The example unit_server...remote is only half an example for some reason - it is missing the server side.
My recommendation is to start with the unit_server_copy_localhost example and then modify it's ip addresses (127.0.0.1) on client and server sides to allow remote copying. that example is complete. The main difference is that client and server will have to exchange/trust each others' keys in the remote case. You must have a server running with config to grant access to the client. The output you posted shows that you already have a server running but it probably gas an empty config. I shall correct the example. Sorry about the confusion. Mark On 2 Jun 2011, at 00:45, Jerome Yanga <jya...@esri.com> wrote: > Mark, > > I am not sure which configuration you are referring to. If you are referring > to basic Cfengine install, I followed the link below. > > http://www.cfengine.org/manuals/cf3-tutorial.html > > To be more specific, I followed the "Getting started with the Community > Edition" section after running "rpm -Uvh > cfengine-community-3.1.5-1.el5.i386.rpm", which I downloaded from the link > below. It is during this time that I ran cf-keys. > > https://cfengine.com/inside/myspace > > After this setup, I started following the sample promises in the tutorial to > see how Cfengine will work with our environment. > > If you are referring to the "body server control", the cf file did not have > any as i wanted to be true to the version I downloaded from the link below. > > http://source.cfengine.com/websvn/listing.php?repname=Cfengine+core&path=%2Ftrunk%2Fexamples%2F&#a9554796c2122e301e19a6820493a2f24 > > Here is the output of the command you have suggested prior to adding the > "body server control" section. > > "[root@5.6.7.8 14:16:35 /tmp] > # cf-serverd -vf ./unit_server_copy_remote.cf > cf3> Cfengine - autonomous configuration engine - commence self-diagnostic > prelude > cf3> ------------------------------------------------------------------------ > cf3> Work directory is /var/cfengine > cf3> Making sure that locks are private... > cf3> Checking integrity of the state database > cf3> Checking integrity of the module directory > cf3> Checking integrity of the PKI directory > cf3> Looking for a source of entropy in /var/cfengine/randseed > cf3> -> Loaded private key /var/cfengine/ppkeys/localhost.priv > cf3> -> Loaded public key /var/cfengine/ppkeys/localhost.pub > cf3> Setting cfengine default port to 5308 = 5308 > cf3> Reference time set to Wed Jun 1 14:16:40 2011 > cf3> Cfengine - 3.1.5 Copyright (C) Cfengine AS 2008,2010- > cf3> ------------------------------------------------------------------------ > cf3> Host name is: 5.6.7.8 > cf3> Operating System Type is linux > cf3> Operating System Release is 2.6.18-238.9.1.el5 > cf3> Architecture = i686 > cf3> Using internal soft-class linux for host 5.6.7.8 > cf3> The time is now Wed Jun 1 14:16:40 2011 > cf3> ------------------------------------------------------------------------ > cf3> # Extended system discovery is only available in version Nova and above > cf3> Additional hard class defined as: 32_bit > cf3> Additional hard class defined as: linux_2_6_18_238_9_1_el5 > cf3> Additional hard class defined as: linux_i686 > cf3> Additional hard class defined as: linux_i686_2_6_18_238_9_1_el5 > cf3> GNU autoconf class from compile time: compiled_on_linux_gnu > cf3> Address given by nameserver: 5.6.7.8 > cf3> Interface 1: lo > cf3> Interface 2: eth0 > cf3> Adding alias 5.6.7.8.. > cf3> Trying to locate my IPv6 address > cf3> Found IPv6 address fe80::250:56ff:fe88:12f > cf3> Looking for environment from cf-monitord... > cf3> Loading environment... > cf3> Environment data loaded > cf3> This appears to be a redhat system. > cf3> Looking for redhat linux info in "Red Hat Enterprise Linux Server > release 5.6 (Tikanga) > " > cf3> *********************************************************** > cf3> Loading persistent classes > cf3> *********************************************************** > cf3> Persistent class messages_high_ldt for 7 more minutes > cf3> Adding persistent class messages_high_ldt to heap > cf3> *********************************************************** > cf3> Loaded persistent memory > cf3> *********************************************************** > cf3> -> No policy server (hub) watch yet registered > cf3> Setting policy server requires version Nova or above > cf3> -> Input file is outside default repository, validating it > cf3> -> Promises seem to change > cf3> -> Input file is changed since last valiadtion, validating it > cf3> -> Verifying the syntax of the inputs... > cf3> -> Caching the state of validation > cf3> > Parsing file ./unit_server_copy_remote.cf > cf3> Initiate variable convergence... > cf3> Initiate variable convergence... > cf3> # Knowledge map reporting feature is only available in version Nova and > above > cf3> -> Defined classes = { 10_50_28_202 32_bit Afternoon Day1 GMT_Hr21 Hr14 > Hr14_Q2 June Lcycle_1 Min15_20 Min16 PK_MD5_05cf31015f55d9cd8c3f9dce76c26122 > Q2 Wednesday Yr2011 any 5.6.7.8 5.6.7.8_esri_com cfengine cfengine_3 > cfengine_3_1 cfengine_3_1_5 com community_edition compiled_on_linux_gnu > entropy_cfengine_in_low entropy_cfengine_out_low entropy_dns_in_low > entropy_dns_out_low entropy_ftp_in_low entropy_ftp_out_low > entropy_icmp_in_low entropy_icmp_out_low entropy_irc_in_low > entropy_irc_out_low entropy_misc_in_low entropy_misc_out_low > entropy_netbiosdgm_in_low entropy_netbiosdgm_out_low entropy_netbiosns_in_low > entropy_netbiosns_out_low entropy_netbiosssn_in_low > entropy_netbiosssn_out_low entropy_nfsd_in_low entropy_nfsd_out_low > entropy_smtp_in_low entropy_smtp_out_low entropy_ssh_out_low > entropy_tcpack_in_low entropy_tcpack_out_low entropy_tcpfin_in_low > entropy_tcpfin_out_low entropy_tcpsyn_in_low entropy_tcpsyn_out_low > entropy_udp_in_low entropy_udp_out_low entropy_www _in_low entropy_www_out_low entropy_wwws_in_low entropy_wwws_out_low esri_com fe80__250_56ff_fe88_12f i686 ipv4_10 ipv4_10_50 ipv4_10_50_28 ipv4_10_50_28_202 linux linux_2_6_18_238_9_1_el5 linux_i686 linux_i686_2_6_18_238_9_1_el5 linux_i686_2_6_18_238_9_1_el5__1_SMP_Fri_Mar_18_12_42_04_EDT_2011 messages_high_dev1 messages_high_ldt net_iface_eth0 redhat redhat_5 redhat_5_6 redhat_s redhat_s_5 redhat_s_5_6 rootprocs_high_normal server verbose_mode } > cf3> -> Negated Classes = { } > cf3> Initiate variable convergence... > cf3> *********************************************************** > cf3> Server control promises.. > cf3> *********************************************************** > cf3> Summarize control promises > cf3> Granted access to paths : > cf3> Denied access to paths : > cf3> -> Host IPs allowed connection access : > cf3> Host IPs denied connection access : > cf3> Host IPs allowed multiple connection access : > cf3> Host IPs from whom we shall accept public keys on trust : > cf3> Users from whom we accept connections : > cf3> Host IPs from NAT which we don't verify : > cf3> Dynamical Host IPs (e.g. DHCP) whose bindings could vary over time : > cf3> Could not bind server address > cf3> !!! System error for bind: "Address already in use" > cf3> Could not bind server address > cf3> !!! System error for bind: "Address already in use" > cf3> Couldn't open bind an open socket > " > > Here is the output of the command you have suggested prior to adding the > "body server control" section. > > "[root@5.6.7.8 15:08:13 /tmp] > # cf-serverd -vf ./unit_server_copy_remote.cf > cf3> Cfengine - autonomous configuration engine - commence self-diagnostic > prelude > cf3> ------------------------------------------------------------------------ > cf3> Work directory is /var/cfengine > cf3> Making sure that locks are private... > cf3> Checking integrity of the state database > cf3> Checking integrity of the module directory > cf3> Checking integrity of the PKI directory > cf3> Looking for a source of entropy in /var/cfengine/randseed > cf3> -> Loaded private key /var/cfengine/ppkeys/localhost.priv > cf3> -> Loaded public key /var/cfengine/ppkeys/localhost.pub > cf3> Setting cfengine default port to 5308 = 5308 > cf3> Reference time set to Wed Jun 1 15:08:20 2011 > cf3> Cfengine - 3.1.5 Copyright (C) Cfengine AS 2008,2010- > cf3> ------------------------------------------------------------------------ > cf3> Host name is: 5.6.7.8 > cf3> Operating System Type is linux > cf3> Operating System Release is 2.6.18-238.9.1.el5 > cf3> Architecture = i686 > cf3> Using internal soft-class linux for host 5.6.7.8 > cf3> The time is now Wed Jun 1 15:08:20 2011 > cf3> ------------------------------------------------------------------------ > cf3> # Extended system discovery is only available in version Nova and above > cf3> Additional hard class defined as: 32_bit > cf3> Additional hard class defined as: linux_2_6_18_238_9_1_el5 > cf3> Additional hard class defined as: linux_i686 > cf3> Additional hard class defined as: linux_i686_2_6_18_238_9_1_el5 > cf3> GNU autoconf class from compile time: compiled_on_linux_gnu > cf3> Address given by nameserver: 5.6.7.8 > cf3> Interface 1: lo > cf3> Interface 2: eth0 > cf3> Adding alias 5.6.7.8.. > cf3> Trying to locate my IPv6 address > cf3> Found IPv6 address fe80::250:56ff:fe88:12f > cf3> Looking for environment from cf-monitord... > cf3> Loading environment... > cf3> Environment data loaded > cf3> This appears to be a redhat system. > cf3> Looking for redhat linux info in "Red Hat Enterprise Linux Server > release 5.6 (Tikanga) > " > cf3> *********************************************************** > cf3> Loading persistent classes > cf3> *********************************************************** > cf3> Persistent class messages_high_ldt expired > cf3> *********************************************************** > cf3> Loaded persistent memory > cf3> *********************************************************** > cf3> -> No policy server (hub) watch yet registered > cf3> Setting policy server requires version Nova or above > cf3> -> Input file is outside default repository, validating it > cf3> -> Promises seem to change > cf3> -> Input file is changed since last valiadtion, validating it > cf3> -> Verifying the syntax of the inputs... > cf3> -> Caching the state of validation > cf3> > Parsing file ./unit_server_copy_remote.cf > cf3> Initiate variable convergence... > cf3> Initiate variable convergence... > cf3> # Knowledge map reporting feature is only available in version Nova and > above > cf3> -> Defined classes = { 10_50_28_202 32_bit Afternoon Day1 GMT_Hr22 Hr15 > Hr15_Q1 June Lcycle_1 Min05_10 Min08 PK_MD5_05cf31015f55d9cd8c3f9dce76c26122 > Q1 Wednesday Yr2011 any 5.6.7.8 5.6.7.8_esri_com cfengine cfengine_3 > cfengine_3_1 cfengine_3_1_5 com community_edition compiled_on_linux_gnu > entropy_cfengine_in_low entropy_cfengine_out_low entropy_dns_in_low > entropy_dns_out_low entropy_ftp_in_low entropy_ftp_out_low > entropy_icmp_in_low entropy_icmp_out_low entropy_irc_in_low > entropy_irc_out_low entropy_misc_in_low entropy_misc_out_low > entropy_netbiosdgm_in_low entropy_netbiosdgm_out_low entropy_netbiosns_in_low > entropy_netbiosns_out_low entropy_netbiosssn_in_low > entropy_netbiosssn_out_low entropy_nfsd_in_low entropy_nfsd_out_low > entropy_smtp_in_low entropy_smtp_out_low entropy_ssh_out_low > entropy_tcpack_in_low entropy_tcpack_out_low entropy_tcpfin_in_low > entropy_tcpfin_out_low entropy_tcpsyn_in_low entropy_tcpsyn_out_low > entropy_udp_in_low entropy_udp_out_low entropy_www _in_low entropy_www_out_low entropy_wwws_in_low entropy_wwws_out_low esri_com fe80__250_56ff_fe88_12f i686 ipv4_10 ipv4_10_50 ipv4_10_50_28 ipv4_10_50_28_202 linux linux_2_6_18_238_9_1_el5 linux_i686 linux_i686_2_6_18_238_9_1_el5 linux_i686_2_6_18_238_9_1_el5__1_SMP_Fri_Mar_18_12_42_04_EDT_2011 messages_low_normal net_iface_eth0 redhat redhat_5 redhat_5_6 redhat_s redhat_s_5 redhat_s_5_6 rootprocs_high_normal server verbose_mode } > cf3> -> Negated Classes = { } > cf3> Initiate variable convergence... > cf3> *********************************************************** > cf3> Server control promises.. > cf3> *********************************************************** > cf3> SET Allowing connections from ... > cf3> SET Allowing multiple connections from ... > cf3> SET Trust keys from ... > cf3> Summarize control promises > cf3> Granted access to paths : > cf3> Denied access to paths : > cf3> -> Host IPs allowed connection access : > cf3> .... IP: 127.0.0.1 > cf3> .... IP: 5.6.7 > cf3> Host IPs denied connection access : > cf3> Host IPs allowed multiple connection access : > cf3> .... IP: 127.0.0.1 > cf3> .... IP: 5.6.7 > cf3> Host IPs from whom we shall accept public keys on trust : > cf3> .... IP: 127.0.0.1 > cf3> .... IP: 5.6.7 > cf3> Users from whom we accept connections : > cf3> Host IPs from NAT which we don't verify : > cf3> Dynamical Host IPs (e.g. DHCP) whose bindings could vary over time : > cf3> Could not bind server address > cf3> !!! System error for bind: "Address already in use" > cf3> Could not bind server address > cf3> !!! System error for bind: "Address already in use" > cf3> Couldn't open bind an open socket > " > > The entirety of the original cf file is in my previous post. > > Per you suggestion, I have added the trustkeys and allowconnects. Here is > the new cf file. > > "# test remote copy > body common control > { > any:: > > bundlesequence => { > "testbundle" > }; > } > > ############################################ > > body server control > { > allowconnects => { "127.0.0.1" , "5.6.7" }; > allowallconnects => { "127.0.0.1" , "5.6.7" }; > trustkeysfrom => { "127.0.0.1" , "5.6.7" }; > } > > > > ############################################ > > bundle agent testbundle > > { > files: > > "/tmp/copy_of_remote_host_file" > > perms => system, > copy_from => mycopy("/etc/hosts","5.6.7.4"), > depth_search => recurse("inf"); > > } > > ############################################ > > body perms system > > { > mode => "0444"; > } > > ######################################################### > > body depth_search recurse(d) > > { > depth => "$(d)"; > } > > ######################################################### > > body copy_from mycopy(from,server) > > { > source => "$(from)"; > #portnumber => "6789"; > servers => { "$(server)" , "5.6.7.4" }; > copy_backup => "true"; #/false/timestamp > stealth => "true"; #/on/false/off > preserve => "true"; > #linkcopy_patterns => { ".*fish.*" }; > #copylink_patterns => { "non-local.*"}; > #xdev => "true"; # /on/false/off > compare => "mtime"; # > ctime/mtime/checksum/sum/byte/binary/any > link_type => "absolute"; # /symbolic/relative/hard etc > type_check => "true"; > force_update => "false"; > force_ipv4 => "false"; > #copy_size => irange("0","50000"); > trustkey => "true"; > encrypt => "true"; > verify => "true"; > purge => "false"; > #findertype => "MacOSX"; > }" > > More info: > Server = 5.6.7.8 > Client = 1.2.3.4 > Server and Client are on the same subnet. Hence, the first three octets are > identical to each other. > 5.6.7=1.2.3 > The first three octets are the only ones that I have specified in the "body > server control" as this is my test network and I intend to add more clients > as I go deeper in my testing. > I have copied /var/cfengine/ppkeys/localhost.pub of host 5.6.7.8 to > /var/cfengine/ppkeys/root-5.6.7.8.pub and copied this into > /var/cfengine/ppkeys/ of host 1.2.3.4. > I have copied /var/cfengine/ppkeys/localhost.pub of host 1.2.3.4 to > /var/cfengine/ppkeys/root-1.2.3.4.pub and copied this into > /var/cfengine/ppkeys/ of host 5.6.7.8. > > What am I missing? > > I apologize if I have to edit off our IP addresses and hostnames. I am not > allowed to share this info in mailing lists. Judging from your email > address, it seems that you work for Cfengine. If this is the case, please > confirm so that I can send you all the actual IPs and hostnames. > > Regards, > j > -----Original Message----- > From: help-cfengine-boun...@cfengine.org > [mailto:help-cfengine-boun...@cfengine.org] On Behalf Of Mark Burgess > Sent: Wednesday, June 01, 2011 2:11 PM > To: help-cfengine@cfengine.org > Subject: Re: Cfengine Help: Cannot copy files to remote host > > > Jermome, cfengine has nothing to do with ssh, so no root login is required. > > You don't show the server half of your configuration, but I suspect you > haven't configured the server properly. > > Run cf-serverd -vf ./unit_server_copy_remote.cf > > and look at the verbose output as you connect. You should have run > > cf-key > > to create keys, and then you should make sure you added your mystery IP > address 1.2.3.4 to trustkeys and allowconnects, etc. > > Hope this helps. > > On 01/06/11 21:59, Jerome Yanga wrote: >> Has anyone gotten copy_from running on cfengine-community-3.1.5-1.el5 to >> work? Is root login required via ssh? What do I need to do on the hosts to >> make this promise work? >> >> I have tried using the sample cf file from the link below. >> >> http://source.cfengine.com/websvn/filedetails.php?repname=Cfengine+core&path=%2Ftrunk%2Fexamples%2Funit_server_copy_remote.cf >> >> I tweaked this file a bit to fit my environment. >> >> Here is the version I am running. >> "# rpm -qa | grep cfen >> cfengine-community-3.1.5-1.el5" >> >> IP Addresses of hosts: >> Server => 5.6.7.8 >> client => 1.2.3.4 >> >> "# test remote copy >> body common control >> { >> any:: >> >> bundlesequence => { >> "testbundle" >> }; >> } >> >> >> ############################################ >> >> bundle agent testbundle >> >> { >> files: >> >> "/tmp/copy_of_remote_host_file" >> >> perms => system, >> copy_from => mycopy("/etc/hosts","1.2.3.4"), >> depth_search => recurse("inf"); >> >> } >> >> ############################################ >> >> body perms system >> >> { >> mode => "0444"; >> } >> >> ######################################################### >> >> body depth_search recurse(d) >> >> { >> depth => "$(d)"; >> } >> >> ######################################################### >> >> ######################################################### >> >> body depth_search recurse(d) >> >> { >> depth => "$(d)"; >> } >> >> ######################################################### >> >> body copy_from mycopy(from,server) >> >> { >> source => "$(from)"; >> #portnumber => "6789"; >> servers => { "$(server)" , "1.2.3.4" }; >> copy_backup => "true"; #/false/timestamp >> stealth => "true"; #/on/false/off >> preserve => "true"; >> #linkcopy_patterns => { ".*fish.*" }; >> #copylink_patterns => { "non-local.*"}; >> #xdev => "true"; # /on/false/off >> compare => "mtime"; # >> ctime/mtime/checksum/sum/byte/binary/any >> link_type => "absolute"; # /symbolic/relative/hard etc >> type_check => "true"; >> force_update => "false"; >> force_ipv4 => "false"; >> #copy_size => irange("0","50000"); >> trustkey => "true"; >> encrypt => "true"; >> verify => "true"; >> purge => "false"; >> #findertype => "MacOSX"; >> }" >> >> I still receive the same error as I have encountered the past few days. >> >> "cf3> ......................................................... >> cf3> Promise handle: >> cf3> Promise made by: /tmp/copy_of_remote_host_file >> cf3> ......................................................... >> cf3> >> cf3> -> Copy file /tmp/copy_of_remote_host_file from /etc/hosts check >> cf3> No existing connection to 1.2.3.4 is established... >> cf3> Set cfengine port number to 5308 = 5308 >> cf3> Set connection timeout to 10 >> cf3> -> Connect to 1.2.3.4 = 1.2.3.4 on port 5308 >> cf3> -> Did not find new key format /var/cfengine/ppkeys/root-.pub >> cf3> -> Trying old style /var/cfengine/ppkeys/root-1.2.3.4.pub >> cf3> -> Could not map key file to new format - we have no digest yet >> (using /var/cfengine/ppkeys/root-1.2.3.4.pub) >> cf3> -> Going to secondary storage for key >> cf3> Couldn't send >> cf3> !!! System error for send: "Connection reset by peer" >> cf3> Couldn't send >> cf3> !!! System error for send: "Broken pipe" >> cf3> Couldn't send >> cf3> !!! System error for send: "Broken pipe" >> cf3> Challenge response from server 1.2.3.4/1.2.3.4 was incorrect! >> cf3> I: Report relates to a promise with handle "" >> cf3> I: Made in version 'not specified' of >> '/tmp/unit_server_copy_remote.cf' near line >> 21http://source.cfengine.com/browse/core/trunk/src/conversion.c?revision=2347&view=markup >> cf3> !! Authentication dialogue with 1.2.3.4 failed >> cf3> Unable to establish connection with 1.2.3.4 >> cf3> No existing connection to 1.2.3.4 is established... >> cf3> Set cfengine port number to 5308 = 5308 >> cf3> Set connection timeout to 10 >> cf3> -> Connect to 1.2.3.4 = 1.2.3.4 on port 5308 >> cf3> -> Did not find new key format /var/cfengine/ppkeys/root-.pub >> cf3> -> Trying old style /var/cfengine/ppkeys/root-1.2.3.4.pub >> cf3> -> Could not map key file to new format - we have no digest yet >> (using /var/cfengine/ppkeys/root-1.2.3.4.pub) >> cf3> -> Going to secondary storage for key >> cf3> Couldn't send >> cf3> !!! System error for send: "Broken pipe" >> cf3> Couldn't send >> cf3> !!! System error for send: "Broken pipe" >> cf3> Couldn't send >> cf3> !!! System error for send: "Broken pipe" >> cf3> Challenge response from server 1.2.3.4/1.2.3.4 was incorrect! >> cf3> I: Report relates to a promise with handle "" >> cf3> I: Made in version 'not specified' of >> '/tmp/unit_server_copy_remote.cf' near line 21 >> cf3> !! Authentication dialogue with 1.2.3.4 failed >> cf3> Unable to establish connection with 1.2.3.4 >> cf3> -> No suitable server responded to hail >> cf3> Promise (version not specified) belongs to bundle 'testbundle' in file >> '/tmp/unit_server_copy_remote.cf' near line 21 >> " >> >> I ran the following command as root. >> >> "[root@5.6.7.8]# /usr/local/sbin/cf-agent -K -v -f >> /tmp/unit_server_copy_remote.cf" >> >> Help. >> >> Regards, >> j >> _______________________________________________ >> Help-cfengine mailing list >> Help-cfengine@cfengine.org >> https://cfengine.org/mailman/listinfo/help-cfengine > _______________________________________________ > Help-cfengine mailing list > Help-cfengine@cfengine.org > https://cfengine.org/mailman/listinfo/help-cfengine > _______________________________________________ Help-cfengine mailing list Help-cfengine@cfengine.org https://cfengine.org/mailman/listinfo/help-cfengine
