Smart-proxy on PE Puppet CA & PE Puppetmaster - install issues

We have a pe-puppet v3.6.2 rpm based setup on SUSE/SLES 11.3 (Puppet CA
and Puppetmaster are seperate VMs, I am only testing on the Puppet CA for
now)
Since there are no SLES 11.3 supported rpm's for the smart-proxy install, I
start from a git clone of https://github.com/theforeman/smart-proxy.git
(for the record, using SLES and PE Puppet was not our choice but chosen by
the customer - we however have a pending PE Puppet upgrade planned on RHEL
7 machines but waiting for this is sadly not really an option at the moment)

I first tried installing additional/required gems on pe-ruby-1.9.3 as
described on some webpages listed below:

Troubleshooting - Foreman

··· # http://projects.theforeman.org/projects/foreman/wiki/_passenger_on_Puppet_PE_and_use_foreman_as_an_ENC_and_reporting_engine_ # http://projects.theforeman.org/projects/foreman/wiki/_passenger_on_Puppet_PE_

gem install json
gem install rest-client
ln -s /usr/lib64/mysql/libmysqlclient.a /usr/lib64/libmysqlclient.a
gem install mysql

At the point of writing of these procedures these dependancies would
probably have satisfied the smart-proxy requirements. However today there
seem to be many more requirements to be able to run smart-proxy
After installing some gems I arrived at the requirement of the puppet gem
and by installing this, I overwrite the current puppet setup on the CA
server, basically breaking it because the next puppet run the CA even lost
it’s own certificates. And by this I also suspect I transformed our PE
Puppet to a community Puppet
Above this, smart-proxy also seems to want a puppet version higher than
3.6.2, in my test case 4.3.2 was installed

So unless I start disabling requirements in the smart-proxy code (which I
don’t know is easily possible + I didn’t really want to do at the time) I
decided to stop with this approach

Next approach was using an OS install of Ruby to install the required
gems in the hopes that I could install a puppet gem without overwriting the
PE-Ruby puppet setup. But this approach quickly came to an end due to
SLES11.3 having basically very old packages in their repositories (max
ruby 1.8.7)

Third approach was using rvm to install all smart-proxy required gems
under a ruby-2.2.1 instance. This worked well at first, all gems installed
and now smart proxy at least starts but quickly gave an error:
Error during startup, terminating. cannot load such file – puppet
On the troubleshooting page I found an entry about something similar
specifying I needed to install facter which I did but this didn’t solve my
issue. While the facter and puppet gem (both latest automatically installed
version and the ones matching with my pe-puppet setup) are installed, it
still cannot find puppet.
Also, while inside the ruby-2.2.1 rvm environment, doing a pe-puppet agent
run gives errors due to probably being in another ruby env. This made me
think, will the smart proxy in ruby-2.2.1 rvm ever be able to talk to and
execute puppet commands in the pe-ruby ? I have no experience in these
setups or in ruby in general.

So basically I am stuck, I tried a few approaches but I am not sure which
is the one I should pursue and investigate further. Is there anyone with
enough deep knowledge to point me to a possible solution ?
Maybe I need to use older smart-proxy commit on git to start from in which
there are less requirements but will it then be able to talk to my foreman
v1.10.2 server ?

Any help is much appreciated !

Kind regards,
Koen

Thanks to the help of Dominic on #theforeman, I got the smart proxy process
running and listening on :8443 by using the SLES11.3 OS Ruby

$ zypper install -y git gcc gcc-c++ mysql-devel make ruby ruby-devel
rubygems rubygem-bundler

VERSIONS: rubygems-1.8.15-0.14.1 ruby-devel-1.8.7.p357-0.9.15.1

rubygem-bundler-1.0.21-0.6.2 ruby-1.8.7.p357-0.9.15.1
$ mkdir -p /usr/share/foreman-proxy;cd /usr/share/foreman-proxy
$ git clone https://github.com/theforeman/smart-proxy.git .
$ bundle install --without development test bmc krb5 windows
$ bundle update addressable
$ grep puppet bundler.d/puppet.rb
group :puppet, :puppetca do
gem 'puppet', '< 3.6.3'
$ bundle install --without development test bmc krb5 windows
$ bundle show
Gems included by the bundle:

  • CFPropertyList (2.2.8)
  • bundler (1.11.2)
  • facter (2.4.6)
  • hiera (1.3.4)
  • json (1.8.3)
  • json_pure (1.8.3)
  • puppet (3.6.1)
  • rack (1.5.5)
  • rack-protection (1.5.3)
  • rgen (0.6.6)
  • ruby-augeas (0.5.0)
  • sinatra (1.4.7)
  • smart_proxy (1.12.0.develop)
  • tilt (2.0.2)

bundle exec bin/smart-proxy
-> smart proxy is running

ISSUE: even with the latest openssl package for SLES11.3 the cipher list
doesn't seem to be satisfying for smart proxy to offer something other than
the unsafe SSLv3

Installing: libopenssl0_9_8-0.9.8j-0.80.1 [done]
Installing: openssl-0.9.8j-0.80.1 [done]

$ openssl ciphers 'ALL:eNULL' | sed -e 's/:confused: /g'
AECDH-AES256-SHA AECDH-AES128-SHA AECDH-DES-CBC3-SHA AECDH-RC4-SHA
ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-DES-CBC3-SHA
ECDHE-RSA-RC4-SHA ECDH-RSA-AES256-SHA ECDH-RSA-AES128-SHA
ECDH-RSA-DES-CBC3-SHA ECDH-RSA-RC4-SHA ECDHE-ECDSA-AES256-SHA
ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-DES-CBC3-SHA ECDHE-ECDSA-RC4-SHA
ECDH-ECDSA-AES256-SHA ECDH-ECDSA-AES128-SHA ECDH-ECDSA-DES-CBC3-SHA
ECDH-ECDSA-RC4-SHA ADH-CAMELLIA256-SHA DHE-RSA-CAMELLIA256-SHA
DHE-DSS-CAMELLIA256-SHA CAMELLIA256-SHA ADH-CAMELLIA128-SHA
DHE-RSA-CAMELLIA128-SHA DHE-DSS-CAMELLIA128-SHA CAMELLIA128-SHA
ADH-AES256-SHA DHE-RSA-AES256-SHA DHE-DSS-AES256-SHA AES256-SHA
ADH-AES128-SHA DHE-RSA-AES128-SHA DHE-DSS-AES128-SHA AES128-SHA
ADH-DES-CBC3-SHA ADH-DES-CBC-SHA EXP-ADH-DES-CBC-SHA ADH-RC4-MD5
EXP-ADH-RC4-MD5 EDH-RSA-DES-CBC3-SHA EDH-RSA-DES-CBC-SHA
EXP-EDH-RSA-DES-CBC-SHA EDH-DSS-DES-CBC3-SHA EDH-DSS-DES-CBC-SHA
EXP-EDH-DSS-DES-CBC-SHA DES-CBC3-SHA DES-CBC-SHA EXP-DES-CBC-SHA
EXP-RC2-CBC-MD5 RC4-SHA RC4-MD5 EXP-RC4-MD5 DES-CBC3-MD5 DES-CBC-MD5
EXP-RC2-CBC-MD5 RC2-CBC-MD5 EXP-RC4-MD5 RC4-MD5 AECDH-NULL-SHA
ECDHE-RSA-NULL-SHA ECDH-RSA-NULL-SHA ECDHE-ECDSA-NULL-SHA
ECDH-ECDSA-NULL-SHA NULL-SHA NULL-MD5

I noticed there once was poodles-fix
(Revision 6ddd00db - fixes #8282: sslv3 is disabled - Smart Proxy - Foreman)
Today I guess this is replaced by webrick-patch.rb but it doesn't offer a
secure SSL cipher for the connection

CONCLUSION: since we will move to Puppet PE on RHEL 7 in the near future
anyways, I will abandon my efforts on SLES and move to a RHEL sandbox
environment to continue testing on PE Puppet