[katello] 403 forbidden errors on RHEL6 client attached to Katello 2 server

Support
1

I've installed a Katello 2.0 server to manage CentOS servers in our
environment, but we have a number of RHEL servers in our environment too,
so I've been attempting to follow:

http://www.katello.org/docs/user_guide/red_hat_content/content.html

to register the RHEL servers to our Katello too.

Now, I've managed to get the manifest imported, repositories synced etc.
and have also managed to get a server to register, see
katello-content-hosts.png

However, whenever I try to do anything with Yum on the registered server, I
just get 403 Forbidden errors:

[root@rhel6-template ~]# yum -v check-update
Not loading "rhnplugin" plugin, as it is disabled
Loading "downloadonly" plugin
Plugin "package_upload" can't be imported
Loading "product-id" plugin
Loading "security" plugin
Loading "subscription-manager" plugin
Updating Subscription Management repositories.
Config time: 0.838
Yum Version: 3.2.29
Setting up Package Sacks
https://katello.example.com/pulp/repos/Press_Association/Library/RHEL-6/content/dist/rhel/server/6/6Server/x86_64/os/repodata/repomd.xml:
[Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 403
Forbidden"
Trying other mirror.
Error: Cannot retrieve repository metadata (repomd.xml) for repository:
rhel-6-server-rpms. Please verify its path and try again

I have the Katello agent and consumer RPM installed:

[root@rhel6-template ~]# rpm -qa |grep katello
katello-agent-2.0.1-1.el6.noarch
katello-ca-consumer-katello.example.com-1.0-1.noarch

Is there any more useful information to provide? I can't find anything very
enlightening in the Katello server logs, only entries like the following in
foreman-ssl_access_ssl.log:

10.253.65.214 - - [17/Nov/2014:09:46:01 +0000] "GET
/pulp/repos/Example_Organisation/Library/RHEL-6/content/dist/rhel/server/6/6Server/x86_64/os/repodata/repomd.xml
HTTP/1.1" 403 310 "-" "urlgrabber/3.9.1 yum/3.2.29"

Any clues?

Cheers,

John

2

Hi,

Try this on the client:
yum clean all
subscription-manager refresh

If that doesn't help, please provide:

  • subscription-manager status
  • subscription-manager list --available
  • See if any errors in /var/log/candlepin/candlepin.log
··· On Mon, Nov 17, 2014 at 01:49:36AM -0800, John Beranek - PA wrote: > > > > I've installed a Katello 2.0 server to manage CentOS servers in our > environment, but we have a number of RHEL servers in our environment too, > so I've been attempting to follow: > > http://www.katello.org/docs/user_guide/red_hat_content/content.html > > to register the RHEL servers to our Katello too. > > Now, I've managed to get the manifest imported, repositories synced etc. > and have also managed to get a server to register, see > katello-content-hosts.png > > However, whenever I try to do anything with Yum on the registered server, I > just get 403 Forbidden errors: > > > [root@rhel6-template ~]# yum -v check-update > Not loading "rhnplugin" plugin, as it is disabled > Loading "downloadonly" plugin > Plugin "package_upload" can't be imported > Loading "product-id" plugin > Loading "security" plugin > Loading "subscription-manager" plugin > Updating Subscription Management repositories. > Config time: 0.838 > Yum Version: 3.2.29 > Setting up Package Sacks > https://katello.example.com/pulp/repos/Press_Association/Library/RHEL-6/content/dist/rhel/server/6/6Server/x86_64/os/repodata/repomd.xml: > [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 403 > Forbidden" > Trying other mirror. > Error: Cannot retrieve repository metadata (repomd.xml) for repository: > rhel-6-server-rpms. Please verify its path and try again > > I have the Katello agent and consumer RPM installed: > > [root@rhel6-template ~]# rpm -qa |grep katello > katello-agent-2.0.1-1.el6.noarch > katello-ca-consumer-katello.example.com-1.0-1.noarch > > Is there any more useful information to provide? I can't find anything very > enlightening in the Katello server logs, only entries like the following in > foreman-ssl_access_ssl.log: > > 10.253.65.214 - - [17/Nov/2014:09:46:01 +0000] "GET > /pulp/repos/Example_Organisation/Library/RHEL-6/content/dist/rhel/server/6/6Server/x86_64/os/repodata/repomd.xml > HTTP/1.1" 403 310 "-" "urlgrabber/3.9.1 yum/3.2.29" > > > Any clues?

–
Stephen Benjamin

Red Hat GmbH | http://de.redhat.com/ | Sitz: Grasbrunn
Handelsregister: Amtsgericht München, HRB 153243
Geschäftsführer: Charles Cachera, Michael Cunningham,
Michael O’Neill, Charles Peters

3

No help from the client-side commands.

[root@rhel6-template ~]# subscription-manager status

··· +-------------------------------------------+ System Status Details +-------------------------------------------+ Overall Status: Current

[root@rhel6-template ~]# subscription-manager list --available
±------------------------------------------+
Available Subscriptions
±------------------------------------------+
Subscription Name: CentOS
Provides:
SKU: 1413025265833
Contract:
Pool ID: 8a8ca29648fed71c0148fede7a910008
Available: Unlimited
Suggested: 1
Service Level:
Service Type:
Subscription Type: Standard
Ends: 03/10/44
System Type: Physical

Nothing error-like in the Candlepin log:

2014-11-17 10:14:27,898 [req=e03fbcd8-4055-4e6a-8738-6fc6bbd55409, org=]
INFO org.candlepin.common.filter.LoggingFilter - Request: verb=GET,
uri=/candlepin/consumers/e9994eca-a8f5-40b6-ab71-55619658c272/content_overrides
2014-11-17 10:14:27,935 [req=e03fbcd8-4055-4e6a-8738-6fc6bbd55409, org=]
INFO org.candlepin.common.filter.LoggingFilter - Response: status=200,
content-type=“application/json”, time=37ms
2014-11-17 10:14:28,068 [req=544ba8e7-73ec-41ce-a060-c4962f3df2c0, org=]
INFO org.candlepin.common.filter.LoggingFilter - Request: verb=GET,
uri=/candlepin/consumers/e9994eca-a8f5-40b6-ab71-55619658c272/release
2014-11-17 10:14:28,110 [req=544ba8e7-73ec-41ce-a060-c4962f3df2c0,
org=Example_Organisation] INFO org.candlepin.common.filter.LoggingFilter -
Response: status=200, content-type=“application/json”, time=42ms

Cheers,

John

4

> No help from the client-side commands.
>
> [root@rhel6-template ~]# subscription-manager status
> ±------------------------------------------+
> System Status Details
> ±------------------------------------------+
> Overall Status: Current
>
> [root@rhel6-template ~]# subscription-manager list --available
> ±------------------------------------------+
> Available Subscriptions
> ±------------------------------------------+
> Subscription Name: CentOS
> Provides:
> SKU: 1413025265833
> Contract:
> Pool ID: 8a8ca29648fed71c0148fede7a910008
> Available: Unlimited
> Suggested: 1
> Service Level:
> Service Type:
> Subscription Type: Standard
> Ends: 03/10/44
> System Type: Physical

You'll need to attach a RHEL subscription, this is CentOS.

For this host, you can add one from the Content Host page, click
Subscriptions, add a RHEL one, and then click auto-attach. You
may need to run refresh on the host itself again.

You could also create an activation key and add any subscriptions
you need there, and then when you register future machines:

subscription-manager register --org="Whatever" --activationkey="activationkey" --auto-attach
··· On Mon, Nov 17, 2014 at 02:15:22AM -0800, John Beranek - PA wrote:

Nothing error-like in the Candlepin log:

2014-11-17 10:14:27,898 [req=e03fbcd8-4055-4e6a-8738-6fc6bbd55409, org=]
INFO org.candlepin.common.filter.LoggingFilter - Request: verb=GET,
uri=/candlepin/consumers/e9994eca-a8f5-40b6-ab71-55619658c272/content_overrides
2014-11-17 10:14:27,935 [req=e03fbcd8-4055-4e6a-8738-6fc6bbd55409, org=]
INFO org.candlepin.common.filter.LoggingFilter - Response: status=200,
content-type=“application/json”, time=37ms
2014-11-17 10:14:28,068 [req=544ba8e7-73ec-41ce-a060-c4962f3df2c0, org=]
INFO org.candlepin.common.filter.LoggingFilter - Request: verb=GET,
uri=/candlepin/consumers/e9994eca-a8f5-40b6-ab71-55619658c272/release
2014-11-17 10:14:28,110 [req=544ba8e7-73ec-41ce-a060-c4962f3df2c0,
org=Example_Organisation] INFO org.candlepin.common.filter.LoggingFilter -
Response: status=200, content-type=“application/json”, time=42ms

Cheers,

John

–
You received this message because you are subscribed to the Google Groups “Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send an email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.

–
Stephen Benjamin

Red Hat GmbH | http://de.redhat.com/ | Sitz: Grasbrunn
Handelsregister: Amtsgericht München, HRB 153243
Geschäftsführer: Charles Cachera, Michael Cunningham,
Michael O’Neill, Charles Peters

5

CentOS subscriptions are available, but the server is using a RHEL
subscription:

[johnb@rhel6-template ~]$ sudo subscription-manager list

··· +-------------------------------------------+ Installed Product Status +-------------------------------------------+ Product Name: Red Hat Enterprise Linux Server Product ID: 69 Version: 6.3 Arch: x86_64 Status: Subscribed Status Details: Starts: 12/15/2013 Ends: 12/15/2014

http://imgur.com/iwWqa3V

Just thought it’s worth stating that this host was previously registered
with Red Hat via RHN Classic. I did try the rhn-migrate-classic-to-rhsm
script, but couldn’t get it to work with my Katello 2.0 server…

Cheers,

John

On Monday, 17 November 2014 10:39:51 UTC, Stephen Benjamin wrote:

On Mon, Nov 17, 2014 at 02:15:22AM -0800, John Beranek - PA wrote:

No help from the client-side commands.

[root@rhel6-template ~]# subscription-manager status
±------------------------------------------+
System Status Details
±------------------------------------------+
Overall Status: Current

[root@rhel6-template ~]# subscription-manager list --available
±------------------------------------------+
Available Subscriptions
±------------------------------------------+
Subscription Name: CentOS
Provides:
SKU: 1413025265833
Contract:
Pool ID: 8a8ca29648fed71c0148fede7a910008
Available: Unlimited
Suggested: 1
Service Level:
Service Type:
Subscription Type: Standard
Ends: 03/10/44
System Type: Physical

You’ll need to attach a RHEL subscription, this is CentOS.

For this host, you can add one from the Content Host page, click
Subscriptions, add a RHEL one, and then click auto-attach. You
may need to run refresh on the host itself again.

You could also create an activation key and add any subscriptions
you need there, and then when you register future machines:

subscription-manager register --org="Whatever"

–activationkey=“activationkey” --auto-attach

Nothing error-like in the Candlepin log:

2014-11-17 10:14:27,898 [req=e03fbcd8-4055-4e6a-8738-6fc6bbd55409, org=]
INFO org.candlepin.common.filter.LoggingFilter - Request: verb=GET,

uri=/candlepin/consumers/e9994eca-a8f5-40b6-ab71-55619658c272/content_overrides

2014-11-17 10:14:27,935 [req=e03fbcd8-4055-4e6a-8738-6fc6bbd55409, org=]
INFO org.candlepin.common.filter.LoggingFilter - Response: status=200,
content-type=“application/json”, time=37ms
2014-11-17 10:14:28,068 [req=544ba8e7-73ec-41ce-a060-c4962f3df2c0, org=]
INFO org.candlepin.common.filter.LoggingFilter - Request: verb=GET,
uri=/candlepin/consumers/e9994eca-a8f5-40b6-ab71-55619658c272/release
2014-11-17 10:14:28,110 [req=544ba8e7-73ec-41ce-a060-c4962f3df2c0,
org=Example_Organisation] INFO
org.candlepin.common.filter.LoggingFilter -
Response: status=200, content-type=“application/json”, time=42ms

Cheers,

John

–
You received this message because you are subscribed to the Google
Groups “Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send
an email to foreman-user...@googlegroups.com <javascript:>.
To post to this group, send email to forema...@googlegroups.com
<javascript:>.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.

–
Stephen Benjamin

Red Hat GmbH | http://de.redhat.com/ | Sitz: Grasbrunn
Handelsregister: Amtsgericht München, HRB 153243
Geschäftsführer: Charles Cachera, Michael Cunningham,
Michael O’Neill, Charles Peters

6

The system was RHEL 6.5, so no 6.6 update and perhaps unpatched for 6
months or so…

[root@rhel6-template ~]# cat /etc/issue
Red Hat Enterprise Linux Server release 6.5 (Santiago)
Kernel \r on an \m

[root@rhel6-template ~]# rpm -qa|grep subscript
subscription-manager-migration-1.12.14-7.el6.x86_64
subscription-manager-migration-data-2.0.13-1.el6.noarch
subscription-manager-1.12.14-7.el6.x86_64

I'll try re-registering the server with RHN Classic.

Cheers,

John

7

Updating to fully patched 6.6 hasn't helped…

[root@rhel6-template ~]# yum check-update
Plugin "package_upload" can't be imported
Loaded plugins: downloadonly, product-id, security, subscription-manager
https://katello.local/pulp/repos/Example_Organisation/Library/RHEL-6/content/dist/rhel/server/6/6Server/x86_64/os/repodata/repomd.xml:
[Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 403
Forbidden"
Trying other mirror.
Error: Cannot retrieve repository metadata (repomd.xml) for repository:
rhel-6-server-rpms. Please verify its path and try again

John

8

> CentOS subscriptions are available, but the server is using a RHEL
> subscription:
>
> [johnb@rhel6-template ~]$ sudo subscription-manager list
> ±------------------------------------------+
> Installed Product Status
> ±------------------------------------------+
> Product Name: Red Hat Enterprise Linux Server
> Product ID: 69
> Version: 6.3
> Arch: x86_64
> Status: Subscribed
> Status Details:
> Starts: 12/15/2013
> Ends: 12/15/2014
>
>
> http://imgur.com/iwWqa3V
>
> Just thought it's worth stating that this host was previously registered
> with Red Hat via RHN Classic. I did try the rhn-migrate-classic-to-rhsm
> script, but couldn't get it to work with my Katello 2.0 server…

Ah sorry, I thought subscription-manager list --available would've show
the installed product too.

The subscription looks right. Date and time on the server match up with
the Katello server? Hostname didn't change or anything of the client?

And, is this machine actually RHEL 6.3? I wonder if it's something with
the subscription-manager version being compatible, we started testing
against 6.5 with Katello 2.0. That's just a guess, one of the other devs
might know if that would be a problem.

If you can get it back registered to RHN and update, I would try that
too.

··· On Mon, Nov 17, 2014 at 02:57:03AM -0800, John Beranek - PA wrote:

Cheers,

John

On Monday, 17 November 2014 10:39:51 UTC, Stephen Benjamin wrote:

On Mon, Nov 17, 2014 at 02:15:22AM -0800, John Beranek - PA wrote:

No help from the client-side commands.

[root@rhel6-template ~]# subscription-manager status
±------------------------------------------+
System Status Details
±------------------------------------------+
Overall Status: Current

[root@rhel6-template ~]# subscription-manager list --available
±------------------------------------------+
Available Subscriptions
±------------------------------------------+
Subscription Name: CentOS
Provides:
SKU: 1413025265833
Contract:
Pool ID: 8a8ca29648fed71c0148fede7a910008
Available: Unlimited
Suggested: 1
Service Level:
Service Type:
Subscription Type: Standard
Ends: 03/10/44
System Type: Physical

You’ll need to attach a RHEL subscription, this is CentOS.

For this host, you can add one from the Content Host page, click
Subscriptions, add a RHEL one, and then click auto-attach. You
may need to run refresh on the host itself again.

You could also create an activation key and add any subscriptions
you need there, and then when you register future machines:

subscription-manager register --org="Whatever"

–activationkey=“activationkey” --auto-attach

Nothing error-like in the Candlepin log:

2014-11-17 10:14:27,898 [req=e03fbcd8-4055-4e6a-8738-6fc6bbd55409, org=]
INFO org.candlepin.common.filter.LoggingFilter - Request: verb=GET,

uri=/candlepin/consumers/e9994eca-a8f5-40b6-ab71-55619658c272/content_overrides

2014-11-17 10:14:27,935 [req=e03fbcd8-4055-4e6a-8738-6fc6bbd55409, org=]
INFO org.candlepin.common.filter.LoggingFilter - Response: status=200,
content-type=“application/json”, time=37ms
2014-11-17 10:14:28,068 [req=544ba8e7-73ec-41ce-a060-c4962f3df2c0, org=]
INFO org.candlepin.common.filter.LoggingFilter - Request: verb=GET,
uri=/candlepin/consumers/e9994eca-a8f5-40b6-ab71-55619658c272/release
2014-11-17 10:14:28,110 [req=544ba8e7-73ec-41ce-a060-c4962f3df2c0,
org=Example_Organisation] INFO
org.candlepin.common.filter.LoggingFilter -
Response: status=200, content-type=“application/json”, time=42ms

Cheers,

John

–
You received this message because you are subscribed to the Google
Groups “Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send
an email to foreman-user...@googlegroups.com <javascript:>.
To post to this group, send email to forema...@googlegroups.com
<javascript:>.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.

–
Stephen Benjamin

Red Hat GmbH | http://de.redhat.com/ | Sitz: Grasbrunn
Handelsregister: Amtsgericht München, HRB 153243
Geschäftsführer: Charles Cachera, Michael Cunningham,
Michael O’Neill, Charles Peters

–
Stephen Benjamin

Red Hat GmbH | http://de.redhat.com/ | Sitz: Grasbrunn
Handelsregister: Amtsgericht München, HRB 153243
Geschäftsführer: Charles Cachera, Michael Cunningham,
Michael O’Neill, Charles Peters