Wednesday, October 28, 2009

Configuration management: Puppet with Ubuntu 9.04

When you have a lot of machines to configure and manage, Configuration management tools like (Cfengine or Puppet)  becomes very handy.  The following procedure shows you how to have your Puppet Server installed and one client using Ubuntu 9.04.

For Server
#apt-get install puppetmaster

For Client

#apt-get install puppet

On Puppet server:

Edit /etc/puppet/puppet.conf


and add certname

certname =

certname will guarantee that the cert is created right.

Edit /etc/puppet/fileserver.conf

This file will configure the path for files stored on the servers and who is allowed
to take them.

  path /etc/puppet/files
  allow *

Copy /etc/sudoers to /etc/puppet/files/etc/ so clients can take the file.

Now you have to make sure that on directory /etc/puppet/, you have all this directories.

root@puppetserver:/etc/puppet# ls
files  fileserver.conf  manifests  puppet.conf

then go manifests and create a directory called classes.

Create a file /etc/puppet/manifests/classes/sudo.pp

# /etc/puppet/manifests/classes/sudo.pp

class sudo {
    file { "/etc/sudoers":
        owner => "root",
        group => "root",
        mode  => 440,
        source => "puppet://"

Create a file /etc/puppet/manifests/site.pp

import "classes/*"

# tell puppet on which client to run the class
node puppetclient {
    include sudo

Start puppet master /etc/init.d/puppetmasterd start

Note: You will get an error with xmlsimple.rb file. You will basically go to
/usr/lib/ruby/1.8/ and move xmlsimple.rb file to /usr/lib/ruby/1.8/lib/.

On Puppet client

Edit /etc/puppet/puppet.conf


certname =
server =
runinterval = 60   

runinterval will check puppet server every 60 seconds (Default 1800)

Then run the following command so the Puppet Server can issue a certificate.

# puppetd --test
warning: peer certificate won't be verified in this SSL session
notice: Did not receive certificate
notice: Set to run 'one time'; exiting with no certificate


#puppetca --list

Then sign it.

# puppetca --sign

Now your client can talk with the master.

#/etc/init.d/puppet start

Enjoy it

No comments:

Post a Comment