Re: [Users] Otopi pre-seeded answers and firewall settings
--_64b96cf8-fdd4-4df4-bf3e-459817379ccc_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Joshua=2C many thanks for your suggestion which I suppose would work perfectly=2C but= I actually want iptables (CentOS 6.5 here=2C so no firewalld) rules in pla= ce all the time=2C but only "MY OWN" iptables rules =3B> Regards=2C Giuseppe Date: Tue=2C 25 Mar 2014 18:04:04 -0400 Subject: Re: [Users] Otopi pre-seeded answers and firewall settings From: josh@wrale.com To: giuseppe.ragusa@hotmail.com Perhaps you could add the iptables and firewalld packages to yum.conf as ex= cludes. I don't know if this would fail silently=2C but if so=2C the engin= e installer would never know. Thanks=2C =0A= Joshua On Tue=2C Mar 25=2C 2014 at 5:49 PM=2C Giuseppe Ragusa <giuseppe.ragusa@hot= mail.com> wrote: =0A= =0A= =0A= =0A= Hi Didi=2C many thanks for your invaluable help! I'll try your suggestion (/etc/ovirt-host-deploy.conf.d/99-prevent-iptables= .conf) asap and then I will report back. By the way: I have a really custom iptables setup (multiple separated netwo= rks on hypervisor hosts)=2C so I suppose it's best to hand tune firewall ru= les and then leave them alone (I pre-configure them=2C so the setup procedu= re won't be impeded in its communication needs anyway AND I will always gua= rantee the most stringent filtering possible with default deny ecc.). =0A= Many thanks again=2C Giuseppe Date: Tue=2C 25 Mar 2014 04:05:33 -0400 From: didi@redhat.com To: giuseppe.ragusa@hotmail.com =0A= CC: users@ovirt.org Subject: Re: [Users] Otopi pre-seeded answers and firewall settings =0A= From: "Giuseppe Ragusa" <giuseppe.ragusa@hotmail.com> =0A= To: "Yedidyah Bar David" <didi@redhat.com> Cc: "Users@ovirt.org" <users@ovirt.org> =0A= Sent: Tuesday=2C March 25=2C 2014 1:53:20 AM Subject: RE: [Users] Otopi pre-seeded answers and firewall settings Hi Didi=2C I found the references to NETWORK/iptablesEnable in my engine logs (/var/lo= g/ovirt-engine/host-deploy/ovirt-*.log)=2C but it didn't seem to work after= all. =0A= Full logs attached. I resurrected my Engine by rebooting the (still only) host=2C then restarti= ng ovirt-ha-agent (at startup the agent failed while trying to launch vdsm= =2C but I found vdsm running and so tried manually...).=0A= OK=2C so it's host-deploy that's doing that.But it's not host-deploy itself= - it's the engine that is talking to it=2C asking it to configure iptables= .I don't know how to make the agent don't do that. I searched a bit the sou= rces (which I don't know)=0A= and didn't find a simple way. You can=2C however=2C try to override this by:# mkdir -p /etc/ovirt-host-de= ploy.conf.d# echo '[environment:enforce]' > /etc/ovirt-host-deploy.conf.d/9= 9-prevent-iptables.conf=0A= # echo 'NETWORK/iptablesEnable=3Dbool:False' >> /etc/ovirt-host-deploy.conf= .d/99-prevent-iptables.conf Never tried that=2C and not sure it's recommended - if it does work=2C it m= eans that host-deploy will not=0A= update iptables=2C but the engine will think it did. So it's better to find= a way to make the engine not dothat. Or=2C better yet=2C that you'll expla= in why you need this and somehow make the engine do what you want...=0A= -- Didi =0A= _______________________________________________ =0A= Users mailing list =0A= Users@ovirt.org =0A= http://lists.ovirt.org/mailman/listinfo/users =0A= = --_64b96cf8-fdd4-4df4-bf3e-459817379ccc_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <style><!-- .hmmessage P { margin:0px=3B padding:0px } body.hmmessage { font-size: 12pt=3B font-family:Calibri } --></style></head> <body class=3D'hmmessage'><div dir=3D'ltr'>Hi Joshua=2C<br>many thanks for = your suggestion which I suppose would work perfectly=2C but I actually want= iptables (CentOS 6.5 here=2C so no firewalld) rules in place all the time= =2C but only "MY OWN" iptables rules =3B>=3B<br><br>Regards=2C<br>Giusepp= e<br><br><div><hr id=3D"stopSpelling">Date: Tue=2C 25 Mar 2014 18:04:04 -04= 00<br>Subject: Re: [Users] Otopi pre-seeded answers and firewall settings<b= r>From: josh@wrale.com<br>To: giuseppe.ragusa@hotmail.com<br><br><div dir= =3D"ltr"><div>Perhaps you could add the iptables and firewalld packages to = yum.conf as excludes. =3B I don't know if this would fail silently=2C b= ut if so=2C the engine installer would never know.<br><br></div>Thanks=2C<b= r>=0A= Joshua<br></div><div class=3D"ecxgmail_extra"><br><br><div class=3D"ecxgmai= l_quote">On Tue=2C Mar 25=2C 2014 at 5:49 PM=2C Giuseppe Ragusa <span dir= =3D"ltr"><=3B<a href=3D"mailto:giuseppe.ragusa@hotmail.com" target=3D"_bl= ank">giuseppe.ragusa@hotmail.com</a>>=3B</span> wrote:<br>=0A= <blockquote class=3D"ecxgmail_quote" style=3D"border-left:1px #ccc solid=3B= padding-left:1ex=3B">=0A= =0A= =0A= <div><div dir=3D"ltr">Hi Didi=2C<br>many thanks for your invaluable help!<b= r><br>I'll try your suggestion (/etc/ovirt-host-deploy.conf.d/99-prevent-ip= tables.conf) asap and then I will report back.<br><br>By the way: I have a = really custom iptables setup (multiple separated networks on hypervisor hos= ts)=2C so I suppose it's best to hand tune firewall rules and then leave th= em alone (I pre-configure them=2C so the setup procedure won't be impeded i= n its communication needs anyway AND I will always guarantee the most strin= gent filtering possible with default deny ecc.).<br>=0A= <br>Many thanks again=2C<br>Giuseppe<br><br><div><hr>Date: Tue=2C 25 Mar 20= 14 04:05:33 -0400<br>From: <a href=3D"mailto:didi@redhat.com" target=3D"_bl= ank">didi@redhat.com</a><br>To: <a href=3D"mailto:giuseppe.ragusa@hotmail.c= om" target=3D"_blank">giuseppe.ragusa@hotmail.com</a><br>=0A= CC: <a href=3D"mailto:users@ovirt.org" target=3D"_blank">users@ovirt.org</a=
<br>Subject: Re: [Users] Otopi pre-seeded answers and firewall settings<br= <br><div style=3D"font-size:12pt=3Bfont-family:times new roman=2Cnew york= =2Ctimes=2Cserif=3B">=0A= <div></div><blockquote style=3D"padding-left:5px=3Bfont-size:12pt=3Bfont-st= yle:normal=3Bfont-family:Helvetica=2CArial=2Csans-serif=3Btext-decoration:n= one=3Bfont-weight:normal=3Bborder-left:2px solid #1010ff=3B"><b>From: </b>"= Giuseppe Ragusa" <=3B<a href=3D"mailto:giuseppe.ragusa@hotmail.com" targe= t=3D"_blank">giuseppe.ragusa@hotmail.com</a>>=3B<br>=0A= <b>To: </b>"Yedidyah Bar David" <=3B<a href=3D"mailto:didi@redhat.com" ta= rget=3D"_blank">didi@redhat.com</a>>=3B<br><b>Cc: </b>"<a href=3D"mailto:= Users@ovirt.org" target=3D"_blank">Users@ovirt.org</a>" <=3B<a href=3D"ma= ilto:users@ovirt.org" target=3D"_blank">users@ovirt.org</a>>=3B<br>=0A= <b>Sent: </b>Tuesday=2C March 25=2C 2014 1:53:20 AM<br><b>Subject: </b>RE: = [Users] Otopi pre-seeded answers and firewall settings<br><div><br></div><d= iv dir=3D"ltr">Hi Didi=2C<br>I found the references to NETWORK/iptablesEnab= le in my engine logs (/var/log/ovirt-engine/host-deploy/ovirt-*.log)=2C but= it didn't seem to work after all.<br>=0A= <div><br></div>Full logs attached.<br><div><br></div>I resurrected my Engin= e by rebooting the (still only) host=2C then restarting ovirt-ha-agent (at = startup the agent failed while trying to launch vdsm=2C but I found vdsm ru= nning and so tried manually...).</div>=0A= </blockquote><div><br></div><div>OK=2C so it's host-deploy that's doing tha= t.</div><div>But it's not host-deploy itself - it's the engine that is talk= ing to it=2C asking it to configure iptables.</div><div>I don't know how to= make the agent don't do that. I searched a bit the sources (which I don't = know)</div>=0A= <div>and didn't find a simple way.</div><div><br></div><div>You can=2C howe= ver=2C try to override this by:</div><div># mkdir -p /etc/ovirt-host-deploy= .conf.d</div><div># echo '[environment:enforce]' >=3B =3B/etc/ovirt-h= ost-deploy.conf.d/99-prevent-iptables.conf</div>=0A= <div># echo 'NETWORK/iptablesEnable=3Dbool:False' >=3B>=3B =3B/etc/= ovirt-host-deploy.conf.d/99-prevent-iptables.conf</div><div><br></div><div>= Never tried that=2C and not sure it's recommended - if it does work=2C it m= eans that host-deploy will not</div>=0A= <div>update iptables=2C but the engine will think it did. So it's better to= find a way to make the engine not do</div><div>that. Or=2C better yet=2C t= hat you'll explain why you need this and somehow make the engine do what yo= u want...</div>=0A= <span class=3D"ecxHOEnZb"><font color=3D"#888888"><div><span style=3D"font-= size:12pt=3B">-- =3B</span></div><div>Didi</div><div><br></div></font><= /span></div></div> </div></div>=0A= <br>_______________________________________________<br>=0A= Users mailing list<br>=0A= <a href=3D"mailto:Users@ovirt.org">Users@ovirt.org</a><br>=0A= <a href=3D"http://lists.ovirt.org/mailman/listinfo/users" target=3D"_blank"= http://lists.ovirt.org/mailman/listinfo/users</a><br>=0A= <br></blockquote></div><br></div></div> </div></body> </html>=
--_64b96cf8-fdd4-4df4-bf3e-459817379ccc_--
Giuseppe, I should have clarified. I meant to blacklist the packages only for a short time, while you add the nodes to the oVirt environment. Once everything was set up, you would remove these restrictions and yum install iptables. You'd then configure to taste. Glad to hear of your success with the conf file method, though. Thanks, Joshua On Tue, Mar 25, 2014 at 6:15 PM, Giuseppe Ragusa < giuseppe.ragusa@hotmail.com> wrote:
Hi Joshua, many thanks for your suggestion which I suppose would work perfectly, but I actually want iptables (CentOS 6.5 here, so no firewalld) rules in place all the time, but only "MY OWN" iptables rules ;>
Regards, Giuseppe
------------------------------ Date: Tue, 25 Mar 2014 18:04:04 -0400 Subject: Re: [Users] Otopi pre-seeded answers and firewall settings From: josh@wrale.com To: giuseppe.ragusa@hotmail.com
Perhaps you could add the iptables and firewalld packages to yum.conf as excludes. I don't know if this would fail silently, but if so, the engine installer would never know.
Thanks, Joshua
On Tue, Mar 25, 2014 at 5:49 PM, Giuseppe Ragusa < giuseppe.ragusa@hotmail.com> wrote:
Hi Didi, many thanks for your invaluable help!
I'll try your suggestion (/etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf) asap and then I will report back.
By the way: I have a really custom iptables setup (multiple separated networks on hypervisor hosts), so I suppose it's best to hand tune firewall rules and then leave them alone (I pre-configure them, so the setup procedure won't be impeded in its communication needs anyway AND I will always guarantee the most stringent filtering possible with default deny ecc.).
Many thanks again, Giuseppe
------------------------------ Date: Tue, 25 Mar 2014 04:05:33 -0400 From: didi@redhat.com To: giuseppe.ragusa@hotmail.com CC: users@ovirt.org Subject: Re: [Users] Otopi pre-seeded answers and firewall settings
*From: *"Giuseppe Ragusa" <giuseppe.ragusa@hotmail.com> *To: *"Yedidyah Bar David" <didi@redhat.com> *Cc: *"Users@ovirt.org" <users@ovirt.org> *Sent: *Tuesday, March 25, 2014 1:53:20 AM *Subject: *RE: [Users] Otopi pre-seeded answers and firewall settings
Hi Didi, I found the references to NETWORK/iptablesEnable in my engine logs (/var/log/ovirt-engine/host-deploy/ovirt-*.log), but it didn't seem to work after all.
Full logs attached.
I resurrected my Engine by rebooting the (still only) host, then restarting ovirt-ha-agent (at startup the agent failed while trying to launch vdsm, but I found vdsm running and so tried manually...).
OK, so it's host-deploy that's doing that. But it's not host-deploy itself - it's the engine that is talking to it, asking it to configure iptables. I don't know how to make the agent don't do that. I searched a bit the sources (which I don't know) and didn't find a simple way.
You can, however, try to override this by: # mkdir -p /etc/ovirt-host-deploy.conf.d # echo '[environment:enforce]'
/etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf # echo 'NETWORK/iptablesEnable=bool:False'
/etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf
Never tried that, and not sure it's recommended - if it does work, it means that host-deploy will not update iptables, but the engine will think it did. So it's better to find a way to make the engine not do that. Or, better yet, that you'll explain why you need this and somehow make the engine do what you want... -- Didi
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
participants (2)
-
Giuseppe Ragusa -
Joshua Dotson