Open tberreis opened 3 years ago
Hi, thanks you for opening this. Do you have a reproducer steps for the 404 error? I can think of steps that may lead to what you are describing, though I haven't tested yet:
foreman_scap_client $id
where $id belongs to deleted policyThis will cause a configuration discrepancy - the policy no longer exists in Foreman, but host still has an entry in config. Because the policy has not yet been executed, host does not yet have scap content file and tries to download it - which of course fails. Getting the config into a consistent state is the fix in this case.
Is defining a separate source meant to fix the error or is it a separate feature?
Hi,
I performed a clean install of Foreman 2.5 with Katello as seen below:
foreman-installer --scenario katello \
--foreman-initial-organization my_orga \
--foreman-initial-location my_location \
--foreman-initial-admin-username admin \
--foreman-initial-admin-password MySecurePassword \
--enable-foreman-plugin-openscap \
--enable-foreman-proxy-plugin-openscap \
--enable-foreman-plugin-ansible \
--enable-foreman-proxy-plugin-ansible \
--enable-foreman-plugin-remote-execution \
--enable-foreman-proxy-plugin-remote-execution-ssh \
--enable-foreman-plugin-azure \
--enable-foreman-plugin-statistics \
--enable-foreman-plugin-tasks \
--enable-foreman-cli-ansible \
--enable-foreman-cli-azure \
--enable-foreman-cli-katello \
--enable-foreman-cli-openscap \
--enable-foreman-cli-remote-execution \
--enable-foreman-cli-tasks \
--foreman-plugin-tasks-automatic-cleanup true \
--foreman-plugin-tasks-backup true
The smart proxy is listening on :9090 and uploading arf reports is working as expected. But the scap content is not available on :9090. The smart proxy is not delivering any SCAP content and only the Foreman API itself which is available on :443 can be used to download the policy content and tailoring files. Therefore upload and download target differ.
Not sure, if it's a corner case or some misconfiguration on my side. Because I used the default settings, I'm wondering if I'm the first, who's struggling ...
Thank you for the details. Taking a closer look, I noticed the client config has a couple of unusual values.
:download_path:
in your config starts with /api/compliance
, while mine has just /compliance
, which is probably the cause of 404.
Was your config file created manually?
Unfortunately, that doesn't change anything:
[root ~]# foreman_scap_client 2
File /usr/share/xml/scap/ssg/content/ssg-centos7-ds-1.2.xml is missing. Downloading it from proxy.
Download SCAP content xml from: https://*****.com:9090/compliance/policies/2/content/
SCAP content is missing and download failed with error: 404 "Not Found"
[root ~]# vi /etc/foreman_scap_client/config.yaml
[root ~]# foreman_scap_client 2
File /usr/share/xml/scap/ssg/content/ssg-centos7-ds-1.2.xml is missing. Downloading it from proxy.
Download SCAP content xml from: https://*****.com:9090/api/compliance/policies/2/content/
SCAP content is missing and download failed with error: 404 "Not Found"
[root ~]# curl https://*****.com:9090/compliance/policies/2/content/
No client SSL certificate supplied
[root ~]# curl --key /etc/pki/consumer/key.pem --cert /etc/pki/consumer/cert.pem https://*****.com:9090/compliance/policies/2/content/
Requested url was not found
[root ~]# curl https://*****.com:/api/compliance/policies/2/content/
{
"error": {"message":"Access denied","details":"Missing one of the required permissions: view_policies","missing_permissions":["view_policies"]}
}
[root ~]# curl -s -u ***:****** https://*****.com:/api/compliance/policies/2/content/
<ds:data-stream-collection xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" xmlns:cpe-dict="http://cpe.mitre.org/dictionary/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" [...]
API is used as a workaround more or less:
Hi, this is really strange. I just installed 2.5, but could not reproduce. I would check /var/log/foreman/production.log and /var/log/foreman-proxy/proxy.log as you run the client, maybe something useful will show up.
Any update ? I have exactly the same behaviour
It seems that usually the scap client uses the same settings for uploading reports and for downloading content which is not suitable in some circumstances. After installing Foreman with default settings, the proxy for uploading reports listens on :9090, but downloading content and tailoring files is available via API on :443.
Example Configuration
may lead to
It should be possible to define the source via separate settings, e.g.
And if so - the possibility to use basic authentication would be great too.
In the end it should look like