Bug 825562 - [glusterfs-3.3.0q43]: clear-locks attempts to connect using privileged port
[glusterfs-3.3.0q43]: clear-locks attempts to connect using privileged port
Product: GlusterFS
Classification: Community
Component: cli (Show other bugs)
Unspecified Unspecified
medium Severity high
: ---
: ---
Assigned To: krishnan parthasarathi
: Triaged
Depends On:
Blocks: 849291
  Show dependency treegraph
Reported: 2012-05-27 15:57 EDT by Joe Julian
Modified: 2015-11-03 18:04 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 849291 (view as bug list)
Last Closed: 2012-12-27 01:11:22 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: DP
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
mysql1-clearlocks-mnt.log (59.36 KB, text/plain)
2012-05-28 05:37 EDT, Joe Julian
no flags Details
ewcs2:var-spool-glusterfs-a_mysql1.log (7.18 KB, text/plain)
2012-05-28 06:02 EDT, Joe Julian
no flags Details
ewcs2: b,c,d (22.86 KB, text/plain)
2012-05-28 06:11 EDT, Joe Julian
no flags Details
ewcs4: var-spool-glusterfs-{a,b,c,d}_mysql1.log (29.26 KB, text/plain)
2012-05-28 06:15 EDT, Joe Julian
no flags Details

  None (edit)
Description Joe Julian 2012-05-27 15:57:54 EDT
Version: 3.3.0qa34

clear-locks commands fail if rpc-auth-allow is not set as it attempts to connect via privileged port.

The CLI reports the error as:
Volume clear-locks unsuccessful
clear-locks getxattr command failed. Reason: Transport endpoint is not connected

### glusterd.vol.log has
[2012-05-27 12:54:33.217491] E [rpcsvc.c:491:rpcsvc_handle_rpc_call] 0-glusterd: Request received from non-privileged port. Failing request
Comment 1 Joe Julian 2012-05-28 02:49:01 EDT
Did it again. Sorry, it's qa43 not 34.
Comment 2 Joe Julian 2012-05-28 05:37:31 EDT
Created attachment 587189 [details]
Comment 3 Joe Julian 2012-05-28 06:02:06 EDT
Created attachment 587198 [details]
Comment 4 Joe Julian 2012-05-28 06:11:43 EDT
Created attachment 587200 [details]
ewcs2: b,c,d
Comment 5 Joe Julian 2012-05-28 06:15:34 EDT
Created attachment 587203 [details]
ewcs4: var-spool-glusterfs-{a,b,c,d}_mysql1.log

Each of these logs are for just the minutes that were in the clearlocks log. Let me know if that's not what you needed.
Comment 6 Amar Tumballi 2012-12-21 04:45:35 EST
one of the work around is to make sure everything works by adding "rpc-auth-allow-insecure yes" in volume files (both glusterd.vol and glusterfsd.vol, for which one can do 'gluster volume set <VOL> server.allow-insecure yes').

as the work around exists, would like to move the priority to medium.
Comment 7 Amar Tumballi 2012-12-27 01:10:15 EST
amar@supernova:~/work/glusterfs$ git diff
diff --git a/doc/glusterd.vol b/doc/glusterd.vol
index de17d8f..8268c3d 100644
--- a/doc/glusterd.vol
+++ b/doc/glusterd.vol
@@ -4,5 +4,12 @@ volume management
     option transport-type socket,rdma
     option transport.socket.keepalive-time 10
     option transport.socket.keepalive-interval 2
+  # enable below option only if there are not many ports free below 1024
+  # to bind() the client process. In this case, you would have to run :
+  # 'gluster volume set <VOL> server.allow-insecure yes'
+  # on all the volumes to the proper functioning.
+  #
+#   option rpc-auth-allow-insecure yes
     option transport.socket.read-fail-log off

The above patch is the only way at the moment to fix these things.

Also, Would like to close the bug with D(ocumentation)P(ending) flag set, once we have more better way of handling security (SSL/Kerberos etc), this issue will go away.
Comment 8 Amar Tumballi 2012-12-27 01:11:22 EST
as per comment #7 (WORKSFORME always when we have the above two options set). WONTFIX the part of not having these options set for now.

Note You need to log in before you can comment on or make changes to this bug.