cobbler November 2008

cobbler@lists.fedorahosted.org

41 participants
119 discussions

[PATCH] Webui system edit cosmetics
by Vreman, Peter 17 Nov '08

17 Nov '08

Please find attached the following patches: Power_type.diff - Fix invalid default power type Comment.diff - Fix invalid attribute style system_edit_webui_order.diff - Reorder netboot, KS meta group related items. Also extend description of netboot. Regards, Peter This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 1

[PATCH] removal of the path.walk at repo_finder
by Javier Palacios 17 Nov '08

17 Nov '08

The patch below pretends to remove a non needed os.path.walk call within repo_finder. It is the used to find comps.xml file, whose location is actually known relative to the directory where rpm packages live. It has been tested (successfully) with a Fedora9 media, and two Centos versions : 5.2 and 3.9. http://github.com/javiplx/cobbler/commit/ab6e56bd49df5cc39cc92e1f365c6bc874… Javier Palacios

2 4

Debian/ubuntu deployments
by Javier Palacios 16 Nov '08

16 Nov '08

Hello, I've performed a last deployment test of debian distros, which require some additional patches. They are listed below, and they include a final change on preseed, an attempt to create proper apt repositories for ubuntu, and some massaging in the creation of pxe entries, to move into a debianish shape. Javier Palacios http://github.com/javiplx/cobbler/commit/56222fb7928175a576795052ed30a4d26a… http://github.com/javiplx/cobbler/commit/cb920d42cac04a12ccbbf3900436461fd5… http://github.com/javiplx/cobbler/commit/22cc96b357823daa5c754b35990f9959ae…

2 2

Changes for rsync.exclude (for debian and ppc)
by Javier Palacios 16 Nov '08

16 Nov '08

Hello, I've not followed recent discussions as much as I would like, but unles I'm very wrong, powerpc architecture is on the way. I'm not sure if import tests are working well, but in the exclude file for rsync there is a **/ppc/** that could prevent creation of proper trees. On the other side, to not copy debian source packages when a debian media is importe, it should be added pool/**/*.dsc pool/**/*.gz Javier Palacios

2 1

IMPORTANT: potential priv escalation in CobblerWeb, action potentially required
by Michael DeHaan 14 Nov '08

14 Nov '08

All users of Cobbler who are using the web interface and have granted access to users who do /not/ already have local root access to the Cobbler server should upgrade to 1.2.8 and apply the following fix: http://git.fedorahosted.org/git/?p=cobbler;a=commitdiff;h=cc3dd9828e02f1693… ===== Background: Cheetah templates, which Cobbler uses to build kickstarts, can execute Python code, which is normally a /very/ useful thing. We rely on this some in Cobbler to do simple things like translate timestamps to the local time zone. We have had this capable in /every/ version of Cobbler. This becomes a problem if you have granted access to a user through Cobbler Web who you trust with your datacenter but you do /not/ trust with your Cobbler server's root access. Details: However it is can be a problem when a web user edits a kickstart template through the webapp because then they could write code that could run what they wanted to run. One such example would be adding a kickstart that imported subprocess and then called code to give them a user account on the cobbler box that they didn't already have. A trivial example: #import $subprocess subprocess.call("/sbin/service squid restart",shell=True) A solution to this (included in the patch linked above) is to restrict what type of "#import" commands we allow and fail if any Cheetah code attempts to import something. Rather than blacklisting (which would be weak), we're whitelisting -- only enabling packages we know to be safe. I've added some code to whitelist ones that should be allowed and are useful. Currently I only have two allowed in the devel branch -- time, and random. Cobbler only uses time currently. (If anyone else has any templates they want to keep working that "#import" another module, please let me know what it is.) Note -- If you do /not/ trust the users using your Cobbler web instance you need to evaluate whether they deserve web access at all -- you are already giving them access to decide exactly what they put on every machine in your datacenter and are letting them reinstall machines when they choose. The problem with this however is that with the above, it's possible for web users to run commands as root on the cobbler server. If you are feeling this is a serious issue, you can disable the XMLRPC read write interface entirely. vi /etc/cobbler/modules.conf change the authentication mode to "authn_denyall" /sbin/service cobblerd restart The web app will now be disabled. OR... you can upgrade to the code currently on the devel branch. You could also modify the authz_ownership module to allow only certain users to edit kickstart files. I will be rolling out a Cobbler 1.2.9 to the builders that will contain /only/ this fix on top of 1.2.8. This vulnerability has been in Cobbler as long as kickstarts have been editable in the web app, I would appreciate your continued vigilance to possible exploit scenarios such as this -- and if you are using Cobbler Web with more than one user account, please disable Cobbler Web until you have applied the above patch. --Michael

1 0

Cobbler and Red Hat Cluster Suite?
by Jasper Capel 14 Nov '08

14 Nov '08

Hey, It would be great to be able to dynamically provision cluster nodes. Is there any good way to accomplish this? Does RHCS have something like an API which we can use to integrate this in Cobbler somehow? I'd like to hear some thoughts on this. Kind regards, Jasper Capel

4 5

Power management code/feature ready for review -- call for input
by Michael DeHaan 14 Nov '08

14 Nov '08

I've pushed a version of the power management feature to Cobbler's git now and it will be included in the test release. I suspect that it is pretty rough and I have not concluded testing yet (it's based entirely on Bill Peck's email), but it's as described here: https://fedorahosted.org/cobbler/wiki/PowerManagement Here are the new flags to the "cobbler system edit" command --power-address=POWER_ADDRESS address of power mgmt device, if required --power-id=POWER_ID plug-number or blade name, if required --power-pass=POWER_PASS password for power management interface --power-type=POWER_TYPE one of: none, apc_snmp, bullpap, drac, ether-wake, ilo, ipmilan, ipmitool, wti --power-user=POWER_USER username for power management interface, if required The general idea is you tell cobbler how the system is power managed and it remembers for you, so you can just do: cobbler system poweron --name=foo cobbler system poweroff --name=foo cobbler system reboot --name=foo For reinstallations, you can be a bit more clever now... cobbler system edit --name=foo --profile=newprofile && cobbler system reboot --name=foo Which, in my opininon, is at least better than reconstructing the long power management command for the system -- and if you're unlucky you may have more than one power management command to contend with. You will note that in many cases certain power management modes will not use all of the new options. If I get any of the commands wrong, no fear, let me know, and you can edit /etc/cobbler/power_*.template to fix them. Each of the above flags are available in those template files and are run through our templating engine to build the commands. For those that know Python, the majority of the code lives in cobbler/action_power.py There is also code in cobbler/item_system.py and cobbler/webui/CobblerWeb.py, as well as webui_templates/system_edit.tmpl Patches of any kind are welcome, and I'll continue to test this up also -- though I wanted to share here to see what everyone thought. If I'm leaving out a power management module/tool you use, or the arguments or wrong, or ... whatever I'm doing, let me know :) (I also have not yet added any sort of calls to support remotely cycling the power through the web app -- that's up next) Thanks! --Michael

3 9

WebUI color coding, and call to those graphically design inclined
by Michael DeHaan 14 Nov '08

14 Nov '08

A lot of the fields in CobblerWeb are logically grouped -- so I've added some CSS to color code the virtualization sections and the power management sections. This makes these sections easier to skip over if they don't apply to you, though as I was doing this, I did want to point out that this isn't set in stone if you don't like my color choices :) I don't pretend to be the world's greatest web designer, so if anyone wants to try to polish this up some more, or wants to try restyling Cobbler Web in general, you are welcome to do so. From a git checkout, everything is a Cheetah template -- /etc/cobbler/webui_templates/*.template, CSS and other static content lives in /etc/cobbler/webui_content/* I should have the color coding changes pushed shortly. --Michael

1 0

[PATCH] Fix func_install_if_enabled snippet
by James Laska 14 Nov '08

14 Nov '08

--- kickstarts/sample.ks | 2 +- kickstarts/sample_end.ks | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/kickstarts/sample.ks b/kickstarts/sample.ks index 00672fb..6af365d 100644 --- a/kickstarts/sample.ks +++ b/kickstarts/sample.ks @@ -45,7 +45,7 @@ $kickstart_start $SNIPPET('pre_install_network_config') %packages -$func_install_if_enabled +$SNIPPET('func_install_if_enabled') %post diff --git a/kickstarts/sample_end.ks b/kickstarts/sample_end.ks index c807413..3f91492 100644 --- a/kickstarts/sample_end.ks +++ b/kickstarts/sample_end.ks @@ -49,7 +49,7 @@ $kickstart_start %end %packages -$func_install_if_enabled +SNIPPET::func_install_if_enabled %end %post -- 1.6.0.3

2 1

[PATCH] authn_spacewalk.py change to token mechanism
by Mike McCune 14 Nov '08

14 Nov '08

-- Mike McCune mmccune AT redhat.com Engineering | Portland, OR RHN Satellite | 650.567.9039x79248 >From efcd4787010b2e55f135c9cf4fdc5969143bf127 Mon Sep 17 00:00:00 2001 From: Mike McCune <mmccune(a)gmail.com> Date: Fri, 14 Nov 2008 10:23:15 -0800 Subject: [PATCH] switching to a trusted authorization token that spacewalk generates, passes to cobbler and cobbler then asks spacewalk if it is valid. --- cobbler/modules/authn_spacewalk.py | 30 +++++++++--------------------- 1 files changed, 9 insertions(+), 21 deletions(-) diff --git a/cobbler/modules/authn_spacewalk.py b/cobbler/modules/authn_spacewalk.py index 958120c..dfb6fb9 100644 --- a/cobbler/modules/authn_spacewalk.py +++ b/cobbler/modules/authn_spacewalk.py @@ -39,33 +39,21 @@ def register(): def authenticate(api_handle,username,password): """ Validate a username/password combo, returning True/False - - Thanks to http://trac.edgewall.org/ticket/845 for supplying - the algorithm info. + + This will pass the username and password back to Spacewalk + to see if this authentication request is valid. """ spacewalk_url = api_handle.settings().spacewalk_url client = xmlrpclib.Server(spacewalk_url, verbose=0) - key = client.auth.loginAndSkipIntegrationAuth(username,password) - if key is None: + valid = client.auth.checkAuthToken(username,password) + + if valid is None: return False - - # NOTE: this is technically a little bit of authz, but - # not enough to warrant a seperate module yet. - list = client.user.list_roles(key, username) - success = False - for role in list: - if role == "org_admin" or "kickstart_admin": - success = True - - try: - client.auth.logout(key) - except: - # workaround for https://bugzilla.redhat.com/show_bug.cgi?id=454474 - # which is a Java exception from Spacewalk - pass - return success + + return (valid == 1) + -- 1.5.6.5

1 0

← Newer
1
2
3
4
5
6
7
8
9
...
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

cobbler November 2008