- Users - oVirt List Archives

Help with SSL
by ~Stack~ 11 Oct '17

11 Oct '17

This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --7s08lKxr317U4f7S2uiLNhLgbhqI41l89 Content-Type: multipart/mixed; boundary="hSq7F28gapFg5m3iNcupps9DgFkLnpMkc"; protected-headers="v1" From: ~Stack~ <i.am.stack(a)gmail.com> To: users <users(a)ovirt.org> Message-ID: <bdcd0a7d-84c7-b37c-e66e-b2c6ace3e31c(a)gmail.com> Subject: Help with SSL --hSq7F28gapFg5m3iNcupps9DgFkLnpMkc Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Greetings, OS: Scientific Linux 7.3 Ovirt: 4.1.6.2-1.el7.centos Foreman: 1.16.0-RC1 I updated my OVirt SSL cert from a self-signed to a purchased one using the directions here: https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL/ Everything seems to work from the web interface. Then I tried to add in Foreman. Thats where I get the error: Unable to save ERF56-1309 [Foreman::FingerprintException]: The remote system presented a public key signed by an unidentified certificate authority. If you are sure the remote system is authentic, go to the compute resource edit page, press the 'Test Connection' or 'Load Datacenters' button and submit= =2E Everything I can find says that it *should* be resolved - From Red Hat, to Foreman, to even the Ovirt list! Yet there it is! Well after poking at it for a while, I realized that the cert Foreman was auto-resolving was still the /OLD/ cert! Step #2 in those ovirt directions says to break the symbolic link to /etc/pki/ovirt-engine/ca.pem. But it doesn't say what to do with that file. So I replaced it with my cert. Restarted ovirt and now Foreman resolves the correct X509 cert! (I have no idea if that broke something else.) But I still get the error in foreman. :-( I feel like I'm still missing something in the ovirt configs. Something needs to be updated/replaced in ovirt that isn't in those docs. Can anyone help me out please? I've been trying for hours and not making progress. Thanks! ~Stack~ --hSq7F28gapFg5m3iNcupps9DgFkLnpMkc-- --7s08lKxr317U4f7S2uiLNhLgbhqI41l89 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJZ3UApAAoJELkej+ysXJPmACEP/11wrxRd3rc3vOyR/4BKO+gg KFdO2eOjuWBZlx6UV1sl61ivj2Pm3tXwz/v97vEtVtxFrmcdstJ1MEGTjsMV3QcB J6j4zljuafGQheLI7atEuzoyi22yhzopbfvfTnMoe6QLdkxVLSFEDmiSf5foV+Rc 52MzSv1Xu8tXgubyam2CazpS/DKGPYU8jojWRlsTyZsF5AJ8su5m+1ZVr8UgdTMR GBZlnZYuwb6bFjEPu0hkXwTPGTzVI6yaj0MfcCfO01merJWpv0QtOwgVAvdDgoyX 9X8HId0hjWqS4fM82CMgIvfmYb9AGzEWVz4deGXlYPLX76tlsi+cu/YkHVWiznPS znReyqliTY2q621WgdcK9xNWW/Kqf2W/CiEbmVIv0k59Hg3FpTGtrjcaS+ny98qw kZpHGRtQNoojCvcSrx86Fnt7e3Oqr8woOtnUJxtzPeN6I0CYCMOw2pt02a9npVSC iKxj84LsFQphMNjVhqrsmrYW7NS9RtWCoiVweEQAwS/+bKfoLniqT4cj8xgpCkHJ W/7qz9qTR8sMTuEr2WhLouZyCk7z5FD6A49B+0OCPpUYuFE7Cll7+7hxSHuNqy8I M74aEPNVO7DdE0iT0yz5EkIxn5oht/gaPwyN8QYCJxjyglUEHOBK/+hAnpvfeLEF y5hEnpvgwgt9iZtqrI4S =qZrE -----END PGP SIGNATURE----- --7s08lKxr317U4f7S2uiLNhLgbhqI41l89--

2 2

[ANN] oVirt 4.1.7 Third Release Candidate is now available
by Sandro Bonazzola 11 Oct '17

11 Oct '17

The oVirt Project is pleased to announce the availability of the Third Release Candidate of oVirt 4.1.7, as of October 11th, 2017 This update is the seventh in a series of stabilization updates to the 4.1 series. Starting from 4.1.5 oVirt supports libgfapi [5]. Using libgfapi provides a real performance boost for ovirt when using GlusterFS . Due to a known issue [6], using this will break live storage migration. This is expected to be fixed soon. If you do not use live storage migration you can give it a try. Use [7] for more details on how to enable it. This release is available now for: * Red Hat Enterprise Linux 7.4 or later * CentOS Linux (or similar) 7.4 or later This release supports Hypervisor Hosts running: * Red Hat Enterprise Linux 7.4 or later * CentOS Linux (or similar) 7.4 or later * oVirt Node 4.1 See the release notes draft [3] for installation / upgrade instructions and a list of new features and bugs fixed. Notes: - oVirt Appliance is already available - oVirt Live is already available[4] - oVirt Node is already available[4] Additional Resources: * Read more about the oVirt 4.1.7 release highlights: http://www.ovirt.org/release/4.1.7/ * Get more oVirt Project updates on Twitter: https://twitter.com/ovirt * Check out the latest project news on the oVirt blog: http://www.ovirt.org/blog/ [1] https://www.ovirt.org/community/ [2] https://bugzilla.redhat.com/enter_bug.cgi?classification=oVirt [3] http://www.ovirt.org/release/4.1.7/ [4] http://resources.ovirt.org/pub/ovirt-4.1-pre/iso/ [5] http://staged-gluster-docs.readthedocs.io/en/release3.7.0beta1/Features/lib… [6] https://bugzilla.redhat.com/show_bug.cgi?id=1306562 [7] http://www.ovirt.org/develop/release-management/features/storage/glusterfs-… -- SANDRO BONAZZOLA ASSOCIATE MANAGER, SOFTWARE ENGINEERING, EMEA ENG VIRTUALIZATION R&D Red Hat EMEA <https://www.redhat.com/> <https://red.ht/sig> TRIED. TESTED. TRUSTED. <https://redhat.com/trusted> <http://www.teraplan.it/redhat-osd-2017/>

1 0

Info on manual operations after removing FC storage domain
by Gianluca Cecchi 11 Oct '17

11 Oct '17

Hello, I'm relocating some disks from some storage domains to other ones. At the end I'm going to remove source storage domains. All the SD involved are FC and the hosts are CentOS 7.4 I see that after removing an SD from oVirt, the multipath part on host remains. What is the correct sequence of operations to do at hosts' side after completing the Webadmin Gui part? Some questions: - do the remove SD from gui imply vgchange -an of the VG and vgremove of the vg? Or are they delegated to post actions? - do it imply the pvremove on the LUN? After clearing what above I would imagine remaining steps would be, based on my previous similar experience with iSCSI removal on physical servers: - take note of the paths sdY, ... of mpathX - remove the multipath device with multipath -f mpathX - flush the single paths devices blockdev --flushbufs sdY for every path of the previous taken note ones - remove single path devices echo 1 > /sys/block/sdY/device/delete - remove LUN from storage array when previous steps done on all the hypervisors Any comment? Any further step at vdsm level files..? Thanks in advance, Gianluca

2 3

Maximum storage per VM?
by Dmitri Chebotarov 11 Oct '17

11 Oct '17

Hello I'm trying to find any info on how much storage I can attach to a VM. Is there a recommended/maximum for number of disks and maximum disk size? I'm using GlusterFS as backend storage for the cluster. The VM uses LVM (/w striped volumes) to manage attached disks. Thank you, -- Dmitri Chebotarov. George Mason University, 4400 University Drive, Fairfax, VA, 22030 GPG Public key# 5E19F14D: [https://goo.gl/SlE8tj]

3 5

VM Serial Port connection to network port
by Gagandeep Arora 11 Oct '17

11 Oct '17

Hi, Is it possible to configure a VM with a serial port connecting to network port in client mode? Can someone point me in the right direction on how to do this in ovirt. We are running ovirt-4.0.6.3-1.1. Regards, Gagan

1 0

Re: [ovirt-users] ovirt-engine-extension-aaa-ldap active directory
by Luca 'remix_tj' Lorenzetto 10 Oct '17

10 Oct '17

On Tue, Oct 10, 2017 at 4:41 PM, nicola gentile <nicola.gentile.to(a)gmail.com> wrote: > I run the command you suggest > ldapsearch -h domaincontroller.dom.it -b "dc=dom,dc=it" -D user(a)dom.it > -W -x sAMAccountName=user_to_search userPrincipalName | grep > userPrincipalName > > This is the result: > > Enter LDAP Password: > # requesting: userPrincipalName > Supposing you're using all the right parameters in ldapsearch command, it seems that the user you were looking up is not a valid user in that directory server. Please check with someone that can access to AD and verify the status of the user with ADSI Edit. Luca -- "E' assurdo impiegare gli uomini di intelligenza eccellente per fare calcoli che potrebbero essere affidati a chiunque se si usassero delle macchine" Gottfried Wilhelm von Leibnitz, Filosofo e Matematico (1646-1716) "Internet è la più grande biblioteca del mondo. Ma il problema è che i libri sono tutti sparsi sul pavimento" John Allen Paulos, Matematico (1945-vivente) Luca 'remix_tj' Lorenzetto, http://www.remixtj.net , <lorenzetto.luca(a)gmail.com>

2 1

Re: [ovirt-users] ovirt-engine-extension-aaa-ldap active directory
by nicola gentile 10 Oct '17

10 Oct '17

yes is AD. Nick 2017-10-10 16:41 GMT+02:00 nicola gentile <nicola.gentile.to(a)gmail.com>: > I run the command you suggest > ldapsearch -h domaincontroller.dom.it -b "dc=dom,dc=it" -D user(a)dom.it > -W -x sAMAccountName=user_to_search userPrincipalName | grep > userPrincipalName > > This is the result: > > Enter LDAP Password: > # requesting: userPrincipalName > > Nick > > 2017-10-10 16:21 GMT+02:00 Luca 'remix_tj' Lorenzetto > <lorenzetto.luca(a)gmail.com>: >> On Tue, Oct 10, 2017 at 4:06 PM, nicola gentile >> <nicola.gentile.to(a)gmail.com> wrote: >>> include = <ad.properties> >>> >>> vars.domain = dom.it >>> vars.user = CN=myuser,OU=spuser,DC=dom,DC=it >>> vars.password = xxxxxxxxx >>> >>> pool.default.auth.simple.bindDN = ${global:vars.user} >>> pool.default.auth.simple.password = ${global:vars.password} >>> pool.default.serverset.type = srvrecord >>> pool.default.serverset.srvrecord.domain = ${global:vars.domain} >>> pool.default.ssl.startTLS = true >>> pool.default.ssl.truststore.file = ${local:_basedir}/polito.it.jks >>> pool.default.ssl.truststore.password = changeit >> >> It's an AD? >> >> Can you check if userPrincipalName of the user you're trying to use >> for connecting contains the login name in the format of >> user(a)domain.fqdn? >> >> I had issues with users that had userPrincipalName wrongly formatted. >> You should find nicola.gentile(a)polito.it on that field. >> >> You can check in this way: >> >> ldapsearch -h domaincontroller.dom.it -b "dc=dom,dc=it" -D user(a)dom.it >> -W -x sAMAccountName=user_to_search userPrincipalName | grep >> userPrincipalName >> >> >> Luca >> >> >> >> -- >> "E' assurdo impiegare gli uomini di intelligenza eccellente per fare >> calcoli che potrebbero essere affidati a chiunque se si usassero delle >> macchine" >> Gottfried Wilhelm von Leibnitz, Filosofo e Matematico (1646-1716) >> >> "Internet è la più grande biblioteca del mondo. >> Ma il problema è che i libri sono tutti sparsi sul pavimento" >> John Allen Paulos, Matematico (1945-vivente) >> >> Luca 'remix_tj' Lorenzetto, http://www.remixtj.net , <lorenzetto.luca(a)gmail.com>

1 0

Re: [ovirt-users] ovirt-engine-extension-aaa-ldap active directory
by Luca 'remix_tj' Lorenzetto 10 Oct '17

10 Oct '17

On Tue, Oct 10, 2017 at 4:06 PM, nicola gentile <nicola.gentile.to(a)gmail.com> wrote: > include = <ad.properties> > > vars.domain = dom.it > vars.user = CN=myuser,OU=spuser,DC=dom,DC=it > vars.password = xxxxxxxxx > > pool.default.auth.simple.bindDN = ${global:vars.user} > pool.default.auth.simple.password = ${global:vars.password} > pool.default.serverset.type = srvrecord > pool.default.serverset.srvrecord.domain = ${global:vars.domain} > pool.default.ssl.startTLS = true > pool.default.ssl.truststore.file = ${local:_basedir}/polito.it.jks > pool.default.ssl.truststore.password = changeit It's an AD? Can you check if userPrincipalName of the user you're trying to use for connecting contains the login name in the format of user(a)domain.fqdn? I had issues with users that had userPrincipalName wrongly formatted. You should find nicola.gentile(a)polito.it on that field. You can check in this way: ldapsearch -h domaincontroller.dom.it -b "dc=dom,dc=it" -D user(a)dom.it -W -x sAMAccountName=user_to_search userPrincipalName | grep userPrincipalName Luca -- "E' assurdo impiegare gli uomini di intelligenza eccellente per fare calcoli che potrebbero essere affidati a chiunque se si usassero delle macchine" Gottfried Wilhelm von Leibnitz, Filosofo e Matematico (1646-1716) "Internet è la più grande biblioteca del mondo. Ma il problema è che i libri sono tutti sparsi sul pavimento" John Allen Paulos, Matematico (1945-vivente) Luca 'remix_tj' Lorenzetto, http://www.remixtj.net , <lorenzetto.luca(a)gmail.com>

1 0

ovirt-engine-extension-aaa-ldap active directory
by nicola.gentile.to 10 Oct '17

10 Oct '17

Hi, I have a problem. Suddenly from the user portal the users of AD not login and displays the error: server_error: Unexpected comma or semicolon found at the end of the DN string. Also, from Admin Portal ->Users when I try to add a user of AD I don't see the sub domain Also, I try to run ovirt-engine-extension-aaa-ldap-setup but not works. I attach the log file. please help me Thanks Nick

3 4

multipath configuration for local disks?
by Matthias Leopold 10 Oct '17

10 Oct '17

hi, i'm using three different generations of hardware for my oVirt hypervisor hosts. they are not exactly the "same", but very "similar". - all were installed with oVirt Node 4.1.x installers - all have (2-4) local SSD disks for oVirt Node OS - all were configured with manual partitioning and SW RAID 1 with two SSD disks for oVirt Node OS after initializing the third generation of hosts (with 4 SSD disks) i noticed the difference in multipath configuration for the local disks. suddenly the two OS disks (for RAID 1) are not configured as multipath disks anymore, the unused other two are multipath disks. in the first two host generations the (only) two OS disks (for RAID 1) are configured as multipath disks. after looking at this for the first time and briefly looking into multipath documentation i think that local disks shouldn't be included in multipath configuration at all. i tried to remove the local disks from multipathing (delete from wwids file, explicit blacklisting), to no avail. i'm pasting two listings from the 4 SSD disk situation: # lsscsi --scsi_id -g [0:0:0:0] disk ATA SAMSUNG MZ7LM480 204Q /dev/sda - /dev/sg0 [0:0:1:0] disk ATA SAMSUNG MZ7LM480 204Q /dev/sdb - /dev/sg1 [0:0:2:0] disk ATA SAMSUNG MZ7LM480 204Q /dev/sdc SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102216 /dev/sg2 [0:0:3:0] disk ATA SAMSUNG MZ7LM480 204Q /dev/sdd SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102214 /dev/sg3 # ls -l /dev/disk/by-id/*SAMSUNG* lrwxrwxrwx. 1 root root 9 9. Okt 12:07 /dev/disk/by-id/ata-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102212 -> ../../sdb lrwxrwxrwx. 1 root root 10 9. Okt 12:07 /dev/disk/by-id/ata-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102212-part1 -> ../../sdb1 lrwxrwxrwx. 1 root root 10 9. Okt 12:07 /dev/disk/by-id/ata-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102212-part2 -> ../../sdb2 lrwxrwxrwx. 1 root root 9 9. Okt 12:07 /dev/disk/by-id/ata-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102214 -> ../../sdd lrwxrwxrwx. 1 root root 9 9. Okt 12:07 /dev/disk/by-id/ata-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102216 -> ../../sdc lrwxrwxrwx. 1 root root 9 9. Okt 12:07 /dev/disk/by-id/ata-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102222 -> ../../sda lrwxrwxrwx. 1 root root 10 9. Okt 12:07 /dev/disk/by-id/ata-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102222-part1 -> ../../sda1 lrwxrwxrwx. 1 root root 10 9. Okt 12:07 /dev/disk/by-id/ata-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102222-part2 -> ../../sda2 lrwxrwxrwx. 1 root root 10 9. Okt 12:07 /dev/disk/by-id/dm-name-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102214 -> ../../dm-6 lrwxrwxrwx. 1 root root 10 9. Okt 12:07 /dev/disk/by-id/dm-name-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102216 -> ../../dm-5 lrwxrwxrwx. 1 root root 10 9. Okt 12:07 /dev/disk/by-id/dm-uuid-mpath-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102214 -> ../../dm-6 lrwxrwxrwx. 1 root root 10 9. Okt 12:07 /dev/disk/by-id/dm-uuid-mpath-SAMSUNG_MZ7LM480HMHQ-00005_S2UJNX0J102216 -> ../../dm-5 can someone explain this behaviour? what is the _intended_ configuration? thx matthias

2 2