Question

我使用两个Vagrant虚拟机来测试Puppet的一些东西，但是当我去申请一个证书时，我收到一条神秘的错误消息，我无法找到任何相关信息。

我应该注意，与良好的Linux服务器管理相对应，我使用/var/和/opt/来存储敏感的证书信息，否则就是标准的Puppet设置。

# Client node details
IP: 192.168.250.10 
Hostname: client.example.com
Puppet version: 4.3.2
OS: CentOS Linux release 7.0.1406 (on Vagrant)

# Puppet server details
IP: 192.168.250.6
Hostname: puppet-server.example.com
Puppet version: 4.3.2
OS: CentOS Linux release 7.0.1406 (on Vagrant)

# client's and server's /etc/hosts files are identical
192.168.250.5  puppetmaster.example.com
192.168.250.6  puppet.example.com puppet-server.example.com
192.168.250.7  dashserver.example.com dashboard.example.com
192.168.250.10 client.example.com
192.168.250.20 webserver.example.com

# /etc/puppetlabs/puppet/puppet.conf on both client and server
[main]
    logdest = syslog
[user]
    bucketdir = $clientbucketdir
    vardir = /var/opt/puppetlabs/server
    ssldir = $vardir/ssl
[agent]
    server = puppet.example.com
[master]
    certname = puppet.example.com
    vardir = /var/opt/puppetlabs/puppetserver
    ssldir = $vardir/ssl
    logdir = /var/log/puppetlabs/puppetserver
    rundir = /var/run/puppetlabs/puppetserver
    pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
    trusted_server_facts = true
    reports = store
    cacert = /var/opt/puppetlabs/puppetserver/ssl/certs/ca.pem
    cacrl = /var/opt/puppetlabs/puppetserver/ssl/crl.pem
    hostcert = /var/opt/puppetlabs/puppetserver/ssl/certs/{puppet, client}.example.com.pem  # respectively, obviously
    hostprivkey = /var/opt/puppetlabs/puppetserver/ssl/private_keys/{puppet, client}.example.com.pem # respectively, obviously

最后，我得到错误：

$ sudo puppet resource service puppet ensure=stopped enable=false
Notice: /Service[puppet]/ensure: ensure changed 'running' to 'stopped'
service { 'puppet':
  ensure => 'stopped',
  enable => 'false',
}
$ sudo puppet resource service puppet ensure=running enable=true
Notice: /Service[puppet]/ensure: ensure changed 'stopped' to 'running'
service { 'puppet':
  ensure => 'running',
  enable => 'true',
}
$ puppet agent --test --server=puppet.example.com
Error: Could not request certificate: Permission denied @ dir_initialize - /etc/puppetlabs/puppet/ssl/private_keys
Exiting; failed to retrieve certificate and waitforcert is disabled

首先，使用此设置Puppet不应该使用/etc/puppetlabs/puppet/ssl/private_keys。它没有正确使用我的配置文件：

$ puppet config print ssldir 
/etc/puppetlabs/puppet/ssl

接下来，我在服务器和客户端节点as prescribed in the Puppet docs上完成并重新生成密钥，但是我仍然遇到相同的错误，客户端和服务器仍然认为我的$ssldir是{{ 1}}它应该是/etc/puppetlabs/puppet/ssl。

有什么想法？

Answer 1

您需要在代理部分和master中指定ssl和vardir配置。

the user section is only applicable to the puppet apply commands etc

无法重新加载Puppet配置 - ＆gt;无法连接到Puppet Server

1 个答案: