h1. Installing Puppet


  • This goes through an installation on Ubuntu 12.04.
  • Make sure that the package that is installed is a current version (this example uses 2.7.11). Previous versions of Ubuntu (notably, 10.04 LTS) does not have a current version of puppet, and most documentation is for the latest branch.


h3. Install on the Server:

apt-get update
apt-get install puppet puppetmaster puppetmaster-passenger

  This configuration started the Webrick server. To fix, stop the running instance and remove the script out of @/etc/init.d@.


h3. Install on the Client

apt-get update
apt-get install puppet

h4. Update:

  • In @/etc/puppet/puppet.conf@, set the hostname for the certificate (@certname@) and the name of the puppetmaster (@server@).
  • Change @/etc/default/puppet@ to start at boot


h3. Create Certificate:

  The agent and the master communicate over a secure channel. Besides setting up an encrypted channel, the SSL handshake verifies that both sides really are who they claim to be.

  +To authenticate a client+:

client# puppet agent --no-daemonize --verbose

server# puppet cert --list (01:23:45:67:89:AB:CD:EF:FE:DC:BA:98:76:54:32:01)
server# puppet cert --sign
notice: Signed certificate request for
notice: Removing file Puppet::SSL::CertificateRequest at '/var/lib/puppet/ssl/ca/requests/'


  The client checks every 60 seconds to see if there is a signed certificate. If so, it will grab it, then try to get the latest catalog from the puppet master. After the client completes its work, stop the client (control-C) and start the agent service (@service puppet start@).

  With all of the machine name aliasing, it is not uncommon for the initial certificate to be created for a machine name other than what is desired. For example, when the above master was installed, it created a certificate for the machine name @''@ instead of @''@. When an agent attempted to register, the server could sign the agent's certificate, but the agent wouldn't trust the server's certificate, because it wasn't under the hostname the client used for the server.

  To fix this, modify @/etc/puppet/puppet.conf@, in the @[main]@ stanza, and add the line Stop any running puppet instrance, remove all of the certificates and authorities (rm -rf /var/lib/puppet/ssl), and restart (this works for both the client and the agent).

  The puppet master is a Ruby on Rails application that uses Passenger Phusion ("mod_ruby") and listens on port 8140.

Add picture from clipboard (Maximum size: 14.8 MB)