Never mind... those DSC resources are still just as slow. PE Agent times are inconsistent and we can see those inconsistencies before the change was made too.

So it seems that SCE_Windows 2.0 and Puppet Agent 8.12.0 don't get along

It looks like SCE is continuing to corrupt our redhat.repo files. Seen it more frequently lately. Not sure why its happening on some servers and not others but it seems like it makes changes to some repos to enable gpgcheck and then after that can't read the file anymore

I'm guessing Subscription manager and Puppet end up trying to edit the file at the same time and just destroy it. Anyone have any solutions to this or do I just need to stop forcing the gpgpcheck?

I'm seeing an issue with the

sce_mass_mount_opts

type fail when trying to update any entry in /etc/fstab (RHEL9, stig). The error I'm getting for all of these controls is basically:

Error: Could not set 'present' on ensure: comparison of NilClass with 14 failed (file: /etc/puppetlabs/puppetserver/code/environments/production/modules/sce_linux/manifests/utils/partitions/non_root_local_options.pp, line: 40)

fstab entries look like the below for all mounts:

UUID=0979b5f9-8ca7-49c4-98de-2058d6cd76c1  /tmp  xfs  defaults  0  0
/dev/mapper/rootvg-auditlv /var/log/audit xfs defaults 0 0

@CVQuesty has left the channel

In SCM is there a way to manually trigger a refresh of the inventory from PE? The docs just mentions changing the polling interval (default 24 hrs)

is there a Jira issue already for the

warning: already initialized constant PAM_POSITION_ALIASES

that comes from

lib/puppet/provider/sce_pam/augeas.rb

when you also use puppet-augeasproviders_pam (that file

augeas.rb

is a copy of https://github.com/voxpupuli/puppet-augeasproviders_pam/blob/master/lib/puppet/provider/pam/augeas.rb)?

@Peter danis has left the channel

hi, is there anyone familiar with puppet SCM ? Iam a newbie and just started to explore puppet for its Security Compliance Mangement. Ijust installed an agent to my windows server 2022 and when i run puppet agent -t, I get this error Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Resource Statement, Class[Puppet_enterprise:RepoConfig] parameter 'platform_tag' expects a String value, got Undef (file: /opt/puppetlabs/puppet/modules/puppet_enterprise/manifests/repo.pp, line: 50, column: 5) on node win-9rh4dov61s7 Warning: Not using cache on failed catalog Error: Could not retrieve catalog; skipping run it does not happen when i install agent on ubuntu server

Had support put one in.

Open a ticket with support, it may be the CIS Assessor has a bug in it

Is there a reason why audit rules files wouldn't update for example if privileged commands changed?

I already put a ticket in, but I think an old bug has been reintroduced to SCE_Linux. Seems to only affect RHEL7 and 8 but not 9 and 10 This error pops up every agent run Error while resolving custom fact fact='sce_mount_info', resolution='<anonymous>': unexpected token at ''

This doesn't seem to work as expected sce_linux:utilsaccount hardeningenforce_nologin: false Needing to override that control because its breaking gitlab

d'oh

colon

I am now looking for a long term partner who can work with me

Thank you for the 2.6.1 update. Is the update to the release notes page coming soon?

It should be up https://help.puppet.com/sce/current/linux/scel_relnotes_261.htm

What's the purpose of the

CLAUDE.md

file in this release?

Internal development experimentation

I also just forgot to add it to the ignore list for packaging the module

Hi team We're seeing a checksum mismatch issue after upgrading both the SCM application and the puppetlabs/comply module to version 3.7.0. Error from Puppet agent logs: (I removed actual checksum from below log)

Resource:  Assessor-CLI-4.60.0.zip
  Class:     Comply::Scanners::Ciscat
  Message:   Download file checksum mismatch
               expected: --------
               actual:   --------

Same error observed for Linux nodes Both the SCM application and the comply module are on 3.7.0. The checksums in the module do not match the files served by the application of the same version. This looks like the module Please check

Is there an ETA on RHEL 10 support in SCE_Linux?

Hi team — we're running CIS-CAT scans on Windows Domain Controllers (assessor 4.60.0, profile Windows 2022 DC L1). The scan consistently times out at the 2,400s PE orchestrator limit. Question: What's the supported way to increase Java heap for the 4.60.0 assessor running on Windows nodes? cc: @Jacob Wade

sce_linux needs to be updated to handle the newer version of the aide software, at least on RHEL based systems such as Rocky 9. aide 0.19.2 drops several config file directives.

I created an issue under https://github.com/puppetlabs/sce_issues but that repo seems to be low activity

Hello, can someone please expound a bit on SCE 2.7.0 deprecating support for RHEL7? It looks like I can still get a catalog applied on my RHEL7 systems,

sce_mount_info

is even more noisy, but otherwise it looks like I can still use SCE on them while we're still transitioning away from that release.