1:15 a.m.
--_64b96cf8-fdd4-4df4-bf3e-459817379ccc_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi Joshua=2C
many thanks for your suggestion which I suppose would work perfectly=2C but=
I actually want iptables (CentOS 6.5 here=2C so no firewalld) rules in pla=
ce all the time=2C but only "MY OWN" iptables rules =3B>
Regards=2C
Giuseppe
Date: Tue=2C 25 Mar 2014 18:04:04 -0400
Subject: Re: [Users] Otopi pre-seeded answers and firewall settings
From: josh(a)wrale.com
To: giuseppe.ragusa(a)hotmail.com
Perhaps you could add the iptables and firewalld packages to yum.conf as ex=
cludes. I don't know if this would fail silently=2C but if so=2C the engin=
e installer would never know.
Thanks=2C
=0A=
Joshua
On Tue=2C Mar 25=2C 2014 at 5:49 PM=2C Giuseppe Ragusa <giuseppe.ragusa@hot=
mail.com> wrote:
=0A=
=0A=
=0A=
=0A=
Hi Didi=2C
many thanks for your invaluable help!
I'll try your suggestion (/etc/ovirt-host-deploy.conf.d/99-prevent-iptables=
.conf) asap and then I will report back.
By the way: I have a really custom iptables setup (multiple separated netwo=
rks on hypervisor hosts)=2C so I suppose it's best to hand tune firewall ru=
les and then leave them alone (I pre-configure them=2C so the setup procedu=
re won't be impeded in its communication needs anyway AND I will always gua=
rantee the most stringent filtering possible with default deny ecc.).
=0A=
Many thanks again=2C
Giuseppe
Date: Tue=2C 25 Mar 2014 04:05:33 -0400
From: didi(a)redhat.com
To: giuseppe.ragusa(a)hotmail.com
=0A=
CC: users(a)ovirt.org
Subject: Re: [Users] Otopi pre-seeded answers and firewall settings
=0A=
From: "Giuseppe Ragusa" <giuseppe.ragusa(a)hotmail.com>
=0A=
To: "Yedidyah Bar David" <didi(a)redhat.com>
Cc: "Users(a)ovirt.org" <users(a)ovirt.org>
=0A=
Sent: Tuesday=2C March 25=2C 2014 1:53:20 AM
Subject: RE: [Users] Otopi pre-seeded answers and firewall settings
Hi Didi=2C
I found the references to NETWORK/iptablesEnable in my engine logs (/var/lo=
g/ovirt-engine/host-deploy/ovirt-*.log)=2C but it didn't seem to work after=
all.
=0A=
Full logs attached.
I resurrected my Engine by rebooting the (still only) host=2C then restarti=
ng ovirt-ha-agent (at startup the agent failed while trying to launch vdsm=
=2C but I found vdsm running and so tried manually...).=0A=
OK=2C so it's host-deploy that's doing that.But it's not host-deploy itself=
- it's the engine that is talking to it=2C asking it to configure iptables=
.I don't know how to make the agent don't do that. I searched a bit the sou=
rces (which I don't know)=0A=
and didn't find a simple way.
You can=2C however=2C try to override this by:# mkdir -p /etc/ovirt-host-de=
ploy.conf.d# echo '[environment:enforce]' > /etc/ovirt-host-deploy.conf.d/9=
9-prevent-iptables.conf=0A=
# echo 'NETWORK/iptablesEnable=3Dbool:False' >>
/etc/ovirt-host-deploy.conf=
.d/99-prevent-iptables.conf
Never tried that=2C and not sure it's recommended - if it does work=2C it m=
eans that host-deploy will not=0A=
update iptables=2C but the engine will think it did. So it's better to find=
a way to make the engine not dothat. Or=2C better yet=2C that you'll expla=
in why you need this and somehow make the engine do what you want...=0A=
-- Didi
=0A=
_______________________________________________
=0A=
Users mailing list
=0A=
Users(a)ovirt.org
=0A=
http://lists.ovirt.org/mailman/listinfo/users
=0A=
=
--_64b96cf8-fdd4-4df4-bf3e-459817379ccc_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<style><!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 12pt=3B
font-family:Calibri
}
--></style></head>
<body class=3D'hmmessage'><div dir=3D'ltr'>Hi
Joshua=2C<br>many thanks for =
your suggestion which I suppose would work perfectly=2C but I actually want=
iptables (CentOS 6.5 here=2C so no firewalld) rules in place all the time=
=2C but only "MY OWN" iptables rules
=3B>=3B<br><br>Regards=2C<br>Giusepp=
e<br><br><div><hr id=3D"stopSpelling">Date: Tue=2C 25
Mar 2014 18:04:04 -04=
00<br>Subject: Re: [Users] Otopi pre-seeded answers and firewall settings<b=
r>From: josh(a)wrale.com<br>To:
giuseppe.ragusa(a)hotmail.com<br><br><div dir=
=3D"ltr"><div>Perhaps you could add the iptables and firewalld packages
to =
yum.conf as excludes. =3B I don't know if this would fail silently=2C b=
ut if so=2C the engine installer would never
know.<br><br></div>Thanks=2C<b=
r>=0A=
Joshua<br></div><div
class=3D"ecxgmail_extra"><br><br><div class=3D"ecxgmai=
l_quote">On Tue=2C Mar 25=2C 2014 at 5:49 PM=2C Giuseppe Ragusa <span dir=
=3D"ltr"><=3B<a
href=3D"mailto:giuseppe.ragusa@hotmail.com" target=3D"_bl=
ank">giuseppe.ragusa(a)hotmail.com</a>&gt=3B</span>
wrote:<br>=0A=
<blockquote class=3D"ecxgmail_quote" style=3D"border-left:1px #ccc
solid=3B=
padding-left:1ex=3B">=0A=
=0A=
=0A=
<div><div dir=3D"ltr">Hi Didi=2C<br>many thanks for your
invaluable help!<b=
r><br>I'll try your suggestion (/etc/ovirt-host-deploy.conf.d/99-prevent-ip=
tables.conf) asap and then I will report back.<br><br>By the way: I have a =
really custom iptables setup (multiple separated networks on hypervisor hos=
ts)=2C so I suppose it's best to hand tune firewall rules and then leave th=
em alone (I pre-configure them=2C so the setup procedure won't be impeded i=
n its communication needs anyway AND I will always guarantee the most strin=
gent filtering possible with default deny ecc.).<br>=0A=
<br>Many thanks
again=2C<br>Giuseppe<br><br><div><hr>Date: Tue=2C 25 Mar
20=
14 04:05:33 -0400<br>From: <a href=3D"mailto:didi@redhat.com"
target=3D"_bl=
ank">didi(a)redhat.com</a><br>To: <a
href=3D"mailto:giuseppe.ragusa@hotmail.c=
om"
target=3D"_blank">giuseppe.ragusa(a)hotmail.com</a><br>=0A=
CC: <a href=3D"mailto:users@ovirt.org"
target=3D"_blank">users(a)ovirt.org</a=
<br>Subject: Re: [Users] Otopi pre-seeded answers and firewall
settings<br=
<br><div style=3D"font-size:12pt=3Bfont-family:times new roman=2Cnew york=
=2Ctimes=2Cserif=3B">=0A=
<div></div><blockquote
style=3D"padding-left:5px=3Bfont-size:12pt=3Bfont-st=
yle:normal=3Bfont-family:Helvetica=2CArial=2Csans-serif=3Btext-decoration:n=
one=3Bfont-weight:normal=3Bborder-left:2px solid #1010ff=3B"><b>From:
</b>"=
Giuseppe Ragusa" <=3B<a
href=3D"mailto:giuseppe.ragusa@hotmail.com" targe=
t=3D"_blank">giuseppe.ragusa(a)hotmail.com</a>&gt=3B<br>=0A=
<b>To: </b>"Yedidyah Bar David" <=3B<a
href=3D"mailto:didi@redhat.com" ta=
rget=3D"_blank">didi(a)redhat.com</a>&gt=3B<br><b>Cc:
</b>"<a href=3D"mailto:=
Users(a)ovirt.org" target=3D"_blank">Users(a)ovirt.org</a>"
<=3B<a href=3D"ma=
ilto:users@ovirt.org"
target=3D"_blank">users(a)ovirt.org</a>&gt=3B<br>=0A=
<b>Sent: </b>Tuesday=2C March 25=2C 2014 1:53:20 AM<br><b>Subject:
</b>RE: =
[Users] Otopi pre-seeded answers and firewall
settings<br><div><br></div><d=
iv dir=3D"ltr">Hi Didi=2C<br>I found the references to
NETWORK/iptablesEnab=
le in my engine logs (/var/log/ovirt-engine/host-deploy/ovirt-*.log)=2C but=
it didn't seem to work after all.<br>=0A=
<div><br></div>Full logs
attached.<br><div><br></div>I resurrected my Engin=
e by rebooting the (still only) host=2C then restarting ovirt-ha-agent (at =
startup the agent failed while trying to launch vdsm=2C but I found vdsm ru=
nning and so tried manually...).</div>=0A=
</blockquote><div><br></div><div>OK=2C so it's
host-deploy that's doing tha=
t.</div><div>But it's not host-deploy itself - it's the engine that is
talk=
ing to it=2C asking it to configure iptables.</div><div>I don't know how
to=
make the agent don't do that. I searched a bit the sources (which I don't =
know)</div>=0A=
<div>and didn't find a simple
way.</div><div><br></div><div>You can=2C howe=
ver=2C try to override this by:</div><div># mkdir -p /etc/ovirt-host-deploy=
.conf.d</div><div># echo '[environment:enforce]'
>=3B =3B/etc/ovirt-h=
ost-deploy.conf.d/99-prevent-iptables.conf</div>=0A=
<div># echo 'NETWORK/iptablesEnable=3Dbool:False'
>=3B>=3B =3B/etc/=
ovirt-host-deploy.conf.d/99-prevent-iptables.conf</div><div><br></div><div>=
Never tried that=2C and not sure it's recommended - if it does work=2C it m=
eans that host-deploy will not</div>=0A=
<div>update iptables=2C but the engine will think it did. So it's better to=
find a way to make the engine not do</div><div>that. Or=2C better yet=2C t=
hat you'll explain why you need this and somehow make the engine do what yo=
u want...</div>=0A=
<span class=3D"ecxHOEnZb"><font
color=3D"#888888"><div><span style=3D"font-=
size:12pt=3B">-- =3B</span></div><div>Didi</div><div><br></div></font><=
/span></div></div> </div></div>=0A=
<br>_______________________________________________<br>=0A=
Users mailing list<br>=0A=
<a
href=3D"mailto:Users@ovirt.org">Users@ovirt.org</a><br>=0A=
<a href=3D"http://lists.ovirt.org/mailman/listinfo/users"
target=3D"_blank"=
<br></blockquote></div><br></div></div>
</div></body>
</html>=
--_64b96cf8-fdd4-4df4-bf3e-459817379ccc_--
1:18 a.m.
New subject: [Users] Otopi pre-seeded answers and firewall settings
Giuseppe,
I should have clarified. I meant to blacklist the packages only for a
short time, while you add the nodes to the oVirt environment. Once
everything was set up, you would remove these restrictions and yum install
iptables. You'd then configure to taste.
Glad to hear of your success with the conf file method, though.
Thanks,
Joshua
On Tue, Mar 25, 2014 at 6:15 PM, Giuseppe Ragusa <
giuseppe.ragusa(a)hotmail.com> wrote:
Hi Joshua,
many thanks for your suggestion which I suppose would work perfectly, but
I actually want iptables (CentOS 6.5 here, so no firewalld) rules in place
all the time, but only "MY OWN" iptables rules ;>
Regards,
Giuseppe
------------------------------
Date: Tue, 25 Mar 2014 18:04:04 -0400
Subject: Re: [Users] Otopi pre-seeded answers and firewall settings
From: josh(a)wrale.com
To: giuseppe.ragusa(a)hotmail.com
Perhaps you could add the iptables and firewalld packages to yum.conf as
excludes. I don't know if this would fail silently, but if so, the engine
installer would never know.
Thanks,
Joshua
On Tue, Mar 25, 2014 at 5:49 PM, Giuseppe Ragusa <
giuseppe.ragusa(a)hotmail.com> wrote:
Hi Didi,
many thanks for your invaluable help!
I'll try your suggestion
(/etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf) asap and then I
will report back.
By the way: I have a really custom iptables setup (multiple separated
networks on hypervisor hosts), so I suppose it's best to hand tune firewall
rules and then leave them alone (I pre-configure them, so the setup
procedure won't be impeded in its communication needs anyway AND I will
always guarantee the most stringent filtering possible with default deny
ecc.).
Many thanks again,
Giuseppe
------------------------------
Date: Tue, 25 Mar 2014 04:05:33 -0400
From: didi(a)redhat.com
To: giuseppe.ragusa(a)hotmail.com
CC: users(a)ovirt.org
Subject: Re: [Users] Otopi pre-seeded answers and firewall settings
*From: *"Giuseppe Ragusa" <giuseppe.ragusa(a)hotmail.com>
*To: *"Yedidyah Bar David" <didi(a)redhat.com>
*Cc: *"Users(a)ovirt.org" <users(a)ovirt.org>
*Sent: *Tuesday, March 25, 2014 1:53:20 AM
*Subject: *RE: [Users] Otopi pre-seeded answers and firewall settings
Hi Didi,
I found the references to NETWORK/iptablesEnable in my engine logs
(/var/log/ovirt-engine/host-deploy/ovirt-*.log), but it didn't seem to work
after all.
Full logs attached.
I resurrected my Engine by rebooting the (still only) host, then
restarting ovirt-ha-agent (at startup the agent failed while trying to
launch vdsm, but I found vdsm running and so tried manually...).
OK, so it's host-deploy that's doing that.
But it's not host-deploy itself - it's the engine that is talking to it,
asking it to configure iptables.
I don't know how to make the agent don't do that. I searched a bit the
sources (which I don't know)
and didn't find a simple way.
You can, however, try to override this by:
# mkdir -p /etc/ovirt-host-deploy.conf.d
# echo '[environment:enforce]'
> /etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf
# echo 'NETWORK/iptablesEnable=bool:False'
>> /etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf
Never tried that, and not sure it's recommended - if it does work, it
means that host-deploy will not
update iptables, but the engine will think it did. So it's better to find
a way to make the engine not do
that. Or, better yet, that you'll explain why you need this and somehow
make the engine do what you want...
--
Didi
_______________________________________________
Users mailing list
Users(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
3895
days inactive
3895
days old
1 comments
2 participants
participants (2)
-
Giuseppe Ragusa -
Joshua Dotson