Salt-Minion can't talk to Salt-Master

NerdyDad

@black3dynamite said in Salt-Minion can't talk to Salt-Master:

Will you show the command for adding the firewall rules for 4505-5606?
The reason I'm asking is because if you include --zone=FedoraServer but your active firewall zone is public then that could be the issue.

I've tried a number of commands

firewall-cmd --permanent --zone=trusted --add-port=4505-4506/tcp
firewall-cmd --permanent --zone=default --add-port=4505-4506/tcp
firewall-cmd --permanent --add-port=4505-4506/tcp

In that order, but not all at the same time. I reloaded the firewall and retested between each line.

DustinB3403

@NerdyDad if you run firewall-cmd --get-active-zones what is the output?

NerdyDad

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

@NerdyDad if you run firewall-cmd --get-active-zones what is the output?

FedoraServer
interfaces: enp3s0

NerdyDad

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

@NerdyDad if you run firewall-cmd --get-active-zones what is the output?

So I gather that FedoraServer is the zone that I need to add the ports to in the firewall?

DustinB3403

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

@NerdyDad if you run firewall-cmd --get-active-zones what is the output?

FedoraServer
interfaces: enp3s0

Did you create a custom zone called FedoraServer?

NerdyDad

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

@NerdyDad if you run firewall-cmd --get-active-zones what is the output?

FedoraServer
interfaces: enp3s0

Did you create a custom zone called FedoraServer?

No, I have not created any zones yet. That came stock.

DustinB3403

If your output of firewall-cmd --get-active-zones is FedoraServer interfaces: enp3s0 then yes, add the rules to that zone.

DustinB3403

firewall-cmd --permanent --zone=FedoraServer --add-port=4505-4506/tcp

Should be what you're looking for.

DustinB3403

Then you need to reload the firewall and test.

NerdyDad

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

firewall-cmd --permanent --zone=FedoraServer --add-port=4505-4506/tcp

Should be what you're looking for.

Did that and says it is already enabled.

NerdyDad

Is the salt master service looking at the correct zone? Is that the right way to think of it?

DustinB3403

And you've reloaded the firewall with firewall-cmd --reload?

DustinB3403

Well going into the salt master config file you'd have to look and see if it's set correctly.

https://docs.saltstack.com/en/latest/ref/configuration/master.html

DustinB3403

Just for laughs check the status of setenforce.

NerdyDad

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

And you've reloaded the firewall with firewall-cmd --reload?

Still not working

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

Just for laughs check the status of setenforce.

Enforcing

DustinB3403

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

And you've reloaded the firewall with firewall-cmd --reload?

Still not working

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

Just for laughs check the status of setenforce.

Enforcing

Try setting setenforce to permissive or disabled for now and test.

NerdyDad

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

And you've reloaded the firewall with firewall-cmd --reload?

Still not working

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

Just for laughs check the status of setenforce.

Enforcing

Try setting setenforce to permissive or disabled for now and test.

Finally, got the minion to talk to the master. Thanks

dafyre

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

And you've reloaded the firewall with firewall-cmd --reload?

Still not working

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

Just for laughs check the status of setenforce.

Enforcing

Try setting setenforce to permissive or disabled for now and test.

Finally, got the minion to talk to the master. Thanks

Was it SELinux?

DustinB3403

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

And you've reloaded the firewall with firewall-cmd --reload?

Still not working

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

Just for laughs check the status of setenforce.

Enforcing

Try setting setenforce to permissive or disabled for now and test.

Finally, got the minion to talk to the master. Thanks

Cool so now you need create an exclusion in setenforce.

NerdyDad

@dafyre said in Salt-Minion can't talk to Salt-Master:

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

@NerdyDad said in Salt-Minion can't talk to Salt-Master:

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

And you've reloaded the firewall with firewall-cmd --reload?

Still not working

@DustinB3403 said in Salt-Minion can't talk to Salt-Master:

Just for laughs check the status of setenforce.

Enforcing

Try setting setenforce to permissive or disabled for now and test.

Finally, got the minion to talk to the master. Thanks

Was it SELinux?

I think that was part of it. The other part as not to specify a port to the server in the minions config file.