500 Cant Connect to on ESX Inventory

[nykroy]

Bug reporting acknowledgment

Yes, I read it

Professional support

None

Describe the bug

I need to inventory 2 of my ESX servers (version 7). I configured the ESX with the GLPI Inventory Plugin using the IP address (only the IP) and associated the login and password. Then I created a task for VMware.

When I force the inventory from the GLPI agent on the GLPI server (Rocky Linux 9 with Nginx and the latest GLPI agent version 1.10), I received this error:

[debug2] [http client] Not using compression
[debug2] http://127.0.0.1/plugins/glpiinventory/?action=getConfig&machineid=cmdb-2024-06-20-10-11-57&task[ESX]=2.11
[debug2] http://172.18.5.136/plugins/glpiinventory/b/esx/?action=getJobs&machineid=cmdb-2024-06-20-10-11-57
[info] Having to contact 2 remote ESX servers
[debug2] http://172.18.5.136/plugins/glpiinventory/b/esx/?action=setLog&msg=500%20Can%27t%20connect%20to%20172.26.112.151%3A443&machineid=cmdb-2024-06-20-10-11-57&code=ko&part=login&uuid=66accecd93a6f
[debug2] http://172.18.5.136/plugins/glpiinventory/b/esx/?action=setLog&code=ko&uuid=66accecd95517&part=login&machineid=cmdb-2024-06-20-10-11-57&msg=500%20Can%27t%20connect%20to%20172.26.112.152%3A443

I tried a telnet to port 443 on 172.26.112.152 and the communication is OK. I don't see any traffic on the physical firewalls (the Rocky Linux firewall is disabled). It seems like the GLPI agent doesn't send the task, but on the console I have this:

Could you help me? Can it be a bug?

To reproduce

1. Force vmware task on glpi website
2. Force inventory on glpi server with sudo glpi-agent --logger=stderr --debug --debug --force

Expected behavior

connect and import data form esx

Operating system

Linux

GLPI Agent version

v1.10

GLPI version

10.0.15

GLPIInventory plugin or other plugin version

GLPI Inventory v1.3.5

Additional context

No response

[g-bougard]

Hi @nykroy

as you can see here:

[debug2] http://127.0.0.1/plugins/glpiinventory/?action=getConfig&machineid=cmdb-2024-06-20-10-11-57&task[ESX]=2.11
[debug2] http://172.18.5.136/plugins/glpiinventory/b/esx/?action=getJobs&machineid=cmdb-2024-06-20-10-11-57

Agent first starts to request tasks config on local host, then it asks on another ip. I assume the second url is not correct.

This happens because you probably have this url set as "Agent base URL" in the "Asset" tab of the entity configuration.
You should try to leave this field empty as it should be used only in very specific case.

[nykroy]

both, 172.18.5.136 and 127.0.0.1, are glpi instance. I have Agent base URL empty :(

It send request by 172.18.5.136 IP because on glpi config i have configurated that IP

Nginx permit conexions to http://172.18.5.136

I have change the url of glpi with the name (not the ip), but i have the same error.

[b-keller]

Hi,

I have a similar problem

"Agent base URL" in "Asset" is empty in the root entity and in the sub entities too.
The behavior seems different depending on the type of task: for machine inventory, network discovery or network inventory, no problem.

But for esx inventory, it connects to the server via the settings
server = in agent conf file
but then, strangely, it tries to retrieve information via the
URL of the application on the glpi server

for me, it doesn't seem to work because there's an access problem linked to the fact that I'm using a CAS server for user authentication in Glpi

[info] running task ESX
[debug2] [http client] Not using compression
[debug2] http://xxx.yyy.z.40/plugins/glpiinventory/?action=getConfig&task[ESX]=2.11&machineid=s040-2024-07-30-08-47-49
[debug2] https://glpi.mydomain.org/plugins/glpiinventory/b/esx/?action=getJobs&machineid=s040-2024-07-30-08-47-49
DEBUG: .../IO/Socket/SSL.pm:2887: new ctx 94138490340880
DEBUG: .../IO/Socket/SSL.pm:674: socket not yet connected
DEBUG: .../IO/Socket/SSL.pm:676: socket connected
DEBUG: .../IO/Socket/SSL.pm:699: ssl handshake not started
DEBUG: .../IO/Socket/SSL.pm:741: using SNI with hostname glpi.mydomain.org
DEBUG: .../IO/Socket/SSL.pm:776: request OCSP stapling
DEBUG: .../IO/Socket/SSL.pm:792: set socket to non-blocking to enforce timeout=180
DEBUG: .../IO/Socket/SSL.pm:805: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:808: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:818: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:828: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:848: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:805: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:808: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:818: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:828: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:848: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:805: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:2741: ok=1 [2] /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G2/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G2
DEBUG: .../IO/Socket/SSL.pm:2741: ok=1 [1] /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G2/C=IE/O=DigiCert Ireland Limited/CN=DigiCert G2 TLS EU RSA4096 SHA384 2022 CA1
DEBUG: .../IO/Socket/SSL.pm:2741: ok=1 [0] /C=IE/O=DigiCert Ireland Limited/CN=DigiCert G2 TLS EU RSA4096 SHA384 2022 CA1/C=FR/ST=MYSTATE\xC3\xA9/L=Nevers/O=MYORG/CN=*.mydomain.org
DEBUG: .../IO/Socket/SSL.pm:1740: scheme=www cert=94138507782640
DEBUG: .../IO/Socket/SSL.pm:1750: identity=glpi.mydomain.org cn=*.mydomain.org alt=2 *.mydomain.org 2 mydomain.org
DEBUG: .../IO/Socket/SSL.pm:2791: got stapled OCSP response
run basic verify at /usr/share/perl5/vendor_perl/IO/Socket/SSL.pm line 2798.
found issuer in chain at /usr/share/perl5/vendor_perl/IO/Socket/SSL.pm line 2805.
got issuer at /usr/share/perl5/vendor_perl/IO/Socket/SSL.pm line 2805.
DEBUG: .../IO/Socket/SSL.pm:808: done Net::SSLeay::connect -> 1
DEBUG: .../IO/Socket/SSL.pm:863: ssl handshake done
DEBUG: .../IO/Socket/SSL.pm:876: got OCSP success with stapling
DEBUG: .../IO/Socket/SSL.pm:2887: new ctx 94138507956240
DEBUG: .../IO/Socket/SSL.pm:674: socket not yet connected
DEBUG: .../IO/Socket/SSL.pm:676: socket connected
DEBUG: .../IO/Socket/SSL.pm:699: ssl handshake not started
DEBUG: .../IO/Socket/SSL.pm:741: using SNI with hostname auth.mydomain.org
DEBUG: .../IO/Socket/SSL.pm:776: request OCSP stapling
DEBUG: .../IO/Socket/SSL.pm:792: set socket to non-blocking to enforce timeout=180
DEBUG: .../IO/Socket/SSL.pm:805: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:808: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:818: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:828: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:848: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:805: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:808: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:818: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:828: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:848: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:805: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:2741: ok=1 [2] /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G2/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G2
DEBUG: .../IO/Socket/SSL.pm:2741: ok=1 [1] /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G2/C=IE/O=DigiCert Ireland Limited/CN=DigiCert G2 TLS EU RSA4096 SHA384 2022 CA1
DEBUG: .../IO/Socket/SSL.pm:2741: ok=1 [0] /C=IE/O=DigiCert Ireland Limited/CN=DigiCert G2 TLS EU RSA4096 SHA384 2022 CA1/C=FR/ST=MYSTATE\xC3\xA9/L=Nevers/O=MYORG/CN=*.mydomain.org
DEBUG: .../IO/Socket/SSL.pm:1740: scheme=www cert=94138507812528
DEBUG: .../IO/Socket/SSL.pm:1750: identity=auth.mydomain.org cn=*.mydomain.org alt=2 *.mydomain.org 2 mydomain.org
DEBUG: .../IO/Socket/SSL.pm:2791: got stapled OCSP response
run basic verify at /usr/share/perl5/vendor_perl/IO/Socket/SSL.pm line 2798.
found issuer in chain at /usr/share/perl5/vendor_perl/IO/Socket/SSL.pm line 2805.
got issuer at /usr/share/perl5/vendor_perl/IO/Socket/SSL.pm line 2805.
DEBUG: .../IO/Socket/SSL.pm:808: done Net::SSLeay::connect -> 1
DEBUG: .../IO/Socket/SSL.pm:863: ssl handshake done
DEBUG: .../IO/Socket/SSL.pm:876: got OCSP success with stapling
DEBUG: .../IO/Socket/SSL.pm:2936: free ctx 94138490340880 open=94138490340880 94138507956240
DEBUG: .../IO/Socket/SSL.pm:2940: free ctx 94138490340880 callback
DEBUG: .../IO/Socket/SSL.pm:2947: OK free ctx 94138490340880
[error] [http client] Can't decode JSON content, starting with: <!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
 <title trspan="authPortal">Authentication portal</title>
...
DEBUG: .../IO/Socket/SSL.pm:2936: free ctx 94138507956240 open=94138507956240
DEBUG: .../IO/Socket/SSL.pm:2940: free ctx 94138507956240 callback
DEBUG: .../IO/Socket/SSL.pm:2947: OK free ctx 94138507956240
[info] running task NetInventory

[b-keller]

if I put the http://aaa.bbb.ccc.ddd in URL of the application of the entity in glpi server
And

server = http://aaa.bbb.ccc.ddd/plugins/glpiinventory/

in agent conf file

It works

[nykroy]

with that configuration i have the same result:

[debug2] http://127.0.0.1/plugins/glpiinventory/b/esx/?action=setLog&code=ko&msg=500%20Can%27t%20connect%20to%20172.26.112.151%3A443&part=login&machineid=cmdb-2024-06-20-10-11-57&uuid=66b4c0f036c90

Could it be beacuse i have this error if i do a curl ?

[root@cmdb anchors]# curl -v https://172.26.112.151
*   Trying 172.26.112.151:443...
* Connected to 172.26.112.151 (172.26.112.151) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS header, Unknown (21):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

i can do a ping and a telnet but not a curl

[g-bougard]

Hi @nykroy

about curl test, you need to use --insecure (or shorter -k) option to disable ssl security checks.

ESX task always disable server certificate checks in glpi-agent. So this is not the reason.

Can't connect to 172.26.112.151:443

This probably means authentication is wrong and so the provided credentials may be wrong.

[nykroy]

Could the problem be that the ESX version is 7?

[g-bougard]

I don't think ESX version is a problem.

The only thing I see is you can try to use a wrong user. As pointed in #259, cluster users are not supported, only local are.

[nykroy]

Yes I am using a local user.
think I have a problem with the CA on the GLPI server running on Rocky Linux.

[nykroy]

Do you know if I need to activate a service on ESX to run this task, or if I need another configuration on ESX to allow login?

I can log in through the UI, but the GLPI agent shows me a 500 error.