When configuring a yum proxy via /etc/yum.conf a “yum check-update” fails on the rhel6-some-repo-x.y repository with:
[root@myhost yum.repos.d]# yum check-update Loaded plugins: priorities, refresh-packagekit, rhnplugin, security This system is receiving updates from RHN Classic or RHN Satellite. http://REDACTED:REDACTED@yum.whatever.com/yum/base/repodata/repomd.xml: [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 400 Bad request" Trying other mirror. Error: Cannot retrieve repository metadata (repomd.xml) for repository: rhel6-some-repo-x.y. Please verify its path and try again
The customer used a cloud-based proxy service (ZScaler) but has NOT implemented proxy authentication. The proxy is configured correctly in /etc/yum.conf
A packet capture indicated the following HTTP header when requesting the repository information:
GET http://REDACTED:REDACTED@yum.whatever.com/yum/base/repodata/repomd.xml HTTP/1.1 Authorization: Basic REDACTED User-Agent: urlgrabber/3.9.1 yum/3.2.29 Host: yum.whatever.com Accept: */* Proxy-Connection: Keep-Alive
A GET HTTP request in this format is malformed and therefore return a “400 Bad request”
Further investigation revealed Yum's documentation recommends the following configuration when implementing HTTP authentication for a yum repository:
baseurl=http://yum.whatever.com/yum/base/ username=REDACTED password=REDACTED
Running the “yum check-update” command again reveals a different error:
[root@myhost yum.repos.d]# yum check-update Loaded plugins: priorities, refresh-packagekit, rhnplugin, security This system is receiving updates from RHN Classic or RHN Satellite. http://yum.whatever.com/yum/base/repodata/repomd.xml: [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 401 Authorization Required" Trying other mirror. Error: Cannot retrieve repository metadata (repomd.xml) for repository: rhel6-some-repo-x.y. Please verify its path and try again
A packet capture shows the following HTTP request:
GET http://REDACTED:REDACTED@yum.whatever.com/yum/base/repodata/repomd.xml HTTP/1.1 Authorization: Basic REDACTED User-Agent: urlgrabber/3.9.1 yum/3.2.29 Host: yum.whatever.com Accept: */* Proxy-Connection: Keep-Alive Resolution:
Because there is “Basic” authentication but no credentials supplied, the web server responds with “401 Authorization Required”.
The problem was tracked to an incompatibility with yum-3.2.29-60 and python-urlgrabber-3.9.1-9.
More information:
This problem currently exists in RHEL 6.6 but may be resolved in a future version. It likely exists on any system with the python-urlgrabber-3.9.1-9 package.
1. Modify /etc/yum.repos.d/rhel6-some-repo-x.y.repo to conform to yum's recommended standard of baseurl/username/password for both contained repositories.
2. Apply the patch as documented in the NEXUS URL:
2a. Copy the file urlgrabber.patch to the /root/ directory.
2b. Back up the existing grabber.py file:
cp /usr/lib/python2.6/site-packages/urlgrabber/grabber.py /root/urlgrabber_backup/head_node/grabber.py
2c. Patch the file:
patch /usr/lib/python2.6/site-packages/urlgrabber/grabber.py < /root/urlgrabber.patch
2d. Each command should return an output similar to below:
patching file /usr/lib/python2.6/site-packages/urlgrabber/grabber.py Hunk #2 succeeded at 426 (offset -5 lines). Hunk #3 succeeded at 828 (offset -6 lines). Hunk #4 succeeded at 1253 (offset -9 lines). Hunk #5 succeeded at 1349 (offset -9 lines).
3. Re-run the “yum check-update” command. It should complete successfully.