diff --git a/Version b/Version index 371a952d6..ccc99d021 100644 --- a/Version +++ b/Version @@ -1 +1 @@ -2.12.2 +2.12.3 diff --git a/build-ubunturepo b/build-ubunturepo index 6c9e001cd..6eae01394 100755 --- a/build-ubunturepo +++ b/build-ubunturepo @@ -203,7 +203,7 @@ then pkg_type="snap" build_string="Snap_Build" cur_date=`date +%Y%m%d%H%M` - pkg_version="${short_ver}-${pkg_type}${cur_date}" + pkg_version="${ver}-${pkg_type}${cur_date}" if [ ! -d ../../$package_dir_name ];then mkdir -p "../../$package_dir_name" @@ -233,9 +233,10 @@ then #3 symbolic link can't work during package if [ $file_low = "xcat-probe" ]; then CURDIR=$(pwd) - mkdir -p ${CURDIR}/xCAT-probe/lib/perl/xCAT/ - cp -f ${CURDIR}/perl-xCAT/xCAT/NetworkUtils.pm ${CURDIR}/xCAT-probe/lib/perl/xCAT/ - cp -f ${CURDIR}/perl-xCAT/xCAT/GlobalDef.pm ${CURDIR}/xCAT-probe/lib/perl/xCAT/ + mkdir -p ${CURDIR}/lib/perl/xCAT/ + cp -f ${CURDIR}/../perl-xCAT/xCAT/NetworkUtils.pm ${CURDIR}/lib/perl/xCAT/ + cp -f ${CURDIR}/../perl-xCAT/xCAT/GlobalDef.pm ${CURDIR}/lib/perl/xCAT/ + cp -f ${CURDIR}/../perl-xCAT/xCAT/ServiceNodeUtils.pm ${CURDIR}/lib/perl/xCAT/ fi dpkg-buildpackage -uc -us else diff --git a/docs/source/guides/admin-guides/manage_clusters/common/deployment/create_img.rst b/docs/source/guides/admin-guides/manage_clusters/common/deployment/create_img.rst index c07b65f78..a7dbc54ec 100644 --- a/docs/source/guides/admin-guides/manage_clusters/common/deployment/create_img.rst +++ b/docs/source/guides/admin-guides/manage_clusters/common/deployment/create_img.rst @@ -53,6 +53,8 @@ For ubuntu ppc64le, the initrd.gz shipped with the ISO does not support network [ubuntu 16.04]: http://xcat.org/files/netboot/ubuntu16.04/ppc64el/mini.iso + [ubuntu 16.04.1]: http://xcat.org/files/netboot/ubuntu16.04.1/ppc64el/mini.iso + * Mount mini.iso :: mkdir /tmp/iso @@ -61,7 +63,7 @@ For ubuntu ppc64le, the initrd.gz shipped with the ISO does not support network * Copy the netboot initrd.gz to osimage :: mkdir -p /install//ppc64el/install/netboot - cp /tmp/iso/install/initrd.gz /install//ppc64el/installe/netboot + cp /tmp/iso/install/initrd.gz /install//ppc64el/install/netboot **[Below tips maybe helpful for you]** diff --git a/docs/source/guides/admin-guides/references/man1/chvm.1.rst b/docs/source/guides/admin-guides/references/man1/chvm.1.rst index 056aa31e3..bd81a7f17 100644 --- a/docs/source/guides/admin-guides/references/man1/chvm.1.rst +++ b/docs/source/guides/admin-guides/references/man1/chvm.1.rst @@ -62,7 +62,7 @@ VMware/KVM specific: ==================== -\ **chvm**\ \ *noderange*\ [\ **-a**\ \ *size*\ ] [\ **-d**\ \ *disk*\ ] [\ **-p**\ \ *disk*\ ] [\ **-**\ **-resize**\ \ **disk**\ =\ *size*\ ] [\ **-**\ **-cpus**\ \ *count*\ ] [\ **-**\ **-mem**\ \ *memory*\ ] +\ **chvm**\ \ *noderange*\ [\ **-a**\ \ *size*\ ] [\ **-d**\ \ *disk*\ ] [\ **-p**\ \ *disk*\ ] [\ **-**\ **-resize**\ \ *disk*\ =\ *size*\ ] [\ **-**\ **-cpus**\ \ *count*\ ] [\ **-**\ **-mem**\ \ *memory*\ ] zVM specific: @@ -318,7 +318,7 @@ VMware/KVM specific: \ **-d**\ \ *disk*\ - Deregister the Hard disk but leave the backing files. Multiple can be done with comma separated values. The disks are specified by SCSI id. Size defaults to GB. + Deregister the Hard disk but leave the backing files. Multiple can be done with comma separated values. The disks are specified by SCSI id. @@ -330,13 +330,13 @@ VMware/KVM specific: \ **-p**\ \ *disk*\ - Purge the Hard disk. Deregisters and deletes the files. Multiple can be done with comma separated values. The disks are specified by SCSI id. Size defaults to GB. + Purge the Hard disk. Deregisters and deletes the files. Multiple can be done with comma separated values. The disks are specified by SCSI id. -\ **-**\ **-resize**\ \ **disk**\ =\ *size*\ +\ **-**\ **-resize**\ \ *disk*\ =\ *size*\ - Change the size of the Hard disk. The disk can never be set to less than it's current size. Multiple disks can be resized to \ *size*\ by using comma separated values on the left side of \ **=**\ . The disks are specified by SCSI id. Size defaults to GB. + Change the size of the Hard disk. The disk in \ *qcow2*\ format can not be set to less than it's current size. The disk in \ *raw*\ format can be resized smaller, please use caution. Multiple disks can be resized by using comma separated \ *disk*\ \ **=**\ \ *size*\ pairs. The disks are specified by SCSI id. Size defaults to GB. @@ -976,6 +976,14 @@ Output is similar to: gpok3: Replacing user entry of LNX3... Done +8. To resize virtual machine's disk sdb to 10G and sdc to 15G: + + +.. code-block:: perl + + chvm gpok3 --resize sdb=10G,sdc=15G + + ***** diff --git a/docs/source/guides/admin-guides/references/man1/packimage.1.rst b/docs/source/guides/admin-guides/references/man1/packimage.1.rst index d0520af54..0ab919668 100644 --- a/docs/source/guides/admin-guides/references/man1/packimage.1.rst +++ b/docs/source/guides/admin-guides/references/man1/packimage.1.rst @@ -23,7 +23,7 @@ SYNOPSIS \ **packimage [-v| -**\ **-version]**\ -\ **packimage**\ \ *imagename*\ +\ **packimage**\ [\ **-m | -**\ **-method**\ \ *cpio|tar*\ ] [\ **-c | -**\ **-compress**\ \ *gzip|pigz|xz*\ ] \ *imagename*\ *********** @@ -56,13 +56,9 @@ OPTIONS \ **-v**\ Command Version. -\ **-o**\ Operating system (fedora8, rhel5, sles10,etc) +\ **-m| -**\ **-method**\ Archive Method (cpio,tar,squashfs, default is cpio) -\ **-p**\ Profile (compute,service) - -\ **-a**\ Architecture (ppc64,x86_64,etc) - -\ **-m**\ Archive Method (cpio,tar,squashfs, default is cpio) +\ **-c| -**\ **-compress**\ Compress Method (pigz,gzip,xz, default is pigz/gzip) ************ @@ -88,6 +84,14 @@ EXAMPLES packimage rhels7.1-x86_64-netboot-compute +2. To pack the osimage rhels7.1-x86_64-netboot-compute with "tar" to archive and "pigz" to compress: + + +.. code-block:: perl + + packimage -m tar -c pigz rhels7.1-x86_64-netboot-compute + + ***** FILES diff --git a/docs/source/guides/admin-guides/references/man1/rspconfig.1.rst b/docs/source/guides/admin-guides/references/man1/rspconfig.1.rst index 911a80222..e737ef070 100644 --- a/docs/source/guides/admin-guides/references/man1/rspconfig.1.rst +++ b/docs/source/guides/admin-guides/references/man1/rspconfig.1.rst @@ -80,16 +80,12 @@ FSP/CEC specific: ================= -\ **rspconfig**\ \ *noderange*\ {\ **autopower | iocap | dev | celogin1 | decfg | memdecfg | procdecfg | time | date | spdump | sysdump | network**\ } +\ **rspconfig**\ \ *noderange*\ {\ **autopower | iocap | decfg | memdecfg | procdecfg | time | date | spdump | sysdump | network**\ } \ **rspconfig**\ \ *noderange*\ \ **autopower**\ ={\ **enable | disable**\ } \ **rspconfig**\ \ *noderange*\ \ **iocap**\ ={\ **enable | disable**\ } -\ **rspconfig**\ \ *noderange*\ \ **dev**\ ={\ **enable | disable**\ } - -\ **rspconfig**\ \ *noderange*\ \ **celogin1**\ ={\ **enable | disable**\ } - \ **rspconfig**\ \ *noderange*\ \ **time**\ =\ *hh:mm:ss*\ \ **rspconfig**\ \ *noderange*\ \ **date**\ =\ *mm:dd:yyyy*\ @@ -142,7 +138,7 @@ BPA/Frame Specific: =================== -\ **rspconfig**\ \ *noderange*\ {\ **network | dev | celogin1**\ } +\ **rspconfig**\ \ *noderange*\ {\ **network**\ } \ **rspconfig**\ \ *noderange*\ \ **network**\ ={\ **nic,**\ \*} @@ -150,10 +146,6 @@ BPA/Frame Specific: \ **rspconfig**\ \ *noderange*\ \ **network**\ ={\ **nic,0.0.0.0**\ } -\ **rspconfig**\ \ *noderange*\ \ **dev**\ ={\ **enable | disable**\ } - -\ **rspconfig**\ \ *noderange*\ \ **celogin1**\ ={\ **enable | disable**\ } - \ **rspconfig**\ \ *noderange*\ \ **HMC_passwd**\ ={\ *currentpasswd,newpasswd*\ } \ **rspconfig**\ \ *noderange*\ \ **admin_passwd**\ ={\ *currentpasswd,newpasswd*\ } @@ -255,7 +247,7 @@ DESCRIPTION \ **rspconfig**\ configures various settings in the nodes' service processors. If only a keyword is specified, without the \ **=**\ , it displays the current value. -For options \ **autopower | iocap | dev | celogin1 | decfg | memdecfg | procdecfg | time | date | spdump | sysdump | network**\ , user need to use \ *chdef -t site enableASMI=yes*\ to enable ASMI first. For options \ **dev | celogin1**\ , user also need to contact IBM service to get the dynamic password for 'celogin' and put it in passwd table. After completed the command, user should use \ *chdef -t site enableASMI=no*\ to disable ASMI. +For options \ **autopower | iocap | decfg | memdecfg | procdecfg | time | date | spdump | sysdump | network**\ , user need to use \ *chdef -t site enableASMI=yes*\ to enable ASMI first. ******* @@ -396,18 +388,6 @@ OPTIONS -\ **dev**\ ={\ **enable**\ | \ **disable**\ } - - Enable or disable the CEC|Frame 'dev' account or display account status if no value specified. - - - -\ **celogin1**\ ={\ **enable**\ | \ **disable**\ } - - Enable or disable the CEC|Frame 'celogin1' account or display account status if no value specified. - - - \ **ip**\ The ip address. diff --git a/docs/source/guides/install-guides/apt/configure_xcat.rst b/docs/source/guides/install-guides/apt/configure_xcat.rst index 435b57ba9..887ef327f 100644 --- a/docs/source/guides/install-guides/apt/configure_xcat.rst +++ b/docs/source/guides/install-guides/apt/configure_xcat.rst @@ -12,14 +12,20 @@ From the xCAT download page, find the build you want to install and add to ``/et To configure the xCAT development build, add the following line to ``/etc/apt/sources.list``: :: - deb http://xcat.org/files/xcat/repos/apt/devel/core-snap trusty main + [For x86_64 servers] + deb [arch=amd64] http://xcat.org/files/xcat/repos/apt/devel/core-snap trusty main + [For ppc64el servers] + deb [arch=ppc64el] http://xcat.org/files/xcat/repos/apt/devel/core-snap trusty main **[xcat-dep]** To configure the xCAT deps online repository, add the following line to ``/etc/apt/sources.list``: :: - deb http://xcat.org/files/xcat/repos/apt/xcat-dep trusty main + [For x86_64 servers] + deb [arch=amd64] http://xcat.org/files/xcat/repos/apt/xcat-dep trusty main + [For ppc64el servers] + deb [arch=ppc64el] http://xcat.org/files/xcat/repos/apt/xcat-dep trusty main If using internet repositories, continue to the next step to install xCAT. diff --git a/docs/source/overview/features.rst b/docs/source/overview/features.rst index c15ac8471..176d6b82a 100644 --- a/docs/source/overview/features.rst +++ b/docs/source/overview/features.rst @@ -51,6 +51,7 @@ Features * Parallel ping #. Integrate xCAT in Cloud + * Openstack * SoftLayer diff --git a/docs/source/overview/xcat2_release.rst b/docs/source/overview/xcat2_release.rst index 1f128f855..f3d2da69a 100644 --- a/docs/source/overview/xcat2_release.rst +++ b/docs/source/overview/xcat2_release.rst @@ -14,6 +14,14 @@ xCAT 2.12.x |xCAT |New OS |New |New Feature | |Version | |Hardware | | +=================================+===============+=============+==================================+ +|| xCAT 2.12.2 |- UBT 16.04.1 | |- nodeset offline | +|| 2016/08/19 | | |- Enhance: node status update | +|| | | |- Support Bond for install nics | +| `2.12.2 Release Notes `_ | | | | +| | | | | ++---------------------------------+---------------+-------------+----------------------------------+ || xCAT 2.12.1 | | |- New xCAT install tool: go-xcat | || 2016/07/08 | | |- New opt: mkdef/lsdef --template | || | | |- Support rinstall for all OS/ARCH| diff --git a/docs/source/security/2015/20150312_openssl.rst b/docs/source/security/2015/20150312_openssl.rst new file mode 100644 index 000000000..698b5e76c --- /dev/null +++ b/docs/source/security/2015/20150312_openssl.rst @@ -0,0 +1,20 @@ +2015-03-12 - OpenSSL Vulnerabilities (FREAK) +============================================= + +OpenSSL announced security fixes on 01/08/15 in the following bulletin: https://www-origin.openssl.org/news/secadv/20150108.txt + +Advisory CVEs +------------- + +* CVE-2015-0204 **RSA silently downgrades to EXPORT_RSA [Client]** (Severity: Low) + +FREAK vulnerability CVE-2015-0204 is involved when 'RSA_EXPORT' ssl cipher suit is used in ssl server/client. + +Action +------ + +xCAT does not use RSA_EXPORT ciphers for ssl communication by default. However, xCAT does allow user to choose the ciphers from the site.xcatsslciphers attribute. + +Please make sure you do not put RSA_EXPORT related ciphers in this attribute. + +It is recommended that you upgrade openssl to 1.0.1L and upper version for the fix of this problem. Please go to the os distribution to get the latest openssl package. diff --git a/docs/source/security/2015/20150324_openssl.rst b/docs/source/security/2015/20150324_openssl.rst new file mode 100644 index 000000000..973bfa57f --- /dev/null +++ b/docs/source/security/2015/20150324_openssl.rst @@ -0,0 +1,12 @@ +2015-03-24 - OpenSSL Vulnerabilities +==================================== + +OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This feature only applies on 64 bit x86 architecture platforms that support AES NI instructions. A defect in the implementation of "multiblock" can cause a segmentation fault within OpenSSL, thus enabling a potential DoS attack. + +This issue affects OpenSSL version: 1.0.2 + + +Action +------ + +xCAT uses OpenSSL for client-server communication but **does not** ship it. Please upgrade OpenSSL to 1.0.2a or higher. diff --git a/docs/source/security/2015/20150403_openssl.rst b/docs/source/security/2015/20150403_openssl.rst new file mode 100644 index 000000000..12262015c --- /dev/null +++ b/docs/source/security/2015/20150403_openssl.rst @@ -0,0 +1,14 @@ +2015-04-03 - OpenSSL Vulnerabilities (BAR MITZVAH) +================================================== + +The RC4 Bar mitzvah attack is an attack on the SSL/TLS protocols when both the client and server have RC4 enabled. + +* http://www.darkreading.com/attacks-breaches/ssl-tls-suffers-bar-mitzvah-attack-/d/d-id/1319633 +* http://www.imperva.com/docs/HII_Attacking_SSL_when_using_RC4.pdf. + +Action +------ + +xCAT uses OpenSSL shipped with OS distribution for client-server communication. It does not use RC4 ciphers explicitly. However, it allows user to specify xcatsslciphers on the site table for ssl communication. It is recommended that the user not specify RC4 ciphers to avoid the Bar mitzvah attack. + +It is also recommended that the user go to the OS distribution to get latest OpenSSL package for the fix of this problem. diff --git a/docs/source/security/2015/20150519_openssl.rst b/docs/source/security/2015/20150519_openssl.rst new file mode 100644 index 000000000..280cf6eb7 --- /dev/null +++ b/docs/source/security/2015/20150519_openssl.rst @@ -0,0 +1,27 @@ +2015-05-19 - OpenSSL Vulnerabilities (VENOM) +============================================ + +Advisory CVEs +------------- + +* CVE-2015-3456 - **(aka VENOM) is a security flaw in the QEMU's Floppy Disk Controller (FDC) emulation.** + +VENOM vulnerability could expose virtual machines on unpatched host systems + +A new vulnerability known as VENOM has been discovered, which could allow an attacker to escape a guest virtual machine (VM) and access the host system along with other VMs running on this system. The VENOM bug could potentially allow an attacker to steal sensitive data on any of the virtual machines on this system and gain elevated access to the host''''s local network and its systems. + +The VENOM bug (CVE-2015-3456) exists in the virtual Floppy Disk Controller for the open-source hypervisor QEMU, which is installed by default in a number of virtualization infrastructures such as Xen hypervisors, the QEMU client, and Kernel-based Virtual Machine (KVM). VENOM does not affect VMware, Microsoft Hyper-V, and Bochs hypervisors. + +* QEMU: http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721f305d67bc0718795fedee2e824c +* Xen Project: http://xenbits.xen.org/xsa/advisory-133.html +* Red Hat: https://access.redhat.com/articles/1444903 +* SUSE: https://www.suse.com/support/kb/doc.php?id=7016497 +* Ubuntu: http://www.ubuntu.com/usn/usn-2608-1/ + + +Action +------ + +xCAT does not ship any rpms that have QEMU component directly. However xCAT does make system calls to QEMU when doing KVM/Xen visualization. If you are using xCAT to manage KVM or Xen hosts and quests, please get the latest rpms that have QEMU component from the os distro and do a upgrade on both xCAT management node and the KVM/Xen hosts. + + diff --git a/docs/source/security/2015/20150520_openssl.rst b/docs/source/security/2015/20150520_openssl.rst new file mode 100644 index 000000000..8cbaf20c0 --- /dev/null +++ b/docs/source/security/2015/20150520_openssl.rst @@ -0,0 +1,20 @@ +2015-05-20 - OpenSSL Vulnerabilities (LOGJAM) +============================================= + +A Logjam vulnerability attacks openssl and web services on weak (512-bit) Diffie-Hellman key groups. Please refer to the following documents for details. + +Main site: https://weakdh.org/ + +Server test: https://weakdh.org/sysadmin.html + +Please refer to the following openssl link for more details regarding the fix: https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/ + + OpenSSL 1.0.2 users should upgrade to 1.0.2b + OpenSSL 1.0.1 users should upgrade to 1.0.1n + +Action +------ + +xCAT uses OpenSSL for client-server communication but **does not** ship it. It uses the default ciphers from openssl. It also allows the user to customize it through site.xcatsslversion and site.xcatsslciphers. Please make sure you do not enable DH or DHE ciphers. + +Please get the latest openssl package from the os distros and upgrade it on all the xCAT management nodes, the service nodes and xCAT client nodes. diff --git a/docs/source/security/2015/20151203_openssl.rst b/docs/source/security/2015/20151203_openssl.rst new file mode 100644 index 000000000..da5e9e772 --- /dev/null +++ b/docs/source/security/2015/20151203_openssl.rst @@ -0,0 +1,42 @@ +2015-12-03 - OpenSSL Vulnerabilities +==================================== + +OpenSSL announced security fixes on 12/03/15 in the following bulletin: http://openssl.org/news/secadv/20151203.txt + +Advisory CVEs +------------- + +* CVE-2015-3193 - **BN_mod_exp may produce incorrect results on x86_64** (Severity:Moderate) + + OpenSSL 1.0.2 users should upgrade to 1.0.2e + +* CVE-2015-3194 - **Certificate verify crash with missing PSS parameter** (Severity:Moderate) + + OpenSSL 1.0.2 users should upgrade to 1.0.2e + OpenSSL 1.0.1 users should upgrade to 1.0.1q + +* CVE-2015-3195 - **X509_ATTRIBUTE memory leak** (Severity:Moderate) + + OpenSSL 1.0.2 users should upgrade to 1.0.2e + OpenSSL 1.0.1 users should upgrade to 1.0.1q + OpenSSL 1.0.0 users should upgrade to 1.0.0t + OpenSSL 0.9.8 users should upgrade to 0.9.8zh + +* CVE-2015-3196 - **Race condition handling PSK identify hint** (Severity:Low) + + OpenSSL 1.0.2 users should upgrade to 1.0.2d + OpenSSL 1.0.1 users should upgrade to 1.0.1p + OpenSSL 1.0.0 users should upgrade to 1.0.0t + +* CVE-2015-1794 - **Anon DH ServerKeyExchange with 0 p parameter** (Severity:Low) + + OpenSSL 1.0.2 users should upgrade to 1.0.2e + + +Action +------ + +xCAT uses OpenSSL for client-server communication but **does not** ship it. + +It is recommended to keep your OpenSSL levels up-to-date with the indicated versions in the security bulletins to prevent any potential security threats. + diff --git a/docs/source/security/2015/index.rst b/docs/source/security/2015/index.rst new file mode 100644 index 000000000..4da7c1928 --- /dev/null +++ b/docs/source/security/2015/index.rst @@ -0,0 +1,12 @@ +2015 Notices +============ + +.. toctree:: + :maxdepth: 1 + + 20151203_openssl.rst + 20150520_openssl.rst + 20150519_openssl.rst + 20150403_openssl.rst + 20150324_openssl.rst + 20150312_openssl.rst diff --git a/docs/source/security/2016/20160815_openssl.rst b/docs/source/security/2016/20160815_openssl.rst new file mode 100644 index 000000000..1a99c972d --- /dev/null +++ b/docs/source/security/2016/20160815_openssl.rst @@ -0,0 +1,18 @@ +2016-08-16 - OpenSSL Vulnerabilities +==================================== + +This vulnerability has no fix available at this time (other then mentioned patches below) + +Issue: https://bugzilla.redhat.com/show_bug.cgi?id=1359615 + +Patch: https://github.com/openssl/openssl/commit/0ed26acce328ec16a3aa635f1ca37365e8c7403a + +Advisory CVEs +------------- + +`CVE-2016-2180 `_ - OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds read in the TS_OBJ_print_bio function. + +Action +------ + +xCAT uses OpenSSL for client-server communication but **does not** ship it. It is highly recommended to keep your OpenSSL levels up-to-date to prevent any potential security threats. diff --git a/docs/source/security/2016/20160824_openssl.rst b/docs/source/security/2016/20160824_openssl.rst new file mode 100644 index 000000000..fdf724cc9 --- /dev/null +++ b/docs/source/security/2016/20160824_openssl.rst @@ -0,0 +1,31 @@ +2016-08-24 - OpenSSL Vulnerabilities (Sweet32) +============================================== + +**SWEET32: Birthday attacks against TLS ciphers with 64bit block size** + +**CVE-2016-2183** + +Description: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the in the Triple-DES on 64-bit block cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a man-in-the-middle attack could exploit this vulnerability to recover the plaintext data and obtain sensitive information. + +**CVE-2016-6329** + +Description: OpenVPN could allow a remote attacker to obtain sensitive information, caused by an error in the in the Triple-DES on 64-bit block cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a man-in-the-middle attack could exploit this vulnerability to recover the plaintext data and obtain sensitive information. + + +A detailed description of this issue can be seen in the following blog posting: https://www.openssl.org/blog/blog/2016/08/24/sweet32/ + + +Advisory CVEs +------------- + +* CVE-2016-2183 +* CVE-2016-6329 + +Action +------ + +xCAT uses OpenSSL for client-server communication but **does not** ship it. + +It is highly recommended to keep your OpenSSL levels up-to-date with the indicated versions in the security bulletins to prevent any potential security threats. Obtain the updated software packages from your Operating system distribution channels. + + diff --git a/docs/source/security/2016/index.rst b/docs/source/security/2016/index.rst index 3017c40dd..43cebeb61 100644 --- a/docs/source/security/2016/index.rst +++ b/docs/source/security/2016/index.rst @@ -4,6 +4,8 @@ .. toctree:: :maxdepth: 1 + 20160824_openssl.rst + 20160815_openssl.rst 20160503_openssl.rst 20160301_openssl.rst 20160128_openssl.rst diff --git a/docs/source/security/index.rst b/docs/source/security/index.rst index 9952ab44f..4f9535ac9 100644 --- a/docs/source/security/index.rst +++ b/docs/source/security/index.rst @@ -5,3 +5,4 @@ Security Notices :maxdepth: 2 2016/index.rst + 2015/index.rst diff --git a/makerpm b/makerpm index c3cd442df..983b3ecc5 100755 --- a/makerpm +++ b/makerpm @@ -50,6 +50,7 @@ function makenoarch { mkdir -p ${CURDIR}/xCAT-probe/lib/perl/xCAT/ cp -f ${CURDIR}/perl-xCAT/xCAT/NetworkUtils.pm ${CURDIR}/xCAT-probe/lib/perl/xCAT/ cp -f ${CURDIR}/perl-xCAT/xCAT/GlobalDef.pm ${CURDIR}/xCAT-probe/lib/perl/xCAT/ + cp -f ${CURDIR}/perl-xCAT/xCAT/ServiceNodeUtils.pm ${CURDIR}/xCAT-probe/lib/perl/xCAT/ fi tar --exclude .svn -czf $RPMROOT/SOURCES/$RPMNAME-$VER.tar.gz $RPMNAME diff --git a/perl-xCAT/xCAT/PPCcfg.pm b/perl-xCAT/xCAT/PPCcfg.pm index 9c0f1c2af..cae3b7907 100644 --- a/perl-xCAT/xCAT/PPCcfg.pm +++ b/perl-xCAT/xCAT/PPCcfg.pm @@ -50,9 +50,7 @@ sub parse_args { "general_passwd", "*_passwd", "hostname", - "resetnet", - "dev", - "celogin1" + "resetnet" ); my @bpa = ( "frame", @@ -63,9 +61,7 @@ sub parse_args { "general_passwd", "*_passwd", "hostname", - "resetnet", - "dev", - "celogin1" + "resetnet" ); my @ppc = ( "sshcfg" @@ -169,16 +165,6 @@ sub parse_args { return (usage("No argument specified for '$_'")); } } - { - if ($request->{dev} eq '1' && $request->{other} eq '1') { - return (usage("Invalid command arrays")); - } - - # my $result = parse_dev_option( $request, \%cmds); - # if ($result) { - # return ( usage($result)); - # } - } #################################### # Return method to invoke #################################### @@ -216,25 +202,6 @@ sub parse_args { return (\%opt); } - -sub parse_dev_option { - my $req = shift; - my $cmds = shift; - foreach my $cmd (keys %$cmds) { - if ($cmd =~ /^(dev|celogin1)$/) { - if ($cmds->{$cmd} and ($cmds->{$cmd} !~ /^(enable|disable)$/i)) { - return ("Invalid argument " . $cmds->{$cmd} . " for " . $cmd); - } - $req->{dev} = 1; - } else { - $req->{other} = 1; - } - } - if ($req->{dev} eq '1' && $req->{other} eq '1') { - return ("Invalid command arrays"); - } - return undef; -} ########################################################################## # Parse the command line optional arguments ########################################################################## @@ -324,14 +291,6 @@ sub parse_option { } } - if ($command eq 'dev' or $command eq 'celogin1') { - if ($value !~ /^(enable|disable)$/i) { - return ("Invalid argument '$value'"); - } - $request->{dev} = 1; - } else { - $request->{other} = 1; - } return undef; } diff --git a/perl-xCAT/xCAT/PPCfsp.pm b/perl-xCAT/xCAT/PPCfsp.pm index 081ac4217..be754ee57 100644 --- a/perl-xCAT/xCAT/PPCfsp.pm +++ b/perl-xCAT/xCAT/PPCfsp.pm @@ -38,9 +38,7 @@ my %cmds = ( autopower => [ "Auto Power Restart", \&autopower ], sysdump => [ "System Dump", \&sysdump ], spdump => [ "Service Processor Dump", \&spdump ], - network => [ "Network Configuration", \&netcfg ], - dev => [ "Service Processor Command Line", \&devenable ], - celogin1 => [ "Service Processor Command Line", \&ce1enable ] }, + network => [ "Network Configuration", \&netcfg ]}, ); @@ -216,55 +214,6 @@ sub connect { } -sub ce1enable { - return &loginenable($_[0], $_[1], $_[2], "celogin1"); -} - -sub devenable { - return &loginenable($_[0], $_[1], $_[2], "dev"); -} -my %cmdline_for_log = ( - dev => { - enable => "registry -Hw nets/DevEnabled 1", - disable => "registry -Hw nets/DevEnabled 0", - check_pwd => "registry -l DevPwdFile", - create_pwd => "netsDynPwdTool --create dev FipSdev", - password => "FipSdev" - }, - celogin1 => { - enable => "registry -Hw nets/CE1Enabled 1", - disable => "registry -Hw nets/CE1Enabled 0", - check_pwd => "registry -l Ce1PwdFile", - create_pwd => "netsDynPwdTool --create celogin1 FipSce1", - password => "FipSce1" - }, -); - -sub send_command { - my $ua = shift; - my $server = shift; - my $id = shift; - my $log_name = shift; - my $cmd = shift; - my $cmd_line = $cmdline_for_log{$log_name}{$cmd}; - if (!defined($cmd_line)) { - return undef; - } - my $res = $ua->post("https://$server/cgi-bin/cgi", - [ form => $id, - cmd => $cmd_line, - submit => "Execute" ] - ); - - if (!$res->is_success()) { - return undef; - } - if ($res->content =~ /(not allowed.*\.|Invalid entry)/) { - return undef; - } - return $res->content; -} - sub loginstate { my $ua = shift; my $server = shift; @@ -282,55 +231,6 @@ sub loginstate { } } -sub loginenable { - my $exp = shift; - my $request = shift; - my $id = shift; - my $log_name = shift; - my $ua = @$exp[0]; - my $server = @$exp[1]; - - my $value = $request->{method}{$log_name}; - if (!defined($value)) { - return &loginstate($ua, $server, $log_name); - } - my $url = "https://$server/cgi-bin/cgi?form=$id"; - my $res = $ua->get($url); - if (!$res->is_success()) { - return ([ RC_ERROR, $res->status_line ]); - } - - $res = &send_command($ua, $server, $id, $log_name, $value); - if (!defined($res)) { - return ([ RC_ERROR, "Send command Failed" ]); - } - if ($value =~ m/^disable$/) { - my $out = sprintf("%9s: Disabled", $log_name); - return ([ SUCCESS, $out ]); - } - - #check password# - $res = &send_command($ua, $server, $id, $log_name, "check_pwd"); - if (!defined($res)) { - return ([ RC_ERROR, "Send command Failed" ]); - } - my $password = undef; - if ($res =~ m/\[\d+([a-zA-Z]+)\d+\]/) { - $password = $1; - } else { - - # create password # - $res = &send_command($ua, $server, $id, $log_name, "create_pwd"); - if (!defined($res)) { - return ([ RC_ERROR, "Send command Failed" ]); - } - $password = $cmdline_for_log{$log_name}{password}; - print "create password for $log_name is '$cmdline_for_log{$log_name}{password}'\n"; - } - my $out = sprintf("%9s: Enabled, password: $password", $log_name); - return ([ SUCCESS, $out ]); -} - sub disconnect { my $exp = shift; diff --git a/perl-xCAT/xCAT/Usage.pm b/perl-xCAT/xCAT/Usage.pm index 523ba6acb..b978a03d1 100755 --- a/perl-xCAT/xCAT/Usage.pm +++ b/perl-xCAT/xCAT/Usage.pm @@ -187,10 +187,6 @@ my %usage = ( HMC specific: rspconfig [sshcfg] rspconfig [sshcfg=] - CEC|Frame(using ASM)Specific: - rspconfig [dev|celogin1] - rspconfig [dev=]| - rspconfig [celogin1=] ", "getmacs" => "Usage: diff --git a/xCAT-client/bin/mysqlsetup b/xCAT-client/bin/mysqlsetup index e61857a20..e242ed930 100755 --- a/xCAT-client/bin/mysqlsetup +++ b/xCAT-client/bin/mysqlsetup @@ -916,7 +916,13 @@ sub initmysqldb } else { - $cmd = "/usr/bin/mysql_install_db --user=mysql"; + my $sqlcmd = "/usr/bin/mysql_install_db"; + if (!(-x ($sqlcmd))) { + xCAT::MsgUtils->message("E", "$sqlcmd is not available, please install required mysql/mariadb packages"); + exit(1); + } + + $cmd = "$sqlcmd --user=mysql"; } xCAT::Utils->runcmd($cmd, 0); if ($::RUNCMD_RC != 0) diff --git a/xCAT-client/bin/tcons b/xCAT-client/bin/tcons index c7f5ea4fb..cc0af755d 100755 --- a/xCAT-client/bin/tcons +++ b/xCAT-client/bin/tcons @@ -1,7 +1,7 @@ #!/bin/sh f=1 p=0 -for i in `nodels $1`; do +for i in `nodels "$1"`; do if [ "$f" = 1 ]; then f=0 qdate=$((`date +%s`+5)) diff --git a/xCAT-client/pods/man1/chvm.1.pod b/xCAT-client/pods/man1/chvm.1.pod index 4a52a7a38..615ec1fca 100644 --- a/xCAT-client/pods/man1/chvm.1.pod +++ b/xCAT-client/pods/man1/chvm.1.pod @@ -38,7 +38,7 @@ B I [B<--devdetach> I...] =head2 VMware/KVM specific: -B I [B<-a> I] [B<-d> I] [B<-p> I] [B<--resize> B=I] [B<--cpus> I] [B<--mem> I] +B I [B<-a> I] [B<-d> I] [B<-p> I] [B<--resize> I=I] [B<--cpus> I] [B<--mem> I] =head2 zVM specific: @@ -236,7 +236,7 @@ Set the number of CPUs. =item B<-d> I -Deregister the Hard disk but leave the backing files. Multiple can be done with comma separated values. The disks are specified by SCSI id. Size defaults to GB. +Deregister the Hard disk but leave the backing files. Multiple can be done with comma separated values. The disks are specified by SCSI id. =item B<--mem> I @@ -244,11 +244,11 @@ Set the memory, defaults to MB. =item B<-p> I -Purge the Hard disk. Deregisters and deletes the files. Multiple can be done with comma separated values. The disks are specified by SCSI id. Size defaults to GB. +Purge the Hard disk. Deregisters and deletes the files. Multiple can be done with comma separated values. The disks are specified by SCSI id. -=item B<--resize> B=I +=item B<--resize> I=I -Change the size of the Hard disk. The disk can never be set to less than it's current size. Multiple disks can be resized to I by using comma separated values on the left side of B<=>. The disks are specified by SCSI id. Size defaults to GB. +Change the size of the Hard disk. The disk in I format can not be set to less than it's current size. The disk in I format can be resized smaller, please use caution. Multiple disks can be resized by using comma separated IB<=>I pairs. The disks are specified by SCSI id. Size defaults to GB. =back @@ -640,6 +640,10 @@ Output is similar to: gpok3: Replacing user entry of LNX3... Done +8. To resize virtual machine's disk sdb to 10G and sdc to 15G: + + chvm gpok3 --resize sdb=10G,sdc=15G + =head1 FILES /opt/xcat/bin/chvm diff --git a/xCAT-client/pods/man1/packimage.1.pod b/xCAT-client/pods/man1/packimage.1.pod index 0fa78542c..c3cf60d65 100644 --- a/xCAT-client/pods/man1/packimage.1.pod +++ b/xCAT-client/pods/man1/packimage.1.pod @@ -8,7 +8,7 @@ B B -B I +B [B<-m>|B<--method> I] [B<-c>|B<--compress> I] I =head1 DESCRIPTION @@ -30,13 +30,9 @@ B<-h> Display usage message. B<-v> Command Version. -B<-o> Operating system (fedora8, rhel5, sles10,etc) +B<-m| --method> Archive Method (cpio,tar,squashfs, default is cpio) -B<-p> Profile (compute,service) - -B<-a> Architecture (ppc64,x86_64,etc) - -B<-m> Archive Method (cpio,tar,squashfs, default is cpio) +B<-c| --compress> Compress Method (pigz,gzip,xz, default is pigz/gzip) =head1 RETURN VALUE @@ -51,6 +47,9 @@ B<-m> Archive Method (cpio,tar,squashfs, default is cpio) packimage rhels7.1-x86_64-netboot-compute +2. To pack the osimage rhels7.1-x86_64-netboot-compute with "tar" to archive and "pigz" to compress: + + packimage -m tar -c pigz rhels7.1-x86_64-netboot-compute =head1 FILES diff --git a/xCAT-client/pods/man1/rspconfig.1.pod b/xCAT-client/pods/man1/rspconfig.1.pod index e2f89c4b1..eabf3cb61 100644 --- a/xCAT-client/pods/man1/rspconfig.1.pod +++ b/xCAT-client/pods/man1/rspconfig.1.pod @@ -54,16 +54,12 @@ B I B={[B],[B],[B],[ =head2 FSP/CEC specific: -B I {B|B|B|B|B|B|B|B