Symantec Access Management

Hello,

I am receiving the following error when starting the Webagent. From the first view it seems that apache user is unable to obtain write permissions on SmHost.conf file located on "/opt/siteminder/webagent/config".  Although I have changed the permissions it is still throwing the same error.

Below is the webserver log:-

**********************************************************************************

Wed Jun 21 10:24:08 2017] [notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
[Wed Jun 21 10:24:08 2017] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[21/Jun/2017:10:24:09] [Info] [CA WebAgent LLAWP] [5221] [LLAWP Monitor: LLAWP has been started.]
[21/Jun/2017:10:24:09] [Warning] SiteMinder Agent
Siteminder Web Agent not having write permissions on host configuration file. Shared secret roll-over may not be supported.
Permission denied. Please assign write privileges to the user apache for the file /opt/siteminder/webagent/config/SmHost.conf
[21/Jun/2017:10:24:09] [Error] SiteMinder Agent
Unable to load SiteMinder host configuration object or host configuration file.
/opt/siteminder/webagent/config/SmHost.conf
06 00 00 00
[21/Jun/2017:10:24:09] [Error] SiteMinder Agent
Failed to initialize the configuration manager.
LLAWP unable to get configuration, exiting.
nm: '/etc/httpd/bin/httpd': No such file
[Wed Jun 21 10:24:14 2017] [warn] Siteminder Web Agent: restart not supported.
[Wed Jun 21 10:24:14 2017] [notice] Digest: generating secret for digest authentication ...
[Wed Jun 21 10:24:14 2017] [notice] Digest: done
[Wed Jun 21 10:24:14 2017] [notice] Apache/2.2.15 (Unix) DAV/2 configured -- resuming normal operations

*************************************************************************************

Following are the installation details:-

Webagengt: smwa-12.52-sp01-cr06-linux-x86-64

Apache version: Apache/2.2.15 (Unix)

OS: RHEL 6

Can anyone point me in the right direction?

Thanks in advance.

Best Regards,

Krishna

Hi Krishna,

Wed Jun 21 10:24:08 2017] [notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
[Wed Jun 21 10:24:08 2017] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

Change SELINUX status from "enforcing" to "disabled".

Refer : https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC1883834.html

Regards,

Leo Joseph.

Dear Leo,

Thanks for the quick response. I have disabled the SELINUX . The permission issue related to  SmHost.conf has vanished. Still the webagent is not coming up. Although the process LLAWP starts up, I can't see whether the webagent is running in the logs.

What I am expecting:" SiteMinder agent is running." in the logs. Please find below the webserver error log.

Wed Jun 21 13:19:10 2017] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[21/Jun/2017:13:19:10] [Info] [CA WebAgent LLAWP] [4909] [LLAWP Monitor: LLAWP has been started.]
[21/Jun/2017:13:19:11] [Info] [CA WebAgent IPC] [4910] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6b47862b
[21/Jun/2017:13:19:11] [Info] [CA WebAgent IPC] [4910] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6b47862b
[21/Jun/2017:13:19:11] [Info] [CA WebAgent IPC] [4910] [CSmSem::getSem] Created semaphore 262146 using key 0x6b47862b
[21/Jun/2017:13:19:11] [Info] [CA WebAgent IPC] [4910] [CSmSharedSegment::smalloc] Created shared memory segment 688146 using key 0x6c47862b
[21/Jun/2017:13:19:11] [Info] [CA WebAgent IPC] [4910] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0xf447862b
[21/Jun/2017:13:19:11] [Info] [CA WebAgent IPC] [4910] [CSmSem::getSem] Created semaphore 294915 using key 0xf447862b
[21/Jun/2017:13:19:11] [Info] [CA WebAgent IPC] [4910] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x3247862b
nm: '/etc/httpd/bin/httpd': No such file
[Wed Jun 21 13:19:15 2017] [warn] Siteminder Web Agent: restart not supported.
[Wed Jun 21 13:19:15 2017] [notice] Digest: generating secret for digest authentication ...
[Wed Jun 21 13:19:15 2017] [notice] Digest: done
[Wed Jun 21 13:19:15 2017] [notice] Apache/2.2.15 (Unix) DAV/2 configured -- resuming normal operations

.

I noticed one same message under info "nm: '/etc/httpd/bin/httpd': No such file". As per the suggestion in link  WebAgent Configuration: Incorrect Path  I tried changing the permission. Which didn't work. 

Can you me suggest me on this issue?

Best Regards,

Krishna

Hi Krishna,

Check the below,

1) Stop the web server.

2) Check that LLAWP process and Webserver process has exited completely:

> ps ef | grep llawp
> ps ef | grep httpd

3) Check for the orphaned semaphores and Shared Memory segments:

- list semaphores:
> ipcs -s

- list shared memory segments:
> ipcs -m

- remove semaphores
> ipcrm -s

- remove shared memory segments:
> ipcrm -m

4) Look in the Web Server error log for the semaphore and shared memory keys.

Those are the ones which need to be removed.

5) After all the semaphores/Shared Memory Segments have been cleared, restart the Webserver/Agent.

Regards,

Leo Joseph.

Dear Leo,

As suggested I stopped the web server, verified LLAWP process and Webserver process (both were not running post stopping web server),  

******************************************

root@localhost selinux]# ipcs -s

------ Semaphore Arrays --------
key semid owner perms nsems

******************************************

I am unable to remove these shared memory segments. Moreover, I tried to check any orpahned processes related to these shmid which yielded nothing.

root@localhost ~]# ipcs

------ Shared Memory Segments --------
key shmid owner perms bytes nattch status
0x00000000 950272 root 600 393216 2 dest
0x00000000 983041 root 600 393216 2 dest
0x00000000 1015810 root 600 393216 2 dest
0x00000000 1048579 root 600 393216 2 dest
0x00000000 1081348 root 600 393216 2 dest
0x00000000 1114117 root 600 393216 2 dest
0x00000000 1146886 root 600 393216 2 dest
0x00000000 1179655 root 600 393216 2 dest
0x00000000 1212424 root 600 393216 2 dest
0x00000000 1245193 root 600 393216 2 dest
0x00000000 1277962 root 600 393216 2 dest
0x00000000 1310731 root 600 393216 2 dest
0x00000000 1343500 root 600 393216 2 dest
0x00000000 1376269 root 600 393216 2 dest
0x00000000 1409038 root 600 393216 2 dest
0x00000000 1441807 root 600 393216 2 dest
0x00000000 1474576 root 600 393216 2 dest

------ Semaphore Arrays --------
key semid owner perms nsems

------ Message Queues --------
key msqid owner perms used-bytes messages

********************************************

semaphore and shared memory keys present in error.log has already been cleared(as seen above output of ipcs).

After this I started the webagent. Error_log post restarting the webagent.

****************************************************

Wed Jun 21 15:52:40 2017] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[21/Jun/2017:15:52:40] [Info] [CA WebAgent LLAWP] [3647] [LLAWP Monitor: LLAWP has been started.]
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6b47862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6b47862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 131074 using key 0x6b47862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smalloc] Created shared memory segment 622608 using key 0x6c47862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0xf447862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 163843 using key 0xf447862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x3247862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 196612 using key 0x3247862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smalloc] Created shared memory segment 655377 using key 0x6147862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x3347862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 229381 using key 0x3347862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smalloc] Created shared memory segment 688146 using key 0x6247862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x3447862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 262150 using key 0x3447862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smalloc] Created shared memory segment 720915 using key 0x6347862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6a47862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 294919 using key 0x6a47862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smalloc] Created shared memory segment 753684 using key 0x6947862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6647862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 327688 using key 0x6647862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6747862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 360457 using key 0x6747862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6c47862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 393226 using key 0x6c47862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smalloc] Created shared memory segment 786453 using key 0x6547862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6847862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 425995 using key 0x6847862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Attempted to attach to non-existent semaphore with key 0x6947862b
[21/Jun/2017:15:52:41] [Info] [CA WebAgent IPC] [3648] [CSmSem::getSem] Created semaphore 458764 using key 0x6947862b
nm: '/etc/httpd/bin/httpd': No such file
[Wed Jun 21 15:52:45 2017] [warn] Siteminder Web Agent: restart not supported.
[Wed Jun 21 15:52:45 2017] [notice] Digest: generating secret for digest authentication ...
[Wed Jun 21 15:52:45 2017] [notice] Digest: done
[Wed Jun 21 15:52:45 2017] [notice] Apache/2.2.15 (Unix) DAV/2 configured -- resuming normal operations

************************************************************************************

These created semaphores are automatically removed when stopping the server.

[Wed Jun 21 16:12:06 2017] [notice] caught SIGTERM, shutting down
[21/Jun/2017:16:12:06] [Info] [CA WebAgent IPC] [3852] [CSmSem::getSem] Attached to semaphore 163843 using key 0xf447862b
[21/Jun/2017:16:12:06] [Info] [CA WebAgent LLAWP] [3852] [Shutdown message sent to the LLAWP. It should stop within 5 seconds ...]
[21/Jun/2017:16:12:06] [Info] [CA WebAgent LLAWP] [3648] [Shutdown Message received waiting for all clients to disconnect ...]
[21/Jun/2017:16:12:06] [Info] [CA WebAgent LLAWP] [3648] [Now shutting down.]
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smfree] Removed shared memory segment 786453
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 425995
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 458764
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 327688
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 360457
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 393226
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 294919
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smfree] Removed shared memory segment 753684
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 163843
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smfree] Removed shared memory segment 720915
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 262150
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smfree] Removed shared memory segment 688146
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 229381
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smfree] Removed shared memory segment 655377
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 196612
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSharedSegment::smfree] Removed shared memory segment 622608
[21/Jun/2017:16:12:07] [Info] [CA WebAgent IPC] [3648] [CSmSem::SemRm] Removed semaphore 131074.

Please let me know if you require more information.

Best Regards,

Krishna

Hi Krishna,

It seems like LLAWP is started fine.

What is the output of below command?

ps -ef | grep -i llawp

Also please try to hit the application URL and check what error are you getting ?

Thanks,

Sharan

Dear Sharana/Leo,

Thank you very much for your support. 

LLAWP is up and running.

[root@localhost conf]# ps -ef | grep -i llawp
apache 5057 1 0 05:46 ? 00:02:00 LLAWP /etc/httpd/conf/WebAgent.conf -APACHE22
root 7352 4438 0 09:36 pts/0 00:00:00 grep -i llawp

Also, webagent is running as expected.

[22/Jun/2017:09:21:34] [Information] SiteMinder Agent SiteMinder agent is running.

Best Regards,

Krishna