Installing Puppet Open-Source on CentOS 5.8


I recently started playing around with Puppet to manage my current infrastructure of a plethora of linux flavors. After an evaluation using Puppet-Enterprise I was told to see what I could do with the Open Source version. As Puppet-Enterprise is pretty much a ‘no brainer’ install, the open-source version is a different animal.
I’ve had several attempts at installing the Open Source version of Puppet and getting it enterprise ready. Below are my notes on it’s installation:

First, I started with a clean install of CentOS 5.8. I disable selinux but not the firewall. Then did a ‘sudo yum update’ to bring it up to date.

Since I am installing on a VM (off of the network) and puppet requires dns resolution for the puppet master, I’m installing Bind and system-config-bind.

I opened the network configuration and edited the DNS settings and modified the hostname.

Then modified the hosts to include aliases for and

I added the latter because I am going to make a forwarding dns for this instance.

Then I opened up the DNS and let it create the default bind configuration and added a zone for my

I then added an A record for my host and a cname for

I tested this by using nslookup and setting it to my local loopback address.

I then opened the network configuration and set my primary dns server to

Next I added the EPEL repository
sudo rpm -ivh

And installed puppet:
sudo yum install puppet-server

Edited and added the following under [main] since this is going to be the server AND an agent to itself.
vim /etc/puppet/puppet.conf


server =
#dns_alt_names is comma separated list,puppet

After saving the file, I started the puppet master non daemonized so that I can see the output:
sudo puppet master --no-daemonize --verbose

This was the output:
info: Creating a new SSL key for ca
info: Creating a new SSL certificate request for ca
info: Certificate Request fingerprint (md5): 4A:8B:BF:01:6A:BC:84:8C:EA:12:7D:A3:46:C8:32:9A
notice: Signed certificate request for ca
notice: Rebuilding inventory file
info: Creating a new certificate revocation list
info: Creating a new SSL key for
info: Creating a new SSL certificate request for
info: Certificate Request fingerprint (md5): BB:D2:A1:47:24:F3:C4:3F:9E:37:20:DE:FC:0F:44:07
notice: has a waiting certificate request
notice: Signed certificate request for
notice: Removing file Puppet::SSL::CertificateRequest at '/var/lib/puppet/ssl/ca/requests/'
notice: Removing file Puppet::SSL::CertificateRequest at '/var/lib/puppet/ssl/certificate_requests/'
notice: Starting Puppet master version 2.6.17

Here I can see that the puppet master created the certificate using the name I wanted:

Next I opened another terminal window and started the puppet agent. This way I can see what was happening on the master AND the agent:
sudo puppet agent --no-daemonize --verbose

The agent returned:
notice: Starting Puppet client version 2.6.17
info: Retrieving plugin
err: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve information from environment production source(s) puppet://
info: Caching catalog for
info: Applying configuration version '1345431460'
info: Creating state file /var/lib/puppet/state/state.yaml
notice: Finished catalog run in 0.06 seconds

The error is OK. It doesn’t mean that the agent is not working. It means that there is no plugins location on the server.

The server returned the following:
info: access[^/catalog/([^/]+)$]: allowing 'method' find
info: access[^/catalog/([^/]+)$]: allowing $1 access
info: access[/certificate_revocation_list/ca]: allowing 'method' find
info: access[/certificate_revocation_list/ca]: allowing * access
info: access[/report]: allowing 'method' save
info: access[/report]: allowing * access
info: access[/file]: allowing * access
info: access[/certificate/ca]: adding authentication no
info: access[/certificate/ca]: allowing 'method' find
info: access[/certificate/ca]: allowing * access
info: access[/certificate/]: adding authentication no
info: access[/certificate/]: allowing 'method' find
info: access[/certificate/]: allowing * access
info: access[/certificate_request]: adding authentication no
info: access[/certificate_request]: allowing 'method' find
info: access[/certificate_request]: allowing 'method' save
info: access[/certificate_request]: allowing * access
info: access[/]: adding authentication any
info: Inserting default '/status'(auth) ACL because none were found in '/etc/puppet/auth.conf'
info: Could not find filesystem info for file 'plugins' in environment production
info: Could not find file_metadata for 'plugins'
info: Caching node for
notice: Compiled catalog for in environment production in 0.03 seconds

Now that I know it’s working I’m going to CtrlC both the agent and the master. I’m not going to set the master to start automatically yet because I want the puppet master to use httpd and not the ruby server it uses by default.

NOTE: One thing I notice when I setup the master and agent up on the same machine is that I do not need to sign the certificate.

First thing is to install Passenger:
sudo rpm -Uvh

sudo yum install mod_passenger

Then install mod_ssl:
sudo yum install mod_ssl

If you look at it says to copy cp puppetmaster.conf /etc/httpd/conf.d/

but this file is no where to be found or at least, I cannot find it. So… I created it:
touch /etc/httpd/conf.d/puppetmaster.conf

I then add the contents at the bottom of

Listen 8140

SSLEngine on
SSLCertificateFile /var/lib/puppet/ssl/certs/
SSLCertificateKeyFile /var/lib/puppet/ssl/private_keys/
SSLCertificateChainFile /var/lib/puppet/ssl/ca/ca_crt.pem
SSLCACertificateFile /var/lib/puppet/ssl/ca/ca_crt.pem
# CRL checking should be enabled; if you have problems with Apache complaining about the CRL, disable the next line
SSLCARevocationFile /var/lib/puppet/ssl/ca/ca_crl.pem
SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +StdEnvVars

ErrorLog /var/log/httpd/puppetmaster_error.log

CustomLog /var/log/httpd/puppetmaster_access.log

# The following client headers allow the same configuration to work with Pound.
RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e

RackAutoDetect On
DocumentRoot /usr/share/puppet/rack/puppetmasterd/public/

Options None
AllowOverride None
Order allow,deny
allow from all

NOTE: There is a file called apache2 in /usr/share/puppet/ext/rack/files but this file will not work if you copy if into /etc/httpd/conf.d.

Next I created the rack application:
mkdir -p /usr/share/rack/puppetmasterd
mkdir -p /usr/share/puppet/rack/puppetmasterd
mkdir /usr/share/puppet/rack/puppetmasterd/public /usr/share/puppet/rack/puppetmasterd/tmp
cp /usr/share/puppet/ext/rack/files/ /usr/share/puppet/rack/puppetmasterd/
chown puppet /usr/share/puppet/rack/puppetmasterd/

Now I check if my config is ok for httpd:
sudo /sbin/service httpd configtest

If all is good it returns ‘Syntax OK’
I restart it:
sudo /sbin/service httpd restart

Now I start the agent in –no-daemonize and –verbose mode:notice: Starting Puppet client version 2.6.17
info: Retrieving plugin
err: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve information from environment production source(s) puppet://
info: Caching catalog for
info: Applying configuration version '1345435173'
notice: Finished catalog run in 0.10 seconds

Same as above! that’s good. Just to be 100% sure that it’s working using the httpd server, I’m going to check the access log i added in the conf file: - - [19/Aug/2012:21:59:32 -0600] "GET /production/file_metadatas/plugins?links=manage&&checksum_type=md5&ignore=---+%0A++-+.svn%0A++-+CVS%0A++-+.git&recurse=true HTTP/1.1" 404 56 "-" "-" - - [19/Aug/2012:21:59:33 -0600] "GET /production/file_metadata/plugins HTTP/1.1" 404 36 "-" "-" - - [19/Aug/2012:21:59:33 -0600] "GET /production/catalog/ HTTP/1.1" 200 500 "-" "-" - - [19/Aug/2012:21:59:34 -0600] "PUT /production/report/ HTTP/1.1" 200 14 "-" "-"

Success! I can see that the agent is accessing the master via httpd!
Now I set the agent to start and run automatically:
sudo /sbin/chkconfig puppet on
sudo /sbin/service puppet start

Now we’re good!



I am a g33k, Linux blogger, developer, student and Tech Writer for My passion for all things tech drives my hunt for all the coolz. I often need a vacation after I get back from vacation....