[ovirt-users] ipv6 FTP not enabled on resources ?

2014-09-24 Thread R P Herrold

I get this message trying to mirror some content off
resources.ovirt.org

The following error was encountered while trying to retrieve 
the URL: ftp://resources.ovirt.org/pub/ovirt-3.3/rpm/el6/

Connection to 2600:3c01::f03c:91ff:fe93:4b0d failed.

The system returned: (111) Connection refused

Is ip6tables not opened, or the anon. ftpd not listening on 
ipv6?  if not, could it please be enabled?  It is not possible 
to readily mirror content off through http ...

Thanks

-- Russ herrold

___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[ovirt-users] Unable to email from Wiki

2014-08-12 Thread R P Herrold
On Mon, 11 Aug 2014, Nick Kesick wrote:

 Mailer returned: Failed to set sender: w...@ovirt.org [SMTP: Invalid
 response code received from server (code: 452, response: 4.3.1 Insufficient
 system storage)] 

yes -- the drive filled up (again)

can someome PLEASE pull, build and install 

ftp://ftp.owlriver.com/pub/mirror/ORC/diskcheck/diskcheck-1.6-4.orc6.src.rpm

which will email notices off the unit when it goes over (by 
default) 90 pct full?

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


Re: [ovirt-users] Is there a plan to allow VM migration?

2014-08-06 Thread R P Herrold
On Wed, 6 Aug 2014, John Gardeniers wrote:

 Could it be that you're over-thinking this? Why can't Ovirt simply
 export VMs to a standard format, preferably of course one already used
 elsewhere, such as ovf? That way it's a straight one-to-one.

Life is not so neat

not a thought experiment here, but rather a summary of real 
life, in practice issues hit in working toward a generally 
applicable, FOSS based solution

The testing grid, to make it interesting is to be able to 
gobble in and use [examples still in production for ome 
reason or another]:
RHL 5.2
RHL 7.2
Windows 95
Windows NT 3.51
Windows 2000
Windows XP
--- all above this line are legacy and out of support -- we 
know this, but our customers are indifferent to such, so long 
as it does not 'see' the internet at large --

RHEL / CentOS 5 (Xen hooks)
RHEL / CentOS 6 (KVM hooks, with grub)
RHEL / CentOS 6 (KVM hooks, with grub2)
assorted Fedora
assorted (but largely recent) Ubuntu
Assorted Debian Testing and Stable
OpenBSD -- various
NetBSD -- various

We have automation for parts, but not all of that grid

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[ovirt-users] Is there a plan to allow VM migration?

2014-08-05 Thread R P Herrold
On Wed, 6 Aug 2014, John Gardeniers wrote:

 As per the subject, is there a plan to allow VM migration? By that I
 import that into the destination machine. That's slow, cumbersome and
 still requires the VMs configuration to be manually duplicated.

The problem we have run into when trying to implement 
automated assistance on image migrations between different 
backing store, is that the bootloader / initrd fixups are not 
deterministic and 'doable' as between grub, grub2, and other 
'first stage'

I would love a solution, but after much experimentation, I 
just don't see a good path to solving this in a general form.  
(it is not a many spokes to one common interchange format, and 
then one to new spoke transition, but rather a many to many 
problem)

Perhaps the libguestfs uplift mentioned for a few months from 
now with the RHEL 7.1 updates will help

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[ovirt-users] getting 404 after fresh install of oVirt 3.4 on CentOS 6.5 (+ solution)

2014-05-13 Thread R P Herrold
On Tue, 13 May 2014, Sven Kieske wrote:

 Doesn't this make you wonder where the minimum requirements come from?
 
 If it runs with less than 1 GB RAM, why do the docs say you need 4 GB
 and recommend even 16 GB ?

certainly a fair question ... There is also a statement in 
that setup script as to needed filesystem space which seems to 
have been simply 'pulled out of the air', rather than 
documented / explained
 
 Is it just a matter of scale(number of vms/hosts/DCs) ?
 What would make engine consume more RAM?
 
 Can you maybe lower the minimum requirements?

Or isolate the recommendations to a flat file which is 
commented, and sourced by the script, so a person can discern 
the difference between 'hard' requirements, and simple 
'recommendations' for a stated use case

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[ovirt-users] Ovirt snapshot failing on one VM

2014-04-23 Thread R P Herrold
On Wed, 23 Apr 2014, Steve Dainard wrote:

 I have other VM's with the same amount of snapshots without this problem.
 No conclusion jumping going on. More interested in what the best practice
 is for VM's that accumulate snapshots over time.

For some real world context, we seem to accumulate snapshots 
using our local approach, and are not that focused on, or 
attentive about removing them.  The 'highwater mark' of 39, on 
a machine that has been around since it was provisioned: 
2010-01-05

[root@xxx backups]# ./count-snapshots.sh | sort -n | tail -3
38 vm_64099
38 vm_98036
39 vm_06359

Accumulating large numbers of snapshots seems more the 
function of pets, than ephemeral 'cattle'

I wrote the first paragraph without looking up the 'owners' of 
the images. As I dereference the VM id's, all of the top ten 
in that list turn out to be mailservers, radius servers, name 
servers, and such, where the business unit owners chose not 
(or neglect) to 'winnow' their herd.  There are no ephemeral 
use units in the top ten

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] adding scripts

2014-03-21 Thread R P Herrold

the threading is not clear to me, and I hope I have the 
attributions correct

On Fri, 21 Mar 2014, Greg Sheremeta wrote:

 From: aditya mamidwar aditya.mamid...@gmail.com 

 To: aw...@redhat.com, engine-de...@ovirt.org, users@ovirt.org 
 Sent: Friday, March 21, 2014 6:14:01 AM 
 Subject: Re: [Users] [Engine-devel] adding scripts 

 am thus facing following difficulties: 

 1 : i wrote the required code using in bash scripting, 
 which i wish to invoke after a click of button in the 
 ovirt-portal. (which does not seem to be possible). can you 
 help on that? which programming language should i use, and 
 how that file should be invoked.

[I think Greg said:]

 This needs to be done in Java. You'll need to read up on 
 oVirt's UI Plugin infrastructure, which Einav and others 
 mentioned below. No, you cannot write a bash script and have 
 a button click in oVirt invoke that.

Reading this:
http://www.ovirt.org/VDSM-Hooks
it states as a pull quote:

The hooks reside on every host in 
/usr/libexec/vdsm/hooks/ A hook can be any executable 
(bash/python/perl/binary/etc). 

and then at:
http://www.ovirt.org/Features/UIPlugins

UI plugins integrate with WebAdmin directly on the 
client (web browser) using JavaScript programming language. 
Plugin invocation is driven by WebAdmin and happens right 
within the context of browser's JavaScript runtime, using 
JavaScript language as the lowest common denominator between 
WebAdmin (GWT) and individual plugins. UI plugins can take 
full advantage of JavaScript language and its rich ecosystem 
of libraries. There are no specific rules on how to implement 
UI plugins, plugin API is designed to be simple and not to get 
in developer's way, regardless of how a developer chooses to 
write the plugin



I thought I understood the model, but have gotten confused.  
Iam left with two questions:

1. is the plugin to be Java or JavaScript? (I think the answer 
is the latter)

2. is there a constraint as to implementation language, or 
not. I think a JS wrapper can call whatever it wishes, but 
this is not clear to me

Thank you

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] centralized Logging engine and hypervisor

2014-03-20 Thread R P Herrold
On Thu, 20 Mar 2014, Sven Kieske wrote:

 But it would be cool if you could work towards
 integrating this feature into ovirt in the future, maybe
 for 3.5 or 4.0.
 
 So I created an RFE at:
 
 https://bugzilla.redhat.com/show_bug.cgi?id=1078738
 
 I think many large data centers could use this feature
 as most people tend to have centralized logging already.

we certainly do ... but this is a shifting space with syslog, 
rsyslog, and (on the horizon) systemd wanting to handle event 
generation.  On the receiving end, we have a checklist for 
getting rsyslog set up to 'listen correctly'  Also there are 
issues on the axis: ipv4 only, mixed, and ipv6 , and then: 
with and without DNS (A, , CNAME, and PTR record 
completeness matters in some configuration setups)

  Later this could get expanded to easily allow to use syslog..

I think I have the '' attribution correct

Probably term 'syslog' is being used generically here.  Concur 
that this would help a lot

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] el6 live snapshots and storage migration

2014-03-20 Thread R P Herrold
On Thu, 20 Mar 2014, Ernest Beinrohr wrote:

 Works ok on my centos 6.5.
 
 these are my packages, so maybe a BuildRequired is missing in the src.rpm
 
 $ rpm -qa \*usb\*
 libusb1-devel-1.0.9-0.6.rc1.el6.x86_64
 libusb1-1.0.9-0.6.rc1.el6.x86_64
 rt73usb-firmware-1.8-7.el6.noarch
 usbutils-003-4.el6.x86_64
 usbredir-devel-0.5.1-1.el6.x86_64
 libertas-usb8388-firmware-5.110.22.p23-3.1.el6.noarch
 usbredir-0.5.1-1.el6.x86_64
 libusb-0.1.12-23.el6.x86_64

thank tyou

for other reasons in development (spice and friends must have 
wanted a later 'usbredir-server') I had to 'fork ahead' my 
'usbredir' series, and it seems the tines had diverged

[herrold@centos-6 qemu-kvm-rhev]$ rpm -q `cat  README-others`
libusb1-devel-1.0.9-0.6.rc1.el6.x86_64
libusb1-1.0.9-0.6.rc1.el6.x86_64
rt73usb-firmware-1.8-7.el6.noarch
usbutils-003-4.el6.x86_64
usbredir-devel-0.6-5.orc6.x86_64
libertas-usb8388-firmware-5.110.22.p23-3.1.el6.noarch
usbredir-0.6-5.orc6.x86_64
libusb-0.1.12-23.el6.x86_64
[herrold@centos-6 qemu-kvm-rhev]$

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] el6 live snapshots and storage migration

2014-03-19 Thread R P Herrold
On Wed, 19 Mar 2014, Sven Kieske wrote:

 forwarding to the List as this may be interesting for others:

 This may be another option:
 
 wget
 http://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/RHEV/SRPMS/qemu-kvm-rhev-0.12.1.2-2.415.el6_5.5.src.rpm
 
 sha256sum qemu-kvm-rhev-0.12.1.2-2.415.el6_5.5.src.rpm
 # check with http://rhn.redhat.com/errata/RHBA-2014-0248.html
 
 yum-builddep /archiv/qemu-kvm-rhev-0.12.1.2-2.415.el6_5.5.src.rpm
 
 rpmbuild --rebuild /archiv/qemu-kvm-rhev-0.12.1.2-2.415.el6_5.5.src.rpm

seemingly untested.  Not sure if it is a missing BR, or a 
patch is needed.   The build fails thus here:

+ ../configure --target-list=x86_64-softmmu --prefix=/usr 
--localstatedir=/var --sysconfdir=/etc 
--audio-drv-list=pa,alsa --audio-card-list=ac97,es1370 
--disable-strip '--extra-ldflags=-Wl,--build-id -pie 
-Wl,-z,relro -Wl,-z,now' '--extra-cflags=-O2 -g -pipe -Wall 
-Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector 
--param=ssp-buffer-size=4 -m64 -mtune=generic -fPIE -DPIE' 
--disable-xen 
--block-drv-rw-whitelist=qcow2,raw,file,host_device,host_cdrom,qed,gluster,rbd 
--block-drv-ro-whitelist=vmdk,vhdx,vpc --disable-debug-tcg 
--disable-sparse --enable-werror --disable-sdl 
--disable-curses --disable-curl --disable-check-utests 
--enable-vnc-tls --enable-vnc-sasl --disable-brlapi 
--disable-bluez --enable-docs --disable-vde --enable-linux-aio 
--enable-kvm --enable-spice --enable-kvm-cap-pit 
--enable-kvm-cap-device-assignment --trace-backend=dtrace 
--enable-smartcard --disable-smartcard-nss --enable-usb-redir 
--enable-mixemu --enable-glusterfs
ERROR
ERROR: User requested feature usb-redir
ERROR: configure was not able to find it
ERROR
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] qemu-kvm-rhev solution under CentOS 6; was: el6 live snapshots and storage migration

2014-03-19 Thread R P Herrold
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Wed, 19 Mar 2014, R P Herrold wrote:

These steps build under a basic CentOS 6, updated to current:
 
  wget \
  http://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/RHEV/SRPMS/qemu-kvm-rhev-0.12.1.2-2.415.el6_5.5.src.rpm

  sha256sum qemu-kvm-rhev-0.12.1.2-2.415.el6_5.5.src.rpm
  # check with http://rhn.redhat.com/errata/RHBA-2014-0248.html

  yum-builddep /archiv/qemu-kvm-rhev-0.12.1.2-2.415.el6_5.5.src.rpm

wget \

ftp://ftp.owlriver.com/pub/local/ORC/qemu-kvm-rhev/qemu-kvm-nousb-redir.spec
 
rpm -U qemu-kvm-rhev-0.12.1.2-2.415.el6_5.5.src.rpm

rpmbuild -ba qemu-kvm-nousb-redir.spec


and a collection of binaries and SRPM will result.
  
/home/herrold/rpmbuild/SRPMS/qemu-kvm-rhev-0.12.1.2-2.415.orc6.6.pmman.src.rpm  
  
/home/herrold/rpmbuild/RPMS/x86_64/qemu-kvm-rhev-0.12.1.2-2.415.orc6.6.pmman.x86_64.rpm

 
/home/herrold/rpmbuild/RPMS/x86_64/qemu-img-rhev-0.12.1.2-2.415.orc6.6.pmman.x86_64.rpm

 
/home/herrold/rpmbuild/RPMS/x86_64/qemu-kvm-rhev-tools-0.12.1.2-2.415.orc6.6.pmman.x86_64.rpm
  


Diff is as follows (mod linewraps):

[herrold@centos-6 qemu-kvm-rhev]$ diff -u qemu-kvm.spec 
qemu-kvm-nousb-redir.spec 
- --- qemu-kvm.spec   2014-03-19 14:25:52.0 -0400   

+++ qemu-kvm-nousb-redir.spec   2014-03-19 16:33:57.0 
- -0400   
@@ -2,6 +2,18 @@
  
 # Define rhev as the first variable
  
 %define rhev 1 
  

  
+# usb-redir
  
+#  quite invasive, but we can patch the ./configure
  
+#  to exclude by default (viz, leave undefined ) and then 
ignore, perhaps
+%define config_usb_redir %{nil}
  
+%if 0%{?usb-redir} 
  
+%define enable_usb_redir 1 
  
+%define config_usb_redir --enable-usb-redir
  
+%else  
  
+%define enable_usb_redir 0 
  
+%define config_usb_redir --disable-usb-redir   
  
+%endif 
  
+   
  
 %if 0%{?rhev_test} 
  
 %define enable_fake_machine 1  
  
 %else  
  
@@ -85,7 +97,10 @@  
  

  
 %define buildid %{nil} 
  

  
- -%define zrelease 5   

+#  orc temp fork as to usb-redir   
  
+%define buildid .pmman 
  
+%define zrelease 6 
  
+   
  
 %define sublevel 0.12.1.2  
  
 %define pkgrelease 2.415   
  

  
@@ -11531,12 +11546,17 @@   
  
 --trace-backend=dtrace \   
  
 --enable-smartcard \   
  
 --disable-smartcard-nss \  
  
- ---enable-usb-redir \ 

 --enable-mixemu \  
  
 --enable-glusterfs

[Users] Snapshot merging and the effect on underlying LV metadata

2014-02-28 Thread R P Herrold
On Fri, 28 Feb 2014, Alasdair G Kergon wrote:

 In lvm2 version 2.02.105 lvconvert gained a --splitsnapshot option to
 allow people to wipe snapshot content before releasing the extents
 for reallocation.
 
--splitsnapshot
   Separates SnapshotLogicalVolume from  its  origin.   The  volume
   that  is split off contains the chunks that differ from the ori-
   gin along with the metadata describing them.  This volume can be
   wiped  and then destroyed with lvremove.  The inverse of --snap-
   shot.

Nice to know ... we use the snapshot feature heavilyin our 
virtualization, but as: 
CentOS 6 is at lvm2-2.02.100-8.el6.x86_64, and 
C 5 at lvm2-2.02.88-12.el5, 

we will need to wait a bit before relying on its presence.  
Any chance of a re-basing / refresh / backport at least into 
RHEL 6 (we have only one Xen oriented dom0 at this point on 
C5)?

Thanks

--Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] Snapshot merging and the effect on underlying LV metadata

2014-02-27 Thread R P Herrold
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Thu, 27 Feb 2014, Davis, Richard wrote:

 I am being told that unless the Wipe After Delete option 
 is set on a vDisk, any subsequent snapshot merging of the 
 related VM will not delete LV metadata (or any data!) from 
 the volume created by the snapshot. Is this correct ? I'm 
 kinda hoping not !

It is my belief a depetion cannot be relied upon to have 
happened in all cases.  Some options flag sets in lvm ** do ** 
persist old data, and so our security practice at PMman to 
treat data on removed LV's as though it persists

There are published reports that instances on other public 
cloud providers have been deployed with 'non-wiped' drives in 
the 'slack space'.  Why run the reputational risk?

When we reclaim a LV, we perform a 'renaming' that permits to 
spot 'dirty' and 'scratched' instances needing wiping.  [we 
also fill a new VG / PV with LV's indicating it needs wiping, 
as we do not wish to expose content if a drive is pulled and 
then re-used after testing when SMART errors appeared, but do 
not stand up to disqualify a drive]

Later a cron driven process, sensitive to IO load runs.  It 
builds a list of candidates over a day old, using 'find' and 
the LV name series showing it is dirty and scratched.  Then in 
turn by LV found, it fires off a sub-task (when load is low), 
which in turn performs a 'niced' 'shred' operation on that LV, 
followed by the 'shred 'zeroing' operation.  When load is too 
high, it sleeps for a couple of minutes, and re-tries

fragment:
 $_shredCmd = ionice -c 3 shred -n \
.$_num_passes. -z .$_working_lvm;

Only when that sub-process has completed do we 
'rename' and later 'remove' a given LV, to let its space 
re-enter the assignment pool

- -- Russ herrold

-BEGIN PGP SIGNATURE-
Version: GnuPG v2.0.14 (GNU/Linux)

iEYEARECAAYFAlMPkAMACgkQMRh1QZtklkSamQCgnVqEo2Kmzq9Ao8T0BCYhBTyn
aToAoIaOVGkxX3EsVghMxOtgE3RiUr9G
=rm/K
-END PGP SIGNATURE-
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] The purpose of Wipe on delete ?

2014-02-27 Thread R P Herrold
On Thu, 27 Feb 2014, Richard Davis wrote:

 What is the purpose of the Wipe on delete option for a VM disk ?
 Why would you not want data wiped on delete if the alternative is to leave LV
 metadata and other data languishing on the SD ?

debugging, cloning, snapshot backups, and giving 'second 
chances' to undelete, come to mind as reasonable use cases NOT 
to wipe by default

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] wiki weeding intervention request: was: Install on CentOS6.5 fails

2014-02-04 Thread R P Herrold
On Tue, 4 Feb 2014, Yedidyah Bar David wrote:

  The Howto from: http://www.ovirt.org/Download fails with:

 Can you install epel, step 1 there? 
 It's probably a bug in the instructions' order - 0 and 1 should be exchanged. 

In trying to 'weed' the wiki, the page is locked to editors 
with more permissions than I have:
   This page has been protected to prevent editing.

The last two editors were Mike Burns and Dave Neary -- adding 
direct copies to them, to get this fixed, or to seek the 
rights to do the edit

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] Reconfirming membership to do excessive bounces

2014-01-22 Thread R P Herrold
On Wed, 22 Jan 2014, Pat Pierson wrote:

 Has anyone else had this issue with this list and gmail?  
 if so how can i fix it?

The mailing list host lacks some conventional mail filtering 
setup values -- Infra is aware of it and has requested the 
needed changes in DNS, etc

As a 'workaround' you can also paw through your gmail 'spam' 
folder, and add a whitelisting rule, which sometimes works.  
But google 'tunes' its rules over time, and this can be a 
non-durable fix until proper A, , PTR, and optionally SPF 
rules are added

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] too many bouces information message..

2014-01-08 Thread R P Herrold
On Wed, 8 Jan 2014, Dave Neary wrote:

 It may be related to the IPv6 bounce we got from a spam filtering
 service recently. RP Herrold suggested that we add an IPv6 PTR for

It is possible, but not that likely -- trying to understand 
gmail downratings and refusals to deliver, when there is no 
way to access log files and track a given Message-Id through 
them chweing on it, nor giving straight answers as to the 
filtering regime of the day, are a whole 'nother kettle of 
dysfunction in the Venn diagram of email pain to diagnose ;(

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] ovirt-node post-reboot no persistent networks config .. !!! urgent update req for POC coming weekend

2013-10-02 Thread R P Herrold

On Wed, 2 Oct 2013, Fabian Deutsch wrote:


lsb_release -a does not provide a correct output, it just states:

RedHatEnterpriseVirtualizationHypervisor which is not very
informative, no version information or whatsoever.



do you know what the output should look like?


http://refspecs.linuxbase.org/LSB_3.1.0/LSB-Core-generic/LSB-Core-generic/lsbrelease.html

Shall I a bug on this non-conformance?

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


Re: [Users] ovirt-node post-reboot no persistent networks config .. !!! urgent update req for POC coming weekend

2013-10-02 Thread R P Herrold

On Wed, 2 Oct 2013, R P Herrold wrote:


do you know what the output should look like?


http://refspecs.linuxbase.org/LSB_3.1.0/LSB-Core-generic/LSB-Core-generic/lsbrelease.html


Checking further, with the LSB 5.0 beta candidate imminent, 
there is an open uplift bug as well

https://lsbbugs.linuxfoundation.org/show_bug.cgi?id=3512

-- Russ herrold
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


[Users] iptables settings/scripts ovirt 3.3

2013-10-01 Thread R P Herrold

On Tue, 1 Oct 2013, Sven Kieske wrote:

We read about some vdsm bootstrap script (e.g. BZ 893680), 
may this be related?


SvenKieske appeared in the OFTC IRC channel #ovirt with this 
issue, and we discussed it some more


11:41  SvenKieske meaning you can't ping compute nodes, this 
is in the default install


11:41  orc_orc SvenKieske: * nod * that effect would occur 
with the physdev rule, I think


11:41  SvenKieske and I think this default iptables rule is 
just plain useless :)
11:42  SvenKieske and prevents proper network debugging, as 
we are having some issues with network related to newest ovirt 
nodes


11:42  orc_orc SvenKieske: assumedly you are following a 
guide.  can you point out that URL and the step at which the 
problem is first noticed


and he pointed to the wiki outline at:
http://www.ovirt.org/Quick_Start_Guide#Install_oVirt_Node

11:43  orc_orc but from a policy POV, it may make sense that 
a node is not reachible until it has had time to become 
hardened


.. and I also pointed out an example of an ICMP fragmantation 
attack and its remdiation in the Red Hat bugzilla



I don't see why you shouldn't be able to ping the hypervisor in the
management lan? this is useful for monitoring and network debugging.

ICMP is no danger at all.


and in IRC he there stated

11:45  SvenKieske I'm not sure you can harden this node any 
further, as it resides on a read only file system, beside 
that, I can not think of any attack vector via icmp on the 
compute node


11:46  orc_orc SvenKieske: there are some ICMP attacks, 
particularly on ipv6 stacks, which can cause machines to fall 
over and die

11:46  orc_orc I reported one a while back
11:47  orc_orc the packet reassembly code had an unsuspected 
re-construction method with a problem in it


and at that point he concluded that perhaps the ICMP block 
limitation had policy reasons behind it


11:49  SvenKieske Well then that's fine with me, but maybe 
the node devs should more focus on reliable network 
configuration and then harden it for security and not the 
other way around, it was just a small nuisance, if network 
setup in 3.3 would work ootb I'd maybe never noticed ping 
doesn't work ootb


to which I can only respond:

11:49  orc_orc SvenKieske: sounds like you are saying that 
you need to file an RFE as to debugging tools extensions


or amend the setup documentation

I had a private inquiry about KVM hardening and so had been 
looking at the physdev iptables rules recently, and on a VM 
for which I am responsible an incident just last weekend


11:50  orc_orc SvenKieske: I had a person at my office just 
today, who was the victim of a TOR attack on a VM


11:50  orc_orc so VM's _do_ get scanned for and attacked

... in part we mitigated the attack via a temporary iptables 
rule on the KVM based hypervisor ...


and he closed that he may file something tomorrow.

11:50  SvenKieske yeah, might be the way to go, but my 
workday is over now, so maybe tomorrow :)


11:50  orc_orc SvenKieske * nod *  don't forget  ;)

11:51  SvenKieske I'm all in for more computer security :)
11:51  SvenKieske see you!

11:51  * orc_orc waves

I've been working through the setup documentation as well 
since the 3.3 update, and have a list of questions as to the 
wiki materials, as of course bit rot happens in wiki's (heck, 
in _any_ documentation) as new releases are issued


-- Russ herrold






Kind regards

Sven Kieske
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users



--
--
end
==
 .-- -... ---.. ... -.- -.--
Copyright (C) 2013 R P Herrold
  herr...@owlriver.com
   My words are not deathless prose,
  but they are mine.
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users