Thursday, June 8, 2017

Redhat 7 - Puppet installation

Client installation

1. Update hosts file with puppet server if DNS is not working
# vi /etc/hosts
214.38.138.239  spup-lx-v02     spup-lx-v02.expanor.local

wq
# ping spup-lx-v02.expanor.local

2. Update PATH variable
# vi /root/.profile
PATH=/usr/bin:/usr/sbin:/usr/local/bin:/usr/ccs/bin:$PATH:/opt/puppetlabs/puppet/bin
export PATH

wq!

# . /root/.profile

3. Use curn to download and install the agent package

# curl
-bash: curl: command not found

# ls -l /usr/ucb/curl
/usr/ucb/curl: No such file or directory

# cd /usr/local/bin/curl
-rwxr-xr-x   1 root     root      171528 Jan  6  2014 curl



# ./curl -k https://214.38.138.239:8140/packages/current/install.bash | sudo bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (35) Unknown SSL protocol error in connection to 214.38.138.239:8140
# telnet 214.38.138.239:8140
214.38.138.239:8140: node name or service name not known


Verify you can connect to port 8140
# telnet 214.38.138.239 8140
Trying 214.38.138.239...
Connected to 214.38.138.239.
Escape character is '^]'.
^]
telnet> q
Connection to 214.38.138.239 closed.

4. Downloading from puppet server failed. Now, download the puppet client from puppet.com and upload to each client. Extract the file and install.

# gunzip puppet-agent-1.10.1-1.sparc.pkg.gz


# pkgadd -d  puppet-agent-1.10.1-1.sparc.pkg

The following packages are available:
  1  puppet-agent     puppet-agent - https://www.puppetlabs.com
                      (sparc) 1.10.1-1

Select package(s) you wish to process (or 'all' to process
all packages). (default: all) [?,??,q]:

Processing package instance <puppet-agent> from </var/tmp/puppet-agent-1.10.1-1.sparc.pkg>

Installation of <puppet-agent> was successful.


# puppet agent --test --server spup-lx-v02.expanor.local
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for sinf-mw-v20.sces.dsca.mil
Info: Applying configuration version '1496760334'
Notice: Applied catalog in 1.49 seconds
#


# svcs -a | grep pup
disabled       10:41:06 svc:/network/puppet:default
# svcadm enable svc:/network/puppet:default
# svcs -a | grep pup
online         11:30:47 svc:/network/puppet:default
#






error / troubleshooting


Received error : - Exiting; no certificate found and waitforcert is disabled

# puppet agent --test --server spup-lx-v02.expanor.local
Exiting; no certificate found and waitforcert is disabled

# telnet spup-lx-v02.expanor.local 8140
Trying 214.38.138.239...
Connected to spup-lx-v02.
Escape character is '^]'.
^]
telnet> q
Connection to spup-lx-v02 closed.


When puppet client try to make a connection to pupper server first time, it generate a certificate and pass it to puppet server to sign in. The certificate need to signed manually at the server side.


To resolve this issue,
Go to puppet master server and perform the following command to list all certificates that are waiting for sign.

# puppet cert --list | more
  "sidm-mw-v18.expanor.local" (SHA256) 7D:0D:3A:0E:B7:14:9E:72:E5:6D:75:10:70:C1:1E:5A:CD:03:B2:5C:55:88:E8:86:2D:43:AE:C3:C6:E3:EA:B0

Now, we can see the certificate from client waiting for signing.
Run the following command below to sign the certificate.

[root@spup-lx-v02 ~]# puppet cert sign sidm-mw-v18.expanor.local
Signing Certificate Request for:
  "sidm-mw-v18.expanor.local" (SHA256) 7D:0D:3A:0E:B7:14:9E:72:E5:6D:75:10:70:C1:1E:5A:CD:03:B2:5C:55:88:E8:86:2D:43:AE:C3:C6:E3:EA:B0
Notice: Signed certificate request for sidm-mw-v18.expanor.local
Notice: Removing file Puppet::SSL::CertificateRequest sidm-mw-v18.expanor.local at '/etc/puppetlabs/puppet/ssl/ca/requests/sidm-mw-v18.expanor.local.pem'
[root@spup-lx-v02 ~]#


if you want to sign all certificates, run the command below,
# puppet cert sign --all




 you get this error.



Any Puppet agent connecting to a Puppet master server for a first time will generate a certificate and give it to a Puppet master server to sign. Depending on your puppet configuration, a default behavior is that the certificate must by signed manually and thus puppet agent exits with an error:


^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^



Puppet Implementation


Prerequisites
- Root Access
- Server with 2 cores, 6 GB RAM
- 20 GB of free space available under /opt
- Ensure port 3000 is open.

Puppet Enterprise Installation

1. Download Tar ball version ending in  -el-<version arch>.tar.gz.
2. Run the following command to unpack the tarball:
   # tar –xzf <tarball>
3. To set up the installer, Run
   # sudo ./puppet-enterprise-installer
4. When prompted, choose the “Guilded” installation option.
5. The PE installer will start a web server at
   https://<hostname>:3000
6. Log onto PE Console and create password for admin user and fill the remaining info and continue.


Puppet Agent Installation

1. In the console, click Nodes > Classification.  On the Classes tab, select the class that matches your client.
2. Click Add Class and commit changes.
3. From the command line on Puppet Master, run puppet agent –t.
4. SSH into your agent node and run:
   # Curl –k https://<master_server>:8140/packages/current/install.bash | sudo bash
5. The installer installs and configures the Puppet Enterprise Agent.
6. After installation is complete, approve the certificate request from the Request Console from the puppet server.





^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Enterprise Puppet Master is only supported on a Linux based Platform.  Redhat Enterprise Linux is selected because it’s DOD Common Criteria (CC) certified.  Puppet will be used for system baseline and configuration management.

For Puppet Enterprise Server to communicate with clients on TEST & DEV Enclaves, the following firewall changes needs to be implemented:

Source:  TEST  214.38.139.128/25
                DEV   10.222.102.0/25

Target:  spup-lx-v02.expanor.local (214.38.138.239)
Ports:
   8140 --  Puppet Master Inbound Port
   61613 – Mcollective Port
   4433 – Classifier/Console Services API Port
   8081 – PuppetDB Port
   8142 – Orchestrator Port
   8143 – Orchestrator/PCP Broker Port


Puppet will be used to deploy system security baseline and configuration managements.


RedHat Enterprise Linux 7.0 (Puppet Master)
Solaris 10/11  (Puppet Agents Only)



Detailed Description Of Proposed Change
1.  Build a VM running Redhat Enterprise Linux 7.x
2.  Install Enterprise Puppet on Redhat VM.
3.  Deploy Puppet Agents to Solaris systems.
4.  Test communication and deployment pushes between Puppet Master & Client Agents.



Test Documentation

Create a sample Class for NTP under /opt/puppet/classes/ntp.mod

class { '::ntp':
  servers   => ['dev-ad1.sces.dev', 'dev-ad2.sces.dev'],
  restrict  => [
    'default ignore',
    '-6 default ignore',
    '127.0.0.1',
    '-6 ::1',
    'ntp1.corp.com nomodify notrap nopeer noquery',
    'ntp2.corp.com nomodify notrap nopeer noquery'
  ],
}

To test if sample ntp file gets push, Run:
Sudo puppet apply --test


Verify sample test modules created from PE Consoles gets successfully pushed out to Puppet Clients.



Back-out Plan

1. Shutdown Puppet services from Master server.
2. Disabled Puppet Agents on clients.





^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Installation error log

Transaction test succeeded
Running transaction
^Z
[1]+  Stopped                 ./puppet-enterprise-installer
[root@spup-lx-v02 puppet-enterprise-2017.2.1-el-7-x86_64]# jobs
[1]+  Stopped                 ./puppet-enterprise-installer
[root@spup-lx-v02 puppet-enterprise-2017.2.1-el-7-x86_64]# bg
[1]+ ./puppet-enterprise-installer &
[root@spup-lx-v02 puppet-enterprise-2017.2.1-el-7-x86_64]# jobs
[1]+  Running                 ./puppet-enterprise-installer &
[root@spup-lx-v02 puppet-enterprise-2017.2.1-el-7-x86_64]#
[root@spup-lx-v02 puppet-enterprise-2017.2.1-el-7-x86_64]# jobs
[1]+  Running                 ./puppet-enterprise-installer &
[root@spup-lx-v02 puppet-enterprise-2017.2.1-el-7-x86_64]# jobs
[1]+  Running                 ./puppet-enterprise-installer &
[root@spup-lx-v02 puppet-enterprise-2017.2.1-el-7-x86_64]# fg
./puppet-enterprise-installer
  Installing : puppet-agent-1.10.1-1.el7.x86_64                             1/3
Using username "kbhusal".
You are accessing a U.S. Government (USG) Information System (IS) that is
provided for USG-authorized use only. By using this IS (




 The other application is: yum
    Memory :  85 M RSS (429 MB VSZ)
    Started: Mon Jun  5 19:22:06 2017 - 1:02:21 ago
    State  : Uninterruptible, pid: 9221
Cleaning repos: puppet_enterprise
Cleaning up everything
grep: : No such file or directory
2017-06-05 20:24:29,974 Running command: yum install -y puppet-agent-1.10.1 pe-installer pe-modules
BDB2053 Freeing read locks for locker 0x12a: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x12c: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x13b: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x13d: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x13e: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x13f: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x140: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x141: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x142: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x143: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x144: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x145: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x146: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x147: 9221/140345866499904
BDB2053 Freeing read locks for locker 0x148: 9221/140345866499904
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-
              : manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Package puppet-agent-1.10.1-1.el7.x86_64 already installed and latest version
Resolving Dependencies
There are unfinished transactions remaining. You might consider running yum-complete-transaction, or "yum-complete-transaction --cleanup-only"                                                        and "yum history redo last", first to finish them. If those don't work you'll have to try removing/installing packages by hand (maybe package                                                       -cleanup can help).
--> Running transaction check
---> Package pe-installer.x86_64 0:2017.2.0.rc0.20.g20fe238-1.el7 will be installed
---> Package pe-modules.x86_64 0:2017.2.0.rc0.68.g48b0405-1.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package       Arch    Version                         Repository          Size
================================================================================
Installing:
 pe-installer  x86_64  2017.2.0.rc0.20.g20fe238-1.el7  puppet_enterprise  7.4 M
 pe-modules    x86_64  2017.2.0.rc0.68.g48b0405-1.el7  puppet_enterprise  1.6 M

Transaction Summary
================================================================================
Install  2 Packages

Total download size: 8.9 M
Installed size: 31 M
Downloading packages:
--------------------------------------------------------------------------------
Total                                              177 MB/s | 8.9 MB  00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Warning: RPMDB altered outside of yum.


  Installing : pe-modules-2017.2.0.rc0.68.g48b0405-1.el7.x86_64             1/2


Installed:
  pe-installer.x86_64 0:2017.2.0.rc0.20.g20fe238-1.el7
  pe-modules.x86_64 0:2017.2.0.rc0.68.g48b0405-1.el7

Complete!

## We're preparing the Web Installer...

2017-06-05 21:04:06,314 Running command: mkdir -p /opt/puppetlabs/puppet/share/installer/installer
2017-06-05 21:04:06,329 Running command: cp -pR /opt/puppet-enterprise-2017.2.1-el-7-x86_64/* /opt/puppetlabs/puppet/share/installer/installer

## Go to https://spup-lx-v02.expanor.local:3000 in your browser to continue installation.


## Be sure to use 'https://' and that port 3000 is reachable through the firewall.

2017-06-05 21:04:09,293 Running command: RACK_ENV=production /opt/puppetlabs/puppet/share/installer/vendor/bundler/bin/thin start --debug -p 3

----------------------------------


[root@spup-lx-v02 puppet-enterprise-2017.2.1-el-7-x86_64]# yum history
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
ID     | Login user               | Date and time    | Action(s)      | Altered
-------------------------------------------------------------------------------
     8 | Kamal Bhusal <kbhusal>   | 2017-06-05 20:24 | Install        |    2
     7 | Kamal Bhusal <kbhusal>   | 2017-06-05 19:22 | Install        |    3 **
     6 | Kamal Bhusal <kbhusal>   | 2017-06-05 17:58 | Install        |    3 **
     5 | Jay Kancho <jkancho>    | 2017-05-31 11:05 | I, U           |  163 EE
     4 | Kamal Bhusal <kbhusal>   | 2017-05-30 10:39 | Install        |    1  <
     3 | Kamal Bhusal <kbhusal>   | 2017-04-20 11:06 | Install        |    1 >
     2 | Kamal Bhusal <kbhusal>   | 2017-04-20 09:48 | Install        |    1
     1 | System <unset>           | 2017-04-19 11:43 | Install        | 1286
history list
[root@spup-lx-v02 puppet-enterprise-2017.2.1-el-7-x86_64]# yum history redo last



No comments:

Post a Comment