, Server finished (14):
> >>> * SSLv3, TLS handshake, CERT (11):
> >>> * SSLv3, TLS handshake, Client key exchange (16):
> >>> * SSLv3, TLS change cipher, Client hello (1):
> >>> * SSLv3, TLS handshake, Finished (20):
> >>> * SSLv3, TLS change cipher, Client hello (1):
> >>> * SSLv3, TLS handshake, Finished (20):
> >>> * SSL connection using DHE-RSA-AES256-SHA
> >>> * Server certificate:
> >>> * subject: CN=ubuntu.ttinet
> >>> * start date: 2011-08-01 18:31:08 GMT
> >>> * expire date: 2021-07-29 18:31:08 GMT
> >>> * subjectAltName: ubuntu.ttinet matched
> >>> * issuer: CN=Puppet CA: ubuntu.ttinet
> >>> * SSL certificate verify result: self signed certificate in
> certificate chain (19), continuing anyway.
> >>>> GET /node/ubuntu.ttinet?format=yml HTTP/1.1
> >>>> User-Agent: curl/7.19.7 (x86_64-pc-linux-gnu) libcurl/7.19.7
> OpenSSL/0.9.8k zlib/1.2.3.3 libidn/1.15
> >>>> Host: ubuntu.ttinet:8142
> >>>> Accept: /
> >>>>
> >>> < HTTP/1.1 200 OK
> >>> < Date: Wed, 10 Aug 2011 15:52:01 GMT
> >>> < Server: Apache/2.2.14 (Ubuntu)
> >>> < X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.7
> >>> < ETag: "5ea41dae4f5240cf3990b5e50decbd4f"
> >>> < X-Runtime: 20
> >>> < Cache-Control: private, max-age=0, must-revalidate
> >>> < Content-Length: 397
> >>> < Status: 200
> >>> < Vary: Accept-Encoding
> >>> < Content-Type: text/plain; charset=utf-8
> >>> <
> >>> —
> >>> parameters:
> >>> puppetmaster: ubuntu.ttinet
> >>> hostgroup: puppetmaster
> >>> apt:
7F0CEB10
> >>> classes:
> >>> - sudoers::hostgroup
> >>> - subversion
> >>> - postfix
> >>> - ntp
> >>> - git
> >>> - etc
> >>> - apt
> >>> - sudoers
> >>> - ldap::configure
> >>> - ldap::client_install
> >>> - mysql
> >>> - apache::service
> >>> - gems::passenger
> >>> - apache
> >>> - firebird
> >>> - mongodb
> >>> * Connection #0 to host ubuntu.ttinet left intact
> >>> * Closing connection #0
> >>> * SSLv3, TLS alert, Client hello (1):
> >>>
> >>> As I think I said when I started this thread, I haven't had a problem
> using curl to get the catalog when I use https.
> >>>
> >>> I also don't have a problem accessing the web site using https and
> reports end up on forman from any of the puppet clients when I use https.
> >>>
> >>> The only thing that seems to not work is that the catalogs don't seem
> to happen. The error always is…
> >>>
> >>> Could not retrieve catalog from remote server: Error 400 on SERVER:
> Could not find node 'ubuntu.ttinet'; cannot compile
> >>>
> >>> and yes, I didn't understand why foreman ran as user 'nobody' but I
> ignorantly fixed the problem when I finally chown puppet:puppet
> /var/www/foreman -R and now, I know why it runs as user puppet.
> >>>
> >>> Craig
> >>>
> >>> –
> >>> You received this message because you are subscribed to the Google
> Groups "Foreman users" group.
> >>> To post to this group, send email to foreman-users@googlegroups.com.
> >>> To unsubscribe from this group, send email to
> foreman-users+unsubscribe@googlegroups.com.
> >>> For more options, visit this group at
> http://groups.google.com/group/foreman-users?hl=en.
> >>>
> >>>
> >>
> >> Do you get the 400 even with SSL on?
> >>
> >
> > If you are using the External Nodes script that comes with Foreman, try:
> >
> > chown -R puppet:puppet /var/lib/puppet/yaml/foreman/
> >
> > Ohad: there needs to be an exception check in this script.
> >
> > When run from the cmd line, most people will run it as root,
> > and /var/lib/puppet/yaml/foreman/ becomes root owned.
> >
> > But when puppet master runs it, it can't write files in
> > /var/lib/puppet/yaml/foreman/.
> >
> > Therefore, the script always works as root from the cmd line,
> > and gives 400 on the puppet client side.
> ----
> seemed like a good thought - especially because for a while,
> passenger/rack/rails/foreman was running as user 'nobody' (which I fixed but
> didn't know exactly how but Ohad clarified).
>
> /var/lib/puppet/yaml directory was permission 0750 but all the files seemed
> to be owned by puppet:puppet - I changed the directory to 0775 but it made
> no difference. /var/lib/puppet/yaml/foreman and all the files therein were
> readable by all.
>
> I also took the big hammer to /var/lib/puppet just in case…
>
> chown puppet:puppet /var/lib/puppet -R
> chmod o+r /var/lib/puppet -R
>
> to no avail
>
> what you really need to do is simple:
sudo su - puppet -s /bin/bash
/node_script <fqdn>
I'm guessing you would get your answer this way.
if that doesn't work, then you can always replace our ENC script with the
following
#! /bin/sh
curl -ks https://foreman/node/$1?format=yml
Ohad
Craig
···
On Thu, Aug 11, 2011 at 12:48 AM, Craig White wrote:
> On Aug 10, 2011, at 12:18 PM, Ashay Humane wrote:
> > On Wed, Aug 10, 2011 at 12:05 PM, Ashay Humane > wrote:
> >> On Wed, Aug 10, 2011 at 9:02 AM, Craig White > wrote:
> >>> On Aug 10, 2011, at 12:18 AM, Ohad Levy wrote:
> >>>> On Tue, Aug 9, 2011 at 11:20 PM, Craig White > wrote:
>
> --
> You received this message because you are subscribed to the Google Groups
> "Foreman users" group.
> To post to this group, send email to foreman-users@googlegroups.com.
> To unsubscribe from this group, send email to
> foreman-users+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/foreman-users?hl=en.
>
>
