- Infra - oVirt List Archives

Security issues when running gerrit patches on jenkins
by Eyal Edri 01 Aug '12

01 Aug '12

Hi, Following last infra meeting, i want to open for discussion the security issues that may arise if we allow Jenkins to run jobs (i.e any code) with every gerrit patch. The problem: In theory, any user that is registered to gerrit might send a patch to any ovirt project. That code might contain malicious code, malware, harmfull or just not-related ovirt code that he wants to use our resources for it. Even though we use limited sudo on hosts, we can't be sure an exploit will be used against one of the jenkins slaves. The proposed solutions: - black-listing authors (published on ovirt.org?) - white-listing authors (published on ovirt.org?) - auto approve patch via comparing to lastest commits - check if author recent patches were approved in the past? adding dan since he raised this issue when we wanted to add vdsm gerrit tests. thoughts? Eyal.

8 28

[oVirt Jenkins] check_gerrit_ovirt_org - Build # 18501 - Failure!
by Jenkins oVirt Server 01 Aug '12

01 Aug '12

------=_Part_423_1550507262.1343818446504 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Project: http://jenkins.ovirt.org/job/check_gerrit_ovirt_org/=20 Build: http://jenkins.ovirt.org/job/check_gerrit_ovirt_org/18501/ Build Number: 18501 Build Status: Failure Triggered By: Started by timer ------------------------------------- Changes Since Last Success: ------------------------------------- Changes for Build #18501 ----------------- Failed Tests: ----------------- No tests ran.=20 ------------------ Build Log: ------------------ Started by timer Building remotely on rhel_62_slave_01 in workspace /home/jenkins/workspace/= check_gerrit_ovirt_org No emails were triggered. [check_gerrit_ovirt_org] $ /bin/sh -xe /tmp/hudson2261710811771472442.sh + rm index.html + rm 'gitweb?p=3Dtest.git' + wget -v -d gerrit.ovirt.org --timeout 60 -t 3 Setting --timeout (timeout) to 60 Setting --tries (tries) to 3 DEBUG output created by Wget 1.12 on linux-gnu. --2012-08-01 06:50:43-- http://gerrit.ovirt.org/ Resolving gerrit.ovirt.org... 107.22.212.69 Caching gerrit.ovirt.org =3D> 107.22.212.69 Connecting to gerrit.ovirt.org|107.22.212.69|:80... connected. Created socket 3. Releasing 0x0000000001379860 (new refcount 1). ---request begin--- GET / HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: gerrit.ovirt.org Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response...=20 ---response begin--- HTTP/1.1 200 OK Date: Wed, 01 Aug 2012 10:50:55 GMT X-XRDS-Location: http://gerrit.ovirt.org/OpenID.XRDS Expires: Fri, 01 Jan 1980 00:00:00 GMT Pragma: no-cache Cache-Control: no-cache, must-revalidate Content-Type: text/html;charset=3DUTF-8 Content-Length: 3245 Connection: keep-alive ---response end--- 200 OK Registered socket 3 for persistent reuse. Length: 3245 (3.2K) [text/html] Saving to: =E2=80=9Cindex.html=E2=80=9D 0K ... 100% 187M=3D= 0s 2012-08-01 06:51:03 (187 MB/s) - =E2=80=9Cindex.html=E2=80=9D saved [3245/3= 245] + wget --timeout 60 -t 3 -v -d 'gerrit.ovirt.org/gitweb?p=3Dtest.git' DEBUG output created by Wget 1.12 on linux-gnu. --2012-08-01 06:51:03-- http://gerrit.ovirt.org/gitweb?p=3Dtest.git Resolving gerrit.ovirt.org... 107.22.212.69 Caching gerrit.ovirt.org =3D> 107.22.212.69 Connecting to gerrit.ovirt.org|107.22.212.69|:80... connected. Created socket 3. Releasing 0x0000000001a7d8e0 (new refcount 1). ---request begin--- GET /gitweb?p=3Dtest.git HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: gerrit.ovirt.org Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... Read error (Connection timed out) i= n headers. Closed fd 3 Retrying. --2012-08-01 06:52:04-- (try: 2) http://gerrit.ovirt.org/gitweb?p=3Dtest.= git Found gerrit.ovirt.org in host_name_addresses_map (0x1a7d8e0) Connecting to gerrit.ovirt.org|107.22.212.69|:80... connected. Created socket 3. Releasing 0x0000000001a7d8e0 (new refcount 1). ---request begin--- GET /gitweb?p=3Dtest.git HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: gerrit.ovirt.org Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... Read error (Connection timed out) i= n headers. Closed fd 3 Retrying. --2012-08-01 06:53:07-- (try: 3) http://gerrit.ovirt.org/gitweb?p=3Dtest.= git Found gerrit.ovirt.org in host_name_addresses_map (0x1a7d8e0) Connecting to gerrit.ovirt.org|107.22.212.69|:80... connected. Created socket 3. Releasing 0x0000000001a7d8e0 (new refcount 1). ---request begin--- GET /gitweb?p=3Dtest.git HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: gerrit.ovirt.org Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... Read error (Connection timed out) i= n headers. Closed fd 3 Giving up. Build step 'Execute shell' marked build as failure Email was triggered for: Failure Sending email for trigger: Failure ------=_Part_423_1550507262.1343818446504--

1 1

how to get files from jenkins.ovirt.org to www.ovirt.org
by Eyal Edri 31 Jul '12

31 Jul '12

Hi, after looking into the process and testing it via jenkins.ovirt.info, here is my proposal: 1. Nightly job [1] will collect rpms from all ovirt projects (other jenkins jobs that build rpms per commit). 1.1 all files will be kept in a flat dir under $WORKSPCE/rpms 1.2 using 'publish over ssh' [2] plugin the job will then copy files to their destination according to their names. [3] for e.g 'ovirt-engine-3.1.0-3.fc17.noarch.rpm' ==> ovirt.org/var/www/html/releases/nightly/rpm/Fedora/17/noarch 'ovirt-engine-3.1.0-3.fc17.src.rpm' ==> ovirt.org/var/www/html/releases/nightly/rpm/Fedora/17/src 'ovirt-engine-3.1.0-3.bz2' ==> ovirt.org/var/www/html/releases/nightly/src' 1.3 publish ssh plugin can execute a command after its done copying the file, so all is left is to run 'createrepo' on the relevant dirs. [4] 2. a separate cron cleaning script needs to run on ovirt.org to delete old rpms and run createrepo. +1 for pushing this forward or comments? Eyal. [1] http://jenkins.ovirt.org/view/rpms/job/publish_ovirt_rpms_nightly/, this job currently works only for fedora17 rpms (that's what we have now). we'll need to improve it to be more generic (maybe as a matrix job) or duplicate it for each opertating system. [2] https://wiki.jenkins-ci.org/display/JENKINS/Publish+Over+SSH+Plugin, using pub/private key with user jenkins to connect [3] jenkins user will need r/q permissions to the nightly folder [4] will need sudo access for it.

3 6

Meeting :: Infra Team weekly 2012-07-31
by Karsten 'quaid' Wade 31 Jul '12

31 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We had some trouble with the meetbot (because I started the meeting, then changed my nick from Guest1332, and couldn't change back to control the meeting). Here is the log: http://ovirt.org/meetings/ovirt/2012/ovirt.2012-07-31-14.01.log.txt - From that I have these URLs and actions: http://wiki.ovirt.org/wiki/Infrastructure_team_meetings#2012-07-31 http://jenkins.ovirt.org/view/rpms/ Actions: * eedri to write up wiki page about connecting to jenkins.ovirt.org with a jnlp port; post page to arch@ * rmiddle and eedir to finish up auto nightly repo this week. * quaid to start thread on finishing the Get Jenkins a New Host discussion, so we can pick a hosting solution and move ASAP - - Karsten - -- Karsten 'quaid' Wade, Sr. Analyst - Community Growth http://TheOpenSourceWay.org .^\ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iD8DBQFQF/U22ZIOBq0ODEERAnI6AKDbx3XcAZDQ2zRVUzdw6xnvZl1LlACfRoh1 sCXOZgo2NSdesPI522LMa4w= =tLuH -----END PGP SIGNATURE-----

1 0

Outage :: www.ovirt.org :: 2012-07-13 2300 to 2330 UTC (7 pm EDT/4 pm PDT)
by Karsten 'quaid' Wade 30 Jul '12

30 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm back with the rescheduled outage for the www.ovirt.org server. We're filling up the disk on www.ovirt.org, which is expected since it's only 10 GB. I'm going to add 15 GB, which requires a reboot. Prior to the reboot I'll come on IRC and make sure everyone is prepared. The restart should only take a few minutes. The hour window is to give me time to start and finish or rollback if there is a problem. If anyone has done this before on Linode and wants to offer suggestions or hold my hand :) let me know. == When == 2300 to 2330 UTC date -d "2012-07-13 2300 UTC" == Affected services == lists.ovirt.org www.ovirt.org/wiki www.ovirt.org/.* ovirtbot (IRC bot) - -- Karsten 'quaid' Wade, Sr. Analyst - Community Growth http://TheOpenSourceWay.org .^\ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iD8DBQFP/3lg2ZIOBq0ODEERAlP4AJ4hbvBeUNcuoDe0PYPOPjauqc6BZwCdFLGm 3nkaZ1xffyW0T7w4nz7RH8Y= =2zx3 -----END PGP SIGNATURE-----

2 4

reminder: gerrit upgrade
by Itamar Heim 29 Jul '12

29 Jul '12

gerrit will be upgraded in a few minutes.

1 1

Jenkins emails
by Doron Fediuck 29 Jul '12

29 Jul '12

Hi Robert, Got a few email messages from Jenkins using this From header: From: Jenkins testing Server <robert(a)middleswarth.net> Can you please fix it to use the standard header of- From: Jenkins oVirt Server <jenkins(a)ovirt.org> Otherwise our mail filtering rules will become unmaintainable... Thanks! Doron -- /d "All computers wait at the same speed."

2 2

Change notice :: cronjobs on linode01.ovirt.org
by Karsten 'quaid' Wade 28 Jul '12

28 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I was adding a cronjob to archive Apache logs ... one of those things I suddenly realized I wished I'd done six months ago ... and I noticed that the root crontab I wrote assumed the quiet time of the day would be Midnight Eastern timezone. I checked the graphs on linode.com and found our low time is 20:00 Eastern (8 pm)/Midnight UTC, rising to a peak at 14:00 UTC, then quickly back down toward 00:00. Of course, there are lots of other peaks during the day; I'm thinking more of the sustained baseline. (Refer to the attached usage graphs for the last 24 hours.) I switched the cronjobs to start at Midnight UTC, and then run over the course of an hour with long spaces in between. Just seemed like the right thing to do, so I did it; same with notifying, being it's a relatively minor change that couldn't disrupt any services. - - Karsten # Give root word about the backup MAILTO=root # # Run five minutes after 8 pm Eastern/Midnight UTC at quietest time, every day 5 20 * * * /root/bin/wordpress-backup.sh # Run ten minutes after 8 pm Eastern/Midnight UTC at quietest time, every day 10 20 * * * /root/bin/mediawiki-backup.sh # Run thirty minutes after 8 pm Eastern/Midnight UTC every day, to clean out older than 7 days 30 20 * * * /root/bin/backup-cleanup.sh # Run forty-five minutes after 8 pm Eastern/Midnight UTC every day, to track subscriber trends 45 20 * * * /root/bin/mailman-subscriber-count.sh # Run fifty-five minutes after 8 pm Eastern/Midnight UTC every day, to archve Apache logs 55 20 * * * /root/bin/httpd_log_backup.sh ~ - -- Karsten 'quaid' Wade, Sr. Analyst - Community Growth http://TheOpenSourceWay.org .^\ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iD8DBQFQEx+P2ZIOBq0ODEERAvJZAKDOk0WYGIGYVsp8DtxHylQpxGCnBgCdElkX QJsx1MStANWUqN6OgDkSYBE= =ph5Q -----END PGP SIGNATURE-----

1 0

Nightly Jenkins backup are running.
by Robert Middleswarth 26 Jul '12

26 Jul '12

I have nightly backups running that is pulling down the following folders. /usr/local/bin/ /usr/local/sbin/ /etc/ /home/ /var/lib/jenkins/ Excluding /var/lib/jenkins/workspace/* /var/log/jenkins/ Did I miss anything? Thanks Robert

3 6

Reduced the number of executors to 2 on master.
by Robert Middleswarth 25 Jul '12

25 Jul '12

I was watching how overloaded Jenkins was well it was running 3 jobs on the master server. It was so overload that the Jenkins website became unresponsive for a several min. So I reduced the number of jobs that will on the master. Thanks Robert

3 3