Puppet users - Jan 2009 - RHEL 5.1 + Puppet 0.24.7, iptables not stopping

- RHEL 5.1
- Puppet 0.24.7
- Puppetmaster and client on the same host

This is all puppet-code for node "mynode" :

node ''mynode'' {
        service { iptables:
                ensure => stopped,
        }
        service { crond:
                ensure => stopped,
        }

}

[root@mynode]# service iptables start
Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: filter                    [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules:                          [  OK  ]

[root@mynode# service crond start
Starting crond:                                            [  OK  ]

[root@mynode]# puppetd  --server mynode --test
info: Caching catalog at /var/lib/puppet/localconfig.yaml
notice: Starting catalog run
notice: //Node[mynode]/Service[crond]/ensure: ensure changed
''running''
to ''stopped''
notice: Finished catalog run in 0.37 seconds

[root@mynode]# service crond status
crond is stopped

[root@mynode]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp
dpt:80

Chain FORWARD (policy DROP)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

[root@mynode]#


As you can see I first start crond and iptables, then execute puppet,
and finally check the result.
Crond stops, but not iptables even if that is what I (think I)
specified in the manifest.

Do you have any suggetions for how I can solve this?

Thanks,

Erling



Erling


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en
-~----------~----~----~----~------~----~------~--~---

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ere wrote:

| As you can see I first start crond and iptables, then execute puppet,
| and finally check the result.
| Crond stops, but not iptables even if that is what I (think I)
| specified in the manifest.

The problem is that by default the service type doesn''t use the init
script to check the service''s status.  Instead it look in the process
table for a process named "iptables", and if it doesn''t find
it, it
will assume the service is stopped.

You need to specify ''hasstatus => true'' for it to work the
right way.


	/Thomas Bellman
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkl4fDUACgkQDGpP8Cv3aqLjNQCdGTRN2V+K2Uciau0QqS8Vhz2B
FjcAn1FMXWOGX6stIgkXMG9UvZdoIqzS
=qpX2
-----END PGP SIGNATURE-----

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en
-~----------~----~----~----~------~----~------~--~---

On 22 Jan, 15:01, Thomas Bellman <bell...@nsc.liu.se>
wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> ere wrote:
>
> | As you can see I first start crond and iptables, then execute puppet,
> | and finally check the result.
> | Crond stops, but not iptables even if that is what I (think I)
> | specified in the manifest.
>
> The problem is that by default the service type doesn''t use the
init
> script to check the service''s status.  Instead it look in the
process
> table for a process named "iptables", and if it doesn''t
find it, it
> will assume the service is stopped.
>
> You need to specify ''hasstatus => true'' for it to work
the right way.
Thanks for your reply. My manifest works now. What confused me was
the
different behavior for two services. I also read in the type
reference, but did not realize
that the hasstatus attribute applied to my problem.

Thanks,

Erling


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en
-~----------~----~----~----~------~----~------~--~---