BAD: keys did not match - Revision history

Hutch at 21:01, 14 January 2008

Hutch — Mon, 14 Jan 2008 21:01:09 GMT

←Older revision		Revision as of 21:01, 14 January 2008
Line 29:		Line 29:
	10.205.0.66 mrpmmap010.prd.mrds.unix.example.com mrpmmap010.example.com		10.205.0.66 mrpmmap010.prd.mrds.unix.example.com mrpmmap010.example.com

-	From nsswitch.conf:	+	From /etc/nsswitch.conf:
	# Note that IPv4 addresses are searched for in all of the ipnodes databases		# Note that IPv4 addresses are searched for in all of the ipnodes databases
	# before searching the hosts databases.		# before searching the hosts databases.

Hutch at 21:00, 14 January 2008

Hutch — Mon, 14 Jan 2008 21:00:27 GMT

←Older revision		Revision as of 21:00, 14 January 2008
Line 13:		Line 13:
	trustkey=true		trustkey=true

-	So what was the problem? To find out, ~~run~~ '''cfagent''' in debug mode.	+	So what was the problem? To find out, I ran '''cfagent''' in debug mode.

	# '''cfagent -qIK -d1'''		# '''cfagent -qIK -d1'''

Hutch at 20:59, 14 January 2008

Hutch — Mon, 14 Jan 2008 20:59:59 GMT

←Older revision		Revision as of 20:59, 14 January 2008
Line 1:		Line 1:
		+	In this example, I received a cfengine authentication error due to name resolution problems on a Solaris 10 client.
		+
	# '''cfagent -qIK'''		# '''cfagent -qIK'''
	...		...
Line 32:		Line 34:
	ipnodes: ldap [NOTFOUND=return] files		ipnodes: ldap [NOTFOUND=return] files

-	This forward/reverse mismatch causes problems with cfengine authentication. As a fix, remove or correct the entry in the LDAP hosts database.	+	This forward/reverse mismatch causes problems with cfengine authentication. As a fix, remove or correct the entry in the LDAP hosts database. In this case, I chose to fix the LDAP hosts entry using '''ldapmodrdn'''.
		+
		+	$ '''ldapmodrdn -r -h ''LDAP_server'' -D "cn=Directory Manager"'''
		+	Enter bind password:
		+	cn=mrpmmap010+ipHostNumber=10.205.0.66,ou=Hosts,dc=prd,dc=mrds,dc=unix,dc=example,dc=com
		+	cn=mrpmmds012+ipHostNumber=10.205.0.66
		+	renaming entry cn=mrpmmap010+ipHostNumber=10.205.0.66,ou=Hosts,dc=prd,dc=mrds,dc=unix,dc=example,dc=com

Hutch at 20:46, 14 January 2008

Hutch — Mon, 14 Jan 2008 20:46:39 GMT

←Older revision		Revision as of 20:46, 14 January 2008
Line 1:		Line 1:
-
	# '''cfagent -qIK'''		# '''cfagent -qIK'''
	...		...
	cfengine:mrpmmds012: BAD: keys did not match		cfengine:mrpmmds012: BAD: keys did not match

-	'''cfservd''' on the policyserver was correctly configured. My cfengine client was listed in AllowConnectionsFrom and TrustKeysFrom. I also allow the policyserver's public cfengine key to be copied to '''/var/cfengine/ppkeys''' on the client.	+	'''cfservd''' on the policyserver was correctly configured. My cfengine client was listed in '''AllowConnectionsFrom''' and '''TrustKeysFrom'''. I also allow the policyserver's public cfengine key to be copied to '''/var/cfengine/ppkeys''' on the client.
	# For boostrapping cfengine clients		# For boostrapping cfengine clients
	/var/cfengine/ppkeys/localhost.pub		/var/cfengine/ppkeys/localhost.pub
Line 12:		Line 11:
	trustkey=true		trustkey=true

-	So what was the problem?	+	So what was the problem? To find out, run '''cfagent''' in debug mode.
		+
		+	# '''cfagent -qIK -d1'''
		+	...
		+	IPV4 address
		+	sockaddr_ntop(10.205.0.66)
		+	Identifying this agent as 10.205.0.66 i.e. mrpmmds012.example.com, with signature 0
		+	IsIPV6Address(mrpmmap010.prd.mrds.unix.example.com)
		+	SENT:::CAUTH 10.205.0.66 mrpmmap010.prd.mrds.unix.example.com root 0
		+
		+	It turns out that this system is mrpmmds012.example.com in DNS and mrpmmap010.prd.mrds.unix.example.com in the LDAP hosts database.
		+	$ '''getent ipnodes mrpmmds012.example.com'''
		+	10.205.0.66 mrpmmds012.example.com loghost
		+	$ '''getent ipnodes 10.205.0.66'''
		+	10.205.0.66 mrpmmap010.prd.mrds.unix.example.com mrpmmap010.example.com
		+
		+	From nsswitch.conf:
		+	# Note that IPv4 addresses are searched for in all of the ipnodes databases
		+	# before searching the hosts databases.
		+	ipnodes: ldap [NOTFOUND=return] files
		+
		+	This forward/reverse mismatch causes problems with cfengine authentication. As a fix, remove or correct the entry in the LDAP hosts database.

Hutch: New page: # '''cfagent -qIK''' ... cfengine:mrpmmds012: BAD: keys did not match '''cfservd''' on the policyserver was correctly configured. My cfengine client was listed in AllowConnectionsFrom...

Hutch — Mon, 14 Jan 2008 19:13:49 GMT

New page: # '''cfagent -qIK''' ... cfengine:mrpmmds012: BAD: keys did not match '''cfservd''' on the policyserver was correctly configured. My cfengine client was listed in AllowConnectionsFrom...

New page

# '''cfagent -qIK'''
...
cfengine:mrpmmds012: BAD: keys did not match

'''cfservd''' on the policyserver was correctly configured. My cfengine client was listed in AllowConnectionsFrom and TrustKeysFrom. I also allow the policyserver's public cfengine key to be copied to '''/var/cfengine/ppkeys''' on the client.
# For boostrapping cfengine clients
/var/cfengine/ppkeys/localhost.pub
server=$(policyhost)
dest=/var/cfengine/ppkeys/root-$(policyhost).pub
mode=600 owner=root group=root
trustkey=true

So what was the problem?