[Starlingx-discuss] About configfile patch for redfishtool
Liu, ZhipengS
zhipengs.liu at intel.com
Mon Jul 8 14:08:05 UTC 2019
Hi all,
Let's discuss this topic here. Your comments are welcome!
Thanks!
Zhipeng
-----Original Message-----
From: MacDonald, Eric [mailto:Eric.MacDonald at windriver.com]
Sent: 2019年7月8日 19:41
To: Saul Wold <sgw at linux.intel.com>; Liu, ZhipengS <zhipengs.liu at intel.com>
Cc: Hu, Yong <yong.hu at intel.com>; Rowsell, Brent <Brent.Rowsell at windriver.com>; Eslimi, Dariush <Dariush.Eslimi at windriver.com>; Khalil, Ghada <Ghada.Khalil at windriver.com>; Xie, Cindy <cindy.xie at intel.com>
Subject: RE: About configfile patch
Saul,
Very good points and suggestion. Thank you.
Zhipeng,
Can you put this out to the general starling-x discussion list as well as Redfish discussion list and keep us informed as to how the redfish community is reacting to the change request.
Eric.
> -----Original Message-----
> From: Saul Wold [mailto:sgw at linux.intel.com]
> Sent: Sunday, July 07, 2019 6:42 PM
> To: Liu, ZhipengS; MacDonald, Eric
> Cc: Hu, Yong
> Subject: Re: About configfile patch
> Importance: High
>
>
> Hi Zihipeng, Eric:
>
> I would like to see this move to the general discuss list, I think
> it's appropriate for everyone to understand what's going. Thanks for
> getting the patch proposed to upstream Redfish.
>
> I am concerned first with the technical debt and making sure that the
> Redfish upstream community is aware of what we are proposing / doing
> in StarlingX. I had another look at this and I now have a better idea
> of why it kept being a concern.
>
> 1) processing the config file itself inside of options processing is
> not generally a good idea. It does not allow for easy parsing and extension
> of the config file's contents.
>
> 2) I see you using json, this is good, thanks for proposing it to the
> Redfish community, they might have an idea to use a different format
> for the contents of the config file. This gets the json idea out there
> now rather than finding out in 6 month they they decided to use a
> different format.
>
> 3) As I have mentioned before having plain text passwords is never my
> favorite way to go, but since we are already down that path with IPMI,
> let's keep going, again maybe the RedFish community had thought about
> this or this patch proposal will force that discussion.
>
> My sunday afternoon thoughts.
>
> Sau!
>
>
> On 7/4/19 7:24 PM, Liu, ZhipengS wrote:
> > +Saul and Yong,
> >
> > Hi Saul,
> >
> > Below email thread may give you some clarification about your concern.
> >
> > Zhipeng
> >
> > *From:* Liu, ZhipengS
> > *Sent:* 2019年7月5日 10:20
> > *To:* 'MacDonald, Eric' <Eric.MacDonald at windriver.com>
> > *Subject:* RE: About configfile patch
> >
> > I can see password through
> >
> > ps –n
> >
> > Thanks!
> >
> > Zhipeng
> >
> > *From:* Liu, ZhipengS
> > *Sent:* 2019年7月5日 10:01
> > *To:* 'MacDonald, Eric' <Eric.MacDonald at windriver.com
> > <mailto:Eric.MacDonald at windriver.com>>
> > *Subject:* RE: About configfile patch
> >
> > Hi Eric,
> >
> > Thanks for your clarification!
> >
> > BTW, how to use process listing, could you give me an example? J
> >
> > Zhipeng
> >
> > *From:*MacDonald, Eric [mailto:Eric.MacDonald at windriver.com]
> > *Sent:* 2019年7月4日20:26
> > *To:* Liu, ZhipengS <zhipengs.liu at intel.com
> > <mailto:zhipengs.liu at intel.com>>
> > *Subject:* RE: About configfile patch
> >
> > Hi Zhipeng,
> >
> > See below.
> >
> > Is Saul’s concern the technical debt of the config patch or the pw
> > file in general. Seems the former.
> >
> > What can do, should I speak with him ?
> >
> > Eric.
> >
> > *From:*Liu, ZhipengS [mailto:zhipengs.liu at intel.com]
> > *Sent:* Thursday, July 04, 2019 4:30 AM
> > *To:* MacDonald, Eric
> > *Subject:* About configfile patch
> > *Importance:* High
> >
> > Hi Eric,
> >
> > For configfile patch, Saul still have some concern about it and why
> > we use a password file
> >
> > Anyway, I have submitted patch to upstream.
> >
> > https://github.com/DMTF/Redfishtool/pull/67
> >
> > From code, I can see that MTC get bmc_pw through keyring.
> >
> > */[... Eric ] or barbican now, yes./*
> >
> > Then we pass the bmc_pw through extra_info to ipmi command thread
> >
> > */[... Eric ] Yes/*
> >
> > “The current implementation using IPMITOOL puts the BMC password
> > into a short lived root privilege temp file so that it does not show
> > up in a process listing.”
> >
> > Why we have to use temp file instead of showing up in a process
> > listing? The password can be got through process listing? Not
> > clear about this point.
> >
> > */[... Eric ] If we use the –P <pw> option when invoking ipmitool
> > then while that command is active and someone does a process listing
> > then they can see the –P <pw> on the process listing. This is a
> > security issue because a non-root user can learn the BMC password
> > for any host by just doing a process listing on the active
> > controller./*
> >
> > Could you give me more detail information, thanks!
> >
> > From below code, it seems we have comment related code. Does it
> > means the file may not be removed right away even with the file open.
> >
> > So, still not sure which one is much more safe.
> >
> > */[... Eric ] The temp file is removed in the thread after execution
> > completion or timeout./*
> >
> > */Example code taken from mtcThreads.cpp/*
> >
> > *//*
> >
> > *//*
> >
> > */There is also a garbage collection cleanup audit that ensures
> > these temp files do not linger due to ‘say’ a process restart during
> > command
> > execution./*
> >
> > */[... Eric ] /**//*
> >
> > *//*
> >
> > *
> >
> > * TODO: fix or figure out why the unlink removes the file right away
> > even
> >
> > * with the file open.
> >
> > *
> >
> > ********************************************************************
> > *********/
> >
> > */[... Eric ] The above comment was added simply because when I was
> > coding I didn’t understand why the unlink removes the file right
> > away./*
> >
> > */I think now that it was because the file was not open at the time
> > the unlink was executed./*
> >
> > *//*
> >
> > */In any case the tmp pw file is still removed with redundancy./*
> >
> > int hostUtil_mktmpfile ( string hostname, string basename, string &
> > filename, string data )
> >
> > {
> >
> > // buffer to hold the temporary file name
> >
> > char tempBuff[MAX_FILENAME_LEN];
> >
> > int fd = -1;
> >
> > memset(tempBuff,0,sizeof(tempBuff));
> >
> > if ( basename.empty() || data.empty() )
> >
> > {
> >
> > slog ("%s called with one or more bad parameters
> > (%d:%d)\n",
> >
> > hostname.c_str(), basename.empty(),
> > data.empty());
> >
> > return (0);
> >
> > }
> >
> > /* add what mkstemp will make unique */
> >
> > basename.append("XXXXXX");
> >
> > // Copy the relevant information in the buffers
> >
> > snprintf ( &tempBuff[0], MAX_FILENAME_LEN, "%s",
> > basename.data());
> >
> > // Create the temporary file, this function will
> >
> > // replace the 'X's with random letters
> >
> > fd = mkstemp(tempBuff);
> >
> > // Call unlink so that whenever the file is closed or the program
> > exits
> >
> > // the temporary file is deleted.
> >
> > //
> >
> > // Note: Unlinking removes the file immediately.
> >
> > // Commenting out. Caller must remove file.
> >
> > //
> >
> > // unlink(tempBuff);
> >
> > Thanks!
> >
> > Zhipeng
> >
> > *From:* MacDonald, Eric [mailto:Eric.MacDonald at windriver.com]
> > *Sent:* 2019年7月2日 19:21
> > *To:* Liu, ZhipengS <zhipengs.liu at intel.com
> > <mailto:zhipengs.liu at intel.com>>
> > *Subject:* WolfPass Sensors
> >
> > Hi Zhipeng,
> >
> > I've been upgrading the firmware on our set of WolfPass servers.
> >
> > Even with the upgrade I’ve been having a hard time reading ther
> > server sensors through redfish.
> >
> > Can you send me the command(s) you use and output you see for/when
> > dumping the sensors on your WolfPass server ?
> >
> > I use the following commands on the supermicro but it seems that the
> > wolfpass servers don't support this method.
> >
> > redfishtool -r <BMC IP> -u <bmc username> -p <bmc password> Chassis
> > Thermal
> >
> > redfishtool -r <BMC IP> -u <bmc username> -p <bmc password> Chassis
> > Power
> >
> > Here are the firmware versions I have. I wonder if it’s my SDR version.
> > What is yours ?
> >
> > *WolfPass*
> >
> >
> >
> > *BMC FW*
> >
> >
> >
> > *ME*
> >
> >
> >
> > *SDR*
> >
> >
> >
> > *Redfish Version*
> >
> > WolfPass 1
> >
> >
> >
> > 1.93.870cf4f0
> >
> >
> >
> > 04.00.04.340
> >
> >
> >
> > 1.04
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 2
> >
> >
> >
> > 1.93.870cf4f0
> >
> >
> >
> > 04.00.04.340
> >
> >
> >
> > 1.04
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 3
> >
> >
> >
> > 1.93.870cf4f0
> >
> >
> >
> > 04.00.04.288
> >
> >
> >
> > 1.29
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 4
> >
> >
> >
> > 1.29.7d703f59
> >
> >
> >
> > 04.00.04.288
> >
> >
> >
> > 1.29
> >
> >
> >
> > No Redfish Support
> >
> > WolfPass 5
> >
> >
> >
> > 1.29.7d703f59
> >
> >
> >
> > 04.00.04.288
> >
> >
> >
> > 1.29
> >
> >
> >
> > No Redfish Support
> >
> > WolfPass 6
> >
> >
> >
> > 1.29.7d703f59
> >
> >
> >
> > 04.00.04.288
> >
> >
> >
> > 1.29
> >
> >
> >
> > No Redfish Support
> >
> > WolfPass 7
> >
> >
> >
> > 1.29.7d703f59
> >
> >
> >
> > 04.00.04.288
> >
> >
> >
> > 1.29
> >
> >
> >
> > No Redfish Support
> >
> > WolfPass 8
> >
> >
> >
> > 1.43.660a4315
> >
> >
> >
> > 04.00.04.294
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 9
> >
> >
> >
> > 1.43.660a4315
> >
> >
> >
> > 04.00.04.294
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 10
> >
> >
> >
> > 1.43.660a4315
> >
> >
> >
> > 04.00.04.294
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 11
> >
> >
> >
> > 1.43.660a4315
> >
> >
> >
> > 04.00.04.294
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 12
> >
> >
> >
> > 1.43.660a4315
> >
> >
> >
> > 04.00.04.340
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 13
> >
> >
> >
> > 1.93.870cf4f0
> >
> >
> >
> > 04.00.04.294
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 14
> >
> >
> >
> > 1.93.870cf4f0
> >
> >
> >
> > 04.00.04.294
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 15
> >
> >
> >
> > 1.43.660a4315
> >
> >
> >
> > 04.00.04.340
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 16
> >
> >
> >
> > 1.43.660a4315
> >
> >
> >
> > 04.00.04.294
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > WolfPass 17
> >
> >
> >
> > 1.43.660a4315
> >
> >
> >
> > 04.00.04.294
> >
> >
> >
> > 1.43
> >
> >
> >
> > "RedfishVersion": "1.1.0",
> >
> > Cheers,
> >
> > Eric MacDonald, MTS, Engineering, Wind River
> >
> > direct 613.963.1387 fax: 613.492.7870 skype: eric.r.macdonald
> >
> > 350 Terry Fox Drive, Suite 200, Kanata, ON K2K 2W5
> >
More information about the Starlingx-discuss
mailing list