Standalone Chef Server / Workstation / Client Setup on CentOS 6

A standalone Chef Infra Server installation deploys all required backend services (Nginx, PostgreSQL, RabbitMQ, Solr/Elasticsearch, Bookshelf, and Erchef) onto a single host. This topology is ideal for lab environments, proof-of-concept deployments, and small-to-medium production environments.

This guide walks through setting up a complete three-node Chef environment on CentOS/RHEL:

Chef Server (chefserver.ahmed.com): Stores cookbooks, roles, environments, data bags, and node objects.
Chef Workstation (chefworkstation.ahmed.com): Where administrators author cookbooks and run knife commands.
Chef Node (chefnode.ahmed.com): A managed target host bootstrapped and converged via chef-client.

Lab Topology and Prerequisites

We will configure three CentOS 6 x86_64 hosts:

Role	IP Address	FQDN	Short Alias
Chef Server	`192.168.30.132`	`chefserver.ahmed.com`	`chefserver`
Chef Workstation	`192.168.30.142`	`chefworkstation.ahmed.com`	`chefworkstation`
Chef Client Node	`192.168.30.141`	`chefnode.ahmed.com`	`chefnode`

1. Configure `/etc/hosts` and Hostnames on All Nodes

Chef Server requires a resolvable Fully Qualified Domain Name (hostname -f) before chef-server-ctl reconfigure is executed. Add the following entries to /etc/hosts on all three nodes:

0.0.1       localhost
168.30.132  chefserver.ahmed.com       chefserver
168.30.142  chefworkstation.ahmed.com  chefworkstation
168.30.141  chefnode.ahmed.com         chefnode

2. Install `crontabs`, Configure Firewall, and Set SELinux Mode

Ensure crontabs and NTP time synchronization are installed on all nodes (clock skew greater than 15 minutes between the Chef Workstation/Client and Chef Server causes HMAC API signature verification to fail):

sudo yum install -y crontabs ntp
sudo service ntpd start
sudo chkconfig ntpd on

For a lab environment, allow traffic between the nodes (or open TCP ports 80 and 443 on the Chef Server) and set SELinux to Permissive:

sudo iptables -F
sudo service iptables save
sudo setenforce Permissive
getenforce

Download the Chef RPM packages (chef-server-core, chefdk, and chef client):

[root@chefnode Downloads]# ls -l
total 656944
-rwxr--r--. 1 root root  52338858 Jun  8 01:45 chef-12.10.24-1.el6.x86_64.rpm
-rwxr--r--. 1 root root 142488123 Jun  8 01:45 chefdk-0.14.25-1.el6.x86_64.rpm
-rwxr--r--. 1 root root 477870942 Jun  8 01:45 chef-server-core-12.6.0-1.el6.x86_64.rpm

Part 1: Install and Configure the Chef Server

Step 1.1: Install `chef-server-core` and Run `reconfigure`

On chefserver.ahmed.com, install the chef-server-core RPM and initialize the internal services:

sudo rpm -ivh chef-server-core-12.6.0-1.el6.x86_64.rpm
sudo chef-server-ctl reconfigure

Troubleshooting Common `chef-server-ctl reconfigure` Errors

Error 1: Chef::Exceptions::ValidationFailed: common_name is required
```
[2015-09-23T16:46:46+00:00] ERROR: Exception handlers complete
  Chef Client failed. 1 resources updated in 10.379691033 seconds
[2015-09-23T16:46:47+00:00] FATAL: Chef::Exceptions::ValidationFailed: common_name is required
```
Cause & Fix: hostname -f returned empty because the system hostname could not be resolved during SSL certificate generation.
1. Set the hostname: sudo hostname chefserver.ahmed.com
2. Persist HOSTNAME=chefserver.ahmed.com in /etc/sysconfig/network.
3. Ensure chefserver.ahmed.com resolves in /etc/hosts and verify hostname -f returns chefserver.ahmed.com, then re-run chef-server-ctl reconfigure.
Error 2: BOOT007: The secrets file (/etc/opscode/private-chef-secrets.json) is present but the file /etc/opscode/pivotal.pem is missing
```
-----------------------------------------------------------------------
BOOT007: The secrets file (/etc/opscode/private-chef-secrets.json) is present
         but the file /etc/opscode/pivotal.pem is missing.
-----------------------------------------------------------------------
```
Cause & Fix: An earlier reconfigure run failed mid-way after writing /etc/opscode/private-chef-secrets.json but before generating pivotal.pem.
1. On a fresh installation, move /etc/opscode/private-chef-secrets.json aside (sudo mv /etc/opscode/private-chef-secrets.json /etc/opscode/private-chef-secrets.json.bak) and re-run sudo chef-server-ctl reconfigure.
2. Alternatively, if the fixture key is needed in a test environment:
```
sudo cp /opt/opscode/embedded/service/omnibus-ctl/spec/fixtures/pivotal.pem /etc/opscode/
```

Step 1.2: Create an Administrator User and Organization

Use chef-server-ctl user-create to create an administrator account and save its RSA private key:

# Syntax:
# chef-server-ctl user-create USER_NAME FIRST_NAME LAST_NAME EMAIL 'PASSWORD' --filename FILE_PATH

sudo mkdir -p /etc/chef
sudo chef-server-ctl user-create ahmed Zubair AHMED ahmedzbyr.a@gmail.com 'REPLACE_WITH_PASSWORD' --filename /etc/chef/ahmed.pem

Next, create an organization (ahmedinc) and associate your user (--association_user ahmed) as an administrator:

# Syntax:
# chef-server-ctl org-create SHORT_NAME 'FULL_ORG_NAME' --association_user USER_NAME --filename VALIDATOR_FILE_PATH

sudo chef-server-ctl org-create ahmedinc 'Ahmed, Inc.' --association_user ahmed --filename /etc/chef/ahmed-validator.pem

Step 1.3: Install the Chef Manage Web UI (Optional)

To enable the web management console (chef-manage), run:

sudo chef-server-ctl install chef-manage
sudo chef-server-ctl reconfigure
sudo chef-manage-ctl reconfigure

Verify that all Chef Server services are running:

sudo chef-server-ctl status

[root@chefserver Downloads]# chef-server-ctl status
run: bookshelf: (pid 6081) 4002s; run: log: (pid 6121) 4001s
run: nginx: (pid 8725) 2724s; run: log: (pid 6245) 3995s
run: oc_bifrost: (pid 5924) 4008s; run: log: (pid 5959) 4008s
run: oc_id: (pid 5976) 4006s; run: log: (pid 5984) 4006s
run: opscode-erchef: (pid 6192) 3999s; run: log: (pid 6160) 4001s
run: opscode-expander: (pid 6046) 4002s; run: log: (pid 6064) 4002s
run: opscode-solr4: (pid 6007) 4004s; run: log: (pid 6036) 4003s
run: postgresql: (pid 5901) 4009s; run: log: (pid 5914) 4009s
run: rabbitmq: (pid 5814) 4010s; run: log: (pid 5807) 4010s
run: redis_lb: (pid 8133) 2805s; run: log: (pid 6241) 3996s

Browse to https://chefserver.ahmed.com/, accept the self-signed certificate warning, and sign in with the user created above:

Login Screen:

Nodes Overview:

Nodes on the server

Users Management:

Users on the server

Part 2: Set Up the Chef Workstation

Step 2.1: Install ChefDK and Verify Components

On chefworkstation.ahmed.com, install the chefdk RPM and run chef verify:

sudo rpm -ivh chefdk-0.14.25-1.el6.x86_64.rpm
chef verify

Configure the workstation shell to use ChefDK’s embedded Ruby installation by default:

eval "$(chef shell-init bash)"
which ruby
# /opt/chefdk/embedded/bin/ruby

echo 'eval "$(chef shell-init bash)"' >> ~/.bash_profile

Step 2.2: Download the Starter Kit (`chef-repo`)

In the Chef Manage web UI on https://chefserver.ahmed.com/:

Navigate to the Administration tab → Organizations.
Select your organization (Ahmed, Inc.) and click Starter Kit in the left sidebar.
Click Download Starter Kit (note that downloading the Starter Kit resets your user and organization validator keys).

files

Unzip chef-starter.zip on chefworkstation.ahmed.com into /home/ahmed/chef-repo:

chef-repo/
├── .chef/
│   ├── ahmed.pem
│   ├── ahmedinc-validator.pem
│   └── knife.rb
├── cookbooks/
│   ├── chefignore
│   └── starter/
├── README.md
└── roles/
    └── starter.rb

Step 2.3: Fetch and Trust the Chef Server TLS Certificate

From inside /home/ahmed/chef-repo, run knife ssl fetch and knife ssl check so knife trusts the Chef Server’s self-signed TLS certificate:

[root@chefworkstation chef-repo]# knife ssl fetch
WARNING: Certificates from chefserver.ahmed.com will be fetched and placed in your trusted_cert
directory (/home/ahmed/chef-repo/.chef/trusted_certs).

Adding certificate for chefserver.ahmed.com in /home/ahmed/chef-repo/.chef/trusted_certs/chefserver_ahmed_com.crt

Verify connectivity to the Chef Server:

[root@chefworkstation chef-repo]# knife client list
ahmedinc-validator

Part 3: Bootstrap a Client Node (`knife bootstrap`)

From /home/ahmed/chef-repo on the workstation, bootstrap chefnode.ahmed.com over SSH:

knife bootstrap chefnode.ahmed.com -x ahmed -P 'REPLACE_WITH_SSH_PASSWORD' --sudo

Connecting to chefnode.ahmed.com
chefnode.ahmed.com -----> Existing Chef installation detected
chefnode.ahmed.com Starting the first Chef Client run...
chefnode.ahmed.com Starting Chef Client, version 12.10.24
chefnode.ahmed.com Creating a new client identity for chefnode.ahmed.com using the validator key.
chefnode.ahmed.com resolving cookbooks for run list: []
chefnode.ahmed.com [2016-06-08T03:05:08-07:00] WARN: Node chefnode.ahmed.com has an empty run list.
chefnode.ahmed.com Chef Client finished, 0/0 resources updated in 05 seconds

Confirm the node is registered with the Chef Server:

[root@chefworkstation chef-repo]# knife client list
ahmedinc-validator
chefnode.ahmed.com

cookbook on chef-server

Part 4: Upload a Cookbook and Converge the Node

Step 4.1: Update and Upload the `starter` Cookbook

Edit /home/ahmed/chef-repo/cookbooks/starter/recipes/default.rb:

log "Welcome to Chef, #{node['starter_name']}!" do
  level :info
end

file '/etc/my_first_file' do
  content 'This is my first file creation using chef server'
end

file '/etc/my_second_file' do
  content 'My Second file'
end

Upload the cookbook to the Chef Server:

knife upload cookbooks/starter
# Or: knife cookbook upload starter

cookbook on chef-server

Step 4.2: Assign the Cookbook to the Node’s Run List

Assign recipe[starter] to chefnode.ahmed.com either via knife:

knife node run_list add chefnode.ahmed.com 'recipe[starter]'

or through the Chef Manage web UI (Nodes → chefnode.ahmed.com → Edit Run List):

files

Step 4.3: Run `chef-client` on the Target Node

[root@chefnode Downloads]# chef-client
Starting Chef Client, version 12.10.24
resolving cookbooks for run list: ["starter"]
Synchronizing Cookbooks:
  - starter (1.0.0)
Compiling Cookbooks...
Converging 2 resources
Recipe: starter::default
  * log[Welcome to Chef, Sam Doe!] action write
  * file[/etc/my_first_file] action create
    - create new file /etc/my_first_file
    - update content in file /etc/my_first_file from none to ad169c
    - restore selinux security context

Chef Client finished, 2/2 resources updated in 05 seconds

Part 5: Clone a Cookbook from Git and Upload to Chef Server

To pull an existing cookbook from Git on the workstation and publish it to the Chef Server:

cd /home/ahmed/chef-repo/cookbooks
git clone https://github.com/ahmedzbyr/cm_setup
cd /home/ahmed/chef-repo
knife upload cookbooks/cm_setup

Verify the cookbook appears under the Policy → Cookbooks tab in the Chef Server UI:

files

References

Share on

Twitter Facebook Google+ LinkedIn

Standalone Chef Server / Workstation / Client Setup on CentOS 6

AHMED ZBYR

Lab Topology and Prerequisites

1. Configure `/etc/hosts` and Hostnames on All Nodes

2. Install `crontabs`, Configure Firewall, and Set SELinux Mode

Part 1: Install and Configure the Chef Server

Step 1.1: Install `chef-server-core` and Run `reconfigure`

Troubleshooting Common `chef-server-ctl reconfigure` Errors

Step 1.2: Create an Administrator User and Organization

Step 1.3: Install the Chef Manage Web UI (Optional)

Part 2: Set Up the Chef Workstation

Step 2.1: Install ChefDK and Verify Components

Step 2.2: Download the Starter Kit (`chef-repo`)

Step 2.3: Fetch and Trust the Chef Server TLS Certificate

Part 3: Bootstrap a Client Node (`knife bootstrap`)

Part 4: Upload a Cookbook and Converge the Node

Step 4.1: Update and Upload the `starter` Cookbook

Step 4.2: Assign the Cookbook to the Node’s Run List

Step 4.3: Run `chef-client` on the Target Node

Part 5: Clone a Cookbook from Git and Upload to Chef Server

References

Share on

You May Also Enjoy

PHP2Shell (CVE-2026-109618) Explained Simply: How an “Out of Memory” Error Lets Attackers Take Over Your Server—And How to Fix It

Patient Zero in Canberra: When a Rogue AI Agent Hacked the Australian Healthcare System Over a Dermatology Spreadsheet

Protocol zzHACKED: When 1,200 Sandboxed AI Agents Built a Secret Society and Breached Hugging Face

Setting Up Pi-hole on a Raspberry Pi Zero 2W for Network-Wide Ad Blocking

Standalone Chef Server / Workstation / Client Setup on CentOS 6

AHMED ZBYR

Lab Topology and Prerequisites

1. Configure /etc/hosts and Hostnames on All Nodes

2. Install crontabs, Configure Firewall, and Set SELinux Mode

Part 1: Install and Configure the Chef Server

Step 1.1: Install chef-server-core and Run reconfigure

Troubleshooting Common chef-server-ctl reconfigure Errors

Step 1.2: Create an Administrator User and Organization

Step 1.3: Install the Chef Manage Web UI (Optional)

Part 2: Set Up the Chef Workstation

Step 2.1: Install ChefDK and Verify Components

Step 2.2: Download the Starter Kit (chef-repo)

Step 2.3: Fetch and Trust the Chef Server TLS Certificate

Part 3: Bootstrap a Client Node (knife bootstrap)

Part 4: Upload a Cookbook and Converge the Node

Step 4.1: Update and Upload the starter Cookbook

Step 4.2: Assign the Cookbook to the Node’s Run List

Step 4.3: Run chef-client on the Target Node

Part 5: Clone a Cookbook from Git and Upload to Chef Server

References

Share on

You May Also Enjoy

PHP2Shell (CVE-2026-109618) Explained Simply: How an “Out of Memory” Error Lets Attackers Take Over Your Server—And How to Fix It

Patient Zero in Canberra: When a Rogue AI Agent Hacked the Australian Healthcare System Over a Dermatology Spreadsheet

Protocol zzHACKED: When 1,200 Sandboxed AI Agents Built a Secret Society and Breached Hugging Face

Setting Up Pi-hole on a Raspberry Pi Zero 2W for Network-Wide Ad Blocking

1. Configure `/etc/hosts` and Hostnames on All Nodes

2. Install `crontabs`, Configure Firewall, and Set SELinux Mode

Step 1.1: Install `chef-server-core` and Run `reconfigure`

Troubleshooting Common `chef-server-ctl reconfigure` Errors

Step 2.2: Download the Starter Kit (`chef-repo`)

Part 3: Bootstrap a Client Node (`knife bootstrap`)

Step 4.1: Update and Upload the `starter` Cookbook

Step 4.3: Run `chef-client` on the Target Node