Deployment doesn't work with OS X agent

Question

[Server]

OCSInventory-Server 2.4.1

CentOS Linux 7 (Core)

Linux x86_64 3.10.0-693.2.2.el7.x86_64

[Agent]

Mac OS : High Sierra 10.13.3

Agent : OCS-NG_unified_unix_agent_v2.3.1

[Issue]

Hi,

My Agent for OS X doesn't download the package.

The "Active Status" of the package remains "Notified" for several days. 

Agent for Windows can download the same package with same cacert.pem.

Both Agents for OS X and Windows can upload the inventory information to the server.

Any idea ?

Best Regards,

>>>>>>>>Log for Agent>>>>>>>>>>>>>>>>>>>

[Wed Jun  6 10:43:47 2018][debug] Ocsinventory unified agent for UNIX, Linux and MacOSX 2.3.1

[Wed Jun  6 10:43:47 2018][debug] Log system initialised (File)

[Wed Jun  6 10:43:47 2018][debug] --scan-homedirs missing. Don't scan user directories

[Wed Jun  6 10:43:48 2018][debug] Accountinfo file: /var/lib/ocsinventory-agent/https:__<our inventory server>_ocsinventory/ocsinv.adm

[Wed Jun  6 10:43:48 2018][debug] OCS Agent initialised

[Wed Jun  6 10:43:48 2018][debug] Failed to load `/etc/ocsinventory-agent/modules.conf': 0

[Wed Jun  6 10:43:48 2018][debug] No modules will be used.

[Wed Jun  6 10:43:48 2018][debug] Compress::Zlib is not available! The data will be compressed with

             gzip instead but won't be accepted by server prior 1.02

[Wed Jun  6 10:43:48 2018][debug] sending XML

[Wed Jun  6 10:43:48 2018][debug] sending: <?xml version="1.0" encoding="UTF-8"?>

<REQUEST>

  <DEVICEID>hamaguchi-mac-6-2018-06-01-19-16-31</DEVICEID>

  <QUERY>PROLOG</QUERY>

</REQUEST>

[Wed Jun  6 10:44:02 2018][debug] =BEGIN=SERVER RET======

[Wed Jun  6 10:44:02 2018][debug] $VAR1 = '<?xml version=\'1.0\' encoding=\'UTF-8\'?>

<REPLY>

  <OPTION>

    <NAME>DOWNLOAD</NAME>

    <PARAM FRAG_LATENCY="10" PERIOD_LATENCY="1" ON="1" TYPE="CONF" CYCLE_LATENCY="60" TIMEOUT="30" PERIOD_LENGTH="10" EXECUTION_TIMEOUT="120" />

    <PARAM ID="1528249165" SCHEDULE="" CERT_FILE="INSTALL_PATH/cacert.pem" TYPE="PACK" INFO_LOC="<our inventory server>/download" CERT_PATH="INSTALL_PATH" PACK_LOC="<our inventory server>/download" FORCE="0" POSTCMD="" />

  </OPTION>

  <RESPONSE>SEND</RESPONSE>

  <INVENTORY_ON_STARTUP>1</INVENTORY_ON_STARTUP>

  <PROLOG_FREQ>24</PROLOG_FREQ>

</REPLY>

';

[Wed Jun  6 10:44:02 2018][debug] =END=SERVER RET======

Answer 1

Hi hamaguchi,

I have the same issue on test platform that we start to use. We have a old version in production environnement that works well (inventory and deployment with Windows and MacOS computer).

In test environnement, we use the same version as you (OCS server 2.4.1 on CentOS 7, Windows 10 with last agent version and MacOS 10.11 with last version agent).

Inventory works for both Windows and Mac computer but download only work with Windows (same cacert.pem but we use the SSL=0 option).

We made test with old version of the Mac Agent (2.0.3) and that gave us this log :

[Thu Jun  7 12:59:58 2018][debug] [download] Making working directory for 1528204141.
[Thu Jun  7 12:59:58 2018][debug] [download] Retrieving info file for 1528204141
[Thu Jun  7 12:59:58 2018][debug] [download] Initialize ssl layer...
[Thu Jun  7 12:59:58 2018][debug] [download] Connect to server: ocsinventory.va.mars/download...
[Thu Jun  7 12:59:58 2018][debug] [download] Starting SSL connection...
[Thu Jun  7 12:59:58 2018][debug] [download] Sending message for 1528204141, code=ERR_DOWNLOAD_INFO.
[Thu Jun  7 12:59:58 2018][error] [download] Error: SSL hanshake has failed

So, we can see that the handshake ssl process does not work and the deployment status goes to ERR_DOWNLOAD_INFO (we use the same cacert.pem).

With the last agent, we do not have any information about this handshake ... We work on this issue.

Do you have more information or solution about this issue ?

Answer 2

Hi Dmauran,

Thank you for your reply.

No update yet on my side.

>In test environnement, we use the same version as you (OCS server 2.4.1 on CentOS 7, Windows 10 with last agent version and MacOS 10.11 with last version agent).

Inventory and deployment of these agents (Windows 10 with last agent version and MacOS 10.11 with last version agent) works well with old version in your production environment ?

If that is the case, i will try older version of  OCS server.

Answer 3

Hi,

No, our production environnement, in OCS Inventory 2.0.3, does not work with the latest version of the agent. We work with 2.0.5.0 agent on Windows computer and 2.0.3 agent on Mac computer.

We still think it's a problem with the SSL certificate and configuration of the apache server. We still search ...

Answer 4

Hi, just to let you know ...

I try my certificat with a test environnement with old version : HTTPD 2.2, with 2.0.3 version of OCS Inventory server and Mac Agent. It works well for deployement (inventory works only in HTTP because this version does not include SSL=0 option) ... So back to our new test environnement with 2.4.3 server.

I try to change httpd conf ssl file. I put all loglevel in max information (debug). I change SSLProtocol to "all -SSLv2" ... And the ssl_access_log, ssl_request_log and ssl_error_log give me much informations.

With 2.4.3 Server and 2.3.1 Mac Agent, inventory works in HTTPS (with SSL=0 option) but the Agent does not ask for the deployement info url (https://server/download/XXXXXXXX/Info) !

With old Mac agent (2.0.3) we can see the SSL error (hanshack failed) when it try to connect to https://server/download/XXXXXXXX/Info. But no trace of this connection with the new agent.

It seems that the new agent does not launch the download mechanism.

With new Agent with SSL=1, we have SSL hanshack failed (I let the error mistake ... I know it's "handshake"). With old agent in HTTPS, same error.

We still search. Do you have news from you side ?

Answer 5

Hi,

No update yet but trying to build Unix Agent 2.4.1 from source code using xcode.

(looks build successfully done but have some error at after build process).