- Users - oVirt List Archives

[Users] A security issue in ovirt 3.2 on fedora - setup leaves a world-writable /etc/sysconfig/nfs
by Yedidyah Bar David 08 Oct '13

08 Oct '13

Hi all, The setup code of ovirt releases 3.2 and older set wrong permissions for several files, depending on options chosen during setup/upgrade. The potentially-affected files are: /etc/sysconfig/nfs /etc/sysconfig/iptables /etc/httpd/conf/httpd.conf.BACKUP* /etc/httpd/conf.d/ssl.conf.BACKUP* files under the ISO domain copied there by setup, by default under /var/lib/exports The bug does not affect systems with linux kernels older than 3.1, which included undocumented behavior that prevented it from occurring. Here is a link to the kernel patch that dropped this undocumented behavior: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit… In practice this means that among the distributions supported by ovirt, only ovirt on Fedora is affected. ovirt 3.3 is not affected as-is. Systems upgraded from 3.2 might still have the files with wrong permissions, and should follow the actions below. How to fix an existing system? Change the permissions of existing files by running the following commands as root: chmod 600 /etc/sysconfig/nfs chmod 600 /etc/sysconfig/iptables chmod 600 /etc/httpd/conf/httpd.conf.BACKUP* chmod 600 /etc/httpd/conf.d/ssl.conf.BACKUP* find /var/lib/exports -perm /002 -type f -exec chmod 600 {} \; For the last command, replace "/var/lib/exports" with the appropriate directory, if you did not accept the default during setup and configured another directory to hold the ISO domain. A fix for this bug was pushed to gerrit: http://gerrit.ovirt.org/19557 Security implications: This bug allows local users escalate their privileges by editing /etc/sysconfig/nfs and waiting until the nfs service will be started/stopped (e.g. a reboot of the machine). -- Didi

1 0

[Users] Regression/Bug in 3.2.3-1 Webadmin?
by Sven Kieske 08 Oct '13

08 Oct '13

Hi, we get a notification each minute that "User admin@interal logged in". This bug was reported and fixed in https://bugzilla.redhat.com/show_bug.cgi?id=906046 for rhev. Can someone confirm to me that this fix got backported/ included in oVirt? We still face this issue, see the attached screenshot. Regards Sven

3 5

[Users] Ovirt 3.3 - How to write a network plugin
by Benoit ML 08 Oct '13

08 Oct '13

Hello, I've seen ovirt can support plugin ... so is there any documentation about writing a plugin ? Can we write it in python ? Well because, here, we don't want to install openstack/neutron for network management ... It's too complicated and to heavy. I, your opinion wrong design choice about openvswitch implementation. Thank you in advance. Regards, -- -- Benoit

3 4

[Users] Low cost OOB management device
by Mario Giammarco 08 Oct '13

08 Oct '13

Hello, I would like to try ovirt powermanagement. I have no ILO so I would like to buy some power management device. Since it is a test I would like to stay in 100 euro range. Is it possible? Thanks, Mario

3 4

[Users] ovirt 3.3 and ilo2 for power fencing?
by Gianluca Cecchi 07 Oct '13

07 Oct '13

Hello, is this combination supported? I'm trying to configure Power Management, but I get this: Power Management test failed for Host f18ovn03.Parse error: Ignoring unknown option 'option=status' Unable to connect/login to fencing device What would be correct setup? Any way to test from command line too? The hw is an HP blade BL685 g1 with iLO2 mgmt Thanks in advance. Gianluca

5 11

[Users] upgrade bug(?) 3.1->3.3
by Jim Kinney 07 Oct '13

07 Oct '13

I just upgraded from engine 3.1 to 3.3 on my standalone centos 6.4 system. The 3.3 engine-setup apparently did NOT include the requisite iptables lines for port opening for the spice to function. I did a yum update for the ovirt-engine-setup to get the latest tool. Then I ran engine-setup to let the process upgrade as required. I added the missing ports from a second system I've not yet upgraded and all is well. Just though someone might want to look at a possible issue. -- -- James P. Kinney III * *Every time you stop a school, you will have to build a jail. What you gain at one end you lose at the other. It's like feeding a dog on his own tail. It won't fatten the dog. - Speech 11/23/1900 Mark Twain * http://heretothereideas.blogspot.com/ *

2 5

[Users] Disk migration among glusterfs volumes
by Mario Giammarco 07 Oct '13

07 Oct '13

Hello, I have a vm disk in glusterfs volume X. Now I have a replicated gluster volume Y. I would like to move the vm disk on it but if I go to "move" menu I cannot choose the target and I see a warning: "some disks cannot be moved". How can I move it? Thanks, Mario

1 1

[Users] Storage error after NFS reload
by Juan Pablo Lorier 07 Oct '13

07 Oct '13

Hi, I've made a change to the host where I run nfs for iso images and after reloading the nfs conf ovirt started to print to console and to log this every few seconds: <11>vdsm Storage.DomainMonitorThread ERROR Error while collecting domain 0d22a7d7-a7e0-4c17-b132-5764b7940a70 monitoring information#012Traceback (most recent call last):#012 File "/usr/share/vdsm/storage/domainMonitor.py", line 186, in _monitorDomain#012 self.domain.selftest()#012 File "/usr/share/vdsm/storage/sdc.py", line 49, in __getattr__#012 return getattr(self.getRealDomain(), attrName)#012 File "/usr/share/vdsm/storage/sdc.py", line 52, in getRealDomain#012 return self._cache._realProduce(self._sdUUID)#012 File "/usr/share/vdsm/storage/sdc.py", line 121, in _realProduce#012 domain = self._findDomain(sdUUID)#012 File "/usr/share/vdsm/storage/sdc.py", line 152, in _findDomain#012 raise se.StorageDomainDoesNotExist(sdUUID)#012StorageDomainDoesNotExist: Storage domain does not exist: (u'0d22a7d7-a7e0-4c17-b132-5764b7940a70',) Is there a way to stop this from happening without having to bring down the host? Regards,

1 0

[Users] oVirt Roadmap feature requests - Summary
by Itamar Heim 06 Oct '13

06 Oct '13

so, a lot of input post my question for 3.4 planning on "what do you want next"[1] I've just aggregated the replies here at this point for easier processing going forward: Infra - ability to give permissions to group of objects (namely, VMs) - support users/groups in oVirt DB as an authentication provider - support keystone as an authentication provider - kerberos login to webadmin/user portal - stateless host (pxe boot, no local disks) - detect updates and update host accordingly - embedded pxe/tftp boot server, setup to deploy the nodes - snmp & snmp trap monitoring Virt - template versions (ability to update template of a pool) - pci passthrough for devices like Telephone modem, PCI-express cards, Graphic cards - usbhost hook as supported feature (hardware license tokens) - ability to provide libvirt features directly[2] - dependencies between VMs (start db vm before webapp vm) - Allow to clone a VM without snapshot/template - Integrate v2v into engine - oVirt guest agent for Ubuntu/openSUSE/SLES/Debian - compatibility with OVF 2.0.1 - solaris as supported guest OS Network - private network between VMs - Network NAT for VMs (with buildin DHCP). - openvswitch support (in 3.3, via neutron?) - nic ordering Storage - import existing data domain - live merge (delete snapshot) - ability to resize a storage domain lun - multiple storage domains (local/gluster/FC) - ISO and export domains on FC/iSCSI - Upload ISOs within the GUI to ISO domain - Use an existing share for ISO domain - A backup and restore option - iSCSI EqualLogic SAN support or use standard iscsi tools/configuration - ATA over ethernet (AoE) as an optional storage transport - DR - DRBD, either with CLVM or perhaps GFS - live disk resize - disk ordering SLA - positive/negative affinity between group of VMs - power saving policy moving hosts to sleep - time based policy (SLA during the day, power saving at night) - collect and show power consumption of hosts - allow to give weights to prefer "faster" hosts to other hosts - application level HA (monitor the service inside the VM) Other - Zabbix monitoring [1] http://lists.ovirt.org/pipermail/users/2013-August/015807.html [2] http://lists.ovirt.org/pipermail/engine-devel/2013-August/005364.html

1 0

[Users] Gluster network info
by Gianluca Cecchi 06 Oct '13

06 Oct '13

Hello, I remember in the past that could be a problem to have high usage of ovirtmgmt network because engine sometimes detects hosts as unresponsive. And it should this the reason about bandwith limitation on vm migration, until dedicated network for it has been released. SO the question is : what about ovirtmgmt network for gluster replication when gluster domain is provided by ovirt nodes? I suppose it could be a problem too, couldn't it? In case I have a dedicated network for gluster for the nodes, how can i configure it? Can I configure in this case Gluster storage domain from ovirt engine or does it require to be on this network too? Thanks in advance for any suggestion Gianluca

6 10