WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-users

Re: [Xen-users] XCP XenAPI fencing script (clustering support)

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] XCP XenAPI fencing script (clustering support)
From: Gémes Géza <geza@xxxxxxxxxxx>
Date: Wed, 30 Mar 2011 21:51:50 +0200
Delivery-date: Wed, 30 Mar 2011 12:53:27 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <AANLkTi=pDsj-5p3dO7MKA+s5p66F+wd3v8_WJDepypmd@xxxxxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <AANLkTi=pDsj-5p3dO7MKA+s5p66F+wd3v8_WJDepypmd@xxxxxxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.14) Gecko/20110223 Thunderbird/3.1.8
2011-03-30 13:09 keltezéssel, m c írta:
Hi,

I think this would be the best forum, let me know if not.

I am in the middle of writing fencing scripts for Citrix XenServer virtual machines (specifically for use with Redhat Clustering, but will also work from pacemaker etc) and I noticed that XCP uses the same XenAPI (from what I can tell).

Just wondering if someone would be able to test the scripts on XCP and let me know if they work.

The latest tar ball can be downloaded from the following URL:-

Once extracted a test can be performed as follows (the following will just list all the VM's and their current state, it will not turn reboot a machine so is safe):-

cd /tmp
tar xvzf fence-xenserver-0.8.tar.gz
cd fence-xenserver-0.8
./fence_cxs_redhat.py  -o list -s http://192.168.1.1/ -l root -p <passwd>

That should be enough to test if it is functioning properly. Appreciate any feedback.

Thanks,
Matt.
_______________________________________________ Xen-users mailing list Xen-users@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-users
Hi,

Just this morning I've decided to start writing something similar (stonith script for pacemaker).
I have only one objection to the approach used by your script. It would be more robust (more secure) if the script would connect to a small server running in Dom0 with some shared secret corresponding to each DomU, in this way non-cluster member DomU's won't be able to shut down cluster members, or legit DomU's wouldn't be able to do whatever they would want on the Dom0 (allowing fence/stonith to run with root credentials, ssh keys, whatever laying somewhere in the DomUs filesystem is not the best solution regarding security).
I planed to write a small server program which would run on the Dom0, with a htpasswd like config file, where user entries would have been DomUs, each with a password. The fence agent/stonith script would connect to this server and providing the right credentials for the given DomU it would be able to issue force-reboot, start, force-shutdown, whatever would be needed actions on that DomU, and nothing more. A similar approach without using a Dom0 side server would be possible if using AD authentication and assignment of different DomUs to different roles.

Best Regards

Geza
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users