/ - Diff - snf-ganeti - Greek Research and Technology Network's projects

     	doc/design-partitioned.rst \
     	doc/design-query-splitting.rst \
     	doc/design-query2.rst \
     	doc/design-remote-commands.rst \
     	doc/design-resource-model.rst \
     	doc/design-restricted-commands.rst \
     	doc/design-shared-storage.rst \
     	doc/design-monitoring-agent.rst \
     	doc/design-virtual-clusters.rst \

     - :doc:`design-bulk-create`
     - :doc:`design-opportunistic-locking`
     - :doc:`design-remote-commands`
     - :doc:`design-restricted-commands`
     - :doc:`design-node-add`
     - :doc:`design-virtual-clusters`
     - :doc:`design-network`

     Design for executing commands via RPC
     =====================================
     .. contents:: :depth: 3
     Current state and shortcomings
     ------------------------------
     We have encountered situations where a node was no longer responding to
     attempts at connecting via SSH or SSH became unavailable through other
     means. Quite often the node daemon is still available, even in
     situations where there's little free memory. The latter is due to the
     node daemon being locked into main memory using ``mlock(2)``.
     Since the node daemon does not allow the execution of arbitrary
     commands, quite often the only solution left was either to attempt a
     powercycle request via said node daemon or to physically reset the node.
     Proposed changes
     ----------------
     The goal of this design is to allow the execution of non-arbitrary
     commands via RPC requests. Since this can be dangerous in case the
     cluster certificate (``server.pem``) is leaked, some precautions need to
     be taken:
     - No parameters may be passed
     - No absolute or relative path may be passed, only a filename
     - Executable must reside in ``/etc/ganeti/remote-commands``, which must
       be owned by root:root and have mode 0755 or stricter
       - Must be regular files or symlinks
       - Must be executable by root:root
     There shall be no way to list available commands or to retrieve an
     executable's contents. The result from a request to execute a specific
     command will either be its output and exit code, or a generic error
     message. Only the receiving node's log files shall contain information
     as to why executing the command failed.
     To slow down dictionary attacks on command names in case an attacker
     manages to obtain a copy of ``server.pem``, a system-wide, file-based
     lock is acquired before verifying the command name and its executable.
     If a command can not be executed for some reason, the lock is only
     released with a delay of several seconds, after which the generic error
     message will be returned to the caller.
     At first, remote commands will not be made available through the
     :doc:`remote API <rapi>`, though that could be done at a later point
     (with a separate password).
     On the command line, a new sub-command will be added to the ``gnt-node``
     script.
     .. vim: set textwidth=72 :
     .. Local Variables:
     .. mode: rst
     .. fill-column: 72
     .. End:

     Design for executing commands via RPC
     =====================================
     .. contents:: :depth: 3
     Current state and shortcomings
     ------------------------------
     We have encountered situations where a node was no longer responding to
     attempts at connecting via SSH or SSH became unavailable through other
     means. Quite often the node daemon is still available, even in
     situations where there's little free memory. The latter is due to the
     node daemon being locked into main memory using ``mlock(2)``.
     Since the node daemon does not allow the execution of arbitrary
     commands, quite often the only solution left was either to attempt a
     powercycle request via said node daemon or to physically reset the node.
     Proposed changes
     ----------------
     The goal of this design is to allow the execution of non-arbitrary
     commands via RPC requests. Since this can be dangerous in case the
     cluster certificate (``server.pem``) is leaked, some precautions need to
     be taken:
     - No parameters may be passed
     - No absolute or relative path may be passed, only a filename
     - Executable must reside in ``/etc/ganeti/restricted-commands``, which must
       be owned by root:root and have mode 0755 or stricter
       - Must be regular files or symlinks
       - Must be executable by root:root
     There shall be no way to list available commands or to retrieve an
     executable's contents. The result from a request to execute a specific
     command will either be its output and exit code, or a generic error
     message. Only the receiving node's log files shall contain information
     as to why executing the command failed.
     To slow down dictionary attacks on command names in case an attacker
     manages to obtain a copy of ``server.pem``, a system-wide, file-based
     lock is acquired before verifying the command name and its executable.
     If a command can not be executed for some reason, the lock is only
     released with a delay of several seconds, after which the generic error
     message will be returned to the caller.
     At first, restricted commands will not be made available through the
     :doc:`remote API <rapi>`, though that could be done at a later point
     (with a separate password).
     On the command line, a new sub-command will be added to the ``gnt-node``
     script.
     .. vim: set textwidth=72 :
     .. Local Variables:
     .. mode: rst
     .. fill-column: 72
     .. End:

        design-opportunistic-locking.rst
        design-ovf-support.rst
        design-query2.rst
        design-remote-commands.rst
        design-restricted-commands.rst
        design-shared-storage.rst
        design-virtual-clusters.rst
        design-network.rst

+    #
+    #
     # Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Google Inc.
     # Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Google Inc.
+    #
     # This program is free software; you can redistribute it and/or modify
     # it under the terms of the GNU General Public License as published by
-...
     _MASTER_START = "start"
     _MASTER_STOP = "stop"
     #: Maximum file permissions for remote command directory and executables
     #: Maximum file permissions for restricted command directory and executables
     _RCMD_MAX_MODE = (stat.S_IRWXU |
                       stat.S_IRGRP | stat.S_IXGRP |
                       stat.S_IROTH | stat.S_IXOTH)
     #: Delay before returning an error for remote commands
     #: Delay before returning an error for restricted commands
     _RCMD_INVALID_DELAY = 10
     #: How long to wait to acquire lock for remote commands (shorter than
     #: How long to wait to acquire lock for restricted commands (shorter than
     #: L{_RCMD_INVALID_DELAY}) to reduce blockage of noded forks when many
     #: command requests arrive
     _RCMD_LOCK_TIMEOUT = _RCMD_INVALID_DELAY * 0.8
-...
     def _VerifyRestrictedCmdName(cmd):
       """Verifies a remote command name.
       """Verifies a restricted command name.
       @type cmd: string
       @param cmd: Command name
-...
     def _CommonRestrictedCmdCheck(path, owner):
       """Common checks for remote command file system directories and files.
       """Common checks for restricted command file system directories and files.
       @type path: string
       @param path: Path to check
-...
     def _VerifyRestrictedCmdDirectory(path, _owner=None):
       """Verifies remote command directory.
       """Verifies restricted command directory.
       @type path: string
       @param path: Path to check
-...
     def _VerifyRestrictedCmd(path, cmd, _owner=None):
       """Verifies a whole remote command and returns its executable filename.
       """Verifies a whole restricted command and returns its executable filename.
       @type path: string
       @param path: Directory containing remote commands
       @param path: Directory containing restricted commands
       @type cmd: string
       @param cmd: Command name
       @rtype: tuple; (boolean, string)
-...
                               _verify_dir=_VerifyRestrictedCmdDirectory,
                               _verify_name=_VerifyRestrictedCmdName,
                               _verify_cmd=_VerifyRestrictedCmd):
       """Performs a number of tests on a remote command.
       """Performs a number of tests on a restricted command.
       @type path: string
       @param path: Directory containing remote commands
       @param path: Directory containing restricted commands
       @type cmd: string
       @param cmd: Command name
       @return: Same as L{_VerifyRestrictedCmd}
-...
                          _prepare_fn=_PrepareRestrictedCmd,
                          _runcmd_fn=utils.RunCmd,
                          _enabled=constants.ENABLE_RESTRICTED_COMMANDS):
       """Executes a remote command after performing strict tests.
       """Executes a restricted command after performing strict tests.
       @type cmd: string
       @param cmd: Command name
-...
       @raise RPCFail: In case of an error
       """
       logging.info("Preparing to run remote command '%s'", cmd)
       logging.info("Preparing to run restricted command '%s'", cmd)
       if not _enabled:
         _Fail("Remote commands disabled at configure time")
         _Fail("Restricted commands disabled at configure time")
       lock = None
       try:
-...
           # Do not include original error message in returned error
           _Fail("Executing command '%s' failed" % cmd)
         elif cmdresult.failed or cmdresult.fail_reason:
           _Fail("Remote command '%s' failed: %s; output: %s",
           _Fail("Restricted command '%s' failed: %s; output: %s",
                 cmd, cmdresult.fail_reason, cmdresult.output)
         else:
           return cmdresult.output

     #!/usr/bin/python
+    #
     # Copyright (C) 2010 Google Inc.
     # Copyright (C) 2010, 2013 Google Inc.
+    #
     # This program is free software; you can redistribute it and/or modify
     # it under the terms of the GNU General Public License as published by
-...
                                    _sleep_fn=sleep_fn, _prepare_fn=prepare_fn,
                                    _enabled=True)
         except backend.RPCFail, err:
           self.assertTrue(str(err).startswith("Remote command 'test3079' failed:"))
           self.assertTrue(str(err).startswith("Restricted command 'test3079'"
                                               " failed:"))
           self.assertTrue("stderr406328567" in str(err),
                           msg="Error did not include output")
         else:
-...
                                    _runcmd_fn=NotImplemented,
                                    _enabled=False)
         except backend.RPCFail, err:
           self.assertEqual(str(err), "Remote commands disabled at configure time")
           self.assertEqual(str(err),
                            "Restricted commands disabled at configure time")
         else:
           self.fail("Did not raise exception")

Synnefo » snf-ganeti

Revision 45bc4635