- Users - oVirt List Archives

CentOS Stream 8 EOL: May 31, 2024
by Diggy Mc 19 Feb '24

19 Feb '24

It has been announced that End-of-Life for CentOS Stream 8 is May 31st, 2024. See announcement: https://blog.centos.org/2023/04/end-dates-are-coming-for-centos-stream-8-an… What does this mean for the future of the hosted-engine which is still based on CentOS Stream 8 ??? My personal vote for the next OS flavor/version for both the hosted-engine and oVirt Node is Rocky Linux 9.

2 1

Unable to upload image to disk - due to a network error
by Alan Aguinaga 19 Feb '24

19 Feb '24

Hi. Is there a way to send an ISO to self hosted server? Because I 've been searching for help and a lot of people complaining about it. 1 - What is the way to send ISOs to oVirt? Are there a command line tool to send ISOs to my server? "The ISO Uploader tool has been deprecated. Red Hat recommends uploading ISO images to the data domain with the Administration Portal or with the REST API. See Section 11.8.1, “Uploading Images to a Data Storage Domain” for details." https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/ht… 2 - ISO sending from portal worked for a smaller image. It could be done for OL 7.9 with 4 GB. But I am trying to upload OL 8.9 ISO with 13.5 GB and it is not finishing. It is not resuming. It started to upload. I have a configured certificate installed and ok tested connection. I got this error: "Unable to upload image to disk a72b0da4-1bbb-453c-b846-701eef9761f6 due to a network error. Ensure ovirt-engine's CA certificate is registered as a trusted CA in the browser. The certificate can be fetched from" It started but not finished: "Sent 1732 of 12812 MB" This message is related to network not to certificate because it is installed otherwise it cannot even started to upload. Are there a user-friendly way to upload a ISO to a server using any command line tool? Latter versions I can send a ISO to a storage pool and it appears in server. Now I read it is impossible. Does it impossible by now? My is 4.4.10.7-1.0.25.el8. I am using NFS share and self hosted engine.

2 1

Ovirt engine deply error- urgently need help
by ihaqikram＠gmail.com 19 Feb '24

19 Feb '24

2024-02-16 21:05:28,499+0000 DEBUG var changed: host "localhost" var "ovirt_sso_auth" type "<type 'dict'>" value: "{ "attempts": 50, "changed": false, "exception": "Traceback (most recent call last):\n File \"/tmp/ansible_ovirt_auth_payload_GY8VTT/ansible_ovirt_auth_payload.zip/ansible/modules/cloud/ovirt/ovirt_auth.py\", line 276, in main\n File \"/usr/lib64/python2.7/site-packages/ovirtsdk4/__init__.py\", line 382, in authenticate\n self._sso_token = self._get_access_token()\n File \"/usr/lib64/python2.7/site-packages/ovirtsdk4/__init__.py\", line 618, in _get_access_token\n sso_response = self._get_sso_response(self._sso_url, post_data)\n File \"/usr/lib64/python2.7/site-packages/ovirtsdk4/__init__.py\", line 703, in _get_sso_response\n self._check_content_type(self.__JSON_CONTENT_TYPE_RE, 'JSON', header_lines)\n File \"/usr/lib64/python2.7/site-packages/ovirtsdk4/__init__.py\", line 890, in _check_content_type\n raise Error(msg)\nError: The response content type 'text/html; charset=iso-8859-1' isn't the expected JSON\n", "failed": true, "msg": "The response content type 'text/html; charset=iso-8859-1' isn't the expected JSON" }" 2024-02-16 21:05:28,499+0000 DEBUG var changed: host "localhost" var "ansible_play_hosts" type "<type 'list'>" value: "[]" 2024-02-16 21:05:28,499+0000 DEBUG var changed: host "localhost" var "play_hosts" type "<type 'list'>" value: "[]" 2024-02-16 21:05:28,499+0000 DEBUG var changed: host "localhost" var "ansible_play_batch" type "<type 'list'>" value: "[]" 2024-02-16 21:05:28,500+0000 ERROR ansible failed {'status': 'FAILED', 'ansible_type': 'task', 'ansible_task': u'Obtain SSO token using username/password credentials', 'ansible_result': u'type: <type \'dict\'>\nstr: {u\'exception\': u\'Traceback (most recent call last):\\n File "/tmp/ansible_ovirt_auth_payload_GY8VTT/ansible_ovirt_auth_payload.zip/ansible/modules/cloud/ovirt/ovirt_auth.py", line 276, in main\\n File "/usr/lib64/python2.7/site-packages/ovirtsdk4/__init__.py", line 382, in authenticate\\n self._ss', 'task_duration': 955, 'ansible_host': u'localhost', 'ansible_playbook': u'/usr/share/ovirt-hosted-engine-setup/ansible/trigger_role.yml'} 2024-02-16 21:05:28,500+0000 DEBUG ansible on_any args <ansible.executor.task_result.TaskResult object at 0x7f70e7500750> kwargs ignore_errors:None 2024-02-16 21:05:28,506+0000 INFO ansible stats { "ansible_playbook": "/usr/share/ovirt-hosted-engine-setup/ansible/trigger_role.yml", "ansible_playbook_duration": "16:00 Minutes", "ansible_result": "type: <type 'dict'>\nstr: {u'localhost': {'ignored': 0, 'skipped': 1, 'ok': 4, 'failures': 1, 'unreachable': 0, 'rescued': 0, 'changed': 0}}", "ansible_type": "finish", "status": "FAILED" } 2024-02-16 21:05:28,506+0000 INFO SUMMARY: Duration Task Name -------- -------- [ < 1 sec ] Execute just a specific set of steps [ 00:01 ] Force facts gathering [ < 1 sec ] Check local VM dir stat [ FAILED ] Obtain SSO token using username/password credentials 2024-02-16 21:05:28,507+0000 DEBUG ansible on_any args <ansible.executor.stats.AggregateStats object at 0x7f70f6095690> kwargs

2 1

Add host into Ovirt-engine failure- Urgently need help with
by Ikram Ulhaq 19 Feb '24

19 Feb '24

I have captured the log below under the events of the host. Not sure why it is failing, as I'm able to SSH into the host form ovirt-engine vm. Host hostb.example.com installation failed. Command returned failure code 1 during SSH session 'root(a)hostb.example.com'.

1 0

IO per VM monitoring
by marek 19 Feb '24

19 Feb '24

hi, i have prometheus based ovirt hosts monitoring (node_exporter, smartcl_exporter, ipmi_exporter) https://prometheus-community.github.io/ansible/branch/main/ and alerts from https://samber.github.io/awesome-prometheus-alerts/ after i started this monitoring i found that one VM is overloading local storage (so i must check IO limiting documentation as a homework :) ) but my question is how do you monitor IO traffic per VM? (IOPS, read/write traffic,..) some qemu/libvirt exporter? some custom text file + node_exporter? thanks for tips Marek

4 7

Ovirt 4.4.10 - Admin account locked after password change
by Andy Lau 19 Feb '24

19 Feb '24

Hello All Recently, I reset the password for the admin account through ovirt-aaa-jdbc-tool. The password changed properly but the admin account will be locked automatically after few hours later. From the engine log, the admin@internal seems login periodically from ovirt engine itself. If I fallback the password with the original one, all working fine. Do anyone has the solution? Screen capture from the engine log: https://polyuit-my.sharepoint.com/:i:/g/personal/tflau_polyu_edu_hk/Edqp2ls…

3 4

Urgent: Assistance Needed - oVirt Host Unresponsive
by Sachendra Shukla 18 Feb '24

18 Feb '24

HI Team, I am writing to inform you about an issue we are currently facing with our oVirt host. Unfortunately, the host has become unresponsive, and our attempts to place it in maintenance mode have been unsuccessful. Additionally, when checking the VDSM status, we encountered an error. Here is a snapshot for your reference: [image: image.png] VDSM error - [image: image.png] -- Regards, Sachendra Shukla Yagna iQ, Inc. and subsidiaries HQ Address: Yagna iQ Inc. 7700 Windrose Ave, Suite G300, Plano, TX 75024, USA 75024, Website: https://yagnaiq.com Contact Customer Support: support(a)yagnaiq.com Privacy Policy: https://www.yagnaiq.com/privacy-policy/ *This communication and any attachments may contain confidential information and/or copyright material of Yagna iQ, Inc. * All unauthorized use, disclosure or distribution is prohibited. If you are not the intended recipient, please notify Yagna iQ immediately by replying to the email and destroy all copies of this communication. This email has been scanned for all known viruses. The sender does not accept liability for any damage inflicted by viewing the content of this email.

5 7

change iscsi auth on hosted engine storage domain
by Jirka Simon 16 Feb '24

16 Feb '24

Hello oVirt community, I have hosted engine on iSCSI storage without any authentication, I would like to change it. Is there any way how to do it without redeploy hosted engine ? Thank you for any help. Jirka

1 0

mirrorlist.ovirt.org Repository is not working
by raghawendra.m＠gmail.com 14 Feb '24

14 Feb '24

Hi, This morning(14Feb2024) noticed that, ovirt repositories are not accessible. Status code: 503 for https://mirrorlist.ovirt.org/mirrorlist-ovirt-4.5-el9 (IP: 8.43.85.224) Hopefully, you are in process of fixing that issue. Regards, Raghavendra M

1 0

Internal pentest result : Ovirt-engine authentication bypass
by Jirka Simon 13 Feb '24

13 Feb '24

Hello ovirt comunity. We had an internal pentest here and one finding is *Ovirt-engine authentication bypass.* Ovirt-engine, as deployed on ovirtm.XXX.XXX.cz, contains an authentication bypass. It is possible to directly call the CreateUserSessionCommand using runAction exposed by /ovirt- engine/webadmin/GenericApiGWTService. *This action explicitly enables everyone to call it:* ```/ @Override protected boolean isUserAuthorizedToRunAction() { return true; } /``` The behavior of this call differs based on the ENGINE_SSO_ENABLE_EXTERNAL_SSO configuration option: ``` /boolean externalSsoEnabled = EngineLocalConfig.getInstance().getBoolean("ENGINE_SSO_ENABLE_EXTERNAL_SSO"); DbUser dbUser = externalSsoEnabled ? dbUserDao.getByUsernameAndDomain(params.getPrincipalName(), authzName) : dbUserDao.getByExternalId(authzName, params.getPrincipalId());/ ``` If this option is enabled, usernames are used to locate users. If it's disabled, the externalId (which seems to be a randomly generated GUID) is used to locate users. If the specified user exists, a session is returned for the user. If the specified user doesn't exist, the user is created in the system. However, the user doesn't get assigned any group membership or rights, therefore the session creation fails because of the missing Login right. The attempt to modify the users table can be seen in the SQL error message when attempting to use a null value for the username (as the endpoint uses GWT, the payload is mostly unreadable): ``` /POST /ovirt-engine/webadmin/GenericApiGWTService HTTP/1.1 Host: ovirtm.xxx.xxx.cz 14 Final Report: Results of penetration testing (internal, external, Wi-Fi) 21 December 2023 Cookie: JSESSIONID=wsp3WAo63LZGHfpB__stEt4lZ7z_zZycpzIprNlT.ovirtm45; Content-Type: text/x-gwt-rpc; charset=utf-8 X-GWT-Module-Base: https://ovirtm.xxx.xx.cz/ovirt-engine/webadmin X-GWT-Permutation: D7ECB5EF5E29205D18271CC08183A28D Ovirt-Xsrf-Token: 4D87D03B631F8506FC668AA4C3FE3F443D723A9F379FDBB8B0D6DA0668650375 Content-Length: 869 7|0|23|https://ovirtm.xxx.xxx.cz/ovirt- engine/webadmin|0D1B4DEE9D1424E18C443F1CD1C11574|org.ovirt.engine.ui.frontend.gwtservices.GenericApiGWT Service|runAction|org.ovirt.engine.core.common.action.ActionType/2930387551|org.ovirt.engine.core.commo n.action.ActionParametersBase/2903049429|org.ovirt.engine.core.common.action.CreateUserSessionParameter s/2744166832|appScope|email|firstName|java.util.ArrayList/4159755760|lastName|namespace|principalId|adm in|internal|sourceIp|ssoScope|ssoToken|org.ovirt.engine.core.common.action.ActionParametersBase$EndProc edure/1568822488|java.util.Collections$EmptyMap/4174664486|org.ovirt.engine.core.common.businessentitie s.VDSStatus/1938301532|org.ovirt.engine.core.compat.TransactionScopeOption/1475850853|1|2|3|4|2|5|6|5|2 01|7|0|8|9|10|11|0|12|13|14|0|16|17|18|19|0|5|0|0|0|0|20|1|0|11|0|0|0|0|0|0|21|0|- 4|22|0|1|0|1|23|2|0|0|0| HTTP/1.1 200 OK Date: Fri, 15 Dec 2023 09:42:35 GMT Server: Apache/2.4.37 (CentOS Stream) OpenSSL/1.1.1k mod_auth_gssapi/1.6.1 Expires: Thu, 14 Dec 2023 09:42:35 GMT Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: locale=cs_CZ; path=/; secure; HttpOnly; Max-Age=2147483647; Expires=Wed, 02-Jan-2092 12:56:42 GMT X-XSS-PROTECTION: 1; MODE=BLOCK Pragma: no-cache X-FRAME-OPTIONS: SAMEORIGIN Content-Disposition: attachment X-CONTENT-TYPE-OPTIONS: NOSNIFF Content-Length: 1794 Content-Type: application/json;charset=utf-8 Correlation-Id: 664c1c1f-9a75-4e14-94d7-aba12c5442f5 Connection: close //OK[0,5,4,8,3,1,2,474,7,6,1,0,2,0,2,5,1,0,4,3,1,2,0,2,1,1,["org.ovirt.engine.core.common.action.Action ReturnValue/4163585948","java.util.ArrayList/4159755760","java.lang.String/2004016611","ENGINE","","org .ovirt.engine.core.common.errors.EngineFault/2377218566","org.ovirt.engine.core.common.errors.EngineErr or/2640515959","ERROR: null value in column \"username\" violates not-null constraint\n Detail: Failing row contains (6dad5e2f-7c95-4547-8f08-6936494c91b6, firstName, lastName, internal-authz, null, , email, , f, principalId, 2023-12-14 17:51:04.757747+01, 2023-12-15 10:42:35.125994+01, namespace, firstName(a)internal-authz).\n Where: SQL statement \"UPDATE users\n SET department \u003D v_department,\n domain \u003D v_domain,\n email \u003D v_email,\n name \u003D v_name,\n note \u003D v_note,\n surname \u003D v_surname,\n username \u003D v_username,\n external_id \u003D v_external_id,\n namespace \u003D v_namespace,\n _update_date \u003D CURRENT_TIMESTAMP\n WHERE external_id \u003D v_external_id\n AND domain \u003D v_domain\"\nPL/pgSQL function updateuserimpl(character varying,character varying,character varying,character varying,character varying,character varying,uuid,character varying,text,character varying) line 5 at SQL statement\nSQL statement \"SELECT UpdateUserImpl(\n v_department,\n v_domain,\n v_email,\n v_name,\n v_note,\n v_surname,\n v_user_id,\n v_username,\n v_external_id,\n v_namespace)\"\nPL/pgSQL function updateuser(character varying,character varying,character varying,character varying,character varying,character varying,uuid,character varying,boolean,text,character varying) line 3 at PERFORM"],0,7]/ ``` Fortunately, in our deplyoment the ENGINE_SSO_ENABLE_EXTERNAL_SSO configuration was set to false, so to create a session for the admin it would be necessary to know the admin's user externalId. However, as this is not the default configuration, it is possible that a later reinstallation could change the value. Still, it was possible to create users in the system without any authentication. What is the best way to report this security issue? Thank you Jirka

2 3