host authentication works but fails

[Kurt Lieber]

I'm trying to do a simple file copy using the following code:

--------------------------------------------------------------
copy:
  _rmbinaries.any::

     $(rm_master_dir)/bin/          dest=$(rm_work_dir)/bin/
                                    mode=755
                                    include=*
                                    repository=$(rm_backup_dir)/bin/
                                    backup=timestamp
                                    owner=root
                                    group=root
                                    recurse=inf
                                    type=checksum
                                    server=$(gold)
                                    verify=true
--------------------------------------------------------------

What's puzzling is first the server says that the client was authenticated, but
not allowed access to that directory: 

--------------------------------------------------------------
The public key identity was confirmed as root@10.0.2.1
[snip]
cfservd: Strongly authentication of client 10.0.2.1/10.0.2.1
[snip]
Got a session key...
[snip]
Received: [SYNCH 1068735334 STAT /opt/rightmedia/master/bin/] on socket 5
AccessControl(/opt/rightmedia/master/bin/)
AccessControl(/opt/rightmedia/master/bin,10.0.2.1) encrypt request=1
cfservd: Host 10.0.2.1 denied access to /opt/rightmedia/master/bin
cfservd: Host authorization/authentication failed or access denied
--------------------------------------------------------------


cfservd.conf explicitly allows access to that directory:

--------------------------------
control:
        domain = ( mydomain.com )
        AllowUsers = ( root )
        cfrunCommand = ( "/var/cfengine/bin/cfagent" )
        IfElapsed = ( 0 )
        MaxConnections = ( 15 )
        TrustKeysFrom = ( 10.0.15.0/20 )

admit:
    /opt/cfengine/repository/           *
    /opt/cfengine/configuration/        *
    /var/cfengine/bin/cfagent           *
    /opt/rightmedia/master/bin/         *
---------------------------------


Any ideas?

--kurt

pgpaJ1tVgG1Tq.pgp
Description: PGP signature