Otdfbt

On the client:

# cf-agent -KIv
...
cf3 -> Handling file existence constraints on /etc/cfengine3
cf3 -> Copy file /etc/cfengine3 from /srv/cfengine/sysconf/server/inputs check
cf3 No existing connection to 172.31.69.83 is established...
cf3 Set cfengine port number to 5308 = 5308
cf3 -> Connect to 172.31.69.83 = 172.31.69.83 on port 5308
cf3 LastSaw host 172.31.69.83 now
cf3 Loaded /var/lib/cfengine3/ppkeys/root-172.31.69.83.pub
cf3 .....................[.h.a.i.l.].................................
cf3 Strong authentication of server=172.31.69.83 connection confirmed
cf3 Server returned error: Unspecified server refusal (see verbose server output)
cf3 Can't stat /srv/cfengine/sysconf/server/inputs in files.copyfrom promise
cf3 ?> defining promise result class Cfengine_Inputs_Updated_Failed
....
cf3 .........................................................
cf3 Promise handle: 
cf3 Promise made by: [cf-agent.cf ] FAILED 172.31.69.83:///srv/cfengine/sysconf/server/inputs -> localhost:///etc/cfengine3

However, on the server (172.31.69.83), there's no reason why it can't stat the directory:

cyrus:/srv/cfengine/sysconf/server# ls -l /srv/cfengine/sysconf/server/inputs
total 52
-rw-r--r-- 1 root root 2142 Sep 6 21:54 cf-agent.cf
-rw-r--r-- 1 root root 831 Sep 6 18:31 cf-execd.cf
-rw-r--r-- 1 root root 4517 Sep 6 21:44 cf-serverd.cf
-rw-r--r-- 1 root root 3082 Sep 6 21:44 dns.cf
-rw-r--r-- 1 root root 2028 Sep 6 15:12 failsafe.cf
-rw-r--r-- 1 root root 5966 Sep 6 21:44 ldap-masters.cf
-rw-r--r-- 1 root root 4380 Sep 6 18:31 ldap-security.cf
-rw-r--r-- 1 root root 2735 Sep 6 08:21 lib-core.cf
-rw-r--r-- 1 root root 1506 Sep 6 21:45 lib-utils.cf
-rw-r--r-- 1 root root 2635 Sep 6 20:27 lib-vars.cf
-rw-r--r-- 1 root root 2057 Sep 3 17:46 nss.cf
-rw-r--r-- 1 root root 1472 Sep 6 18:31 packages.cf
-rw-r--r-- 1 root root 1257 Sep 6 18:01 pam-security.cf
-rw-r--r-- 1 root root 4019 Sep 6 19:32 promises.cf
-rw-r--r-- 1 root root 2808 Sep 3 17:22 site.cf
-rw-r--r-- 1 root root 1670 Sep 6 18:31 sudo-security.cf
-rw-r--r-- 1 root root 831 Sep 6 18:31 sys-security.cf
-rw-r--r-- 1 root root 890 Sep 6 18:31 sys-users.cf
cyrus:/srv/cfengine/sysconf/server# 

I don't see anything interesting server side either when running:

/usr/sbin/cf-serverd -d4 --verbose --no-fork

And the following does not have any complaints:

/usr/sbin/cf-promises -v

Any ideas?

I'm running cfengine3 on debian, v3.0.5+dfsg-1 - and the cf-agent.cf file is as follows:

bundle agent Update 
files:
 linux::
 "$cf3.path[inputs]"
 action => immediate,
 move_obstructions => "true",
 depth_search => Recursive,
 copy_from => MirrorFrom(
 "$cf3.host[server]",
 "$cf3.path[scm-inputs]",
 "true",
 "0400"
 ),
 classes => DefineSoftClass("Cfengine_Inputs_Updated")
 ;

 "$cf3.path[sbin]"
 comment => "Setting cf3 client sbin scripts: $cf3.path[sbin]/",
 action => immediate,
 depth_search => Recursive,
 copy_from => MirrorFrom(
 "$cf3.host[server]",
 "$cf3.path[scm-cnt-scripts]",
 "false",
 "0555"
 )
 ;


reports:
 Cfengine_Inputs_Updated::
 "[cf-agent.cf ] Services:CFAgent:Inputs:Updated";
 Cfengine_Inputs_Updated_Failed::
 "[cf-agent.cf ] FAILED $cf3.host[server]://$cf3.path[scm-inputs] -> localhost://$cf3.path[inputs]";

I lie, there is something interesting with a little more debugging...

AccessControl(/srv/cfengine/sysconf/server/inputs)
AccessControl, match(/srv/cfengine/sysconf/server/inputs,client.com.au) encrypt request=1
Examining rule in access list (/srv/cfengine/sysconf/server/inputs,/home/cfengine)?
cf3 Host client.com.au denied access to /srv/cfengine/sysconf/server/inputs
Unappending Host client.com.au denied access to /srv/cfengine/sysconf/server/inputs
cf3 Access control in sync
Unappending Access control in sync
Transaction Send[t 59][Packed text]
Attempting to send 67 bytes
SendSocketStream, sent 67
cf3 From (host=client.com.au,user=root,ip=172.31.69.3)
Unappending From (host=client.com.au,user=root,ip=172.31.69.3)
cf3 REFUSAL of request from connecting host: (SYNCH 1283777156 STAT /srv/cfengine/sysconf/server/inputs)
Unappending REFUSAL of request from connecting host: (SYNCH 1283777156 STAT /srv/cfengine/sysconf/server/inputs)
RecvSocketStream(8)
cf3 -> Accepting a connection

I'll keep looking.

I'm an old fart who only has experience with cfengine v2. Anyway, the error messages similar to yours were always because of:

• a DNS mismatch




• a relocated server with new hardware etc




• due SNAT/DNAT at some load-balancer




• actually not configured keys

Is this problem present everywhere in your system or just with one client?

Okay, yes it was ACL related, fixed now - thanks for trying though Janne :)