Error -1001

[notverypc]

I've encountered a strange error with my munki setup and I'm not sure what is causing it.

Some of my clients are getting the following error:

Could not retrieve manifest from the server: Error -1001: The request timed out.
Could not retrieve managed install primary manifest.

When this happens the clients can still get to the repo via Safari and ping the server.

I've configured munki with basic authentication and sometimes resending the "AdditionalHttpHeaders" defaults command resolves the error. Other times the error just disappears.

My clients are running 10.9.5 and Munki version 2.2.0.2399.

Any pointers would very helpful.

[Gregory Neagle]

"The request timed out." sounds like your server is under load and not responding to requests before the HTTP(s) code gives up.

-Greg

> --
> You received this message because you are subscribed to the Google Groups "munki-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to munki-dev+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[notverypc]

That was my first thought but the server isn't doing anything other than Munki, I'll give the server a kick in the morning.

Thanks.

[notverypc]

I've done some digging and found this error in the Web Server error logs

mod_auth_apple: User munki: authentication failure for "/munki_repo/manifests/globalapps": Password mismatch according to checkpw

This is repeated for several clients. Often after multiple attempts to update the client the request goes through and the clients will install updates.

The munki server doesn't seem to under any load.

As a test I rolled the version of Munki installed back to 2.0.1.2253 and the client connected first-time and every time after.

[Gregory Neagle]

On Mar 5, 2015, at 5:48 AM, notverypc <notv...@gmail.com> wrote:

I've done some digging and found this error in the Web Server error logs

mod_auth_apple: User munki: authentication failure for "/munki_repo/manifests/globalapps": Password mismatch according to checkpw

Sounds like you have a configuration problem to address.

So why is this? You have password authentication configured on a single manifest? And your clients don't have the right password available to them?

I'd think if this was a general problem with the BasicAuth, all your manifests would cause this error; not just this one.

This is repeated for several clients. Often after multiple attempts to update the client the request goes through and the clients will install updates.

The munki server doesn't seem to under any load.

As a test I rolled the version of Munki installed back to 2.0.1.2253 and the client connected first-time and every time after.

2.0.1.x uses curl. For other reasons, I recommend moving away from these older versions of Munki.

2.1.x and later use Apple's NSURLConnection and friends. 

If this turns out to be a bug with BasicAuthentication/password auth in Munki 2.1 and later we need to get it addressed.

Anyone else using Basic Authentication and Munki 2.1 or later?

[notverypc]

Sorry should have said, I do get the same error for all my manifest.

Each client has the "AdditionalHttpHeaders" added to private/var/root/Library/Preferences/ManagedInstalls.plist

[Josh Malone]

> Anyone else using Basic Authentication and Munki 2.1 or later?

Yes - quite happily. No issues to report.

-Josh

[notverypc]

Thanks for the reply. What is your munki server running on?

[Josh Malone]

Red Hat enterprise Linux 6. Apache. Ssl cert from GoDaddy, with their chaining cert installed on the server.

On Mar 6, 2015 12:59 AM, "notverypc" <notv...@gmail.com> wrote:

Thanks for the reply. What is your munki server running on?

[notverypc]

Thanks for the info.
I'm current,y building a test server just to double check my setting

[Pepijn Bruienne]

We've been seeing the same -1001 error from clients here as well since updating to 2.1.x. We don't use Basic Auth with our repos but we do use the AdditionalHeaders key to send a system-specific ID that is processed by our management system. I'll have to dig a little for more verbose error reporting, but the similarities are there.

Thanks,

Pepijn.

-- 
Pepijn Bruienne
Sent with Airmail

[Matter]

Same here,

After updating to 2.2.0.2399 clients get the -1001 error. We don't use basic authentication or AdditionalHeaders. What got my attention is that the error so far only occurred with clients who have local admin rights.

Op woensdag 25 februari 2015 22:37:40 UTC+1 schreef notverypc: