[Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication
Hi, I was playing around with fault components and I noticed that I'm able to query, create and delete alarms with fmClientCli and the fm_core python module. As I understand the `fm` cli (from python-fmclient) creates a request to keystone before connecting to the fm-rest-api to perform the operation. However this is not the case for fmClientCli, I can create an alarm with the following command. $ fmClientCli -c "blabla###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.5432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###" and delete it with: $ fmClientCli -d "###100.114###host=controller-0.ntp" This without doing the `source /etc/platform/openrc`, I'm even allowed to create alarms from a non sysadmin user. The same case with the `fm_core` python module, which links with libfmcommon as fmClientCli does.
fm_core.get_by_eid("host=controller-0") ['c0d94f45-bc6d-4709-9cc6-6a937659c593###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.005432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###']
So, I'm wondering if this an expected behavior or something is missing in libfmcommon to enable authentication. Also, do you know if the fmClientCli tool is really used? Thanks! -Erich
Hi Erich The fmClientCli is not a customer interface and it does not require authentication. This tool is mainly used for debugging/testing and it requires access to a shell session. It is debatable whether this tool should be packaged in the load. The fm cli (from python-fmclient) that requires authentication is the fm shell and it supports the following subcommands: alarm-delete Delete an active alarm. alarm-list List all active alarms. alarm-show Show an active alarm. alarm-summary Show a summary of active alarms. event-list List event logs. event-show Show an event log. event-suppress Suppress specified Event ID's. event-suppress-list List Suppressed Event ID's event-unsuppress Unsuppress specified Event ID's. event-unsuppress-all Unsuppress all Event ID's. Tao -----Original Message----- From: Cordoba Malibran, Erich [mailto:erich.cordoba.malibran@intel.com] Sent: Tuesday, October 15, 2019 5:00 PM To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication Hi, I was playing around with fault components and I noticed that I'm able to query, create and delete alarms with fmClientCli and the fm_core python module. As I understand the `fm` cli (from python-fmclient) creates a request to keystone before connecting to the fm-rest-api to perform the operation. However this is not the case for fmClientCli, I can create an alarm with the following command. $ fmClientCli -c "blabla###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.5432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###" and delete it with: $ fmClientCli -d "###100.114###host=controller-0.ntp" This without doing the `source /etc/platform/openrc`, I'm even allowed to create alarms from a non sysadmin user. The same case with the `fm_core` python module, which links with libfmcommon as fmClientCli does.
fm_core.get_by_eid("host=controller-0") ['c0d94f45-bc6d-4709-9cc6-6a937659c593###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.005432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###']
So, I'm wondering if this an expected behavior or something is missing in libfmcommon to enable authentication. Also, do you know if the fmClientCli tool is really used? Thanks! -Erich _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Bug https://bugs.launchpad.net/starlingx/+bug/1848280 filed for this issue. brucej -----Original Message----- From: Liu, Tao [mailto:Tao.Liu@windriver.com] Sent: Tuesday, October 15, 2019 2:43 PM To: Cordoba Malibran, Erich <erich.cordoba.malibran@intel.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication Hi Erich The fmClientCli is not a customer interface and it does not require authentication. This tool is mainly used for debugging/testing and it requires access to a shell session. It is debatable whether this tool should be packaged in the load. The fm cli (from python-fmclient) that requires authentication is the fm shell and it supports the following subcommands: alarm-delete Delete an active alarm. alarm-list List all active alarms. alarm-show Show an active alarm. alarm-summary Show a summary of active alarms. event-list List event logs. event-show Show an event log. event-suppress Suppress specified Event ID's. event-suppress-list List Suppressed Event ID's event-unsuppress Unsuppress specified Event ID's. event-unsuppress-all Unsuppress all Event ID's. Tao -----Original Message----- From: Cordoba Malibran, Erich [mailto:erich.cordoba.malibran@intel.com] Sent: Tuesday, October 15, 2019 5:00 PM To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication Hi, I was playing around with fault components and I noticed that I'm able to query, create and delete alarms with fmClientCli and the fm_core python module. As I understand the `fm` cli (from python-fmclient) creates a request to keystone before connecting to the fm-rest-api to perform the operation. However this is not the case for fmClientCli, I can create an alarm with the following command. $ fmClientCli -c "blabla###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.5432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###" and delete it with: $ fmClientCli -d "###100.114###host=controller-0.ntp" This without doing the `source /etc/platform/openrc`, I'm even allowed to create alarms from a non sysadmin user. The same case with the `fm_core` python module, which links with libfmcommon as fmClientCli does.
fm_core.get_by_eid("host=controller-0") ['c0d94f45-bc6d-4709-9cc6-6a937659c593###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.005432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###']
So, I'm wondering if this an expected behavior or something is missing in libfmcommon to enable authentication. Also, do you know if the fmClientCli tool is really used? Thanks! -Erich _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
If the decision is to remove the fmClientCli utility from the image, one or two dependencies will also need to be updated (i.e. IMA appraisal failure event is raised using this tool). Tao -----Original Message----- From: Jones, Bruce E [mailto:bruce.e.jones@intel.com] Sent: Tuesday, October 15, 2019 5:58 PM To: Liu, Tao; Cordoba Malibran, Erich; starlingx-discuss@lists.starlingx.io Subject: RE: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication Bug https://bugs.launchpad.net/starlingx/+bug/1848280 filed for this issue. brucej -----Original Message----- From: Liu, Tao [mailto:Tao.Liu@windriver.com] Sent: Tuesday, October 15, 2019 2:43 PM To: Cordoba Malibran, Erich <erich.cordoba.malibran@intel.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication Hi Erich The fmClientCli is not a customer interface and it does not require authentication. This tool is mainly used for debugging/testing and it requires access to a shell session. It is debatable whether this tool should be packaged in the load. The fm cli (from python-fmclient) that requires authentication is the fm shell and it supports the following subcommands: alarm-delete Delete an active alarm. alarm-list List all active alarms. alarm-show Show an active alarm. alarm-summary Show a summary of active alarms. event-list List event logs. event-show Show an event log. event-suppress Suppress specified Event ID's. event-suppress-list List Suppressed Event ID's event-unsuppress Unsuppress specified Event ID's. event-unsuppress-all Unsuppress all Event ID's. Tao -----Original Message----- From: Cordoba Malibran, Erich [mailto:erich.cordoba.malibran@intel.com] Sent: Tuesday, October 15, 2019 5:00 PM To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication Hi, I was playing around with fault components and I noticed that I'm able to query, create and delete alarms with fmClientCli and the fm_core python module. As I understand the `fm` cli (from python-fmclient) creates a request to keystone before connecting to the fm-rest-api to perform the operation. However this is not the case for fmClientCli, I can create an alarm with the following command. $ fmClientCli -c "blabla###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.5432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###" and delete it with: $ fmClientCli -d "###100.114###host=controller-0.ntp" This without doing the `source /etc/platform/openrc`, I'm even allowed to create alarms from a non sysadmin user. The same case with the `fm_core` python module, which links with libfmcommon as fmClientCli does.
fm_core.get_by_eid("host=controller-0") ['c0d94f45-bc6d-4709-9cc6-6a937659c593###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.005432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###']
So, I'm wondering if this an expected behavior or something is missing in libfmcommon to enable authentication. Also, do you know if the fmClientCli tool is really used? Thanks! -Erich _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
participants (3)
-
Cordoba Malibran, Erich
-
Jones, Bruce E
-
Liu, Tao