Andrew, can we add a notice to the documentation, telling the user that SSH is enabled by default for security reasons, but can be enabled using the doc from comment 14? The appliance can always be accessed through the spice or vnc console (not sure how this is officially called in the docs).
this is an automated message. oVirt 3.6.0 RC3 has been released and GA is targeted to next week, Nov 4th 2015. Please review this bug and if not a blocker, please postpone to a later release. All bugs not postponed on GA release will be automatically re-targeted to - 3.6.1 if severity >= high - 4.0 if severity < high
Hi Fabian, Can you confirm if this bug is still relevant since I believe cloud-init takes care of the engine-setup stuff. Or does this still apply to 3.5 work flow? Also not sure what comment14 doc you are referring to. Cheers, Julie
I believe this bug is not relevant anymore, this is based on looking at the sources for hosted-engine-setup: src/plugins/ovirt-hosted-engine-setup/vm/cloud_init.py: 'ssh_pwauth: True\n' This shows that hosted-engine-setup (via cloud-init) is enabling ssh (and ssh password authentication). Also the appliance itself is enabling ssh by default now: (from spin-kickstarts): rhevm-3.6-rhel-6/rhevm-appliance.ks:services --disabled="avahi-daemon,iscsi,iscsid,firstboot,kdump" --enabled="network,sshd,rsyslog,tuned" I can't recall what I referred to with my comment "comment 14" above.
(In reply to Fabian Deutsch from comment #6) > I believe this bug is not relevant anymore, this is based on looking at the > sources for hosted-engine-setup: > > src/plugins/ovirt-hosted-engine-setup/vm/cloud_init.py: > 'ssh_pwauth: True\n' > > This shows that hosted-engine-setup (via cloud-init) is enabling ssh (and > ssh password authentication). > > Also the appliance itself is enabling ssh by default now: > > (from spin-kickstarts): > > rhevm-3.6-rhel-6/rhevm-appliance.ks:services > --disabled="avahi-daemon,iscsi,iscsid,firstboot,kdump" > --enabled="network,sshd,rsyslog,tuned" > > > I can't recall what I referred to with my comment "comment 14" above. Thanks Fabian! Nikolai, Can we close this bug since it's not applicable to the current setup? Please let me know if you have any concerns. Kind regards, Julie
(In reply to Julie from comment #7) > (In reply to Fabian Deutsch from comment #6) > > I believe this bug is not relevant anymore, this is based on looking at the > > sources for hosted-engine-setup: > > > > src/plugins/ovirt-hosted-engine-setup/vm/cloud_init.py: > > 'ssh_pwauth: True\n' > > > > This shows that hosted-engine-setup (via cloud-init) is enabling ssh (and > > ssh password authentication). > > > > Also the appliance itself is enabling ssh by default now: > > > > (from spin-kickstarts): > > > > rhevm-3.6-rhel-6/rhevm-appliance.ks:services > > --disabled="avahi-daemon,iscsi,iscsid,firstboot,kdump" > > --enabled="network,sshd,rsyslog,tuned" > > > > > > I can't recall what I referred to with my comment "comment 14" above. > > Thanks Fabian! > Nikolai, > Can we close this bug since it's not applicable to the current setup? > Please let me know if you have any concerns. > > Kind regards, > Julie Last time we've tested it on RHELs, the ssh was disabled, will have to check on our latest deployment and will reply if still relevant.
Assigning to Julie for review.
The ssh still disabled on appliance, I saw that on my HE environment with these components: ovirt-vmconsole-host-1.0.1-0.0.master.20151105234454.git3e5d52e.el7.noarch ovirt-release36-002-2.noarch ovirt-engine-sdk-python-3.6.0.4-0.2.20151123.gita2f81ed.el7.centos.noarch sanlock-3.2.4-1.el7.x86_64 ovirt-setup-lib-1.0.1-0.0.master.20151119123055.gitfa908be.el7.centos.noarch qemu-kvm-rhev-2.3.0-31.el7_2.3.x86_64 ovirt-hosted-engine-ha-1.3.3-0.0.master.20151118145556.20151118145552.git71b535e.el7.noarch ovirt-vmconsole-1.0.1-0.0.master.20151105234454.git3e5d52e.el7.noarch ovirt-release36-snapshot-002-2.noarch libvirt-client-1.2.17-13.el7.x86_64 ovirt-hosted-engine-setup-1.3.1-0.0.master.20151118143825.gitc013638.el7.centos.noarch ovirt-host-deploy-1.4.2-0.0.master.20151122153544.gitfc808fc.el7.noarch vdsm-4.17.10.1-0.el7ev.noarch mom-0.5.1-2.el7.noarch ovirt-hosted-engine-ha-1.3.3-0.0.master.20151118145556.20151118145552.git71b535e.el7.noarch ovirt-hosted-engine-setup-1.3.1-0.0.master.20151118143825.gitc013638.el7.centos.noarch Appliance was rhevm-appliance-20151119.0-1.
(In reply to Nikolai Sednev from comment #10) hi Nikolai, Yes, I also tested this last Friday and found I need to enable SSH. I will add in a note on how to enable SSH. If Engineering intends to change the this behaviour, please let me know. Kind regards, Julie
Added 'Restart the sshd service for the changes to take effect.' to the note.
Hi Fabian, Thanks for the need_info. According to my testing, the SSH service is running by default, but password authentication and permit root login is disabled thus causing SSH to fail. When you spin up the manager VM, you set the root password for the engine VM so I assumed password authentication is the SSH method to use. Please advise if I'm wrong. Maybe the note should be: ==== To SSH into the Red Hat Enterprise Virtualization Manager virtual machine that is based on the RHEV-M Virtual Appliance, access the Manager virtual machine through the SPICE or VNC console, and edit /etc/ssh/sshd_config to change the following two options to yes: PasswordAuthentication PermitRootLogin" Restart the sshd service for the changes to take effect. ====
(In reply to Julie from comment #18) … > ==== > To SSH into the Red Hat Enterprise Virtualization Manager virtual machine I'm being a bit picky here, but as ssh is enabled, and we just enable password authentication, I'd suggest to use something like: To enable login with SSH password authentication into the Red Hat Enterprise Virtualization Manager virtual machine that is based on the RHEV-M Virtual Appliance, access the > machine through the SPICE or VNC console, and edit /etc/ssh/sshd_config to > change the following two options to yes: > PasswordAuthentication > PermitRootLogin" > Restart the sshd service for the changes to take effect. > ====
Thanks Fabian, I have updated the note according to what you suggested.