Re: [Kimchi-devel] [project-kimchi] [PATCH] spec: Open 8000 and 8001 port by default in spec.in post section. kimchi server use 8000 and 8001 port. Open 8000 and 8001 port by default in spec.in post section.
6 a.m.
On 12/17/2013 02:36 PM, taget(a)linux.vnet.ibm.com wrote:
From: Eli Qiao <taget(a)linux.vnet.ibm.com>
Signed-off-by: Eli Qiao <taget(a)linux.vnet.ibm.com>
---
contrib/kimchi.spec.fedora.in | 5 +++++
contrib/kimchi.spec.suse.in | 5 +++++
2 files changed, 10 insertions(+), 0 deletions(-)
diff --git a/contrib/kimchi.spec.fedora.in b/contrib/kimchi.spec.fedora.in
index 14ec359..f21ae49 100644
--- a/contrib/kimchi.spec.fedora.in
+++ b/contrib/kimchi.spec.fedora.in
@@ -81,6 +81,11 @@ if [ $1 -eq 1 ] ; then
/bin/systemctl daemon-reload >/dev/null 2>&1 || :
fi
+# open 8000 and 8001 port for firewall
+
+iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
+iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
+
%if 0%{?rhel} == 6
start kimchid
%else
diff --git a/contrib/kimchi.spec.suse.in b/contrib/kimchi.spec.suse.in
index 9051284..5209e03 100644
--- a/contrib/kimchi.spec.suse.in
+++ b/contrib/kimchi.spec.suse.in
@@ -47,6 +47,11 @@ install -Dm 0755 contrib/kimchid.sysvinit
%{buildroot}%{_initrddir}/kimchid
service kimchid start
chkconfig kimchid on
+# open 8000 and 8001 port for firewall
+
+iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
+iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
+
%preun
service kimchid stop
Eli,
Thanks for the patch. But it's not a reliable configuration. This rule
will be lost after reboot.
And shipping a configuration file is better than running commands in
spec file.
Please take a look at firewalld and firewalld.service
http://manpages.ubuntu.com/manpages/raring/man5/firewalld.service.5.html
It could be a better solution for the platforms where firewalld is
available.
--
project-kimchi mailing list <project-kimchi(a)googlegroups.com>
https://groups.google.com/forum/#!forum/project-kimchi
---
You received this message because you are subscribed to the Google Groups
"project-kimchi" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
project-kimchi+unsubscribe(a)googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
9:53 p.m.
New subject: [project-kimchi] [PATCH] spec: Open 8000 and 8001 port by default in spec.in post section. kimchi server use 8000 and 8001 port. Open 8000 and 8001 port by default in spec.in post section.
CCed to kimchi-devel and see the comment line below
? 2013/12/18 19:00, Mark Wu ??:
On 12/17/2013 02:36 PM, taget(a)linux.vnet.ibm.com wrote:
> From: Eli Qiao<taget(a)linux.vnet.ibm.com>
>
> Signed-off-by: Eli Qiao<taget(a)linux.vnet.ibm.com>
> ---
> contrib/kimchi.spec.fedora.in | 5 +++++
> contrib/kimchi.spec.suse.in | 5 +++++
> 2 files changed, 10 insertions(+), 0 deletions(-)
>
> diff --git a/contrib/kimchi.spec.fedora.in b/contrib/kimchi.spec.fedora.in
> index 14ec359..f21ae49 100644
> --- a/contrib/kimchi.spec.fedora.in
> +++ b/contrib/kimchi.spec.fedora.in
> @@ -81,6 +81,11 @@ if [ $1 -eq 1 ] ; then
> /bin/systemctl daemon-reload >/dev/null 2>&1 || :
> fi
>
> +# open 8000 and 8001 port for firewall
> +
> +iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
> +iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
> +
> %if 0%{?rhel} == 6
> start kimchid
> %else
> diff --git a/contrib/kimchi.spec.suse.in b/contrib/kimchi.spec.suse.in
> index 9051284..5209e03 100644
> --- a/contrib/kimchi.spec.suse.in
> +++ b/contrib/kimchi.spec.suse.in
> @@ -47,6 +47,11 @@ install -Dm 0755 contrib/kimchid.sysvinit
%{buildroot}%{_initrddir}/kimchid
> service kimchid start
> chkconfig kimchid on
>
> +# open 8000 and 8001 port for firewall
> +
> +iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
> +iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
> +
> %preun
> service kimchid stop
>
Eli,
Thanks for the patch. But it's not a reliable configuration. This rule
will be lost after reboot.
And shipping a configuration file is better than running commands in
spec file.
Please take a look at firewalld and firewalld.service
http://manpages.ubuntu.com/manpages/raring/man5/firewalld.service.5.html
It could be a better solution for the platforms where firewalld is
available.
Also, we should be careful about the iptbales rules position in file to
avoid it is masked by other rules. And we may need to remove the rules
in rpm remove operations.
--
project-kimchi mailing list <project-kimchi(a)googlegroups.com>
https://groups.google.com/forum/#!forum/project-kimchi
<https://groups.google.com/forum/#%21forum/project-kimchi>
---
You received this message because you are subscribed to the Google
Groups "project-kimchi" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to project-kimchi+unsubscribe(a)googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
10:10 p.m.
New subject: [project-kimchi] [PATCH] spec: Open 8000 and 8001 port by default in spec.in post section. kimchi server use 8000 and 8001 port. Open 8000 and 8001 port by default in spec.in post section.
On 2013?12?18? 19:00, Mark Wu wrote:
On 12/17/2013 02:36 PM, taget(a)linux.vnet.ibm.com wrote:
> From: Eli Qiao<taget(a)linux.vnet.ibm.com>
>
> Signed-off-by: Eli Qiao<taget(a)linux.vnet.ibm.com>
> ---
> contrib/kimchi.spec.fedora.in | 5 +++++
> contrib/kimchi.spec.suse.in | 5 +++++
> 2 files changed, 10 insertions(+), 0 deletions(-)
>
> diff --git a/contrib/kimchi.spec.fedora.in b/contrib/kimchi.spec.fedora.in
> index 14ec359..f21ae49 100644
> --- a/contrib/kimchi.spec.fedora.in
> +++ b/contrib/kimchi.spec.fedora.in
> @@ -81,6 +81,11 @@ if [ $1 -eq 1 ] ; then
> /bin/systemctl daemon-reload >/dev/null 2>&1 || :
> fi
>
> +# open 8000 and 8001 port for firewall
> +
> +iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
> +iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
> +
> %if 0%{?rhel} == 6
> start kimchid
> %else
> diff --git a/contrib/kimchi.spec.suse.in b/contrib/kimchi.spec.suse.in
> index 9051284..5209e03 100644
> --- a/contrib/kimchi.spec.suse.in
> +++ b/contrib/kimchi.spec.suse.in
> @@ -47,6 +47,11 @@ install -Dm 0755 contrib/kimchid.sysvinit
%{buildroot}%{_initrddir}/kimchid
> service kimchid start
> chkconfig kimchid on
>
> +# open 8000 and 8001 port for firewall
> +
> +iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
> +iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
> +
> %preun
> service kimchid stop
>
Eli,
Thanks for the patch. But it's not a reliable configuration. This rule
will be lost after reboot.
And shipping a configuration file is better than running commands in
spec file.
Please take a look at firewalld and firewalld.service
http://manpages.ubuntu.com/manpages/raring/man5/firewalld.service.5.html
It could be a better solution for the platforms where firewalld is
available.
Good point, took a look at vdsm, it manipulates with
'/etc/sysconfig/iptables' when installation. We may also try this way.
--
project-kimchi mailing list <project-kimchi(a)googlegroups.com>
https://groups.google.com/forum/#!forum/project-kimchi
<https://groups.google.com/forum/#%21forum/project-kimchi>
---
You received this message because you are subscribed to the Google
Groups "project-kimchi" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to project-kimchi+unsubscribe(a)googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
--
project-kimchi mailing list <project-kimchi(a)googlegroups.com>
https://groups.google.com/forum/#!forum/project-kimchi
---
You received this message because you are subscribed to the Google Groups
"project-kimchi" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
project-kimchi+unsubscribe(a)googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
10:13 p.m.
New subject: [project-kimchi] [PATCH] spec: Open 8000 and 8001 port by default in spec.in post section. kimchi server use 8000 and 8001 port. Open 8000 and 8001 port by default in spec.in post section.
On 2013?12?18? 19:00, Mark Wu wrote:
On 12/17/2013 02:36 PM, taget(a)linux.vnet.ibm.com wrote:
> From: Eli Qiao<taget(a)linux.vnet.ibm.com>
>
> Signed-off-by: Eli Qiao<taget(a)linux.vnet.ibm.com>
> ---
> contrib/kimchi.spec.fedora.in | 5 +++++
> contrib/kimchi.spec.suse.in | 5 +++++
> 2 files changed, 10 insertions(+), 0 deletions(-)
>
> diff --git a/contrib/kimchi.spec.fedora.in b/contrib/kimchi.spec.fedora.in
> index 14ec359..f21ae49 100644
> --- a/contrib/kimchi.spec.fedora.in
> +++ b/contrib/kimchi.spec.fedora.in
> @@ -81,6 +81,11 @@ if [ $1 -eq 1 ] ; then
> /bin/systemctl daemon-reload >/dev/null 2>&1 || :
> fi
>
> +# open 8000 and 8001 port for firewall
> +
> +iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
> +iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
> +
> %if 0%{?rhel} == 6
> start kimchid
> %else
> diff --git a/contrib/kimchi.spec.suse.in b/contrib/kimchi.spec.suse.in
> index 9051284..5209e03 100644
> --- a/contrib/kimchi.spec.suse.in
> +++ b/contrib/kimchi.spec.suse.in
> @@ -47,6 +47,11 @@ install -Dm 0755 contrib/kimchid.sysvinit
%{buildroot}%{_initrddir}/kimchid
> service kimchid start
> chkconfig kimchid on
>
> +# open 8000 and 8001 port for firewall
> +
> +iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
> +iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
> +
> %preun
> service kimchid stop
>
Eli,
Thanks for the patch. But it's not a reliable configuration. This rule
will be lost after reboot.
And shipping a configuration file is better than running commands in
spec file.
Please take a look at firewalld and firewalld.service
http://manpages.ubuntu.com/manpages/raring/man5/firewalld.service.5.html
It could be a better solution for the platforms where firewalld is
available.
Good point, took a look at vdsm, it manipulates with
'/etc/sysconfig/iptables' when installation. We may also try this way.
--
project-kimchi mailing list <project-kimchi(a)googlegroups.com>
https://groups.google.com/forum/#!forum/project-kimchi
<https://groups.google.com/forum/#%21forum/project-kimchi>
---
You received this message because you are subscribed to the Google
Groups "project-kimchi" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to project-kimchi+unsubscribe(a)googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
2:34 a.m.
New subject: [project-kimchi] [PATCH] spec: Open 8000 and 8001 port by default in spec.in post section. kimchi server use 8000 and 8001 port. Open 8000 and 8001 port by default in spec.in post section.
? 2013?12?18? 19:00, Mark Wu ??:
Eli,
Thanks for the patch. But it's not a reliable configuration. This rule
will be lost after reboot.
And shipping a configuration file is better than running commands in
spec file.
Please take a look at firewalld and firewalld.service
http://manpages.ubuntu.com/manpages/raring/man5/firewalld.service.5.html
It could be a better solution for the platforms where firewalld is
available.
hi Mark thanks for your comments,
I did some investigation, this is a good solution, fedora and ubuntu has
firewalld support. but RHEL not.
as far as i know kimchi should support RHEL also, if we chose this
solution, how about RHEL?
--
Thanks Eli (Li Yong) Qiao (qiaoly(a)cn.ibm.com)
CSTL-KVM Frobisher/RHEV-H
* ? ? - ???
* ??
* ??
<javascript:void(0);>
--
project-kimchi mailing list <project-kimchi(a)googlegroups.com>
https://groups.google.com/forum/#!forum/project-kimchi
---
You received this message because you are subscribed to the Google Groups
"project-kimchi" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
project-kimchi+unsubscribe(a)googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
2:40 a.m.
New subject: [project-kimchi] [PATCH] spec: Open 8000 and 8001 port by default in spec.in post section. kimchi server use 8000 and 8001 port. Open 8000 and 8001 port by default in spec.in post section.
? 2013?12?19? 15:34, Eli Qiao ??:
? 2013?12?18? 19:00, Mark Wu ??:
> Eli,
> Thanks for the patch. But it's not a reliable configuration. This
> rule will be lost after reboot.
> And shipping a configuration file is better than running commands in
> spec file.
>
> Please take a look at firewalld and firewalld.service
> http://manpages.ubuntu.com/manpages/raring/man5/firewalld.service.5.html
>
> It could be a better solution for the platforms where firewalld is
> available.
hi Mark thanks for your comments,
I did some investigation, this is a good solution, fedora and ubuntu
has firewalld support. but RHEL not.
as far as i know kimchi should support RHEL also, if we chose this
solution, how about RHEL?
just got an update, RHEL7 will support firewalld.
we should decided how to go on.
thanks Eli
--
Thanks Eli (Li Yong) Qiao (qiaoly(a)cn.ibm.com)
CSTL-KVM Frobisher/RHEV-H
* ? ? - ???
* ??
* ??
--
project-kimchi mailing list <project-kimchi(a)googlegroups.com>
https://groups.google.com/forum/#!forum/project-kimchi
<https://groups.google.com/forum/#%21forum/project-kimchi>
---
You received this message because you are subscribed to the Google
Groups "project-kimchi" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to project-kimchi+unsubscribe(a)googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
--
Thanks Eli (Li Yong) Qiao (qiaoly(a)cn.ibm.com)
CSTL-KVM Frobisher/RHEV-H
--
project-kimchi mailing list <project-kimchi(a)googlegroups.com>
https://groups.google.com/forum/#!forum/project-kimchi
---
You received this message because you are subscribed to the Google Groups
"project-kimchi" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
project-kimchi+unsubscribe(a)googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
4:14 a.m.
New subject: [project-kimchi] [PATCH] spec: Open 8000 and 8001 port by default in spec.in post section. kimchi server use 8000 and 8001 port. Open 8000 and 8001 port by default in spec.in post section.
On 12/19/2013 03:34 PM, Eli Qiao wrote:
? 2013?12?18? 19:00, Mark Wu ??:
> Eli,
> Thanks for the patch. But it's not a reliable configuration. This
> rule will be lost after reboot.
> And shipping a configuration file is better than running commands in
> spec file.
>
> Please take a look at firewalld and firewalld.service
> http://manpages.ubuntu.com/manpages/raring/man5/firewalld.service.5.html
>
> It could be a better solution for the platforms where firewalld is
> available.
hi Mark thanks for your comments,
I did some investigation, this is a good solution, fedora and ubuntu
has firewalld support. but RHEL not.
as far as i know kimchi should support RHEL also, if we chose this
solution, how about RHEL?
We could handle it separately: use static rules on RHEL
and use
firewall for other platforms
--
Thanks Eli (Li Yong) Qiao (qiaoly(a)cn.ibm.com)
CSTL-KVM Frobisher/RHEV-H
* ? ? - ???
* ??
* ??
4025
days inactive
4026
days old
6 comments
4 participants
participants (4)
-
Eli Qiao -
Mark Wu -
Royce Lv -
Shu Ming