Affects Version/s: 3.10.1
Fix Version/s: None
Platform:RHEL or CentOS
Found in version (details):CFEngine Core 3.10.1
We install tripwire via cfengine. That includes generating the local keys, but only when they don't exist (which means usually only during the first run).
After having distributed tripwire to all server (about 8000) it was running for about a month without problems. But when I changed the wrapper script (masterconfig.sh), cfengine was invoking it with the key generation option, even if the key was already present.
The task file:
So the expression MasterConfig.HasWrapper.HasTripwireInstalled.!HasLocalKey should not be true anymore on server that have already the tripwire keys generated.
When I changed the script masterconfig.sh it should have been distributed, but not be launched (especially not with the option gen_keys).
But that's what happened on all ~8000 server.
I still have one server running the wrong task part. Here you can see, the keys exist since 2nd of August:
cfengine nevertheless started the wrapper with the option gen_keys:
And that happened on the 4th of September:
The task file has not been changed since 2nd of August.
And it was running fine until 4th of September. Then the wrapper script was changed, which should have triggered a copy of the new version (which was done), but it should have not been launched.