<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">From the CRON file you shared, it looks like you’re executing this in the crontab in /etc? I find it more reliable to execute system management tasks there (logrotate; updatedb; and so forth), but for rancid’s environment to be setup correctly
when using rancid’s personal CRON file.<o:p></o:p></p>
<p class="MsoNormal">“sudo su - rancid ; crontab -e” <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Just remember that in a user’s crontab you don’t need to specify the user.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="98%" style="width:98.0%">
<tbody>
<tr>
<td width="13%" valign="top" style="width:13.0%;border:none;border-top:solid #CCCCCC 1.0pt;padding:11.25pt 0in 0in 0in">
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="color:#002060"><img width="66" height="30" style="width:.6875in;height:.3125in" id="Picture_x0020_1" src="cid:image001.jpg@01D9C01C.90A7BEB0" alt="signature_1593189312"></span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="color:#002060"> </span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</td>
<td width="86%" valign="top" style="width:86.0%;border:none;border-top:solid #CCCCCC 1.0pt;padding:11.25pt 0in 0in 7.5pt">
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<b><span style="color:#002060">Weylin Piegorsch </span></b><span style="color:#002060">| </span><span style="font-size:10.0pt;color:#002060"> Manager, Network Engineering</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:10.0pt;color:#002060">Boston University Information Services & Technology<br>
<a href="mailto:weylin@bu.edu"><span style="color:#0563C1">w</span><span style="font-size:11.0pt;color:#0563C1">eylin</span><span style="color:#0563C1">@bu.edu</span></a> | 617.353.8128 | <a href="http://www.bu.edu/tech" title="http://www.bu.edu/tech"><span style="color:#954F72">bu.edu/tech</span></a></span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<b><span style="font-size:10.0pt;color:#002060">Listen. Learn. Lead.</span></b><span style="font-size:12.0pt"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Lucian-Ionut Lepadatu <lepadatu.lucian@gmail.com>
<br>
<b>Sent:</b> Wednesday, July 26, 2023 9:47 AM<br>
<b>To:</b> rancid-discuss@www.shrubbery.net<br>
<b>Subject:</b> [rancid] rancid-run doesn't work from cron for panorama but works manually<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hello,<br>
<br>
I am trying to make rancid pull the configs from a pair of Palo Alto Panorama devices.<o:p></o:p></p>
<div>
<p class="MsoNormal">I've installed it on an Alma Linux 9 box with the default package from epel (rancid.x86_64 3.13-7.el9).<br>
I have in router.db a list of Palo Alto firewalls and a pair of Panorama devices. Login to all devices works.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">If I login with the rancid user and run rancid-run from the shell ([rancid@rancidbox ~]$ /usr/libexec/rancid/rancid-run) it gets the config for all devices.<br>
If I login as root and run rancid run as the rancid user ("[rancid@rancidbox ~]# sudo -u rancid /usr/libexec/rancid/rancid-run") it also works for all devices.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">But if I try to run it from cron as the user rancid, it works for the firewalls but not for panorama.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
The cron entry looks like this:<br>
<br>
<i>SHELL=/bin/bash<br>
PATH=/sbin:/bin:/usr/sbin:/usr/bin<br>
MAILTO=root<br>
HOME=/var/rancid<br>
<br>
0 */8 * * * rancid /usr/libexec/rancid/rancid-run</i><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">In the rancid logs I see:<br>
<i>missed cmd(s): all commands<br>
End of run not found<br>
panlogin error: Error: TIMEOUT reached</i><br>
<br>
I've managed to capture the .raw and .new files for a panorama device when rancid-run was executed from cron and looks like it connects to the device but it gets stuck:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<i>[rancid@rancidbox ~]$ cat network-devices/configs/panorama_hostname.internal.domain.raw<br>
panorama_hostname.internal.domain<br>
spawn ssh -x -l rancid_login_user panorama_hostname.internal.domain<br>
*************************************************************************<br>
* *<br>
* WARNING! Access to this device is restricted *<br>
* to those individuals with specific *<br>
* permissions. If you are not an authorized user *<br>
* disconnect now. *<br>
* *<br>
* Any attempts to gain unauthorized access *<br>
* will be prosecuted to the fullest *<br>
* extent of the law. *<br>
* *<br>
*************************************************************************<br>
(<a href="mailto:rancid_login_user@panorama_hostname.internal.domain">rancid_login_user@panorama_hostname.internal.domain</a>) Password:
<br>
Last login: Wed Jul 26 11:51:59 2023 from IP.XXX.YYY.ZZZ<br>
No entry for terminal type "network";<br>
using dumb terminal settings.<br>
<br>
<br>
<br>
Number of failed attempts since last successful login: 0<br>
<br>
<br>
<br>
<a href="mailto:rancid_login_user@panorama_hostname.internal.domain(primary-active)">rancid_login_user@panorama_hostname.internal.domain(primary-active)</a>>
<br>
<a href="mailto:rancid_login_user@panorama_hostname.internal.domain(primary-active)">rancid_login_user@panorama_hostname.internal.domain(primary-active)</a>> set
<br>
<a href="mailto:rancid_login_user@panorama_hostname.internal.domain(primary-active)">rancid_login_user@panorama_hostname.internal.domain(primary-active)</a>> set cli
<br>
<a href="mailto:rancid_login_user@panorama_hostname.internal.domain(primary-active)">rancid_login_user@panorama_hostname.internal.domain(primary-active)</a>> set cli scripting<br>
-mode <br>
<a href="mailto:rancid_login_user@panorama_hostname.internal.domain(primary-active)">rancid_login_user@panorama_hostname.internal.domain(primary-active)</a>> set cli scripting<br>
-mode on<br>
<a href="mailto:rancid_login_user@panorama_hostname.internal.domain(primary-active)">rancid_login_user@panorama_hostname.internal.domain(primary-active)</a>> [rancid@rancidbox ~]$
<br>
<br>
<br>
<br>
<br>
[rancid@rancidbox ~]$ cat network-devices/configs/panorama_hostname.internal.domain.new<br>
#RANCID-CONTENT-TYPE: paloalto<br>
#</i><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If I try to run run rancid instead of rancid-run from cron for panorama it works (needs a PATH added to be able to find the panlogin script but other than that it succeeds)<br>
<br>
<i>PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/usr/libexec/rancid/:/usr/share/perl5/vendor_perl/rancid</i><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><i>08 10 * * * rancid /usr/libexec/rancid/rancid -t paloalto -d panorama_hostname.internal.domain</i><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I've also got a dump of all environment variables for the rancid user and put it in cron but same as before: rancid-run always fails for panorama but works for the firewalls. (it has the same content in the
.raw file every time)<br>
<br>
I was thinking that since invoking rancid from cron works but rancid-run fails, it might have something to do with how control_rancid or rancid-fe invokes rancid but couldn't see anything obvious in those scripts that might cause this behaviour.<br>
<br>
I am not sure what exactly fails. I appreciate any pointers you might have.<br>
<br>
Thanks,<br>
Lucian Lepadatu<br>
<br>
<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>