Re: Cfengine daemons keep dying!!!

[Thomas Glanzmann]

Hello,

* Wheeler, John <jwheeler@eb.com> [041129 16:24]:
> The ref manual says that the default value for this is ten. Do you
> (meaning this list) suppose this could be the cause of the millions of
> emails I get about:

put it to at least the number of your clients. Splay time doesn't work
anyway when you really need it.

However. The challenge response problems your talking about we solve the
following way:

rm /var/cfengine/ppkeys/root-* on the servers. They will copied on the
first request back when trustkey is yes. Also we have limited the access
to the cfengine ports only from the local machines via a firewall.

You have of course also delete the keys on the client side for some rare
cases. (In case the server key has changed) or you had one of that buggy
cfengine versions running (see archives for details).

Honestly,
        Thomas