大佬教程收集整理的这篇文章主要介绍了linux – 当master从命令行运行时,puppet master REST API在乘客工作时返回403，大佬教程大佬觉得挺不错的，现在分享给大家，也给大家做个参考。
### Authenticated paths - these apply only when the client ### has a valid certificate and is thus authenticated # allow nodes to retrieve their own catalog path ~ ^/catalog/([^/]+)$ method find allow $1 # allow nodes to retrieve their own node deFinition path ~ ^/node/([^/]+)$ method find allow $1 # allow all nodes to access the certificates services path ~ ^/certificate_revocation_list/ca method find allow * # allow all nodes to store their reports path /report method save allow * # unconditionally allow access to all file services # which means in practice that fileserver.conf will # still be used path /file allow * ### Unauthenticated ACL,for clients for which the current master doesn't ### have a valid certificate; we allow authenticated users,too,because ### there isn't a great harm in letTing that request through. # allow access to the master CA path /certificate/ca auth any method find allow * path /certificate/ auth any method find allow * path /certificate_request auth any method find,save allow * path /facts auth any method find,search allow * # this one is not Stricly necessary,but it has the merit # of showing the default policy,which is deny everything else path / auth any
然而,当我在客户端上收到此错误时,Puppet master似乎没有跟随此
[amisr1@blramisr195602 ~]$sudo puppet agent --no-daemonize --verbose --server bangvmpllda02.XXXXX.com [sudo] password for amisr1: StarTing Puppet client version 3.0.1 Warning: Unable to fetch my node deFinition,but the agent run will conTinue: Warning: Error 403 on SERVER: Forbidden request: XX.XXX.XX.XX(XX.XXX.XX.XX) access to /certificate_revocation_list/ca [find] at :110 Info: Retrieving plugin Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate: Error 403 on SERVER: Forbidden request: XX.XXX.XX.XX(XX.XXX.XX.XX) access to /file_Metadata/plugins [search] at :110 Error: /File[/var/lib/puppet/lib]: Could not evaluate: Error 403 on SERVER: Forbidden request: XX.XXX.XX.XX(XX.XXX.XX.XX) access to /file_Metadata/plugins [find] at :110 Could not retrieve file Metadata for puppet://devops.XXXXX.com/plugins: Error 403 on SERVER: Forbidden request: XX.XXX.XX.XX(XX.XXX.XX.XX) access to /file_Metadata/plugins [find] at :110 Error: Could not retrieve catalog from Remote Server: Error 403 on SERVER: Forbidden request: XX.XXX.XX.XX(XX.XXX.XX.XX) access to /catalog/blramisr195602.XXXXX.com [find] at :110 Using cached catalog Error: Could not retrieve catalog; skipping run Error: Could not send report: Error 403 on SERVER: Forbidden request: XX.XXX.XX.XX(XX.XXX.XX.XX) access to /report/blramisr195602.XXXXX.com [save] at :110
和服务器日志显示
XX.XXX.XX.XX - - [10/Dec/2012:14:46:52 +0530] "GET /production/certificate_revocation_list/ca? http/1.1" 403 102 "-" "Ruby" XX.XXX.XX.XX - - [10/Dec/2012:14:46:52 +0530] "GET /production/file_Metadatas/plugins?links=manage&recurse=true&&ignore=---+%0A++-+%22.svn%22%0A++-+CVS%0A++-+%22.git%22&checksum_type=md5 http/1.1" 403 95 "-" "Ruby" XX.XXX.XX.XX - - [10/Dec/2012:14:46:52 +0530] "GET /production/file_Metadata/plugins? http/1.1" 403 93 "-" "Ruby" XX.XXX.XX.XX - - [10/Dec/2012:14:46:53 +0530] "POST /production/catalog/blramisr195602.XXXXX.com http/1.1" 403 106 "-" "Ruby" XX.XXX.XX.XX - - [10/Dec/2012:14:46:53 +0530] "PUT /production/report/blramisr195602.XXXXX.com http/1.1" 403 105 "-" "Ruby"
文件服务器配置文件如下(并按照他们在puppet站点上的说法进行操作,最好在auth.conf中调节访问以获取文件服务器,然后允许文件服务器到服务器全部)
[files] path /apps/puppet/files allow * [private] path /apps/puppet/private/%H allow * [modules] allow *
我使用的是服务器和客户端版本3
Nginx已使用以下选项编译
Nginx version: Nginx/1.3.9 built by gcc 4.4.6 20120305 (Red Hat 4.4.6-4) (GCC) TLS SNI support enabled configure arguments: --prefix=/apps/Nginx --conf-path=/apps/Nginx/Nginx.conf --pid-path=/apps/Nginx/run/Nginx.pid --error-log-path=/apps/Nginx/logs/error.log --http-log-path=/apps/Nginx/logs/access.log --with-http_ssl_module --with-http_gzip_static_module --add-module=/usr/lib/ruby/gems/1.8/gems/passenger-3.0.18/ext/Nginx --add-module=/apps/Downloads/Nginx/Nginx-auth-ldap-master/
和标准的Nginx puppet master conf
server { ssl on; listen 8140 ssl; server_name _; passenger_enabled on; passenger_set_cgi_param http_X_CLIENT_DN $ssl_client_s_dn; passenger_set_cgi_param http_X_CLIENT_VERIFY $ssl_client_verify; passenger_min_instances 5; access_log logs/puppet_access.log; error_log logs/puppet_error.log; root /apps/Nginx/html/rack/PUBLIC; ssl_certificate /var/lib/puppet/ssl/certs/bangvmpllda02.XXXXXX.com.pem; ssl_certificate_key /var/lib/puppet/ssl/private_keys/bangvmpllda02.XXXXXX.com.pem; ssl_crl /var/lib/puppet/ssl/ca/ca_crl.pem; ssl_client_certificate /var/lib/puppet/ssl/certs/ca.pem; ssl_ciphers SSLv2:-LOW:-EXPORT:rC4+RSA; ssl_prefer_server_ciphers on; ssl_verify_client optional; ssl_verify_depth 1; ssl_session_cache shared:SSL:128m; ssl_session_timeout 5m; }
Puppet正在从提到的文件中获取正确的设置,因为config print命令指向/ etc / puppet
[amisr1@bangvmpllDA02 puppet]$sudo puppet config print | grep conf async_storeconfigs = false authconfig = /etc/puppet/namespaceauth.conf autosign = /etc/puppet/autosign.conf catalog_cache_terminus = store_configs confdir = /etc/puppet config = /etc/puppet/puppet.conf config_file_name = puppet.conf config_version = "" configprint = all configtimeout = 120 dbLOCATIOn = /var/lib/puppet/state/clientconfigs.sqlite3 deviceconfig = /etc/puppet/device.conf fileserverconfig = /etc/puppet/fileserver.conf genconfig = false hiera_config = /etc/puppet/hiera.yaml localconfig = /var/lib/puppet/state/localconfig name = config rest_authconfig = /etc/puppet/auth.conf storeconfigs = true storeconfigs_BACkend = puppetdb tagmap = /etc/puppet/tagmail.conf thin_storeconfigs = false
我检查了这个VM上的防火墙规则;允许80,443,8140,3000.我是否还需要调整auth.conf的任何细节才能使其正常工作？
更新
我在puppet master中添加了详细的日志记录并重新启动了Nginx;这是我在日志中看到的其他信息
@H_670_16@mon Dec 10 18:19:15 +0530 2012 Puppet (err): Could not resolve 10.209.47.31: no name for 10.209.47.31 Mon Dec 10 18:19:15 +0530 2012 access[/] (info): defaulTing to no access for 10.209.47.31 Mon Dec 10 18:19:15 +0530 2012 Puppet (warning): Denying access: Forbidden request: 10.209.47.31(10.209.47.31) access to /file_Metadata/plugins [find] at :111 Mon Dec 10 18:19:15 +0530 2012 Puppet (err): Forbidden request: 10.209.47.31(10.209.47.31) access to /file_Metadata/plugins [find] at :111 10.209.47.31 - - [10/Dec/2012:18:19:15 +0530] "GET /production/file_Metadata/plugins? http/1.1" 403 93 "-" "Ruby"在代理机器上,facter fqdn和hostname都返回一个完全限定的主机名
[amisr1@blramisr195602 ~]$sudo facter fqdn blramisr195602.XXXXXXX.com
然后,我更新了要添加的代理配置
dns_alt_names = 10.209.47.31
清除master和agent上的所有证书并重新生成证书,并使用选项–allow-dns-alt-names在master上签名
[amisr1@bangvmpllDA02 ~]$sudo puppet cert sign blramisr195602.XXXXXX.com Error: CSR 'blramisr195602.XXXXXX.com' contains subject alternative names (DNS:10.209.47.31,DNS:blramisr195602.XXXXXX.com),which are disallowed. Use `puppet cert --allow-dns-alt-names sign blramisr195602.XXXXXX.com` to sign this request. [amisr1@bangvmpllDA02 ~]$sudo puppet cert --allow-dns-alt-names sign blramisr195602.XXXXXX.com Signed certificate request for blramisr195602.XXXXXX.com Removing file Puppet::SSL::Certificaterequest blramisr195602.XXXXXX.com at '/var/lib/puppet/ssl/ca/requests/blramisr195602.XXXXXX.com.pem'
然而,这也无济于事;我和以前一样犯了同样的错误.不知道为什么在日志中它显示了按IP而不是主机名比较访问规则.是否有任何Nginx配置可以改变这种行为？
以上是大佬教程为你收集整理的linux – 当master从命令行运行时,puppet master REST API在乘客工作时返回403全部内容，希望文章能够帮你解决linux – 当master从命令行运行时,puppet master REST API在乘客工作时返回403所遇到的程序开发问题。
如果觉得大佬教程网站内容还不错，欢迎将大佬教程推荐给程序员好友。
本图文内容来源于网友网络收集整理提供，作为学习参考使用，版权属于原作者。
如您有任何意见或建议可联系处理。小编QQ：384754419，请注明来意。