{"id":6495,"date":"2017-02-27T08:55:21","date_gmt":"2017-02-27T00:55:21","guid":{"rendered":"http:\/\/rmohan.com\/?p=6495"},"modified":"2017-02-27T08:55:21","modified_gmt":"2017-02-27T00:55:21","slug":"puppet-master-server-on-centos-6","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=6495","title":{"rendered":"Puppet Master Server on CentOS 6"},"content":{"rendered":"<p>very popular tool for any operational guy\u2019s DevOps utility belt is Puppet \u2013 a system configuration management service. It allows you to automate the entire process of system configuration and maintain consistency across groups of servers.\u00a0Imagine having to deploy 50 servers for a new web farm, with each server requiring the exact same configuration. An especially daunting task when done manually. With Puppet, we simply define a server configuration for the web nodes, including which packages and services are installed and how they themselves are configured. When done we then assign that configuration to those systems.<\/p>\n<p>Another benefit to using a tool like Puppet is the ability to update configurations across your entire infrastructure on the fly. This could mean installation of the latest version of MySQL onto your database servers, or simply modifying DNS configurations for every server in the environment.<\/p>\n<p>Puppet uses a client-server model. By that I mean our configurations are defined and stored on what is called a\u00a0Puppet master server, and\u00a0each system that will have its configuration maintained by Puppet has a client \u00a0installed. Every 30 mintues, by default, each client communicates with the master server to have its configuration audited. When a discrepancy\u00a0is discovered between the client\u2019s current configuration and what is defined for it, the appropriate actions are completed to bring the system back into\u00a0compliance.<\/p>\n<p>This tutorial will guide you through setting up and running a Puppet master server using the open-source version of the software on a CentOS 6 server. Unlike the enterprise version of Puppet, the open-source version requires quite a bit of manual configuration. Nothing overwhelming but definitely not as simple as running a single executable.<\/p>\n<h3>Goals<\/h3>\n<ul>\n<li>Deploy a Puppet Master server<\/li>\n<\/ul>\n<h2>Installing Puppet<\/h2>\n<h3>Disabling SELinux<\/h3>\n<p>I am a very strong advocate of always running SELinux on Redhat-based servers. I do not take disabling it lightly and avoid doing so where possible. However, at the time of this writing I was unable to find a satisfactory way of enabling SELinux on a Puppet master server. There are SELinux policies for Puppet that can be found on the Internet. Unfortunately, I cannot recommend using any of them since they are not refined enough to ensure the system is secure.<\/p>\n<p>Outright disabling SELinux is very bad idea. You never know when you\u2019ll be able to re-enable it. And if you do disable it, when it comes time to re-enable SELinx the system will have to relabel every file, directory and port with the appropriate contexts. This a very, very, very time consuming process. Instead, I recommend placing SELinux into Permissive mode. This way SELinux doens\u2019t block Puppet process and communications, and our files, directories, and ports all keep their contexts.<\/p>\n<ol>\n<li>Immediately place SELinux into permissive mode.\n<pre class=\"bash\">setenforce 0<\/pre>\n<\/li>\n<li>The command above is not persistent. It will be undone during the next reboot. To make the change persistent, open the SELinux configuration file into a text editor.\n<pre class=\"bash\">nano \/etc\/sysconfig\/selinux<\/pre>\n<\/li>\n<li>Change the <strong>SELINUX<\/strong> value from <strong>enforcing<\/strong> to permissive, as seen in the example below.\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0# This file controls the state of SELinux on the system.<\/div>\n<div class=\"line\">\u00a0# SELINUX= can take one of these three values:<\/div>\n<div class=\"line\">\u00a0# enforcing &#8211; SELinux security policy is enforced.<\/div>\n<div class=\"line\">\u00a0# permissive &#8211; SELinux prints warnings instead of enforcing.<\/div>\n<div class=\"line\">\u00a0# disabled &#8211; No SELinux policy is loaded.<\/div>\n<div class=\"line highlight\">\u00a0SELINUX=permissive<\/div>\n<div class=\"line\">\u00a0# SELINUXTYPE= can take one of these two values:<\/div>\n<div class=\"line\">\u00a0# targeted &#8211; Targeted processes are protected,<\/div>\n<div class=\"line\">\u00a0# mls &#8211; Multi Level Security protection.<\/div>\n<div class=\"line\">\u00a0SELINUXTYPE=targeted<\/div>\n<\/li>\n<li>Save your changes and exit the text editor.<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<h3>Install the Puppet Repo<\/h3>\n<p>The easiest way to install Puppet is by adding the Puppet Labs repository file to your server. We can install it by using the freely available RPM provided by Puppet Labs.<\/p>\n<ol>\n<li>Download and install the PuppetLabs\u2019 repository RPM. At the time of this writing, version 6.7 was available.\n<pre class=\"bash\">rpm -ivh http:\/\/yum.puppetlabs.com\/el\/6\/products\/i386\/puppetlabs-release-6-7.noarch.rpm<\/pre>\n<\/li>\n<li>If all was successful, you should now have a filled called puppetlabs.repo located in \/etc\/yum.repos.d\/.\n<pre class=\"output\">-rw-r--r--. 1 root root 1926 Nov 27  2013 CentOS-Base.repo\r\n-rw-r--r--. 1 root root  638 Nov 27  2013 CentOS-Debuginfo.repo\r\n-rw-r--r--. 1 root root  630 Nov 27  2013 CentOS-Media.repo\r\n-rw-r--r--. 1 root root 3664 Nov 27  2013 CentOS-Vault.repo\r\n-rw-r--r--. 1 root root 1250 Apr 12  2013 <strong>puppetlabs.repo<\/strong>\r\n<\/pre>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<h3>Install the Puppet Master<\/h3>\n<p>The Puppet Master is where your nodes get their configuration profiles from.<\/p>\n<ol>\n<li>Install the Puppet Master package from the Puppetlabs repository.\n<pre class=\"bash\">yum install -y puppet-server<\/pre>\n<\/li>\n<li>Start the Puppet Master service.\n<pre class=\"bash\">service puppetmaster start<\/pre>\n<\/li>\n<li>Ensure the Puppet master starts at boot.\n<pre class=\"bash\">puppet resource service puppetmaster ensure=running enable=true<\/pre>\n<\/li>\n<\/ol>\n<h3><\/h3>\n<p>&nbsp;<\/p>\n<h3>Install a Web Server for Puppet Agent Access<\/h3>\n<p>Each server being managed by Puppet will have an agent installed. By default, the agent will attempt to connect to a Puppet master server using a HTTPS connection. We need to ensure a web server is available on the master server to allow us to service our clients. You can us any web server, but we\u2019ll be using Apache in this tutorial.<\/p>\n<ol>\n<li>Install the web server and some other required packages, like Ruby.\n<pre class=\"bash\">yum install -y httpd httpd-devel mod_ssl ruby-devel rubygems openssl-devel gcc-c++ curl-devel zlib-devel make automake<\/pre>\n<\/li>\n<li>The web service requires Passenger to process the Ruby files used by Puppet. We install it using Ruby\u2019s gems.\n<pre class=\"bash\">gem install rack passenger<\/pre>\n<\/li>\n<li>With the Passenger, we need to install and configure its Apache module.\n<pre class=\"bash\">passenger-install-apache2-module<\/pre>\n<\/li>\n<\/ol>\n<h3><\/h3>\n<p>&nbsp;<\/p>\n<h3>Prepare Puppet\u2019s Apache directory<\/h3>\n<ol>\n<li>Create a directory.\n<pre class=\"bash\">mkdir -p \/usr\/share\/puppet\/rack\/puppetmasterd<\/pre>\n<\/li>\n<li>Create the document root directory\n<pre class=\"bash\">mkdir \/usr\/share\/puppet\/rack\/puppetmasterd\/public  \/usr\/share\/puppet\/rack\/puppetmasterd\/tmp<\/pre>\n<\/li>\n<li>Copy the Rack config template to our Apache virtual host\u2019s directory root.\n<pre class=\"bash\">cp \/usr\/share\/puppet\/ext\/rack\/files\/config.ru  \/usr\/share\/puppet\/rack\/puppetmasterd\/<\/pre>\n<\/li>\n<li>Apply the appropriate permissions to the configuration file.\n<pre class=\"bash\">chown puppet \/usr\/share\/puppet\/rack\/puppetmasterd\/config.ru<\/pre>\n<\/li>\n<\/ol>\n<h3><\/h3>\n<p>&nbsp;<\/p>\n<h3>Create the Apache Virtual Host for Puppet<\/h3>\n<ol>\n<li>Create a configuration file for the Apache virtual host.\n<pre class=\"bash\">touch \/etc\/httpd\/conf.d\/puppetlabs.conf<\/pre>\n<\/li>\n<li>Edit the file and add the following contents.\n<div class=\"line\"># And the passenger performance tuning settings:<\/div>\n<div class=\"line\">\u00a0PassengerHighPerformance On<\/div>\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0#PassengerUseGlobalQueue On<\/div>\n<div class=\"line\">\u00a0# Set this to about 1.5 times the number of CPU cores in your master:<\/div>\n<div class=\"line\">\u00a0PassengerMaxPoolSize 6<\/div>\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0# Recycle master processes after they service 1000 requests<\/div>\n<div class=\"line\">\u00a0PassengerMaxRequests 1000<\/div>\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0# Stop processes if they sit idle for 10 minutes<\/div>\n<div class=\"line\">\u00a0PassengerPoolIdleTime 600<\/div>\n<div class=\"line\">\u00a0Listen 8140<\/div>\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0&lt;VirtualHost *:8140&gt;<\/div>\n<div class=\"line\">\u00a0 SSLEngine On<\/div>\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0 # Only allow high security cryptography. Alter if needed for compatibility.<\/div>\n<div class=\"line\">\u00a0 SSLProtocol All -SSLv2<\/div>\n<div class=\"line\">\u00a0 SSLCipherSuite HIGH:!ADH:RC4+RSA:-MEDIUM:-LOW:-EXP<\/div>\n<div class=\"line\">\u00a0 SSLCertificateFile \/var\/lib\/puppet\/ssl\/certs\/puppet.serverlab.intra.pem<\/div>\n<div class=\"line\">\u00a0 SSLCertificateKeyFile \/var\/lib\/puppet\/ssl\/private_keys\/puppet.serverlab.intra.pem<\/div>\n<div class=\"line\">\u00a0 SSLCertificateChainFile \/var\/lib\/puppet\/ssl\/ca\/ca_crt.pem<\/div>\n<div class=\"line\">\u00a0 SSLCACertificateFile \/var\/lib\/puppet\/ssl\/ca\/ca_crt.pem<\/div>\n<div class=\"line\">\u00a0 SSLCARevocationFile \/var\/lib\/puppet\/ssl\/ca\/ca_crl.pem<\/div>\n<div class=\"line\">\u00a0 SSLVerifyClient optional<\/div>\n<div class=\"line\">\u00a0 SSLVerifyDepth 1<\/div>\n<div class=\"line\">\u00a0 #SSLOptions +StdEnvVars +ExportCertData<\/div>\n<div class=\"line\">\u00a0 SSLOptions +StdEnvVars<\/div>\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0 # These request headers are used to pass the client certificate<\/div>\n<div class=\"line\">\u00a0 # authentication information on to the puppet master process<\/div>\n<div class=\"line\">\u00a0 RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e<\/div>\n<div class=\"line\">\u00a0 RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e<\/div>\n<div class=\"line\">\u00a0 RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e<\/div>\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0 # RackAutoDetect On<\/div>\n<div class=\"line\">\u00a0 DocumentRoot \/usr\/share\/puppet\/rack\/puppetmasterd\/public\/<\/div>\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0 &lt;Directory \/usr\/share\/puppet\/rack\/puppetmasterd\/&gt;<\/div>\n<div class=\"line\">\u00a0 Options None<\/div>\n<div class=\"line\">\u00a0 AllowOverride None<\/div>\n<div class=\"line\">\u00a0 Order Allow,Deny<\/div>\n<div class=\"line\">\u00a0 Allow from All<\/div>\n<div class=\"line\">\u00a0 &lt;\/Directory&gt;<\/div>\n<div class=\"line\"><\/div>\n<div class=\"line\">\u00a0&lt;\/VirtualHost&gt;<\/div>\n<\/li>\n<li>Stop the puppetmaster service.\n<pre class=\"bash\">service puppetmaster stop<\/pre>\n<\/li>\n<li>Start the Apache service.\n<pre class=\"bash\">service httpd on<\/pre>\n<\/li>\n<li>Disable the puppetmaster service to prevent it from starting during system boot.\n<pre class=\"bash\">chkconfig puppetmaster off<\/pre>\n<\/li>\n<li>Enable the Apache service to automatically start it during system boot.\n<pre class=\"bash\">chkconfig httpd on<\/pre>\n<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>very popular tool for any operational guy\u2019s DevOps utility belt is Puppet \u2013 a system configuration management service. It allows you to automate the entire process of system configuration and maintain consistency across groups of servers. Imagine having to deploy 50 servers for a new web farm, with each server requiring the exact same configuration. [&#8230;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6495"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6495"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6495\/revisions"}],"predecessor-version":[{"id":6496,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6495\/revisions\/6496"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}