CIS 527

Lecture 9 - Puppet Enterprise

Today's Plan

1. Set up the Puppet Learning VM
2. Duplicate the VM for an Agent and Server configuration
3. Reconfigure one VM as an Agent
4. Get the two VMs to communicate
5. Install a module on the server and apply it on the client

1. Set up the Puppet Learning VM

1. It is on the Transient drive in the installers folder
2. Copy it to your folder on the transient drive or a local drive
3. Unzip the file (this may take a bit)

2. Duplicate VM

1. Make sure your VM is off
2. Copy the file on disk
3. Open it in VMWare
4. Make sure both are set to NAT networking
5. Start both VMs

3. Reconfigure VM

wget http://docs.puppetlabs.com/learning/
            files/learningpuppet.tar.gz
tar -xzf learningpuppet.tar.gz
mv learningpuppet /etc/puppetlabs/puppet/modules/
puppet apply -e "class {'learningpuppet::makeagent':}"

4. Communication

1. Ping by IP address

   • facter ipaddress_eth0

2. Reach the puppet master by name
   

   <ip_address> learn.localdomain learn
   puppet.localdomain puppet

3. Firewalls are off
4. Synchronized clocks

   • date -u

Puppet Agent

Puppet agent command runs in 2 modes:

• Daemon mode
• Run and quit

You can stop it by running

/etc/init.d/pe-puppet stop

First Try

Let's try it by running:

puppet agent --test

First Try

Let's try it by running:

puppet agent --test

[root@agent1 ~]# puppet agent --test
info: Creating a new SSL key for agent1.localdomain
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for ca
info: Creating a new SSL certificate request for agent1.localdomain
info: Certificate Request fingerprint (md5): FD:E7:41:C9:2C:B7:5C:27:11:0C:8F:9C:1D:F6:F9:46
Exiting; no certificate found and waitforcert is disabled

What Happened?

• Puppet secures communications between the master and agents with SSL
• Since our agent doesn't have a valid certificate, it won't work
• We must sign our certificate to continue

Signing SSL Certificates

On the Master VM:

puppet cert list

Signing SSL Certificates

On the Master VM:

puppet cert list
agent1.localdomain (FD:E7:41:C9:2C:B7:5C:27:11:0C:8F:9C:1D:F6:F9:46)

Signing SSL Certificates

On the Master VM:

puppet cert list  
agent1.localdomain (FD:E7:41:C9:2C:B7:5C:27:11:0C:8F:9C:1D:F6:F9:46)

puppet cert sign agent1.localdomain

Signing SSL Certificates

On the Master VM:

puppet cert list 
agent1.localdomain (FD:E7:41:C9:2C:B7:5C:27:11:0C:8F:9C:1D:F6:F9:46)

puppet cert sign agent1.localdomain 
notice: Signed certificate request for agent1.localdomain
notice: Removing file Puppet::SSL::CertificateRequest ...

Try Again

puppet agent --test

[root@agent1 ~]# puppet agent --test
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for agent1.localdomain
info: Retrieving plugin
info: Caching certificate_revocation_list for ca
info: Loading facts in facter_dot_d
info: Caching catalog for agent1.localdomain
info: Applying configuration version '1326210629'
notice: Finished catalog run in 0.11 seconds

Configuring the site.pp file

• Install the NTP module from Puppet Forge:
  

  puppet module install puppetlabs-ntp

• /etc/puppetlabs/puppet/manifests/site.pp:
  

  node 'agent1.localdomain' {
  # Note the quotes around the name! 
    class {'ntp':
      servers => [ "ntp-1.ksu.edu dynamic", 
        "ntp-2.ksu.edu dynamic", ],
    }
  }

Apply on Agent

puppet agent --test

[root@agent1 ~]# puppet agent --test
info: Retrieving plugin
info: Loading facts in facter_dot_d
notice: /Stage[main]/Ntp/Package[ntp]/ensure: created
+# Managed by puppet class { "ntp": servers => [ ... ] }
info: ntp.conf: Scheduling refresh of Service[ntp]
notice: /Stage[main]/Ntp/Service[ntp]: Triggered 'refresh' from 1 events
notice: Finished catalog run in 32.74 seconds

What's Next?

• Add more modules
• Add more agents
• Customize configuration for different types of agents
• Test, test, test
• Enjoy your new stress-free life!

Assignments

• Lab Help Session Friday 9 - 10 AM!
• Lab 2 - Configuration Management - Due Monday, Feb 23rd by 12:30 PM
• Automate configuration using Puppet
• Turn in:
  • CIS Transient Storage
  • via Storage Media in class Monday Feb 23rd