August 2016 - Users - oVirt List Archives

qemu-kvm-ev-2.3.0-31.el7_2.21.1 available for testing on x86_64, ppc64le and aarch64
by Sandro Bonazzola 19 Aug '16

19 Aug '16

qemu-kvm-ev-2.3.0-31.el7_2.21.1 has been tagged for testing for CentOS Virt SIG and is already in testing repositories. It's now available for x86_64, ppc64le and aarch64. Please help testing and providing feedback, thanks. We plan to move to stable repo around Wednesday next week. ChangeLog since previous release: * Fri Aug 19 2016 Sandro Bonazzola <sbonazzo(a)redhat.com> - ev-2.3.0-31.el7_2.21 - Removing RH branding from package name * Tue Aug 02 2016 Miroslav Rezanina <mrezanin(a)redhat.com> - rhev-2.3.0-31.el7_2.21 - kvm-block-iscsi-avoid-potential-overflow-of-acb-task-cdb.patch [bz#1358997] - Resolves: bz#1358997 (CVE-2016-5126 qemu-kvm-rhev: Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl [rhel-7.2.z]) * Wed Jul 27 2016 Miroslav Rezanina <mrezanin(a)redhat.com> - rhev-2.3.0-31.el7_2.20 - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359731] - Resolves: bz#1359731 (EMBARGOED CVE-2016-5403 qemu-kvm-rhev: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-7.2.z]) * Wed Jul 20 2016 Miroslav Rezanina <mrezanin(a)redhat.com> - rhev-2.3.0-31.el7_2.19 - kvm-qemu-sockets-use-qapi_free_SocketAddress-in-cleanup.patch [bz#1354090] - kvm-tap-use-an-exit-notifier-to-call-down_script.patch [bz#1354090] - kvm-slirp-use-exit-notifier-for-slirp_smb_cleanup.patch [bz#1354090] - kvm-net-do-not-use-atexit-for-cleanup.patch [bz#1354090] - Resolves: bz#1354090 (Boot guest with vhostuser server mode, QEMU prompt 'Segmentation fault' after executing '(qemu)system_powerdown') * Fri Jul 08 2016 Miroslav Rezanina <mrezanin(a)redhat.com> - rhev-2.3.0-31.el7_2.18 - kvm-vhost-user-disable-chardev-handlers-on-close.patch [bz#1351892] - kvm-char-clean-up-remaining-chardevs-when-leaving.patch [bz#1351892] - kvm-sockets-add-helpers-for-creating-SocketAddress-from-.patch [bz#1351892] - kvm-socket-unlink-unix-socket-on-remove.patch [bz#1351892] - kvm-char-do-not-use-atexit-cleanup-handler.patch [bz#1351892] - Resolves: bz#1351892 (vhost-user: A socket file is not deleted after VM's port is detached.) * Tue Jun 28 2016 Miroslav Rezanina <mrezanin(a)redhat.com> - rhev-2.3.0-31.el7_2.17 - kvm-vhost-user-set-link-down-when-the-char-device-is-clo.patch [bz#1348593] - kvm-vhost-user-fix-use-after-free.patch [bz#1348593] - kvm-vhost-user-test-fix-up-rhel6-build.patch [bz#1348593] - kvm-vhost-user-test-fix-migration-overlap-test.patch [bz#1348593] - kvm-vhost-user-test-fix-chardriver-race.patch [bz#1348593] - kvm-vhost-user-test-use-unix-port-for-migration.patch [bz#1348593] - kvm-vhost-user-test-fix-crash-with-glib-2.36.patch [bz#1348593] - kvm-vhost-user-test-use-correct-ROM-to-speed-up-and-avoi.patch [bz#1348593] - kvm-tests-append-i386-tests.patch [bz#1348593] - kvm-vhost-user-add-ability-to-know-vhost-user-backend-di.patch [bz#1348593] - kvm-qemu-char-add-qemu_chr_disconnect-to-close-a-fd-acce.patch [bz#1348593] - kvm-vhost-user-disconnect-on-start-failure.patch [bz#1348593] - kvm-vhost-net-do-not-crash-if-backend-is-not-present.patch [bz#1348593] - kvm-vhost-net-save-restore-vhost-user-acked-features.patch [bz#1348593] - kvm-vhost-net-save-restore-vring-enable-state.patch [bz#1348593] - kvm-test-start-vhost-user-reconnect-test.patch [bz#1348593] - Resolves: bz#1348593 (No recovery after vhost-user process restart) -- Sandro Bonazzola Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com

1 0

3.5 / 3.6 stuck
by Erik Brakke 19 Aug '16

19 Aug '16

Hello, I changed my cluster and data center compatibility from 3.5 to 3.6 with a 3.5 host. D'oh! Engine: 3.6 on FC22 Host: 3.5 on FC22 (local storage) - Can I change the data center and cluster back to 3.5? How? - I tried to upgrade host to 3.6 in the GUI. Maintenance->Reinstall did not work, and Upgrade option is greyed out. Is there a way to upgrade host to 3.6? Thanks

2 3

Cannot start hosted engine after last 4.0.1 packages
by Matt . 19 Aug '16

19 Aug '16

Hello, I'm having issues after the last 4.0.1 package just before 4.0.2 came out. My engine was running great, hosts started the vm also and the hosted-engine command was working fine. Now I get rpcxml 3.6 deprecated warning which I never got before. See the attachment for this output. I have checked is IPv6 was disabled, but it isn't as that is what is needed for this. Any clue ? Thanks! Matt

3 10

[ANN] oVirt 4.0.2 Post Release update is now available
by Sandro Bonazzola 19 Aug '16

19 Aug '16

The oVirt Project is pleased to announce the availability of an oVirt 4.0.2 post release update, as of August 19th, 2016. This update includes a new build of oVirt Engine fixing: Bug 1367483 - Installing a 3.6 host to rhev-m 4.0 results in 'ovirtmgmt' network as out of sync See the release notes [1] for installation / upgrade instructions and a list of new features and bugs fixed. Notes: * A new oVirt Live ISO is available. [2] * A new oVirt Engine Appliance is already available. * Mirrors[3] might need up to one day to synchronize. Additional Resources: * Read more about the oVirt 4.0.2 release highlights: http://www.ovirt.org/release/4.0.2/ * Get more oVirt Project updates on Twitter: https://twitter.com/ovirt * Check out the latest project news on the oVirt blog: http://www.ovirt.org/blog/ [1] http://www.ovirt.org/release/4.0.2/ [2] http://resources.ovirt.org/pub/ovirt-4.0/iso/ [3] http://www.ovirt.org/Repository_mirrors#Current_mirrors -- Sandro Bonazzola Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com

1 0

Re: [ovirt-users] HostedEngine with HA
by Carlos Rodrigues 18 Aug '16

18 Aug '16

On Thu, 2016-08-18 at 08:55 +0200, Simone Tiraboschi wrote: > On Wed, Aug 17, 2016 at 11:06 AM, Carlos Rodrigues <cmar(a)eurotux.com> > wrote: > > > > Anyone can help me to build HA on HostedEngine VM? > > > > How can i guarantee that if host with HostedEngine VM goes down, > > the > > HostedEngine VM moves to another host? > > it's in charge of ovirt-ha-agent running on your hosts. > > Can you please post the output of > hosted-engine --vm-status > ? There is the output of both hosts: [root@ied-blade11 ~]# hosted-engine --vm-status /usr/lib/python2.7/site- packages/ovirt_hosted_engine_ha/lib/storage_backends.py:15: DeprecationWarning: vdscli uses xmlrpc. since ovirt 3.6 xmlrpc is deprecated, please use vdsm.jsonrpcvdscli import vdsm.vdscli --== Host 1 status ==-- Status up-to-date : True Hostname : ied-blade13.install.eurotux.local Host ID : 1 Engine status : {"health": "good", "vm": "up", "detail": "up"} Score : 3400 stopped : False Local maintenance : False crc32 : a941698e Host timestamp : 153049 Extra metadata (valid at timestamp): metadata_parse_version=1 metadata_feature_version=1 timestamp=153049 (Thu Aug 18 09:22:02 2016) host-id=1 score=3400 maintenance=False state=EngineUp stopped=False --== Host 2 status ==-- Status up-to-date : True Hostname : ied-blade11.install.eurotux.local Host ID : 2 Engine status : {"reason": "vm not running on this host", "health": "bad", "vm": "down", "detail": "unknown"} Score : 3400 stopped : False Local maintenance : False crc32 : 8f79e0e7 Host timestamp : 143139 Extra metadata (valid at timestamp): metadata_parse_version=1 metadata_feature_version=1 timestamp=143139 (Thu Aug 18 09:22:12 2016) host-id=2 score=3400 maintenance=False state=EngineDown stopped=False [root@ied-blade13 ~]# hosted-engine --vm-status /usr/lib/python2.7/site- packages/ovirt_hosted_engine_ha/lib/storage_backends.py:15: DeprecationWarning: vdscli uses xmlrpc. since ovirt 3.6 xmlrpc is deprecated, please use vdsm.jsonrpcvdscli import vdsm.vdscli --== Host 1 status ==-- Status up-to-date : True Hostname : ied-blade13.install.eurotux.local Host ID : 1 Engine status : {"health": "good", "vm": "up", "detail": "up"} Score : 3400 stopped : False Local maintenance : False crc32 : cdd022a2 Host timestamp : 153085 Extra metadata (valid at timestamp): metadata_parse_version=1 metadata_feature_version=1 timestamp=153085 (Thu Aug 18 09:22:38 2016) host-id=1 score=3400 maintenance=False state=EngineUp stopped=False --== Host 2 status ==-- Status up-to-date : True Hostname : ied-blade11.install.eurotux.local Host ID : 2 Engine status : {"reason": "vm not running on this host", "health": "bad", "vm": "down", "detail": "unknown"} Score : 3400 stopped : False Local maintenance : False crc32 : fbbad961 Host timestamp : 143175 Extra metadata (valid at timestamp): metadata_parse_version=1 metadata_feature_version=1 timestamp=143175 (Thu Aug 18 09:22:48 2016) host-id=2 score=3400 maintenance=False state=EngineDown stopped=False > > > > > Regards, > > Carlos Rodrigues > > > > On Tue, 2016-08-16 at 11:53 +0100, Carlos Rodrigues wrote: > > > > > > On Sun, 2016-08-14 at 14:22 +0300, Roy Golan wrote: > > > > > > > > > > > > > > > > > > > > On 12 August 2016 at 20:23, Carlos Rodrigues <cmar(a)eurotux.com> > > > > wrote: > > > > > > > > > > > > > > > Hello, > > > > > > > > > > I have one cluster with two hosts with power management > > > > > correctly > > > > > configured and one virtual machine with HostedEngine over > > > > > shared > > > > > storage with FiberChannel. > > > > > > > > > > When i shutdown the network of host with HostedEngine VM, it > > > > > should be > > > > > possible the HostedEngine VM migrate automatically to another > > > > > host? > > > > > > > > > migrate on which network? > > > > > > > > > > > > > > > > > > > What is the expected behaviour on this HA scenario? > > > > > > > > After a few minutes your vm will be shutdown by the High > > > > Availability > > > > agent, as it can't see network, and started on another host. > > > > > > > > > I'm testing this scenario and after shutdown network, it should > > > be > > > expected that agent shutdown ha and started on another host, but > > > after > > > couple minutes nothing happens and on host with network we > > > getting > > > the > > > following messages: > > > > > > Aug 16 11:44:08 ied-blade11.install.eurotux.local ovirt-ha- > > > agent[2779]: > > > ovirt-ha-agent > > > ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine.config > > > ERROR > > > Unable to get vm.conf from OVF_STORE, falling back to initial > > > vm.conf > > > > > > I think the HA agent its trying to get vm configuration but some > > > how > > > it > > > can't get vm.conf to start VM. > > > > > > Regards, > > > Carlos Rodrigues > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > -- > > > > > Carlos Rodrigues > > > > > > > > > > Engenheiro de Software Sénior > > > > > > > > > > Eurotux Informática, S.A. | www.eurotux.com > > > > > (t) +351 253 680 300 (m) +351 911 926 110 > > > > > > > > > > _______________________________________________ > > > > > Users mailing list > > > > > Users(a)ovirt.org > > > > > http://lists.ovirt.org/mailman/listinfo/users > > > > > > > > > > > -- > > Carlos Rodrigues > > > > Engenheiro de Software Sénior > > > > Eurotux Informática, S.A. | www.eurotux.com > > (t) +351 253 680 300 (m) +351 911 926 110 > > > > _______________________________________________ > > Users mailing list > > Users(a)ovirt.org > > http://lists.ovirt.org/mailman/listinfo/users -- Carlos Rodrigues Engenheiro de Software Sénior Eurotux Informática, S.A. | www.eurotux.com (t) +351 253 680 300 (m) +351 911 926 110

1 0

Change local DC host address
by Alexandr Krivulya 18 Aug '16

18 Aug '16

Hi! There is any way to change host address in a local DC? In web-ui it's grayed out, ovirt-shell gives an error: status: 400 reason: Bad Request detail: Host Address can not be modified due to Security restrictions. In order to change Host Address, Host has to be reinstalled Reinstall host is not a solution with local DC.

2 2

Is hosted engine supported in hosts with diff CPU types?
by Fredy Sanchez 18 Aug '16

18 Aug '16

Hi all, I am deploying hosted engine in what will hopefully become our 4th oVirt cluster. The engine is up and running happily in host 1 already, but I am running into the following when running hosted-engine --deploy in hosts 2 and 3: The following CPU types are supported by this host: - model_Opteron_G3: AMD Opteron G3 - model_Opteron_G2: AMD Opteron G2 - model_Opteron_G1: AMD Opteron G1 [ ERROR ] Failed to execute stage 'Environment customization': Invalid CPU type specified: model_SandyBridge Host 1 has an Intel chip. Hosts 2 and 3 have an AMD chip. Is this a supported config? If so, how can I bypass the error? Thank you very much. Cheers, Fredy

2 1

Ovirt 4.0 Login Issue
by Melissa Mesler 17 Aug '16

17 Aug '16

I am running 4.0 on CentOS 7.2. Sometimes when I first log in to the admin page, it will give me and error that says "Request state does not match session state." Then if I go through the process of logging in again, it will go through with no issue. It doesn't do this every time but it does do it quite often. Any ideas on why? - MeLLy

5 7

ovirt 4.0 installation
by knarra 17 Aug '16

17 Aug '16

Hi, I see the below error logged in vdsm.log file . can some one help me understand what this error is and do we have any bug for this error? JsonRpc (StompReactor)::ERROR::2016-08-17 12:32:05,348::betterAsyncore::113::vds.dispatcher::(recv) SSL error during reading data: unexpected eof Another thing i observed is , f the UI is idle for some time it gets logged out automatically. When i try logging in the same session is see that "Request state does not match session state". click here to continue. why is this? Thanks kasturi

4 4

转发: Running VM reports error when using qemu-2.5.1 replace qemu-kvm-ev 2.3.0 in vdsm 4.18.11
by lifuqiong 17 Aug '16

17 Aug '16

This is a multipart message in MIME format. ------=_NextPart_000_0050_01D1F8B4.53BCD120 Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: quoted-printable =20 Hi all, I installed vdsm 4.18.11 in ovirt engine 4.0.2, uninstall qemu-kvm-ev 2.3.0 with rpm =A8Ce =A8Cnodeps, and then compile and make = install qemu 2.5.1;=20 =20 The vdsm host is still up in ovirt engine, but when =A1=B0Run=A1=B1 Vm = in this vdsm host, it reports an error as: =20 internal error: process exited while connecting to monitor: Could not = access KVM kernel module: Permission denied failed to initialize KVM: Permission denied =20 Here is the error log in VM: LC_ALL=3DC PATH=3D/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin QEMU_AUDIO_DRV=3Dspice /usr/local/bin/qemu-system-x86_64 -name vm1111111111111111111111 -S -machine pc-i440fx-2.1,accel=3Dkvm,usb=3Doff = -cpu Conroe -m size=3D1048576k,slots=3D16,maxmem=3D4294967296k -realtime = mlock=3Doff -smp 1,maxcpus=3D16,sockets=3D16,cores=3D1,threads=3D1 -numa node,nodeid=3D0,cpus=3D0,mem=3D1024 -uuid = ba183268-e53c-4c7d-bfa5-1b5c32ab1965 -smbios type=3D1,manufacturer=3DoVirt,product=3DoVirt Node,version=3D7-2.1511.el7.centos.2.10,serial=3D4C4C4544-0031-3510-8059-= B5C04F4 E4432,uuid=3Dba183268-e53c-4c7d-bfa5-1b5c32ab1965 -no-user-config = -nodefaults -chardev socket,id=3Dcharmonitor,path=3D/var/lib/libvirt/qemu/domain-vm11111111111= 1111111 1111/monitor.sock,server,nowait -mon chardev=3Dcharmonitor,id=3Dmonitor,mode=3Dcontrol -rtc base=3D2016-08-17T02:02:48,driftfix=3Dslew -global kvm-pit.lost_tick_policy=3Ddiscard -no-hpet -no-shutdown -boot = strict=3Don -device piix3-usb-uhci,id=3Dusb,bus=3Dpci.0,addr=3D0x1.0x2 -device virtio-serial-pci,id=3Dvirtio-serial0,max_ports=3D16,bus=3Dpci.0,addr=3D0= x5 -drive if=3Dnone,id=3Ddrive-ide0-1-0,readonly=3Don,format=3Draw -device ide-cd,bus=3Dide.1,unit=3D0,drive=3Ddrive-ide0-1-0,id=3Dide0-1-0 -drive file=3D/rhev/data-center/00000001-0001-0001-0001-0000000003c7/cddc3813-5d= b5-45 82-a325-08676dc2e44c/images/6068705a-289d-4aef-a847-1c2331e1fe6c/2426ea66= -bd 04-494a-afa5-09bdfbc1a17e,if=3Dnone,id=3Ddrive-virtio-disk0,format=3Dqcow= 2,serial=3D 6068705a-289d-4aef-a847-1c2331e1fe6c,cache=3Dnone,werror=3Dstop,rerror=3D= stop,aio=3D threads -device virtio-blk-pci,scsi=3Doff,bus=3Dpci.0,addr=3D0x6,drive=3Ddrive-virtio-dis= k0,id=3Dvirti o-disk0,bootindex=3D1 -netdev = tap,fd=3D27,id=3Dhostnet0,vhost=3Don,vhostfd=3D28 -device virtio-net-pci,netdev=3Dhostnet0,id=3Dnet0,mac=3D00:1a:4a:16:01:5e,bus=3D= pci.0,addr=3D 0x3 -chardev socket,id=3Dcharchannel0,path=3D/var/lib/libvirt/qemu/channels/ba183268-e= 53c-4c7 d-bfa5-1b5c32ab1965.com.redhat.rhevm.vdsm,server,nowait -device virtserialport,bus=3Dvirtio-serial0.0,nr=3D1,chardev=3Dcharchannel0,id=3D= channel0,na me=3Dcom.redhat.rhevm.vdsm -chardev socket,id=3Dcharchannel1,path=3D/var/lib/libvirt/qemu/channels/ba183268-e= 53c-4c7 d-bfa5-1b5c32ab1965.org.qemu.guest_agent.0,server,nowait -device virtserialport,bus=3Dvirtio-serial0.0,nr=3D2,chardev=3Dcharchannel1,id=3D= channel1,na me=3Dorg.qemu.guest_agent.0 -chardev = spicevmc,id=3Dcharchannel2,name=3Dvdagent -device virtserialport,bus=3Dvirtio-serial0.0,nr=3D3,chardev=3Dcharchannel2,id=3D= channel2,na me=3Dcom.redhat.spice.0 -spice tls-port=3D5900,addr=3D192.168.0.115,x509-dir=3D/etc/pki/vdsm/libvirt-spi= ce,tls-ch annel=3Ddefault,tls-channel=3Dmain,tls-channel=3Ddisplay,tls-channel=3Din= puts,tls-ch annel=3Dcursor,tls-channel=3Dplayback,tls-channel=3Drecord,tls-channel=3D= smartcard,t ls-channel=3Dusbredir,seamless-migration=3Don -device qxl-vga,id=3Dvideo0,ram_size=3D67108864,vram_size=3D33554432,vgamem_mb=3D= 16,bus=3Dpci. 0,addr=3D0x2 -device = virtio-balloon-pci,id=3Dballoon0,bus=3Dpci.0,addr=3D0x7 -msg timestamp=3Don Could not access KVM kernel module: Permission denied failed to initialize KVM: Permission denied 2016-08-17 02:02:48.418+0000: shutting down =20 =20 Hope someone help me. Thank you. Mark ------=_NextPart_000_0050_01D1F8B4.53BCD120 Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: quoted-printable <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dgb2312"> <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta name=3DGenerator = content=3D"Microsoft Word 14 (filtered medium)"><style></style></head><body lang=3DZH-CN link=3Dblue = vlink=3Dpurple style=3D'text-justify-trim:punctuation'><div = class=3DWordSection1><p class=3DMsoNormal align=3Dleft = style=3D'text-align:left'><span = lang=3DEN-US><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US>Hi all,<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US>         I = installed vdsm 4.18.11 in ovirt engine 4.0.2,  uninstall = qemu-kvm-ev 2.3.0 with rpm =A8Ce =A8Cnodeps,  and then compile and = make install qemu 2.5.1; <o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US><o:p> </o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US>The vdsm host is still up in ovirt = engine, but when =A1=B0Run=A1=B1 Vm in this vdsm host, it reports an = error as:<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US>internal error: process exited while connecting to monitor: = Could not access KVM kernel module: Permission = denied<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US>failed to initialize KVM: Permission = denied<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US>Here is the error log in VM:<o:p></o:p></span></p><p = class=3DMsoNormal><span lang=3DEN-US>LC_ALL=3DC = PATH=3D/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin = QEMU_AUDIO_DRV=3Dspice /usr/local/bin/qemu-system-x86_64 -name = vm1111111111111111111111 -S -machine pc-i440fx-2.1,accel=3Dkvm,usb=3Doff = -cpu Conroe -m size=3D1048576k,slots=3D16,maxmem=3D4294967296k -realtime = mlock=3Doff -smp 1,maxcpus=3D16,sockets=3D16,cores=3D1,threads=3D1 -numa = node,nodeid=3D0,cpus=3D0,mem=3D1024 -uuid = ba183268-e53c-4c7d-bfa5-1b5c32ab1965 -smbios = type=3D1,manufacturer=3DoVirt,product=3DoVirt = Node,version=3D7-2.1511.el7.centos.2.10,serial=3D4C4C4544-0031-3510-8059-= B5C04F4E4432,uuid=3Dba183268-e53c-4c7d-bfa5-1b5c32ab1965 -no-user-config = -nodefaults -chardev = socket,id=3Dcharmonitor,path=3D/var/lib/libvirt/qemu/domain-vm11111111111= 11111111111/monitor.sock,server,nowait -mon = chardev=3Dcharmonitor,id=3Dmonitor,mode=3Dcontrol -rtc = base=3D2016-08-17T02:02:48,driftfix=3Dslew -global = kvm-pit.lost_tick_policy=3Ddiscard -no-hpet -no-shutdown -boot = strict=3Don -device piix3-usb-uhci,id=3Dusb,bus=3Dpci.0,addr=3D0x1.0x2 = -device = virtio-serial-pci,id=3Dvirtio-serial0,max_ports=3D16,bus=3Dpci.0,addr=3D0= x5 -drive if=3Dnone,id=3Ddrive-ide0-1-0,readonly=3Don,format=3Draw = -device ide-cd,bus=3Dide.1,unit=3D0,drive=3Ddrive-ide0-1-0,id=3Dide0-1-0 = -drive = file=3D/rhev/data-center/00000001-0001-0001-0001-0000000003c7/cddc3813-5d= b5-4582-a325-08676dc2e44c/images/6068705a-289d-4aef-a847-1c2331e1fe6c/242= 6ea66-bd04-494a-afa5-09bdfbc1a17e,if=3Dnone,id=3Ddrive-virtio-disk0,forma= t=3Dqcow2,serial=3D6068705a-289d-4aef-a847-1c2331e1fe6c,cache=3Dnone,werr= or=3Dstop,rerror=3Dstop,aio=3Dthreads -device = virtio-blk-pci,scsi=3Doff,bus=3Dpci.0,addr=3D0x6,drive=3Ddrive-virtio-dis= k0,id=3Dvirtio-disk0,bootindex=3D1 -netdev = tap,fd=3D27,id=3Dhostnet0,vhost=3Don,vhostfd=3D28 -device = virtio-net-pci,netdev=3Dhostnet0,id=3Dnet0,mac=3D00:1a:4a:16:01:5e,bus=3D= pci.0,addr=3D0x3 -chardev = socket,id=3Dcharchannel0,path=3D/var/lib/libvirt/qemu/channels/ba183268-e= 53c-4c7d-bfa5-1b5c32ab1965.com.redhat.rhevm.vdsm,server,nowait -device = virtserialport,bus=3Dvirtio-serial0.0,nr=3D1,chardev=3Dcharchannel0,id=3D= channel0,name=3Dcom.redhat.rhevm.vdsm -chardev = socket,id=3Dcharchannel1,path=3D/var/lib/libvirt/qemu/channels/ba183268-e= 53c-4c7d-bfa5-1b5c32ab1965.org.qemu.guest_agent.0,server,nowait -device = virtserialport,bus=3Dvirtio-serial0.0,nr=3D2,chardev=3Dcharchannel1,id=3D= channel1,name=3Dorg.qemu.guest_agent.0 -chardev = spicevmc,id=3Dcharchannel2,name=3Dvdagent -device = virtserialport,bus=3Dvirtio-serial0.0,nr=3D3,chardev=3Dcharchannel2,id=3D= channel2,name=3Dcom.redhat.spice.0 -spice = tls-port=3D5900,addr=3D192.168.0.115,x509-dir=3D/etc/pki/vdsm/libvirt-spi= ce,tls-channel=3Ddefault,tls-channel=3Dmain,tls-channel=3Ddisplay,tls-cha= nnel=3Dinputs,tls-channel=3Dcursor,tls-channel=3Dplayback,tls-channel=3Dr= ecord,tls-channel=3Dsmartcard,tls-channel=3Dusbredir,seamless-migration=3D= on -device = qxl-vga,id=3Dvideo0,ram_size=3D67108864,vram_size=3D33554432,vgamem_mb=3D= 16,bus=3Dpci.0,addr=3D0x2 -device = virtio-balloon-pci,id=3Dballoon0,bus=3Dpci.0,addr=3D0x7 -msg = timestamp=3Don<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US>Could not access KVM kernel module: Permission = denied<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US>failed to initialize KVM: Permission = denied<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US>2016-08-17 02:02:48.418+0000: shutting = down<o:p></o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US><o:p> </o:p></span></p><p class=3DMsoNormal><span = lang=3DEN-US>Hope someone help me. Thank you.<o:p></o:p></span></p><p = class=3DMsoNormal><span = lang=3DEN-US>Mark<o:p></o:p></span></p></div></body></html> ------=_NextPart_000_0050_01D1F8B4.53BCD120--

1 0

Upgrade hosts/nodes from engine
by Hanson 17 Aug '16

17 Aug '16

Hi Guys, Quick question, I have my nodes on a bond-bridge-privateVlan setup, and my engine on a bond-bridge-publicVlan setup for remote monitoring. Understandably, the nodes are complaining that they are failing updates. (They're on a private vlan, and only configured with IP's in that vlan, the public vlan doesn't have IP's set on the hosts so they can pass it to VMs). Is there a way to have the engine do the updates on the node using its internet connection, like a proxy? For security reasons I like to have the nodes not publicly accessible, as we see hundreds if not thousands of ssh attempts, and root would probably be the most attacked account. Thanks, Hanson

4 3

oVirt Reports
by Fernando Fuentes 16 Aug '16

16 Aug '16

Team, I got two oVirt Servers. One in 4.0.2 and one in 3.6.X I love the new 4.0 dashboard, But I need a way to continue to build reports with ease, 3.6 Can do this with ovirt-reports. How can I make my oVirt 4.0.2 send data for reports to my ovirt reports on 3.6? Thanks for the help team! Regards, -- Fernando Fuentes ffuentes(a)txweather.org http://www.txweather.org

3 8

ovirt 3.6 python sdk how to find logical network from a host nic?
by Huan He (huhe) 16 Aug '16

16 Aug '16

Assuming the logical network ovirtmgmt has been configured in host NIC enp6s0. host = api.hosts.get('host-123') host_nic = host.nics.get('enp6s0') How to get the logical network name ovirtmgmt? I basically need to find ovirtmgmt is configured in which NIC. Thanks, Huan

2 3

Gluster replication on 1Gb interfaces
by Fernando Frediani 16 Aug '16

16 Aug '16

Hi all. I understand using 10Gb interfaces when using Gluster is advised for helping with data replication specially in situations where a node went down for a while and need to re-sync data. However can anyone tell if using one 1Gb interface dedicated for it in hosts with 1.8 TB of Raw storage would be still Ok or can it cause severe impact on performance ? What are the chances of a 1Gb nice being saturated during normal operation ? Thanks Fernando

2 1

edit gluster storage domain
by Edward Clay 16 Aug '16

16 Aug '16

Hello, I need to edit a glusterfs storage domain to add the mount option " backupvolfile-server=SERVER" So when the primary servers IP is not accessible the remaining servers will be used to retrieve data stored on the gluster volume. Right now when I try to edit the storage domain the mount options box is grayed out and not editable. I recently had to take all vms down so I put the HV in maintenance mode and the edit options wasn't present. I need to understand if this is the correct option to make a glusterfs volume fault tolerant? Also I need to understand how to make this edit in the ovirt web interface or other method. TIA

2 6

qos problem in ovirt python sdk
by like.ma＠cs2c.com.cn 16 Aug '16

16 Aug '16

This is a multi-part message in MIME format. ------=_001_NextPart335580042548_=---- Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 SGVsbG8sDQoNCkknbSB1c2luZyBvdmlydDMuNi43LCBhbmQgaSB3YW50IHRvIHVzZSBRb1MgZnVu Y3Rpb24gYnkgcmVzdGFwaS4gQnV0IGkgZm91bnQgaSBjYW4ndCB1cGRhdGUgdGhlIHFvcyB0byB1 bmxpbWl0ZWQuIA0KRm9yIGV4YW1wbGUsIGkgYXNzaWduZWQgYSBxb3MgbmFtZWQgcW9zMSB0byBh IHZuaWMgcHJvZmlsZSBuYW1lZCB2cHJvZmlsZTEsIHRoZW4gaSB3YW50IHRvIHNldCB0aGUgcW9z IG9mIHZwcm9maWxlMSB0byB1bmxpbWl0ZWQsDQpzbyBpIHNldCB0aGUgcW9zIHRvIE5vbmUgaW4g c2RrIHdoZW4gdXBkYXRlIHZuaWMgcHJvZmlsZSwgYnV0IGFmdGVyIHVwZGF0ZSB0aGUgdm5pYyBw cm9maWxlIHN0aWxsIGhhcyBxb3MgbmFtZWQgcW9zMS4NCg0KU28sIGhvdyBzaG91bGQgaSBkbyBp ZiBpIHdhbnQgdG8gc2V0IHFvcyBvZiBhIHZuaWMgcHJvZmlsZSB0byB1bmxpbWl0ZWQ/DQoNCkxv b2sgZm9yd2FyZCB0byB5b3VyIGhlbHAhDQpUaGFua3MgDQoNCg0KDQpsaWtlLm1hQGNzMmMuY29t LmNuDQo= ------=_001_NextPart335580042548_=---- Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: quoted-printable <html><head><meta http-equiv=3D"content-type" content=3D"text/html; charse= t=3DGB2312"><style>body { line-height: 1.5; }body { font-size: 10.5pt; fon= t-family: =CE=A2=C8=ED=D1=C5=BA=DA; color: rgb(0, 0, 0); line-height: 1.5;= }</style></head><body>=0A<div><span></span><div style=3D"font-family: =CE= =A2=C8=ED=D1=C5=BA=DA, Tahoma; line-height: normal;"><div>Hello,<br><br></= div>I'm using ovirt3.6.7, and i want to use QoS function by restapi. But i= fount i can't update the qos to unlimited. </div></div><div style=3D= "font-family: =CE=A2=C8=ED=D1=C5=BA=DA, Tahoma; line-height: normal;">For = example, i assigned a qos named qos1 to a vnic profile named vprofile1, th= en i want to set the qos of vprofile1 to unlimited,</div><div style=3D"fon= t-family: =CE=A2=C8=ED=D1=C5=BA=DA, Tahoma; line-height: normal;">so i set= the qos to None in sdk when update vnic profile, but after update the vni= c profile still has qos named qos1.</div><div style=3D"font-family: =CE=A2= =C8=ED=D1=C5=BA=DA, Tahoma; line-height: normal;"><br></div><div style=3D"= font-family: =CE=A2=C8=ED=D1=C5=BA=DA, Tahoma; line-height: normal;">So, h= ow should i do if i want to set qos of a vnic profile to unlimited?</div><= div style=3D"font-family: =CE=A2=C8=ED=D1=C5=BA=DA, Tahoma; line-height: n= ormal;"><br></div><div style=3D"font-family: =CE=A2=C8=ED=D1=C5=BA=DA, Tah= oma; line-height: normal;">Look forward to your help!</div><div style=3D"f= ont-family: =CE=A2=C8=ED=D1=C5=BA=DA, Tahoma; line-height: normal;">Thanks=  </div>=0A<div><br></div><hr style=3D"width: 210px; height: 1px;" col= or=3D"#b5c4df" size=3D"1" align=3D"left">=0A<div><span><div style=3D"MARGI= N: 10px; FONT-FAMILY: verdana; FONT-SIZE: 10pt"><div>like.ma(a)cs2c.com.cn</= div></div></span></div>=0A</body></html> ------=_001_NextPart335580042548_=------

3 2

oVirt 4 with custom SSL-certificate and SPICE HTML5 browser client -> WebSocket error: Can't connect to websocket on URL: wss://ovirt.engine.fqdn:6100/
by aleksey.maksimov＠it-kb.ru 16 Aug '16

16 Aug '16

Hello oVirt guru`s ! I have successfully replaced the oVirt 4 site SSL-certificate according to the instructions from "Replacing oVirt SSL Certificate" section in "oVirt Administration Guide" http://www.ovirt.org/documentation/admin-guide/administration-guide/ 3 files have been replaced: /etc/pki/ovirt-engine/certs/apache.cer /etc/pki/ovirt-engine/keys/apache.key.nopass /etc/pki/ovirt-engine/apache-ca.pem Now the oVirt site using my certificate and everything works fine, but when I try to use SPICE HTML5 browser client in Firefox or Chrome I see a gray screen and message under the button "Toggle messages output": WebSocket error: Can't connect to websocket on URL: wss://ovirt.engine.fqdn:6100/eyJ...0=[object Event] Before replacing certificates SPICE HTML5 browser client works. Native SPICE client works fine. Tell me what to do with SPICE HTML5 browser client?

3 14

oVirt-shell command to move a disk
by Nicolas Ecarnot 16 Aug '16

16 Aug '16

Hello, I'm confused because though I'm using ovirt-shell to script many actions every day, and even after a large bunch of reading and testing, I can not find the correct syntax to move (offline/available) disks between storage domains. May you help me please? (oVirt 3.4.4) -- Nicolas Ecarnot

4 10

oVirt 4.0 and multipath.conf for HPE 3PAR. What do you advise?
by aleksey.maksimov＠it-kb.ru 16 Aug '16

16 Aug '16

Hello, oVirt guru's ! I installed oVirt 4.0 on several servers HP ProLiant DL360 G5 with QLogic/Emulex 4G dual-port HBAs. These servers have multipath connection to the storage system HP 3PAR 7200. Before installing oVirt to servers I set up the configuration file /etc/multipath.conf according to the vendor recommendations from document "HPE 3PAR Red Hat Enterprise Linux and Oracle Linux Implementation Guide (emr_na-c04448818-9.pdf)" https://blog.it-kb.ru/2016/06/12/configuring-device-mapper-multipathing-dm-… Before installing oVirt my multipath.conf was the: ---> start of /etc/multipath.conf <----- defaults { polling_interval 10 user_friendly_names no find_multipaths yes } blacklist { devnode "^cciss\/c[0-9]d[0-9]*" } multipaths { multipath { wwid 360002ac000000000000000160000cec9 alias 3par-vv2 } multipath { wwid 360002ac000000000000000170000cec9 alias 3par-vv1 } } devices { device { vendor "3PARdata" product "VV" path_grouping_policy group_by_prio path_selector "round-robin 0" path_checker tur features "0" hardware_handler "1 alua" prio alua failback immediate rr_weight uniform no_path_retry 18 rr_min_io_rq 1 detect_prio yes } } ---> end of /etc/multipath.conf <----- But after installing oVirt file multipath.conf has changed to: ---> start of /etc/multipath.conf <----- defaults { polling_interval 5 no_path_retry fail user_friendly_names no flush_on_last_del yes fast_io_fail_tmo 5 dev_loss_tmo 30 max_fds 4096 } devices { device { all_devs yes no_path_retry fail } } ---> end of /etc/multipath.conf <----- Now I'm not sure that this configuration is optimal. What do you advise?

3 3

restore db table
by Fernando Fuentes 16 Aug '16

16 Aug '16

1 1

Short SSL key sizes, and TLS 1.2 on vdsm
by Chris H 15 Aug '16

15 Aug '16

Hello, My RHEVM hypervisors (Red Hat Enterprise Virtualization Hypervisor release 7.2 (20160627.3.el7ev)) are failing corporate Nessus TCP/IP vulnerability scans spectacularly with the following. 1) "SSL Certificate Chain Contains RSA Keys Less Than 2048 bits": many ports in the 5900 range are presenting certificates signed by a key of 1024 bits. I can certainly see 1024-bit keys on the management server and the hypervisors: management ovirt-engine]# openssl x509 -in ca.pem -noout -text | grep Public-Key Public-Key: (1024 bit) hypervisor admin]# openssl x509 -in /etc/pki/vdsm/certs/cacert.pem -noout -text | grep Public-Key Public-Key: (1024 bit) Can anyone point me at directions on how to regenerate the key(s) with 2048 bits, and all certificates, preferably without breaking anything? The management server is running RHEL 6.8, rhevm-3.6.7.5. 2) "TLS Version 1.2 Protocol Detection": Port 54321 is failing because it doesn't support TLS v1.2 (and also because its certificate's key is less than 2048 bits). This port is used by "/usr/bin/python /usr/share/vdsm/vdsm". Can I enable TLS v1.2 in vdsm? It doesn't have to accept TLSv1.2 exclusively, it just has to have v1.2 available (and NOT SSLv2 or 3). If I firewall off these ports, I can't connect to VMs' consoles anymore, so hiding from the scanner isn't feasible for long. Please help point me in the right direction. Thanks, Chris -- *The Starflyer is real!*

1 0

LDAP-based domain not working after upgrade?
by Nicolás 15 Aug '16

15 Aug '16

Hi, We're running oVirt 4.0.1.1, and we're trying to grant a permission to a user on a VM. Thing is when we open the 'Permissions' subtab on that VM, we click on Add, the LDAP backend shows up but any value entered into the search box returns nothing, even when I know the values exist. This has been working on oVirt 3.x, we actually migrated to 4.x last week and didn't notice this issue. Additionally, there's no combobox to choose the permission to grant? All this is done with the admin@internal user, so I guess this is not a self-permission issue. Interesting thing is that I can successfully log-in to the user portal with a LDAP based user and manage all the VMs assigned to them. Just to see if there's been any configuration change, we also run the ovirt-engine-extension-aaa-ldap-setup tool, the configuration it returns is pretty similar to ours, and even the test commands (Login, Search) work successfully (I can see search returning user's data like name, surname, ...). We even applied this configuration to engine to see if it makes a difference but the result is the same, the search dialog returns nothing and neither I can see the permission to grant. Any hint about this? Thanks

4 14

xml config file being used in ovirt different from virsh?
by Bill Bill 15 Aug '16

15 Aug '16

--_000_CO2PR0801MB07431E23EE4A4AFFE56128E0A61F0CO2PR0801MB0743_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBoYXZlIGEgVk0gd2l0aCBuZXR3b3JrIGZpbHRlcmluZyBlbmFibGVkLCBzcGVjaWZpY2FsbHkg dGhlIGNsZWFuLXRyYWZmaWMgZmlsdGVyLg0KDQpUaHJvdWdoIHZpcnNoLCBJIG1vZGlmeSB0aGUg Y29uZmlndXJhdGlvbiB0byByZWZsZWN0IGNoYW5nZXMgbGlrZSB0aGlzOg0KDQogICAgIDxmaWx0 ZXJyZWYgZmlsdGVyPSdjbGVhbi10cmFmZmljJz4NCiAgICAgICAgPHBhcmFtZXRlciBuYW1lPSdJ UCcgdmFsdWU9JzE5Mi4xNjguMTAuMTAuJy8+DQogICAgICAgIDxwYXJhbWV0ZXIgbmFtZT0nSVAn IHZhbHVlPScxOTIuMTY4LjEwLjExJy8+DQogICAgICA8L2ZpbHRlcnJlZj4NCg0KVGhpcyBvbmx5 IGFsbG93cyB0aG9zZSB0d28gc3BlY2lmaWVkIElQ4oCZcyB0byBjb21tdW5pY2F0ZSBvbiB0aGUg Vk0uIEnigJl2ZSBkZWZpbmVkIHRoZSB4bWwgdGhyb3VnaCB2aXJzaC4NCg0KTm93LCBpZiBJIHN0 YXJ0IHRoZSBWTSBkaXJlY3RseSB0aHJvdWdoIHZpcnNoLCB0aG9zZSBydWxlcyBhcHBseSBhbmQg d29yayBjb3JyZWN0bHkuIEkgY2FuIGFkZCBhbnkgb3RoZXIgcmFuZG9tIElQIGZyb20gdGhlIHNh bWUgc3VibmV0IGFuZCBpdCBkb2VzIG5vdCB3b3JrLCBhcyBleHBlY3RlZC4gT25seSB0aGUgdHdv IElw4oCZcyBzcGVjaWZpZWQgYWJvdmUgd2lsbCByZXNwb25kLg0KDQpUaGlzIHVuZm9ydHVuYXRl bHksIG1ha2VzIHRoZSBWTSBhcHBlYXIgdG8gYmUgZG93biBmcm9tIHdpdGggdGhlIG92aXJ0IGRh c2hib2FyZCBpZiBpdOKAmXMgc3RhcnRlZCBtYW51YWxseSB0aHJvdWdoIHZpcnNoLg0KDQpJZiBJ IGVkaXQgdGhlIG1hY2hpbmUgdGhyb3VnaCB2aXJzaCBidXQgZG8gbm90IHN0YXJ0IGl0IGFuZCB0 aGVuIGdvIG9udG8gb1ZpcnQgdG8gc3RhcnQgdGhlIFZNLCBpdCBzZWVtcyB0aGUgY29uZmlndXJh dGlvbiBpcyBub3QgbG9hZGVkIOKAkyBkb2VzIG9WaXJ0IGxvYWQgYSBkaWZmZXJlbnQgY29uZmln dXJhdGlvbiBmaWxlIG90aGVyIHRoYW4gL2V0Yy9saWJ2aXJ0L3FlbXUvbWFjaGluZS54bWw/DQo= --_000_CO2PR0801MB07431E23EE4A4AFFE56128E0A61F0CO2PR0801MB0743_ Content-Type: text/html; charset="utf-8" Content-ID: <4B0D61C4EF4E6348BF40DF4B18975372(a)sct-15-1-485-2-msonline-outlook-1173a.templateTenant> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQouTXNv Q2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTt9DQpAcGFnZSBXb3JkU2Vj dGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEu MGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHls ZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0iIzk1NEY3 MiI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBo YXZlIGEgVk0gd2l0aCBuZXR3b3JrIGZpbHRlcmluZyBlbmFibGVkLCBzcGVjaWZpY2FsbHkgdGhl IGNsZWFuLXRyYWZmaWMgZmlsdGVyLjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhyb3VnaCB2aXJzaCwgSSBtb2Rp ZnkgdGhlIGNvbmZpZ3VyYXRpb24gdG8gcmVmbGVjdCBjaGFuZ2VzIGxpa2UgdGhpczo8L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7ZmlsdGVycmVmIGZpbHRlcj0nY2xl YW4tdHJhZmZpYycmZ3Q7PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtwYXJhbWV0ZXIgbmFtZT0nSVAnIHZhbHVl PScxOTIuMTY4LjEwLjEwLicvJmd0OzwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7cGFyYW1ldGVyIG5hbWU9J0lQ JyB2YWx1ZT0nMTkyLjE2OC4xMC4xMScvJmd0OzwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7L2ZpbHRlcnJlZiZndDs8L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWls eTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+VGhpcyBv bmx5IGFsbG93cyB0aG9zZSB0d28gc3BlY2lmaWVkIElQ4oCZcyB0byBjb21tdW5pY2F0ZSBvbiB0 aGUgVk0uIEnigJl2ZSBkZWZpbmVkIHRoZSB4bWwgdGhyb3VnaCB2aXJzaC48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90 OyxzZXJpZiI+Tm93LCBpZiBJIHN0YXJ0IHRoZSBWTSBkaXJlY3RseSB0aHJvdWdoIHZpcnNoLCB0 aG9zZSBydWxlcyBhcHBseSBhbmQgd29yayBjb3JyZWN0bHkuIEkgY2FuIGFkZCBhbnkgb3RoZXIg cmFuZG9tIElQIGZyb20gdGhlIHNhbWUgc3VibmV0IGFuZCBpdCBkb2VzIG5vdCB3b3JrLCBhcyBl eHBlY3RlZC4NCiBPbmx5IHRoZSB0d28gSXDigJlzIHNwZWNpZmllZCBhYm92ZSB3aWxsIHJlc3Bv bmQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1l cyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPlRoaXMgdW5mb3J0dW5hdGVseSwgbWFrZXMgdGhlIFZN IGFwcGVhciB0byBiZSBkb3duIGZyb20gd2l0aCB0aGUgb3ZpcnQgZGFzaGJvYXJkIGlmIGl04oCZ cyBzdGFydGVkIG1hbnVhbGx5IHRocm91Z2ggdmlyc2guPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPklm IEkgZWRpdCB0aGUgbWFjaGluZSB0aHJvdWdoIHZpcnNoIGJ1dCBkbyBub3Qgc3RhcnQgaXQgYW5k IHRoZW4gZ28gb250byBvVmlydCB0byBzdGFydCB0aGUgVk0sIGl0IHNlZW1zIHRoZSBjb25maWd1 cmF0aW9uIGlzIG5vdCBsb2FkZWQg4oCTIGRvZXMgb1ZpcnQgbG9hZCBhIGRpZmZlcmVudCBjb25m aWd1cmF0aW9uDQogZmlsZSBvdGhlciB0aGFuIC9ldGMvbGlidmlydC9xZW11L21hY2hpbmUueG1s PzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CO2PR0801MB07431E23EE4A4AFFE56128E0A61F0CO2PR0801MB0743_--

3 4

new internal SSO
by Fabrice Bacchella 15 Aug '16

15 Aug '16

--Apple-Mail=_138C94D8-E499-4C85-8D42-96B668C52119 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I'm currently fighting with the new mandatory SSO system introduced in = 4.0. It's also used internally as ovirt-engine is calling himself, as shown = in the apache log, to identity himself to himself: [2016-08-12 11:30:24] 10.83.16.34 "ovirt.prod.exalead.com" "POST = /ovirt-engine/sso/status HTTP/1.1" 256 401 + 163 "-" "Java/1.8.0_92" [2016-08-12 10:55:49] 10.83.16.34 "ovirt.prod.exalead.com" "POST = /ovirt-engine/sso/oauth/token HTTP/1.1" 237 401 + 163 "-" = "Java/1.8.0_92" But the sso will be acceded by human too: [2016-08-12 11:29:27] 192.168.205.59 "ovirt.prod.exalead.com" "GET = /ovirt-engine/sso/interactive-redirect-to-module HTTP/1.1" 5097 302 + - = "https://ovirt.prod.exalead.com/ovirt-engine/" "Mozilla/5.0 (Macintosh; = Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0" I'm using a custom apache configuration, as I need that to better = integrate ovirt in our running SSO and PKI setup. So under SSO I wonder which part needs to be protected using our own = SSO, and what part can be open to any access, and the internal security = of ovirt will manage it ? In https://bugzilla.redhat.com/show_bug.cgi?id=3D1342192, it seems for = me that = ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token-http-auth) = needs to be protected. Am i right ? In my log, I've seen access to: /ovirt-engine/sso/status /ovirt-engine/sso/oauth/token-info /ovirt-engine/webadmin/sso/oauth2-callback /ovirt-engine/webadmin/sso/login /ovirt-engine/sso/oauth/token /ovirt-engine/sso/oauth/authorize /ovirt-engine/sso/interactive-redirect-to-module /ovirt-engine/sso/interactive-login-next-auth /ovirt-engine/sso/interactive-login-negotiate/ovirt-auth= --Apple-Mail=_138C94D8-E499-4C85-8D42-96B668C52119 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D"">I'm currently fighting with the new mandatory SSO system = introduced in 4.0.<div class=3D""><br class=3D""></div><div = class=3D"">It's also used internally as ovirt-engine is calling himself, = as shown in the apache log, to identity himself to himself:</div><div = class=3D""><br class=3D""></div><div class=3D""><div style=3D"margin: = 0px; font-size: 11px; line-height: normal; font-family: Menlo;" = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">[2016-08-12 11:30:24] 10.83.16.34 "<a = href=3D"http://ovirt.prod.exalead.com" = class=3D"">ovirt.prod.exalead.com</a>" "POST /ovirt-engine/sso/status = HTTP/1.1" 256 401 + 163 "-" "Java/1.8.0_92"</span></div></div><div = class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" = class=3D""><div style=3D"margin: 0px; font-size: 11px; line-height: = normal; font-family: Menlo;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">[2016-08-12 10:55:49] 10.83.16.34 "<a = href=3D"http://ovirt.prod.exalead.com" = class=3D"">ovirt.prod.exalead.com</a>" "POST = /ovirt-engine/sso/oauth/token HTTP/1.1" 237 401 + 163 "-" = "Java/1.8.0_92"</span></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><br = class=3D""></span></div></span></div><div class=3D"">But the sso will be = acceded by human too:</div><div class=3D""><br class=3D""></div><div = class=3D""><div style=3D"margin: 0px; font-size: 11px; line-height: = normal; font-family: Menlo;" class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" = class=3D"">[2016-08-12 11:29:27] 192.168.205.59 "<a = href=3D"http://ovirt.prod.exalead.com" = class=3D"">ovirt.prod.exalead.com</a>" "GET = /ovirt-engine/sso/interactive-redirect-to-module HTTP/1.1" 5097 302 + - = "<a href=3D"https://ovirt.prod.exalead.com/ovirt-engine/" = class=3D"">https://ovirt.prod.exalead.com/ovirt-engine/</a>" = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 = Firefox/47.0"</span></div></div><div class=3D""><span = style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><br = class=3D""></span></div><div class=3D""><br class=3D""></div><div = class=3D"">I'm using a custom apache configuration, as I need that to = better integrate ovirt in our running SSO and PKI setup.</div><div = class=3D""><br class=3D""></div><div class=3D"">So under SSO I wonder = which part needs to be protected using our own SSO, and what part can be = open to any access, and the internal security of ovirt will manage it = ?</div><div class=3D""><br class=3D""></div><div class=3D"">In <a = href=3D"https://bugzilla.redhat.com/show_bug.cgi?id=3D1342192" = class=3D"">https://bugzilla.redhat.com/show_bug.cgi?id=3D1342192</a>, it = seems for me that <span style=3D"white-space: pre-wrap;" = class=3D"">^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token-htt= p-auth) needs to be protected. Am i right ?</span></div><div = class=3D""><br class=3D""></div><div class=3D"">In my log, I've seen = access to:</div><div class=3D""><br class=3D"">/ovirt-engine/sso/status<br= class=3D"">/ovirt-engine/sso/oauth/token-info<br = class=3D"">/ovirt-engine/webadmin/sso/oauth2-callback<br = class=3D"">/ovirt-engine/webadmin/sso/login<br = class=3D"">/ovirt-engine/sso/oauth/token<br = class=3D"">/ovirt-engine/sso/oauth/authorize<br = class=3D"">/ovirt-engine/sso/interactive-redirect-to-module<br = class=3D"">/ovirt-engine/sso/interactive-login-next-auth<br = class=3D"">/ovirt-engine/sso/interactive-login-negotiate/ovirt-auth</div><= /body></html>= --Apple-Mail=_138C94D8-E499-4C85-8D42-96B668C52119--

2 2

unable to find valid certification path to requested target
by Bill Bill 15 Aug '16

15 Aug '16

--_000_CO2PR0801MB0743DBC3AD940D3496CE9880A6100CO2PR0801MB0743_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UmVjZW50bHkgdXBncmFkZWQgb3ZpcnQtZW5naW5lIGFuZCBub3cgY2Fubm90IGxvZyBpbi4gR2V0 dGluZyB0aGUgZXJyb3IgYmVsb3c6DQoNCg0Kc3VuLnNlY3VyaXR5LnZhbGlkYXRvci5WYWxpZGF0 b3JFeGNlcHRpb246IFBLSVggcGF0aCBidWlsZGluZyBmYWlsZWQ6IHN1bi5zZWN1cml0eS5wcm92 aWRlci5jZXJ0cGF0aC5TdW5DZXJ0UGF0aEJ1aWxkZXJFeGNlcHRpb246IHVuYWJsZSB0byBmaW5k IHZhbGlkIGNlcnRpZmljYXRpb24gcGF0aCB0byByZXF1ZXN0ZWQgdGFyZ2V0DQoNCg== --_000_CO2PR0801MB0743DBC3AD940D3496CE9880A6100CO2PR0801MB0743_ Content-Type: text/html; charset="utf-8" Content-ID: <87541A889A1A18439B925049574FD1FF(a)sct-15-1-485-2-msonline-outlook-1173a.templateTenant> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFu LndlbGNvbWUtdGl0bGUNCgl7bXNvLXN0eWxlLW5hbWU6d2VsY29tZS10aXRsZTt9DQouTXNvQ2hw RGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTt9DQpAcGFnZSBXb3JkU2VjdGlv bjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGlu O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4N CjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0iIzk1NEY3MiI+ DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVjZW50 bHkgdXBncmFkZWQgb3ZpcnQtZW5naW5lIGFuZCBub3cgY2Fubm90IGxvZyBpbi4gR2V0dGluZyB0 aGUgZXJyb3IgYmVsb3c6PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGNsYXNzPSJ3ZWxjb21lLXRpdGxlIj5zdW4uc2VjdXJpdHku dmFsaWRhdG9yLlZhbGlkYXRvckV4Y2VwdGlvbjogUEtJWCBwYXRoIGJ1aWxkaW5nIGZhaWxlZDog c3VuLnNlY3VyaXR5LnByb3ZpZGVyLmNlcnRwYXRoLlN1bkNlcnRQYXRoQnVpbGRlckV4Y2VwdGlv bjogdW5hYmxlIHRvIGZpbmQgdmFsaWQgY2VydGlmaWNhdGlvbiBwYXRoIHRvIHJlcXVlc3RlZCB0 YXJnZXQ8L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_CO2PR0801MB0743DBC3AD940D3496CE9880A6100CO2PR0801MB0743_--

2 1