From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 0B5276378C for ; Wed, 25 Nov 2020 10:05:38 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id F1E2F16E1F for ; Wed, 25 Nov 2020 10:05:07 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 23A3316E14 for ; Wed, 25 Nov 2020 10:05:07 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id DE06644071 for ; Wed, 25 Nov 2020 10:05:06 +0100 (CET) Date: Wed, 25 Nov 2020 10:04:57 +0100 From: Fabian =?iso-8859-1?q?Gr=FCnbichler?= To: Proxmox VE development discussion References: <20201117113557.112265-1-o.bektas@proxmox.com> In-Reply-To: <20201117113557.112265-1-o.bektas@proxmox.com> MIME-Version: 1.0 User-Agent: astroid/0.15.0 (https://github.com/astroidmail/astroid) Message-Id: <1606293462.dawuwcrib0.astroid@nora.none> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-SPAM-LEVEL: Spam detection results: 0 AWL -0.377 Adjusted score from AWL reputation of From: address KAM_ASCII_DIVIDERS 0.8 Spam that uses ascii formatting tricks KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [proxmox.com] Subject: Re: [pve-devel] [PATCH docs] pvecm: explain role of ssh in PVE stack X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Nov 2020 09:05:38 -0000 On November 17, 2020 12:35 pm, Oguz Bektas wrote: > add a section describing how SSH tunnels are used in conjunction > with PVE. (for #2829) >=20 > Signed-off-by: Oguz Bektas > --- > pvecm.adoc | 35 +++++++++++++++++++++++++++++++++++ > 1 file changed, 35 insertions(+) >=20 > diff --git a/pvecm.adoc b/pvecm.adoc > index 3820c17..10de0a1 100644 > --- a/pvecm.adoc > +++ b/pvecm.adoc > @@ -869,6 +869,41 @@ pvecm status > If you see a healthy cluster state, it means that your new link is being= used. > =20 > =20 > +Role of SSH in {PVE} Clustering > +--------------------------- > + > +{PVE} utilizes SSH tunnels for various operations: s/operations/features > +* Proxying terminal sessions on the GUI * Proxying noVNC guest console access when client is connected to a differe= nt=20 node than the guest is running on * Proxying noVNC host shell access when client is connected to a different=20 node than the target node the latter also includes the 'upgrade' shell, not sure whether we want=20 to mention that separately. > +* VM/CT Migrations (if not configured 'insecure' mode) * Guest migration in 'secure' mode > +* Storage replications * Storage replication > + > +For example when you connect another nodes shell through the interface, = a > +non-interactive SSH tunnel is started in order to forward the necessary = ports > +for the VNC connection. this is not correct. we don't use SSH to forward any ports, we use it to=20 get a secure tunnel to the process running on the other node. the=20 'listen on port' part happens entirely on the node where the client=20 connects to. e.g., if I open a vncterm shell on node2 while being connected to node1,=20 the following will run on node1: 0 0 1505381 1505380 20 0 24140 7136 poll_s S ? 0:00 |= \_ /usr/bin/vncterm -rfbport 5900 -timeout 10 -authpath /nodes/node2= -perm Sys.Console -notls -listen localhost -c /usr/bin/ssh -e none -t IPOF= NODE2 -- /bin/login -f root 0 0 1505385 1505381 20 0 15784 6232 poll_s Ss+ pts/1 0:00 |= \_ /usr/bin/ssh -e none -t IPOFNODE2 -- /bin/login -f root and only the login shell will run on node2 (over SSH). for xtermjs and=20 spice it's different again (websocket / spiceproxy). maybe the following: For example, when using the noVNC shell for node B while being connected=20 to node A, noVNC connects to a terminal proxy on node A, which is in=20 turn connected to the login shell on node B via a non-interactive SSH=20 tunnel. > +Similarly during a VM migration an SSH tunnel is established between the= target > +and source nodes. This way the local `qemu` socket can be used for the m= igration. this is only half of the picture (the other is online and offline=20 storage migration and/or replication, which also happens over SSH and as=20 aprt of migration) > + > +IMPORTANT: In case you have a custom `.bashrc` or similar file that gets > +executed on login, `ssh` will automatically run it once the session is > +established. This can cause some unexpected behavior (as commands may be > +executed as a side-effect). > + > +In order to avoid such complications, it's recommended to add a check in > +`/root/.bashrc` to make sure the session is interactive, and only then r= un > +`.bashrc` commands. > + > +You can add this snippet at the beginning of your `.bashrc` file: drop this sentence, end last paragraph with ':' ? > + > +---- > +# If not running interactively, don't do anything > +case $- in > + *i*) ;; > + *) return;; > +esac > +---- > + > + > Corosync External Vote Support > ------------------------------ > =20 > --=20 > 2.20.1 >=20 >=20 > _______________________________________________ > pve-devel mailing list > pve-devel@lists.proxmox.com > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel >=20 >=20 >=20 =