Mailing List Archive

Bjorn Helgaas <bjorn.helgaas@hp.com> writes:

> I'd really like to be able to use a conserver escape sequence to
> reset or power cycle a system, for example, by using PowerMan.
> Having this ability inside conserver would be handy because it
> would automatically target the correct machine and reduce the need
> to exit/re-enter "console".
>
> Is there a way to do this in conserver? Would this be useful to
> anybody else?


Now, I soppose my use case is a little different from most people's...
but I have mutually untrusting users on my system, so I need to be more
concerned about security than perhaps some of you do, who have the
conserver on the 'trusted network' (not that I really believe in
such things.)

I try to keep my rebooters and my serial consoles on different security
systems (not sharing passwords; using ssh public keys or otherwise
setting it up so that even if one system is compromised, the other is not.
I try to run them on different operating systems, too.)

That way, so long as people set root passwords (and I disable magic sysrq)
even if you compromise my console system, you don't immediately have root on
all my servers; you at least have to wait for someone to login
as root (and in my system, we've got different root passwords; my
console system handles servers owned by different people.)

if you break into my rebooter system, well, you can cause havoc by rebooting
everything, but you don't have access to the data unless you also
break into the console system. (If you have both, really, it's all over.
Everything is compromised.)

--
Luke S. Crawford
http://prgmr.com/xen/ - Hosting for the technically adept
http://nostarch.com/xen.htm - We don't assume you are stupid.
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

On Monday 30 November 2009 05:11:26 pm Luke S Crawford wrote:
> Bjorn Helgaas <bjorn.helgaas@hp.com> writes:
>
> > I'd really like to be able to use a conserver escape sequence to
> > reset or power cycle a system, for example, by using PowerMan.
> > Having this ability inside conserver would be handy because it
> > would automatically target the correct machine and reduce the need
> > to exit/re-enter "console".
> >
> > Is there a way to do this in conserver? Would this be useful to
> > anybody else?
>
> Now, I soppose my use case is a little different from most people's...
> but I have mutually untrusting users on my system, so I need to be more
> concerned about security than perhaps some of you do, who have the
> conserver on the 'trusted network' (not that I really believe in
> such things.)
>
> I try to keep my rebooters and my serial consoles on different security
> systems (not sharing passwords; using ssh public keys or otherwise
> setting it up so that even if one system is compromised, the other is not.
> I try to run them on different operating systems, too.)
>
> That way, so long as people set root passwords (and I disable magic sysrq)
> even if you compromise my console system, you don't immediately have root on
> all my servers; you at least have to wait for someone to login
> as root (and in my system, we've got different root passwords; my
> console system handles servers owned by different people.)
>
> if you break into my rebooter system, well, you can cause havoc by rebooting
> everything, but you don't have access to the data unless you also
> break into the console system. (If you have both, really, it's all over.
> Everything is compromised.)

I think the summary of this is "I wouldn't use this feature, and
here's why." Right?

My use case *is* different: I have dozens of development machines
shared among trusted users. One nuisance is that somebody intends
to reset A but mistakenly resets B instead. Being able to do the
reset directly from conserver would reduce the likelihood of this.

Bjorn
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

> My use case *is* different: I have dozens of development machines
> shared among trusted users. One nuisance is that somebody intends
> to reset A but mistakenly resets B instead. Being able to do the
> reset directly from conserver would reduce the likelihood of this.

We too would find this highly useful.

John

-------------------------------------------------------------------------------
John Hascall, john@iastate.edu
Team Lead, NIADS (Network Infrastructure, Authentication & Directory Services)
IT Services, The Iowa State University of Science and Technology
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

On 12/01/2009 03:55 PM, John Hascall wrote:
>
>> My use case *is* different: I have dozens of development machines
>> shared among trusted users. One nuisance is that somebody intends
>> to reset A but mistakenly resets B instead. Being able to do the
>> reset directly from conserver would reduce the likelihood of this.
>>
> We too would find this highly useful.
>
> John
>
> -------------------------------------------------------------------------------
> John Hascall, john@iastate.edu
> Team Lead, NIADS (Network Infrastructure, Authentication& Directory Services)
> IT Services, The Iowa State University of Science and Technology
> _______________________________________________
> users mailing list
> users@conserver.com
> https://www.conserver.com/mailman/listinfo/users
>

I provided a patch to support this ages ago but it was never accepted
upstream. Not saying it was the best of code.. but it did work.
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

On Tuesday 01 December 2009 02:12:02 pm Bill Peck wrote:

> I provided a patch to support this ages ago but it was never accepted
> upstream. Not saying it was the best of code.. but it did work.

Do you still have it? I'd be interested in playing with it.

Bjorn
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

On Tuesday 01 December 2009 02:27:00 pm Bjorn Helgaas wrote:
> On Tuesday 01 December 2009 02:12:02 pm Bill Peck wrote:
>
> > I provided a patch to support this ages ago but it was never accepted
> > upstream. Not saying it was the best of code.. but it did work.
>
> Do you still have it? I'd be interested in playing with it.

Never mind, I found it here:

https://www.conserver.com/pipermail/users/2007-June/msg00018.html

Thanks much!

Bjorn
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

Hi,

That being said, a more general 'execute external command on keystroke'
would be the way to go, IMHO. But then again maybe that's what this is about
anyway.

_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

On Tue, Dec 01, 2009 at 04:12:02PM -0500, Bill Peck wrote:
> I provided a patch to support this ages ago but it was never accepted
> upstream. Not saying it was the best of code.. but it did work.

Sorry about that...it certainly got lost amonst things - and I never got
back to looking at it.

On Wed, Dec 02, 2009 at 08:26:56AM +0100, Fabien Wernli wrote:
> That being said, a more general 'execute external command on keystroke'
> would be the way to go, IMHO. But then again maybe that's what this is about
> anyway.

Yep, I'd agree. The patch from Bill is certainly a good start at that.
There's a lot of work to make things that wouldn't block on I/O, can be
interrupted, supports two-way communication, etc, but a good idea. Sort
of like ^Ec|, but server-side. I envision commands that would either
interact with the console itself or with the user. But maybe just the
user would be sufficient for most cases.

Bryan
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

Most of our new servers have Ilom on board which is accessable from the
console. We have found that we rarely need the external power control
anymore. I can see that it would still be valuable for network devices
and other appliances.


On Tuesday 01 December 2009 02:27:00 pm Bjorn Helgaas wrote:
> On Tuesday 01 December 2009 02:12:02 pm Bill Peck wrote:
>
> > I provided a patch to support this ages ago but it was never accepted
> > upstream. Not saying it was the best of code.. but it did work.
>
> Do you still have it? I'd be interested in playing with it.

Never mind, I found it here:

https://www.conserver.com/pipermail/users/2007-June/msg00018.html

Thanks much!

Bjorn
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

On Wed, Dec 02, 2009 at 08:53:15AM -0500, Mike Daigle wrote:
> Most of our new servers have Ilom on board which is accessable from the
> console. We have found that we rarely need the external power control
> anymore. I can see that it would still be valuable for network devices
> and other appliances.

for older devices the powerbot script called on a ^Ec could send an email to
a FOD-agent ;-)

_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users

On Wednesday 02 December 2009 06:53:15 am Mike Daigle wrote:
> Most of our new servers have Ilom on board which is accessable from the
> console. We have found that we rarely need the external power control
> anymore. I can see that it would still be valuable for network devices
> and other appliances.

Most of my machines have built-in management processors that can
control power, too. For me, the hassle is just dealing with the
dialogues and confirmation prompts and inconsistencies between
machines.

Bjorn
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users