Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On the client:

# cf-agent -KIv
cf3  -> Handling file existence constraints on /etc/cfengine3
cf3  -> Copy file /etc/cfengine3 from /srv/cfengine/sysconf/server/inputs check
cf3 No existing connection to is established...
cf3 Set cfengine port number to 5308 = 5308
cf3  -> Connect to = on port 5308
cf3 LastSaw host now
cf3 Loaded /var/lib/cfengine3/ppkeys/root-
cf3 .....................[.h.a.i.l.].................................
cf3 Strong authentication of server= connection confirmed
cf3 Server returned error:  Unspecified server refusal (see verbose server output)
cf3 Can't stat /srv/cfengine/sysconf/server/inputs in files.copyfrom promise
cf3  ?> defining promise result class Cfengine_Inputs_Updated_Failed
cf3     .........................................................
cf3     Promise handle: 
cf3     Promise made by: [cf-agent.cf      ] FAILED -> localhost:///etc/cfengine3

However, on the server (, there's no reason why it can't stat the directory:

cyrus:/srv/cfengine/sysconf/server# ls -l /srv/cfengine/sysconf/server/inputs
total 52
-rw-r--r-- 1 root root 2142 Sep  6 21:54 cf-agent.cf
-rw-r--r-- 1 root root  831 Sep  6 18:31 cf-execd.cf
-rw-r--r-- 1 root root 4517 Sep  6 21:44 cf-serverd.cf
-rw-r--r-- 1 root root 3082 Sep  6 21:44 dns.cf
-rw-r--r-- 1 root root 2028 Sep  6 15:12 failsafe.cf
-rw-r--r-- 1 root root 5966 Sep  6 21:44 ldap-masters.cf
-rw-r--r-- 1 root root 4380 Sep  6 18:31 ldap-security.cf
-rw-r--r-- 1 root root 2735 Sep  6 08:21 lib-core.cf
-rw-r--r-- 1 root root 1506 Sep  6 21:45 lib-utils.cf
-rw-r--r-- 1 root root 2635 Sep  6 20:27 lib-vars.cf
-rw-r--r-- 1 root root 2057 Sep  3 17:46 nss.cf
-rw-r--r-- 1 root root 1472 Sep  6 18:31 packages.cf
-rw-r--r-- 1 root root 1257 Sep  6 18:01 pam-security.cf
-rw-r--r-- 1 root root 4019 Sep  6 19:32 promises.cf
-rw-r--r-- 1 root root 2808 Sep  3 17:22 site.cf
-rw-r--r-- 1 root root 1670 Sep  6 18:31 sudo-security.cf
-rw-r--r-- 1 root root  831 Sep  6 18:31 sys-security.cf
-rw-r--r-- 1 root root  890 Sep  6 18:31 sys-users.cf

I don't see anything interesting server side either when running:

/usr/sbin/cf-serverd -d4 --verbose --no-fork

And the following does not have any complaints:

/usr/sbin/cf-promises -v

Any ideas?

I'm running cfengine3 on debian, v3.0.5+dfsg-1 - and the cf-agent.cf file is as follows:

bundle agent Update {
            action => immediate,
            move_obstructions => "true",
            depth_search => Recursive,
            copy_from => MirrorFrom(
            classes => DefineSoftClass("Cfengine_Inputs_Updated")

            comment => "Setting cf3 client sbin scripts: ${cf3.path[sbin]}/",
            action => immediate,
            depth_search => Recursive,
            copy_from => MirrorFrom(

        "[cf-agent.cf      ] Services:CFAgent:Inputs:Updated";
        "[cf-agent.cf      ] FAILED ${cf3.host[server]}://${cf3.path[scm-inputs]} -> localhost://${cf3.path[inputs]}";

I lie, there is something interesting with a little more debugging...

AccessControl, match(/srv/cfengine/sysconf/server/inputs,client.com.au) encrypt request=1
Examining rule in access list (/srv/cfengine/sysconf/server/inputs,/home/cfengine)?
cf3 Host client.com.au denied access to /srv/cfengine/sysconf/server/inputs
Unappending Host client.com.au denied access to /srv/cfengine/sysconf/server/inputs
cf3 Access control in sync
Unappending Access control in sync
Transaction Send[t 59][Packed text]
Attempting to send 67 bytes
SendSocketStream, sent 67
cf3 From (host=client.com.au,user=root,ip=
Unappending From (host=client.com.au,user=root,ip=
cf3 REFUSAL of request from connecting host: (SYNCH 1283777156 STAT /srv/cfengine/sysconf/server/inputs)
Unappending REFUSAL of request from connecting host: (SYNCH 1283777156 STAT /srv/cfengine/sysconf/server/inputs)
cf3  -> Accepting a connection

I'll keep looking.

share|improve this question

2 Answers 2

I'm an old fart who only has experience with cfengine v2. Anyway, the error messages similar to yours were always because of:

  • a DNS mismatch

  • a relocated server with new hardware etc

  • due SNAT/DNAT at some load-balancer

  • actually not configured keys

Is this problem present everywhere in your system or just with one client?

share|improve this answer

Okay, yes it was ACL related, fixed now - thanks for trying though Janne :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.