topic Re: Deployment server to deploy specific serverclass to a client excluding whitelist * in Security

Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Mon, 21 Oct 2013 20:57:31 GMT

How do we make a deployment client with specific client name and serverclass designated not honor "*" whitelist designated for another serverclass

ie this client needs to download only the serverclass designated with its client name in whitelist and ignore all other serverclass with whitelist *

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

emiller42 — Mon, 21 Oct 2013 21:05:57 GMT

Include the following line in your stanza:

continueMatching = false

And then make sure all other stanzas with whitelist=* come after that stanza in your conf file.

Details can be found in the documentation

EDIT FOR CLARITY:

Your stanzas should look like the following:

[serverClass:specificHost]
continueMatching = false
whitelist.0 = specificHost

[serverClass:specificHost:app:foo]

[serverClass:broad]
whitelist.0 = *

[serverClass:broad:app:bar]

Note that the app stanzas are separate stanzas from the serverClass stanzas. So you can't put the whitelist under them.

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Mon, 21 Oct 2013 21:55:41 GMT

Ok..i have 2 separate serverclass and found when i mention specific clientname whitelist on top of serverclass and continue matching =false in that serverclass:app stanza...it just ignored the rest of serverclass below it ..and all apps deployed with * were undeployed suddenly... and cant see the specific client name app also deployed..i do see the specific bundles in ~splunk/var/tmp...however i had moved one specific app from a serverclass with * whitelist to a new server class that was on the top with specific clientname and continuematching=false

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

emiller42 — Mon, 21 Oct 2013 22:14:14 GMT

So if you have something like:

[serverClass:clientSpecific]
whitelist.0=matchingclient
continueMatching=false
[serverClass:clientSpecific:app:bar]

[serverClass:general]
whitelist.0=*
[serverClass:general:app:bar]

then the general class no longer matches and the apps are uninstalled?

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Mon, 21 Oct 2013 23:00:39 GMT

typo in whitelist * ..i just posted the most superfluous version above ...the whitelist was at serverclass before this and since default stance for continuematching was true had only the config as you said before

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

emiller42 — Mon, 21 Oct 2013 23:05:27 GMT

The problem is where your whitelist= lines live. Those are only valid in global or serverClass stanzas, not in app stanzas. (Which is where you have them) Your stanzas should look like the following:

[global]
stateOnClient = enabled
filterType = whitelist
continueMatching = true

[serverClass:serverclass1]
continueMatching = false
whitelist.0=matchingclient

[serverClass:serverclass1:app:app1]

[serverClass:serverclass2]
continueMatching = true
whitelist.0=*

[serverClass:serverclass2:app:app2]

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Tue, 22 Oct 2013 00:26:39 GMT

agreed ..that was my first config...ie whitelist in serverclass and not app...it did nto work ,,thats when i went superfluous

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Tue, 22 Oct 2013 00:29:09 GMT

I have deleted the erroneous post /config as that was my last config and i had the config as you have stated before

Also checked
ndex=_internal source=*splunkd.log (component=application OR component=serverclass) warn OR error on the deployment server serach app and did not find any eror

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Tue, 22 Oct 2013 01:25:01 GMT

i dont see a consistent deployment ...does whitelist=clientname exclude whitelist=* ?
As i see serverclass with whitelist=*
also being deployed to serverclass having specific clientnames and continuematch=false

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Tue, 22 Oct 2013 01:25:50 GMT

is not appearing in whitelist=* when i edit online

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Tue, 22 Oct 2013 01:36:52 GMT

I had to add a explicit blacklist for the specific clientname in the serverclass having whitelist.0=*..for this to work the nearest i want..

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Tue, 22 Oct 2013 01:37:04 GMT

I had to add a explicit blacklist for the specific clientname in the serverclass having whitelist.0=*..for this to work the nearest i want..

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

ShaneNewman — Tue, 22 Oct 2013 01:55:53 GMT

That is what I was going to suggest.

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

emiller42 — Tue, 22 Oct 2013 14:15:43 GMT

can you post your final serverclass.conf? I tested the format I gave you locally, and it worked as expected.

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Wed, 23 Oct 2013 18:43:56 GMT

[global]
stateOnClient = enabled
filterType = whitelist
continueMatching = true

[serverClass:class1]
continueMatching = false
whitelist.0=clientname

[serverClass:class1:app:app1]

[serverClass:class 2]
continueMatching = true
blacklist.0=clientname
whitelist.0=*

[serverClass:class2:app:app2]
[serverClass:class2:app:app3]

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

Mag2sub — Wed, 23 Oct 2013 18:45:57 GMT

I did not work without the blacklist statement ..are you saying the apps for whitelist=* were not deployed to specific client name ? which had continuematching =False..i found all apps were deployed to clientname including both server class...i wanted only class1 apps on clientname and not class2 apps..

Re: Deployment server to deploy specific serverclass to a client excluding whitelist *

BenoSplunk — Fri, 17 Feb 2017 21:36:33 GMT

I downvoted this post because what good is "continuematching = false" in class1 if you have to define blacklist in class2 ???

the whole point of using "continuematching = false" is so that i don't have to go into every single subsequent serverclass and add blacklist.