From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <oguz@gaia.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id C9C28605DD
for <pve-devel@lists.proxmox.com>; Tue, 17 Nov 2020 12:36:46 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id B1E7EF47D
for <pve-devel@lists.proxmox.com>; Tue, 17 Nov 2020 12:36:16 +0100 (CET)
Received: from gaia.proxmox.com (212-186-127-178.static.upcbusiness.at
[212.186.127.178])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by firstgate.proxmox.com (Proxmox) with ESMTPS id 98F7AF473
for <pve-devel@lists.proxmox.com>; Tue, 17 Nov 2020 12:36:15 +0100 (CET)
Received: from gaia.proxmox.com (localhost.localdomain [127.0.0.1])
by gaia.proxmox.com (8.15.2/8.15.2/Debian-14~deb10u1) with ESMTP id
0AHBZwm9112335; Tue, 17 Nov 2020 12:35:58 +0100
Received: (from oguz@localhost)
by gaia.proxmox.com (8.15.2/8.15.2/Submit) id 0AHBZwrP112333;
Tue, 17 Nov 2020 12:35:58 +0100
From: Oguz Bektas <o.bektas@proxmox.com>
To: pve-devel@lists.proxmox.com
Date: Tue, 17 Nov 2020 12:35:57 +0100
Message-Id: <20201117113557.112265-1-o.bektas@proxmox.com>
X-Mailer: git-send-email 2.20.1
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-SPAM-LEVEL: Spam detection results: 1
AWL -0.557 Adjusted score from AWL reputation of From: address
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery
methods
KHOP_HELO_FCRDNS 0.399 Relay HELO differs from its IP's reverse DNS
NO_DNS_FOR_FROM 0.379 Envelope sender has no MX or A DNS records
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_NONE 0.001 SPF: sender does not publish an SPF Record
Subject: [pve-devel] [PATCH docs] pvecm: explain role of ssh in PVE stack
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Tue, 17 Nov 2020 11:36:46 -0000
add a section describing how SSH tunnels are used in conjunction
with PVE. (for #2829)
Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
---
pvecm.adoc | 35 +++++++++++++++++++++++++++++++++++
1 file changed, 35 insertions(+)
diff --git a/pvecm.adoc b/pvecm.adoc
index 3820c17..10de0a1 100644
--- a/pvecm.adoc
+++ b/pvecm.adoc
@@ -869,6 +869,41 @@ pvecm status
If you see a healthy cluster state, it means that your new link is being used.
+Role of SSH in {PVE} Clustering
+---------------------------
+
+{PVE} utilizes SSH tunnels for various operations:
+* Proxying terminal sessions on the GUI
+* VM/CT Migrations (if not configured 'insecure' mode)
+* Storage replications
+
+For example when you connect another nodes shell through the interface, a
+non-interactive SSH tunnel is started in order to forward the necessary ports
+for the VNC connection.
+
+Similarly during a VM migration an SSH tunnel is established between the target
+and source nodes. This way the local `qemu` socket can be used for the migration.
+
+IMPORTANT: In case you have a custom `.bashrc` or similar file that gets
+executed on login, `ssh` will automatically run it once the session is
+established. This can cause some unexpected behavior (as commands may be
+executed as a side-effect).
+
+In order to avoid such complications, it's recommended to add a check in
+`/root/.bashrc` to make sure the session is interactive, and only then run
+`.bashrc` commands.
+
+You can add this snippet at the beginning of your `.bashrc` file:
+
+----
+# If not running interactively, don't do anything
+case $- in
+ *i*) ;;
+ *) return;;
+esac
+----
+
+
Corosync External Vote Support
------------------------------
--
2.20.1