Symantec Access Management

  • 1.  "RHEL 7.x SiteMinder Agent Unable to determine SiteMinder agent configuration file path."

    Posted Dec 20, 2017 08:18 AM

    Hi all,

    we're encountering an issue starting WebAgent R12.51CR08 64bit on Apache 2.4.6/RHEL 7.

     

    The WA doesn't start and we're stuck wit the error below in the Apache error_log:

    [20/Dec/2017:13:27:33] [Error] SiteMinder Agent Unable to determine SiteMinder agent configuration file path. /etc/httpd/conf/WebAgent.conf

    [20/Dec/2017:13:27:33] [Warning] SiteMinder Agent SiteMinder agent has encountered initialization errors and will not service requests.

     

    Trace and WA logs are not available because the agent fails to produce them.

     

    We already tried the solution provided in the KB link on below without success:

    https://support.ca.com/us/knowledge-base-articles.tec1340867.html

     

    We defined CA variables as below, in the head of systemctl httpd script:

    ### Siteminder Variables

    NETE_WA_ROOT=/opt/siteminder/webagent
    NETE_WA_PATH=/opt/siteminder/webagent/bin
    CAPKIHOME=/opt/siteminder/webagent/CAPKI
    LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/siteminder/webagent/bin
    PATH=$PATH:/opt/siteminder/webagent/bin

     

    The Apache WS starts as apache user, the webagent it was correctly installed without issues and it's owned by apache user as well. You can see below permissions of the WebAgent.conf file:

    -rw-rw-r-- 1 apache apache 997 14 dic 17.11 WebAgent.conf

     

    These are environment details: 

    _____________________________________________________________________________________________

    Policy Server: FullVersion=12.51.8.1542 OS: RHEL 6 - 2.6.32-642.1.1.el6.x86_64 (Adminui,PServer & PStore are installed on the same server)

    WebAgent: OS: RHEL 7 - 3.10.0-693.5.2.el7.x86_64 FullVersion=12.51.8.1542 (64bit)

    WebServer: Server version: Apache/2.4.6 (Red Hat Enterprise Linux)

                         Server built: Oct 3 2017 09:37:04

                         Server's Module Magic Number: 20120211:24

                         Server loaded: APR 1.4.8, APR-UTIL 1.5.2

                         Compiled using: APR 1.4.8, APR-UTIL 1.5.2

                         Architecture: 64-bit Server

                         MPM: worker _________________________________________________________________________________________________________

     

     



  • 2.  Re: "RHEL 7.x SiteMinder Agent Unable to determine SiteMinder agent configuration file path."

    Posted Dec 20, 2017 08:25 AM


  • 3.  Re: "RHEL 7.x SiteMinder Agent Unable to determine SiteMinder agent configuration file path."

    Posted Dec 20, 2017 08:50 AM

    Thanks,

    but isn't useful because SW env versions are different.

    Instructions are not applicable.

     

    Bye

    Stefano



  • 4.  Re: "RHEL 7.x SiteMinder Agent Unable to determine SiteMinder agent configuration file path."

    Posted Dec 21, 2017 01:19 AM

    Probably a dumb check suggestion, however

     

    Could we check

    • if the combination is supported as per support matrix. Support site was under scheduled maintenance hence I couldn't check.
    • if the path [/etc/httpd/conf/WebAgent.conf ] exists and could be traversed by the User running apache ?  
    • if the path to SmHost.conf file is specified correctly within WebAgent.conf. Also ACO name is defined accurately as per what is created in WAMUI.
    • if SmHost.conf has the correct HostConfigurationObject value, as per what is created in WAMUI. The IP Addresses / ports within SmHost.conf and HCO are all valid.

     

    Have we tried sourcing the ENV file (ca_wa_env.sh) in the shell session then stopping / starting the webserver ?

     

    Regards

    Hubert



  • 5.  Re: "RHEL 7.x SiteMinder Agent Unable to determine SiteMinder agent configuration file path."

    Posted Dec 21, 2017 08:17 AM

    Hi Hubert,

    thanks, all those checks are already done.

     

    We're investigating about an hardening procedure performed by the client on this RHEL 7 system.
    There's something which breaks the right WA startup.

     

    Thanks & regards

    Stefano



  • 6.  Re: "RHEL 7.x SiteMinder Agent Unable to determine SiteMinder agent configuration file path."
    Best Answer

    Posted Dec 27, 2017 06:26 AM

    Hi all
    i got a fresh-installed VM RHEL 7 updated with latest kernel and packages, without using the Hardened VM template which was using our customer for his servers.
    Obviously i installed the same Apache and WA version as well.
    There's no issue both with installation and configuration of the WebAgent. I compared OS and WS configurations with the hardened VM, and i found out that the issue was due to the execute permission missing over /etc/httpd dir.

    Thanks all

    Regards
    Stefano



  • 7.  Re: "RHEL 7.x SiteMinder Agent Unable to determine SiteMinder agent configuration file path."

    Broadcom Employee
    Posted Dec 28, 2017 04:20 PM

    Thanks for the update.  Just FYI: Often use of strace helps to determine such issue.

    Take care.  - Vijay