- Users - oVirt List Archives

Re: [Users] [oss-security] CVE-2012-XXYY Request -- google-authenticator: Information disclosure due insecure requirement on the secrets file
by Michael Pasternak 18 Apr '13

18 Apr '13

FYI On 04/18/2013 01:45 PM, Jan Lieskovsky wrote: > Hello Kurt, Steve, Alexander, vendors, > > as noted in [1]: > > An information disclosure file was found in the way google-authenticator, > a pluggable authentication module (PAM) which allows login using one-time > passcodes conforming to the open standards developed by the Initiative for > Open Authentication (OATH), performed management of its secret / state file > in certain configurations. Due the lack of 'user=' option the secret file > was previously required to be user-readable, allowing (in certain cases) > a local attacker to obtain the (pre)shared client-to-authentication-server > secret, possibly leading to victim's account impersonation. > > A different vulnerability than CVE-2013-0258. > > References: > [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666129 > [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666129#10 > [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666129#20 > [4] https://bugzilla.redhat.com/show_bug.cgi?id=953505 > > Relevant upstream patch: > [5] https://code.google.com/p/google-authenticator/source/detail?r=c3414e9857ad… > > @Alexander - since I am not sure I have described the attack vector above > properly, please correct me if / where required. > > @Kurt * the CVE-2012- identifier should be allocated to this issue, since > the security implications of this problem are for the first time > mentioned here: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666129#10 (2012-09-22), > > * from what I have looked, there doesn't seem to be: > http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=authenticator > > a CVE identifier allocated to this issue yet (as noted above > CVE-2013-0258 from that list is different issue). > > => could you allocate one? > > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Response Team -- Michael Pasternak RedHat, ENG-Virtualization R&D

1 0

[Users] oVirt storage is down and doesn't come up
by Limor Gavish 18 Apr '13

18 Apr '13

Hi, For some reason, without doing anything, all the storage domains became down and restarting VDSM or the entire machine do not bring it up. I am not using lvm The following errors appear several times in vdsm.log (full logs are attached): Thread-22::WARNING::2013-04-12 19:00:08,597::lvm::378::Storage.LVM::(_reloadvgs) lvm vgs failed: 5 [] [' Volume group "1083422e-a5db-41b6-b667-b9ef1ef244f0" not found'] Thread-22::DEBUG::2013-04-12 19:00:08,598::lvm::402::OperationMutex::(_reloadvgs) Operation 'lvm reload operation' released the operation mutex Thread-22::DEBUG::2013-04-12 19:00:08,681::resourceManager::615::ResourceManager::(releaseResource) Trying to release resource 'Storage.5849b030-626e-47cb-ad90-3ce782d831b3' Thread-22::DEBUG::2013-04-12 19:00:08,681::resourceManager::634::ResourceManager::(releaseResource) Released resource 'Storage.5849b030-626e-47cb-ad90-3ce782d831b3' (0 active users) Thread-22::DEBUG::2013-04-12 19:00:08,681::resourceManager::640::ResourceManager::(releaseResource) Resource 'Storage.5849b030-626e-47cb-ad90-3ce782d831b3' is free, finding out if anyone is waiting for it. Thread-22::DEBUG::2013-04-12 19:00:08,682::resourceManager::648::ResourceManager::(releaseResource) No one is waiting for resource 'Storage.5849b030-626e-47cb-ad90-3ce782d831b3', Clearing records. Thread-22::ERROR::2013-04-12 19:00:08,682::task::850::TaskManager.Task::(_setError) Task=`e35a22ac-771a-4916-851f-2fe9d60a0ae6`::Unexpected error Traceback (most recent call last): File "/usr/share/vdsm/storage/task.py", line 857, in _run return fn(*args, **kargs) File "/usr/share/vdsm/logUtils.py", line 45, in wrapper res = f(*args, **kwargs) File "/usr/share/vdsm/storage/hsm.py", line 939, in connectStoragePool masterVersion, options) File "/usr/share/vdsm/storage/hsm.py", line 986, in _connectStoragePool res = pool.connect(hostID, scsiKey, msdUUID, masterVersion) File "/usr/share/vdsm/storage/sp.py", line 695, in connect self.__rebuild(msdUUID=msdUUID, masterVersion=masterVersion) File "/usr/share/vdsm/storage/sp.py", line 1232, in __rebuild masterVersion=masterVersion) File "/usr/share/vdsm/storage/sp.py", line 1576, in getMasterDomain raise se.StoragePoolMasterNotFound(self.spUUID, msdUUID) StoragePoolMasterNotFound: Cannot find master domain: 'spUUID=5849b030-626e-47cb-ad90-3ce782d831b3, msdUUID=1083422e-a5db-41b6-b667-b9ef1ef244f0' Thread-22::DEBUG::2013-04-12 19:00:08,685::task::869::TaskManager.Task::(_run) Task=`e35a22ac-771a-4916-851f-2fe9d60a0ae6`::Task._run: e35a22ac-771a-4916-851f-2fe9d60a0ae6 ('5849b030-626e-47cb-ad90-3ce782d831b3', 1, '5849b030-626e-47cb-ad90-3ce782d831b3', '1083422e-a5db-41b6-b667-b9ef1ef244f0', 3942) {} failed - stopping task Thread-22::DEBUG::2013-04-12 19:00:08,685::task::1194::TaskManager.Task::(stop) Task=`e35a22ac-771a-4916-851f-2fe9d60a0ae6`::stopping in state preparing (force False) Thread-22::DEBUG::2013-04-12 19:00:08,685::task::974::TaskManager.Task::(_decref) Task=`e35a22ac-771a-4916-851f-2fe9d60a0ae6`::ref 1 aborting True Thread-22::INFO::2013-04-12 19:00:08,686::task::1151::TaskManager.Task::(prepare) Task=`e35a22ac-771a-4916-851f-2fe9d60a0ae6`::aborting: Task is aborted: 'Cannot find master domain' - code 304 *[wil@bufferoverflow ~]$ **sudo vgs --noheadings --units b --nosuffix --separator \| -o uuid,name,attr,size,free,extent_size,extent_count,free_count,tags,vg_mda_size,vg_mda_free * No volume groups found *[wil@bufferoverflow ~]$ **mount* proc on /proc type proc (rw,nosuid,nodev,noexec,relatime) sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime) devtmpfs on /dev type devtmpfs (rw,nosuid,size=8131256k,nr_inodes=2032814,mode=755) securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime) tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev) devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000) tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755) tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,mode=755) cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd) cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset) cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpuacct,cpu) cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory) cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices) cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer) cgroup on /sys/fs/cgroup/net_cls type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls) cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio) cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event) /dev/sda3 on / type ext4 (rw,relatime,data=ordered) rpc_pipefs on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime) debugfs on /sys/kernel/debug type debugfs (rw,relatime) sunrpc on /proc/fs/nfsd type nfsd (rw,relatime) hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime) systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=34,pgrp=1,timeout=300,minproto=5,maxproto=5,direct) mqueue on /dev/mqueue type mqueue (rw,relatime) tmpfs on /tmp type tmpfs (rw) configfs on /sys/kernel/config type configfs (rw,relatime) binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,relatime) /dev/sda5 on /home type ext4 (rw,relatime,data=ordered) /dev/sda1 on /boot type ext4 (rw,relatime,data=ordered) kernelpanic.home:/home/KP_Data_Domain on /rhev/data-center/mnt/kernelpanic.home:_home_KP__Data__Domain type nfs (rw,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,soft,nosharecache,proto=tcp,timeo=600,retrans=6,sec=sys,mountaddr=10.100.101.100,mountvers=3,mountport=20048,mountproto=udp,local_lock=none,addr=10.100.101.100) bufferoverflow.home:/home/BO_ISO_Domain on /rhev/data-center/mnt/bufferoverflow.home:_home_BO__ISO__Domain type nfs (rw,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,soft,nosharecache,proto=tcp,timeo=600,retrans=6,sec=sys,mountaddr=10.100.101.108,mountvers=3,mountport=20048,mountproto=udp,local_lock=none,addr=10.100.101.108) *[wil@bufferoverflow ~]$ **sudo find / -name 5849b030-626e-47cb-ad90-3ce782d831b3* /run/vdsm/pools/5849b030-626e-47cb-ad90-3ce782d831b3 *[wil@bufferoverflow ~]$* *sudo find / -name 1083422e-a5db-41b6-b667-b9ef1ef244f0* /home/BO_Ovirt_Storage/1083422e-a5db-41b6-b667-b9ef1ef244f0 I will extremely appreciate any help, Limor Gavish

4 7

[Users] Problem setting up spice
by Olivier Boulin 18 Apr '13

18 Apr '13

hi, i'm totally an Ovirt newbie. I've installed an all-in-one version to test and i've got a problem with spice. I found this : http://www.ovirt.org/How_to_Connect_to_SPICE_Console_With_Portal but the link to the spice.cab cabinet is down. Is this page obsolete ? If yes, how do i open a console from a windows 7 client ? Thanks in advance

2 1

[Users] oVirt 3.2 and MD3600i
by martin.kralicek＠accenture.com 18 Apr '13

18 Apr '13

--_000_A14EC602F2E1DD4984ABE308D49EA2D226D0A2B1048CH1MPN116204_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello, Has somebody experience with Dell MD3600i and oVirt 3.2.1? Host and oVirt are deployed on Fedora 18. My infrastructure contains: 2 x powerconnect 6224 and this storage with two= controllers Both switch are in stack mode and storage is connect with four 10Gb ports i= n same subnet (is better to use it without stack as two subnet?) So, where is problem...I can create iSCSI storage domain, everything seems = to be OK but when I want to add next host they cannot access this iSCSI tar= get (in storage management tools is already added to host group) And during this process I can see only on host console IO error, buffer err= or and kernel BUG: soft lockup - CPU stuck etc... Exists recommended way how involved iSCSI? Thanks for any suggestions Martin ________________________________ This message is for the designated recipient only and may contain privilege= d, proprietary, or otherwise confidential information. If you have received= it in error, please notify the sender immediately and delete the original.= Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and it= s affiliates, including e-mail and instant messaging (including content), m= ay be scanned by our systems for the purposes of information security and a= ssessment of internal compliance with Accenture policy. ___________________________________________________________________________= ___________ www.accenture.com --_000_A14EC602F2E1DD4984ABE308D49EA2D226D0A2B1048CH1MPN116204_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 12 (filtered medium)"> <style></style> </head> <body lang=3D"CS" link=3D"blue" vlink=3D"purple"> <div class=3D"WordSection1"> Hello,<o:p></o:p> <o:p> </o:p> Has somebody experience with Dell MD3600i and oVirt = 3.2.1?<o:p></o:p> Host and oVirt are deployed on Fedora 18.<o:p></o:p>= My infrastructure contains: 2 x powerconnect 6224 an= d this storage with two controllers<o:p></o:p> Both switch are in stack mode and storage is connect= with four 10Gb ports in same subnet (is better to use it without stack as = two subnet?)<o:p></o:p> So, where is problem...I can create iSCSI storage do= main, everything seems to be OK but when I want to add next host they canno= t access this iSCSI target (in storage management tools is already added to= host group)<o:p></o:p> And during this process I can see only on host conso= le IO error, buffer error and kernel BUG: soft lockup – CPU stuck etc= ...<o:p></o:p> <o:p> </o:p> Exists recommended way how involved iSCSI?<o:p></o:p= > <o:p> </o:p> Thanks for any suggestions<o:p></o:p> <o:p> </o:p> Martin<o:p></o:p> </div> <hr> This message is for the desi= gnated recipient only and may contain privileged, proprietary, or otherwise= confidential information. If you have received it in error, please notify = the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and it= s affiliates, including e-mail and instant messaging (including content), m= ay be scanned by our systems for the purposes of information security and a= ssessment of internal compliance with Accenture policy. ___________________________________________________________________________= ___________ www.accenture.com </body> </html> --_000_A14EC602F2E1DD4984ABE308D49EA2D226D0A2B1048CH1MPN116204_--

4 4

[Users] Fwd: Problem setting up spice
by Juan Jose 18 Apr '13

18 Apr '13

---------- Forwarded message ---------- From: Juan Jose <jj197005(a)gmail.com> Date: Thu, Apr 18, 2013 at 12:53 PM Subject: Re: [Users] Problem setting up spice To: Olivier Boulin <olivier.boulin(a)dijon.iufm.fr> Hello Olivier, You need to install virt-viewer in you client platform, 32 or 64 bits, and to be sure that host and engine are resolvable from your windows 7 client system. I have tested this with IE 9.0 and it's work properly. You can download virt-viewer from this page: http://spice-space.org/download.html. I hope this help you. Juanjo. On Thu, Apr 18, 2013 at 11:06 AM, Olivier Boulin < olivier.boulin(a)dijon.iufm.fr> wrote: > hi, i'm totally an Ovirt newbie. I've installed an all-in-one version to > test and i've got a problem with spice. > > I found this : http://www.ovirt.org/How_to_** > Connect_to_SPICE_Console_With_**Portal<http://www.ovirt.org/How_to_Connect_to_SPICE_Console_With_Portal> > > but the link to the spice.cab cabinet is down. Is this page obsolete ? > > If yes, how do i open a console from a windows 7 client ? > > Thanks in advance > ______________________________**_________________ > Users mailing list > Users(a)ovirt.org > http://lists.ovirt.org/**mailman/listinfo/users<http://lists.ovirt.org/mailman/listinfo/users> >

1 0

[Users] How to remove storage domain
by Gianluca Cecchi 18 Apr '13

18 Apr '13

Hello, oVirt 3.2.1 on f18. I have an FC datacenter where I have several storage domains. I want to remove one storage domain, so I move all its disks to other ones (disk --> move) At the end its state is active, but the "remove" option is greyed out. I can only do "destroy". What to do to have the "delete" option possible? Thanks, Gianluca

2 5

[Users] Certificates and PKI seem to be broken after yum update
by Chris Smith 18 Apr '13

18 Apr '13

I have lost the ability to manage the hosts or VM's using ovirt engine web interface after performing yum update on the ovirt-engine host, and on one Fedora 17 host. The data center is offline, and I can't place the hosts into maintenance mode. I don't think that there are any actions I can perform in the web interface at all. >From the logs it seems that PKI is broken between the engine and the hosts. I am wondering how I can restore or re-generate all of the certificates and get the hosts communicating with the ovirt-engine again so that I can bring the data center back online. I found this page which deals with changing the engine hostname, and thus re-creating the certificates and keystore on the ovirt-engine node, and was wondering if this could help. Could I follow this process but keep the same hostname for the ovirt-engine node? http://wiki.ovirt.org/How_to_change_engine_host_name Currently I have 3 VM's running on two hosts. The VM's are up, but I can't do anything with them in ovirt-engine. Here's the latest activity from engine.log from the ovirt-engine node: 2013-04-06 21:58:47,472 ERROR [org.ovirt.engine.core.engineencryptutils.EncryptionUtils] (QuartzScheduler_Worker-61) Failed to decryptjava.io.FileNotFoundException: /etc/pki/ovirt-engine/.keystore (Permission denied) 2013-04-06 21:58:47,478 ERROR [org.ovirt.engine.core.engineencryptutils.EncryptionUtils] (QuartzScheduler_Worker-62) Can't load keystore from file "/etc/pki/ovirt-engine/.keystore".: java.io.FileNotFoundException: /etc/pki/ovirt-engine/.keystore (Permission denied) at java.io.FileInputStream.open(Native Method) [rt.jar:1.7.0_09-icedtea] at java.io.FileInputStream.<init>(FileInputStream.java:138) [rt.jar:1.7.0_09-icedtea] at org.ovirt.engine.core.engineencryptutils.EncryptionUtils.getKeyStore(EncryptionUtils.java:214) [engine-encryptutils.jar:] at org.ovirt.engine.core.engineencryptutils.EncryptionUtils.decrypt(EncryptionUtils.java:139) [engine-encryptutils.jar:] at org.ovirt.engine.core.dao.VdsStaticDAODbFacadeImpl.decryptPassword(VdsStaticDAODbFacadeImpl.java:139) [engine-dal.jar:] at org.ovirt.engine.core.dao.VdsDAODbFacadeImpl$VdsRowMapper.mapRow(VdsDAODbFacadeImpl.java:253) [engine-dal.jar:] at org.ovirt.engine.core.dao.VdsDAODbFacadeImpl$VdsRowMapper.mapRow(VdsDAODbFacadeImpl.java:169) [engine-dal.jar:] at org.springframework.jdbc.core.RowMapperResultSetExtractor.extractData(RowMapperResultSetExtractor.java:92) [spring-jdbc-2.5.6.SEC02.jar:2.5.6.SEC02] at org.springframework.jdbc.core.JdbcTemplate$1.doInPreparedStatement(JdbcTemplate.java:653) [spring-jdbc-2.5.6.SEC02.jar:2.5.6.SEC02] at org.springframework.jdbc.core.JdbcTemplate.execute(JdbcTemplate.java:591) [spring-jdbc-2.5.6.SEC02.jar:2.5.6.SEC02] at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:641) [spring-jdbc-2.5.6.SEC02.jar:2.5.6.SEC02] at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:670) [spring-jdbc-2.5.6.SEC02.jar:2.5.6.SEC02] at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:702) [spring-jdbc-2.5.6.SEC02.jar:2.5.6.SEC02] at org.ovirt.engine.core.dal.dbbroker.PostgresDbEngineDialect$PostgresSimpleJdbcCall.executeCallInternal(PostgresDbEngineDialect.java:155) [engine-dal.jar:] at org.ovirt.engine.core.dal.dbbroker.PostgresDbEngineDialect$PostgresSimpleJdbcCall.doExecute(PostgresDbEngineDialect.java:121) [engine-dal.jar:] at org.springframework.jdbc.core.simple.SimpleJdbcCall.execute(SimpleJdbcCall.java:164) [spring-jdbc-2.5.6.SEC02.jar:2.5.6.SEC02] at org.ovirt.engine.core.dal.dbbroker.SimpleJdbcCallsHandler.executeImpl(SimpleJdbcCallsHandler.java:124) [engine-dal.jar:] at org.ovirt.engine.core.dal.dbbroker.SimpleJdbcCallsHandler.executeReadAndReturnMap(SimpleJdbcCallsHandler.java:75) [engine-dal.jar:] at org.ovirt.engine.core.dal.dbbroker.SimpleJdbcCallsHandler.executeReadList(SimpleJdbcCallsHandler.java:66) [engine-dal.jar:] at org.ovirt.engine.core.dal.dbbroker.SimpleJdbcCallsHandler.executeRead(SimpleJdbcCallsHandler.java:58) [engine-dal.jar:] at org.ovirt.engine.core.dao.VdsDAODbFacadeImpl.get(VdsDAODbFacadeImpl.java:36) [engine-dal.jar:] at org.ovirt.engine.core.dao.VdsDAODbFacadeImpl.get(VdsDAODbFacadeImpl.java:31) [engine-dal.jar:] at org.ovirt.engine.core.vdsbroker.VdsManager$1.runInTransaction(VdsManager.java:219) [engine-vdsbroker.jar:] at org.ovirt.engine.core.utils.transaction.TransactionSupport.executeInSuppressed(TransactionSupport.java:168) [engine-utils.jar:] at org.ovirt.engine.core.utils.transaction.TransactionSupport.executeInScope(TransactionSupport.java:107) [engine-utils.jar:] at org.ovirt.engine.core.vdsbroker.VdsManager.OnTimer(VdsManager.java:215) [engine-vdsbroker.jar:] at sun.reflect.GeneratedMethodAccessor13.invoke(Unknown Source) [:1.7.0_09-icedtea] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.7.0_09-icedtea] at java.lang.reflect.Method.invoke(Method.java:601) [rt.jar:1.7.0_09-icedtea] at org.ovirt.engine.core.utils.timer.JobWrapper.execute(JobWrapper.java:64) [engine-scheduler.jar:] at org.quartz.core.JobRunShell.run(JobRunShell.java:213) [quartz.jar:] at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:557) [quartz.jar:] 2013-04-06 21:58:47,576 ERROR [org.ovirt.engine.core.vdsbroker.vdsbroker.VdsBrokerCommand] (QuartzScheduler_Worker-61) XML RPC error in command GetCapabilitiesVDS ( Vds: defiant ), the error was: java.util.concurrent.ExecutionException: java.lang.reflect.InvocationTargetException, SSLPeerUnverifiedException: peer not authenticated 2013-04-06 21:58:47,606 ERROR [org.ovirt.engine.core.engineencryptutils.EncryptionUtils] (QuartzScheduler_Worker-62) Failed to decryptjava.io.FileNotFoundException: /etc/pki/ovirt-engine/.keystore (Permission denied) 2013-04-06 21:58:47,671 ERROR [org.ovirt.engine.core.vdsbroker.vdsbroker.VdsBrokerCommand] (QuartzScheduler_Worker-62) XML RPC error in command GetCapabilitiesVDS ( Vds: transporter ), the error was: java.util.concurrent.ExecutionException: java.lang.reflect.InvocationTargetException, SSLPeerUnverifiedException: peer not authenticated Here's the message I seem to get over and over on the fedora 17 host in vdsm.log SSLError: [Errno 1] _ssl.c:504: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown Thread-562520::ERROR::2013-04-06 22:08:44,268::SecureXMLRPCServer::73::root::(handle_error) client ('172.16.23.8', 36127) Traceback (most recent call last): File "/usr/lib64/python2.7/SocketServer.py", line 582, in process_request_thread self.finish_request(request, client_address) File "/usr/lib/python2.7/site-packages/vdsm/SecureXMLRPCServer.py", line 66, in finish_request request.do_handshake() File "/usr/lib64/python2.7/ssl.py", line 305, in do_handshake self._sslobj.do_handshake() I'm also wondering about the permission denied on the .keystore directory. What should the permissions be? Here's what they are currently. [root@reliant pki]# ls -ldZ /etc/pki/ovirt-engine/.keystore -rwxr-x---. root root unconfined_u:object_r:cert_t:s0 /etc/pki/ovirt-engine/.keystore I also seem to have a backup of the ovirt-engine directory at the time the update was performed, but replacing ovirt-engine with the backup does no good. I appreciate any assistance, and please let me know what other information I can post to help with this. Thanks

2 8

[Users] Export domain was working... then... NFS, rpc.statd issues
by Nicolas Ecarnot 17 Apr '13

17 Apr '13

Hi, [oVirt 3.1, F17] My good old NFS export domain was OK, but getting too small for our needs. Then I unmounted it, created another bigger one somewhere else, and tried to mount the new one. Long things short, the NFS is not mounted and the relevant error is here: Thread-1422222::DEBUG::2013-04-16 10:08:25,973::__init__::1249::Storage.Misc.excCmd::(_log) '/usr/bin/sudo -n /usr/bin/mount -t nfs -o soft,nosharecache,timeo=600,retrans=6 serv-vm-adm7.xxx:/data/vmex /rhev/data-center/mnt/serv-vm-adm7.xxx:_data_vmex' (cwd None) Thread-1422222::ERROR::2013-04-16 10:08:26,047::hsm::1932::Storage.HSM::(connectStorageServer) Could not connect to storageServer Traceback (most recent call last): File "/usr/share/vdsm/storage/hsm.py", line 1929, in connectStorageServer File "/usr/share/vdsm/storage/storageServer.py", line 256, in connect File "/usr/share/vdsm/storage/storageServer.py", line 179, in connect File "/usr/share/vdsm/storage/mount.py", line 190, in mount File "/usr/share/vdsm/storage/mount.py", line 206, in _runcmd MountError: (32, ";mount.nfs: rpc.statd is not running but is required for remote locking.\nmount.nfs: Either use '-o nolock' to keep locks local, or start statd.\nmount.nfs: an incorrect mount option was specified\n") I confirm trying to manually mount the same from the node, and using the nolock option does work. While googling, I checked the /etc/services : no problem. I don't know what to change, what I did wrong, what to improve? -- Nicolas Ecarnot [Very rare msg from me using HTML and colors... I'm ready to wear a tie ;)]

2 1

[Users] DNS reverse configuration
by Eduardo Ramos 17 Apr '13

17 Apr '13

This is a multi-part message in MIME format. --------------030000020905080205090702 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi all! I'm trying to connect my ovirt-engine in a samba4 server. Samba4 is ActiveDirectory complaint. But when I use engine-manage-domains, it returns me a strange message: [root@ovirt-dir eduardo]# engine-manage-domains -action=add -domain=gsr.inpe.br -provider=activeDirectory -user=Administrator -interactive Enter password: Error: Authentication Failed. Error in DNS configuration. Please verify the oVirt Engine host has a valid reverse DNS (PTR) record.. Problematic domain is: getconnection: driver class name=org.postgresql.xa.pgxadatasourcegetconnection: url=jdbc:postgresql://localhost:5432/enginegetconnection: considering encrypted passord. secdomain=encryptdbpasswordexecute: beginning execution of action action_get.fetching key=domainname ver=general Failure while applying Kerberos configuration. Details: Authentication Failed. Error in DNS configuration. Please verify the oVirt Engine host has a valid reverse DNS (PTR) record. Using host command, I got the following results: [root@ovirt-dir eduardo]# host ovirt-dir.gsr.inpe.br ovirt-dir.gsr.inpe.br has address 150.163.80.125 [root@ovirt-dir eduardo]# host 150.163.80.125 125.80.163.150.in-addr.arpa domain name pointer ovirt-dir.gsr.inpe.br. [root@ovirt-dir eduardo]# host -t srv _kerberos._tcp.gsr.inpe.br _kerberos._tcp.gsr.inpe.br has SRV record 1 0 88 samba4.gsr.inpe.br. [root@ovirt-dir eduardo]# host samba4.gsr.inpe.br samba4.gsr.inpe.br has address 150.163.73.109 [root@ovirt-dir eduardo]# host 150.163.73.109 109.73.163.150.in-addr.arpa domain name pointer samba4.gsr.inpe.br. As you can see, it is everything ok. No DNS problem. Someone have any idea? Thanks. --------------030000020905080205090702 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit <html> <head> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi all! I'm trying to connect my ovirt-engine in a samba4 server. Samba4 is ActiveDirectory complaint. But when I use engine-manage-domains, it returns me a strange message: [root@ovirt-dir eduardo]# engine-manage-domains -action=add -domain=gsr.inpe.br -provider=activeDirectory -user=Administrator -interactive Enter password: Error: Authentication Failed. Error in DNS configuration. Please verify the oVirt Engine host has a valid reverse DNS (PTR) record.. Problematic domain is: getconnection: driver class name=org.postgresql.xa.pgxadatasourcegetconnection: url=jdbc:postgresql://localhost:5432/enginegetconnection: considering encrypted passord. secdomain=encryptdbpasswordexecute: beginning execution of action action_get.fetching key=domainname ver=general Failure while applying Kerberos configuration. Details: Authentication Failed. Error in DNS configuration. Please verify the oVirt Engine host has a valid reverse DNS (PTR) record. <big><big>Using host command, I got the following results: [root@ovirt-dir eduardo]# host ovirt-dir.gsr.inpe.br ovirt-dir.gsr.inpe.br has address 150.163.80.125 [root@ovirt-dir eduardo]# host 150.163.80.125 125.80.163.150.in-addr.arpa domain name pointer ovirt-dir.gsr.inpe.br. [root@ovirt-dir eduardo]# host -t srv _kerberos._tcp.gsr.inpe.br _kerberos._tcp.gsr.inpe.br has SRV record 1 0 88 samba4.gsr.inpe.br. [root@ovirt-dir eduardo]# host samba4.gsr.inpe.br samba4.gsr.inpe.br has address 150.163.73.109 [root@ovirt-dir eduardo]# host 150.163.73.109 109.73.163.150.in-addr.arpa domain name pointer samba4.gsr.inpe.br. <big>As you can see, it is everything ok. No DNS problem. Someone have any idea? Thanks. </big></big></big> </body> </html> --------------030000020905080205090702--

6 11

[Users] oVirt Weekly Meeting Minutes -- 2013-04-10
by Mike Burns 17 Apr '13

17 Apr '13

Minutes: http://ovirt.org/meetings/ovirt/2013/ovirt.2013-04-10-14.01.html Minutes (text): http://ovirt.org/meetings/ovirt/2013/ovirt.2013-04-10-14.01.txt Log: http://ovirt.org/meetings/ovirt/2013/ovirt.2013-04-10-14.01.log.html ========================= #ovirt: oVirt Weekly Sync ========================= Meeting started by mburns at 14:01:09 UTC. The full logs are available at http://ovirt.org/meetings/ovirt/2013/ovirt.2013-04-10-14.01.log.html . Meeting summary --------------- * Agenda and Roll Call (mburns, 14:01:17) * Agenda (mburns, 14:01:26) * release updates for 3.2 (mburns, 14:01:39) * release updates for 3.3 (mburns, 14:01:41) * conferences and workshops (mburns, 14:01:48) * Sub Project Status (mburns, 14:02:00) * Other Topics (mburns, 14:02:05) * oVirt 3.2 Updates (mburns, 14:03:35) * 3.2 EL6 packages are now available in the stable repositories (as of this morning) (mburns, 14:03:54) * 3.2.2 build should be available in the next couple weeks (mburns, 14:10:11) * work for vms not running on el6 out of the box is underway (mburns, 14:10:28) * oVirt 3.3 Updates (mburns, 14:13:03) * LINK: http://www.ovirt.org/OVirt_3.3_release-management (mburns, 14:13:29) * new features for Virt, SLA, Node, Gluster posted (mburns, 14:14:04) * every feature has a feature page posted as well (mburns, 14:14:20) * a couple more to be posted still -- novnc, spice html5, el6 machine-type bug (mburns, 14:15:10) * reminder: feature freeze is May 31 (mburns, 14:16:23) * direct host feature dropped -- determined to be not useful (mburns, 14:19:43) * node features are primarily running on a different schedule, targeting GA May 31 (mburns, 14:22:00) * exception being the vdsm plugin for ovirt-node which will ship on oVirt Project schedule (mburns, 14:22:27) * Conferences and Workshops (mburns, 14:23:42) * schedule is available http://www.ovirt.org/Intel_Workshop_May_2013 (mburns, 14:24:52) * visa information going out shortly (mburns, 14:25:02) * speakers with approved talks have been notified (mburns, 14:25:15) * slides are due 22-April if your presentation was approved (mburns, 14:25:49) * you should start booking flights and hotels now if you're attending and haven't already (mburns, 14:26:40) * please contack theron if you need visa letters (mburns, 14:28:41) * visa letters should be going out today (mburns, 14:28:50) * Marketing group (mburns, 14:31:23) * the oVirt Marketing group kicked off last week (mburns, 14:31:37) * planning an ovirt/cloud conf to occur in San Francisco in late August (mburns, 14:31:57) * venue secured, prospectus drafted (mburns, 14:32:18) * prospectus to be sent later this week to all oVirt companies (mburns, 14:32:34) * there will be multiple tracks (3-4) (mburns, 14:34:20) * need to get more papers submitted than for our past workshops (mburns, 14:34:35) * conference won't be pure oVirt, but need to make sure oVirt is represented (mburns, 14:35:51) * more info will be shared as the marketing group moves forward (mburns, 14:36:52) * Sub-project status (mburns, 14:38:33) * Sub-project status -- Infra (mburns, 14:38:39) * LINK: http://resources.ovirt.org/meetings/ovirt/2013/ovirt.2013-04-08-14.04.html (ewoud, 14:40:29) * work is still in progress installing servers (mburns, 14:40:37) * not much else to report (mburns, 14:40:43) * issues installing at rackspace (mburns, 14:41:22) * waiting on new IPs from alterway (mburns, 14:41:28) * Other Topics (mburns, 14:42:45) Meeting ended at 14:44:58 UTC. Action Items ------------ Action Items, by person ----------------------- * **UNASSIGNED** * (none) People Present (lines said) --------------------------- * mburns (81) * theron (21) * oschreib (13) * lvernia (5) * ewoud (4) * mskrivanek (3) * ovirtbot (3) * doron (1) * ofri (1) * fsimonce (1) * dustins (1) * dneary (0) Generated by `MeetBot`_ 0.1.4 .. _`MeetBot`: http://wiki.debian.org/MeetBot

2 2