- Users - oVirt List Archives

oVirt 4.3.6 and Security Measures
by scroodj＠gmail.com 10 Mar '21

10 Mar '21

Hello team, Due to security policy in the our customer`s company there is need to implement some changes into machines in their oVirt cluster (Standalone Engine + 2 KVM Host). 1. The home drives of user sanlock (/var/run/sanlock) and gluster (/run/gluster) have permission of 775. We would like to have them at least 755 if not stricter. Is that possible? 2. NFS mount of storage has ‘nodev’ and ‘nosuid’ disabled. Is it safe to use those options for NFS Storage doamin? 3. Usually bridged routing is not allowed on managed servers. Security scan asks us to set the following four parameters to 0 Network Parameter "net.ipv4.conf.all.send_redirects" = 1 (expected: 0) Network Parameter "net.ipv4.conf.all.secure_redirects" = 1 (expected: 0) Network Parameter "net.ipv6.conf.all.accept_redirects" = 1 (expected: 0) Network Parameter "net.ipv4.conf.all.accept_redirects" = 1 (expected: 0) Would changing them interfere with ovirtmgmt network? Those are valid for all three machines in the cluster. On the engine though there is httpd installed now and we have some findings there too: 1. There are modules installed that are on a blacklist. Can they be removed? The modules are: mod_dav_lock mod_userdir mod_include mod_dav_fs mod_autoindex mod_dav mod_info 2. HTTP traces should be blocked so we would set “TraceEnable” to off in virtual host config. If HTTP traces are needed we would have to limit the verbs that are allowed. 3. Apache version information should be turned off to not inform potential attackers of which web server is running. Is that a problem for oVirt? 4. TLSv1.0 and TLSv1.1 are enabled but should be turned off. 5. HSTS should be turned on but is not yet. 6. Can we use X-Frame-Options header to append X-Frame-Options DENY (or SAEMORIGIN or at least ALLOW-FROM)? 7. Can we implement the X-Content-Type-Options HTTP header with “nosniff”? 8. Can we implement the X-XSS-Protection header with “1; mode=block”? I know, this is quite a bit. But maybe you know the answers. BR Aleksandr

3 3

Set host CPU type to kvm64 for a single VM
by Andrei Verovski 10 Mar '21

10 Mar '21

Hi ! Is it possible to set host CPU type to kvm64 for a single VM ? Thanks. Andrei

1 0

engine - gluster volume import
by penguin pages 10 Mar '21

10 Mar '21

I keep going through cycles to get a HCI cluster to deploy. Gluster is working fine. Standard from HCI wizard: Brick thorst.penguinpages.local:/gluster_br icks/vmstore/vmstore 49154 0 Y 40968 Brick odinst.penguinpages.local:/gluster_br icks/vmstore/vmstore 49157 0 Y 3771 Brick medusast.penguinpages.local:/gluster_ bricks/vmstore/vmstore 49154 0 Y 5138 Self-heal Daemon on localhost N/A N/A Y 41172 Self-heal Daemon on medusast.penguinpages.l ocal N/A N/A Y 5150 Self-heal Daemon on odinst.penguinpages.loc al N/A N/A Y 3142 What I think happens when the engine is installed "on existing disk" is that it does not install components for gluster needed to present those to be deployed upon by gluster. What is this service / install / means to get the engine to "add" gluster volumes? Ex: When I click -> Storage -> (no volumes listed) -> New volume -> <empty>.... all drops downs are blank and cannot be populated.

2 2

Commvault
by Colin Coe 10 Mar '21

10 Mar '21

Hi all My workplace is considering replacing Arcserve (which has been terrible) with Commvault. Our virtualisation is a mix of about 95% RHV and 5% HyperV. We have a handful of physical servers, a 50/50 mix of Windows and RHEL. We run dual hot data centers, and want to backup locally (disk to disk) then replicate to the other data center. Cloud is off the table. Anyone have any experience with Commvault? War stories? Happy to be pointed at other alternatives. Thanks

4 6

Setup Hosts Network Disabled
by Andrei Verovski 10 Mar '21

10 Mar '21

Hi ! I run into a problem which looks like a software bug. Network -> Networks -> My_Net_Name -> Hosts Setup Hosts Network button is disabled (greyed out). I deleted this network, created again, restarted hosted engine - no changes. Is it possible to fix this for example from command line ? Thanks in advance.

2 2

ERROR: Installing oVirt Node & Hosted-Engine on one physical server
by ivanpashchuk＠ipoft.com 10 Mar '21

10 Mar '21

oVirt node 4.4.4 Question 1: In General, can i install oVirt Node and hosted-engine on one physical server? Question 2: What domain names should I specify in the DNS server and which ones IP should I reserve? Question 3: "Failed to connect to the host via ssh: ssh: connect to host ovirt-engine-01.local port 22: No route to host" - Who and where is trying to establish a connection via SSH? Can someone reply to questions 1-3 above? Any help will be much appreciated. Thanks for the help, Ivan. Logs: ERROR otopi.ovirt_hosted_engine_setup.ansible_utils ansible_utils._process_output:109 fatal: [localhost]: FAILED! => {"attempts": 180, "changed": true, "cmd": ["hosted-engine", "--vm-status", "--json"], "delta": "0:00:00.565239", "end": "2021-03-03 13:36:54.775239", "rc": 0, "start": "2021-03-03 13:36:54.210000", "stderr": "", "stderr_lines": [], "stdout": "{\"1\": {\"host-id\": 1, \"host-ts\": 16377, \"score\": 3400, \"engine-status\": {\"vm\": \"up\", \"health\": \"bad\", \"detail\": \"Up\", \"reason\": \"failed liveliness check\"}, \"hostname\": \"mng-ovirt-engine-01.local\", \"maintenance\": false, \"stopped\": false, \"crc32\": \"2b3ee5d1\", \"conf_on_shared_storage\": true, \"local_conf_timestamp\": 16377, \"extra\": \"metadata_parse_version=1\\nmetadata_feature_version=1\\ntimestamp=16377 (Wed Mar 3 13:36:48 2021)\\nhost-id=1\\nscore=3400\\nvm_conf_refresh_time=16377 (Wed Mar 3 13:36:48 2021)\\nconf_on_shared_storage=True\\nmaintenance=False\\nstate=EngineStarting\\nstopped= False\\n\", \"live-data\": true}, \"global_maintenance\": false}", "stdout_lines": ["{\"1\": {\"host-id\": 1, \"host-ts\": 16377, \"score\": 3400, \"engine-status\": {\"vm\": \"up\", \"health\": \"bad\", \"detail\": \"Up\", \"reason\": \"failed liveliness check\"}, \"hostname\": \"mng-ovirt-engine-01.local\", \"maintenance\": false, \"stopped\": false, \"crc32\": \"2b3ee5d1\", \"conf_on_shared_storage\": true, \"local_conf_timestamp\": 16377, \"extra\": \"metadata_parse_version=1\\nmetadata_feature_version=1\\ntimestamp=16377 (Wed Mar 3 13:36:48 2021)\\nhost-id=1\\nscore=3400\\nvm_conf_refresh_time=16377 (Wed Mar 3 13:36:48 2021)\\nconf_on_shared_storage=True\\nmaintenance=False\\nstate=EngineStarting\\nstopped=False\\n\", \"live-data\": true}, \"global_maintenance\": false}"]} ERROR otopi.ovirt_hosted_engine_setup.ansible_utils ansible_utils._process_output:109 fatal: [localhost]: FAILED! => {"changed": false, "msg": "Engine VM IP address is while the engine's he_fqdn ovirt-engine-01.local resolves to 10.0.2.250. If you are using DHCP, check your DHCP reservation configuration"} ERROR otopi.ovirt_hosted_engine_setup.ansible_utils ansible_utils._process_output:109 fatal: [localhost]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: ssh: connect to host ovirt-engine-01.local port 22: No route to host", "skip_reason": "Host localhost is unreachable", "unreachable": true}

2 2

Strange Glitches with VM and Network (oVirt 4.4.4.7-1.el8)
by Andrei Verovski 10 Mar '21

10 Mar '21

Hi, I’m running oVirt 4.4.4.7-1.el8 and need to connect one of the VMs straight to the ISP link via Ethernet cable. oVirt already have 2 networks (ovirt mgmt local + DMZ). Created new network provider and assigned to it available physical interface of HP ProLiant, connected via cable to ISP switch with public IP. Options of this network: (VM Network = on, Port Isolation = off, NIC Type = VirtIO, the rest are defaults). VM is Debian 10. Link works but with strange artefacts. If VM left being idle for a while, it cant be connected or pinged from outside, until I initiate pings from VM itself. I have only 2 IPs from this ISP so I’m sure there are no IP address conflicts. Another port and public IP go to our VyOS router handling internal and DMZ zone. How to fix this problem ? Thanks in advance. Andrei

2 3

which functionality replaces vdsm-hook-vmdisk in ovirt 4.4 / CentOS 8 (and is it really deprecated?)
by Andrejs Baulins 09 Mar '21

09 Mar '21

Hi there! I'm a newbie, so don't blame me fast :) I have few questions related to Hypervisor's local disk passthrough to VM strategies Preamble: we found vmdisk hook most comfortable way to use as a "gate to local storage functionality" in shared clusters. Let's assume, You have A. 2 or 4 TB large SSD, which You need to split on different usages: some diskspace provide for SQL / ETCd / Mongod etc. It must be fast, so no network in between. You have only one physical disk, so you can't passthrough whole of it to single VM. So you make LVM, and passthrough LVMs using vmdisk - this is how we did on some setups. B. 2 or 4 TB HDD for gluster bricks. At the end, You have few VMs, which "dies" together with Hypervisor, but most of VMs can live migration. In together with L7 application level fail-over, it can lead to non-critical level services level cluster, which is not so hard to throw in maintenance Yes, it does not work at real device speeds: simple dd operation with unpartitioned block device performs 3-4 times slower in VM, than on hypervisor. But, ability to mix workloads (migratable VMS with non migratable) within small cluster of hypervisors is more important, at some setups. So, there are questions coming... 1. As far as I understand, there is possibility to replace vmdisk-hook vith cmdline. But I didn't found a way, how to get it working. I always ended with "Could not open '/dev/***': No such file or directory." which I could not avoid anyhow. May be, someone can point me to an article or other thread, where there are clues, how to do that? 2. what's the story behind vmdisk hook? As far as I understand from https://github.com/oVirt/vdsm/blob/master/vdsm.spec.in its deprecated? Why? It is replaced with some functionality? Why did VDSM's hook repo been deleted from github (in order to avoid confuse?)? 3. Is it possible to achieve with any hook or some other instrument near hypervisor's performance of local disk? We are ready for inconveniences like custom setup handling / patches and so on Thanks in advance! It worked in 4.3.10 / CentOS 7, but the

1 0

HCI upgrade path from single to three-nodes setup
by s.buelow＠messaufficio.com 09 Mar '21

09 Mar '21

Hello I'm planning an HCI configuration on a single server. In my wishlist there's also the opportunity in the future to upgrade the cluster from single to fully fledged three node setup. Is there any supported and tested migration path available ? Thanks in advance Best regards

2 1

oVirt 4.3.9 readonly filesystem on multi path link failure
by alexio79＠gmail.com 09 Mar '21

09 Mar '21

Hello everyone, I have a cluster with 4 oVirt Node and a self hosted engine, fiber channel storage for storage volumes and for boot in san of oVirt Node itself (nodes doesn't have physical disks but boots from SAN). We made a software update of SAN storage and one of the multi path links went down for some seconds before coming up again. No issues with VMs but oVirt Node marked as readonly a couple of mount points: /dev/mapper/onn-var on /var type ext4 (ro,relatime,seclabel,discard,stripe=16,data=ordered) /dev/mapper/onn-var_log on /var/log type ext4 (ro,relatime,seclabel,discard,stripe=16,data=ordered) Every other mount point was r/w but not /var... We had to reboot every single node to restore r/w mounts. These are the last logs written before read only: Mar 4 11:15:59 ovirt-node1 kernel: sd 1:0:0:4: [sds] FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK Mar 4 11:15:59 ovirt-node1 kernel: sd 1:0:0:4: [sds] CDB: Read(16) 88 00 00 00 00 01 64 5f 9a 18 00 00 00 20 00 00 Mar 4 11:15:59 ovirt-node1 kernel: blk_update_request: I/O error, dev sds, sector 5978954264 Mar 4 11:15:59 ovirt-node1 kernel: device-mapper: multipath: Failing path 65:32. Mar 4 11:15:59 ovirt-node1 multipathd: sds: mark as failed Mar 4 11:15:59 ovirt-node1 multipathd: 36001738c7c8069bb00000000000135eb: remaining active paths: 3 Mar 4 11:16:11 ovirt-node1 sanlock[10535]: 2021-03-04 11:16:11 28402637 [13668]: s4 delta_renew read timeout 10 sec offset 0 /dev/58b54b5f-993b-4710-b107-7744018d22b And this is multipath -ll output: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX dm-2 IBM ,XXXXXX size=237G features='1 queue_if_no_path' hwhandler='0' wp=rw `-+- policy='service-time 0' prio=1 status=active |- 0:0:0:2 sdc 8:32 active ready running |- 1:0:0:2 sdg 8:96 active ready running |- 1:0:1:2 sdn 8:208 active ready running `- 0:0:1:2 sdr 65:16 active ready running Any idea on what happed and how to prevent it? Thank you in advice for you help.

1 0