<html><body bgcolor="#FFFFFF"><div>Hi,</div><div><br></div><div>How nss ldap traffic is doing when the locking time out (default 30 seconds) in /proc/cluster/config/dlm/lock-timeout, when authentication happens from a user/group local to one of the nodes which gets it's KVM locked ?<br><br></div><div>Thanks, --Ahmed</div><div><br>On Mar 5, 2010, at 5:02, Brett Cave <<a href="mailto:brettcave@gmail.com">brettcave@gmail.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div><br><br><div class="gmail_quote">On Fri, Mar 5, 2010 at 12:42 PM, Rudi Ahlers <span dir="ltr"><<a href="mailto:Rudi@softdux.com"><a href="mailto:Rudi@softdux.com">Rudi@softdux.com</a></a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#3333ff"><div class="im">
<br>
<br>
On 2010/03/05 11:59 AM, Brett Cave wrote:
<blockquote type="cite"><br>
<br>
<div class="gmail_quote">On Thu, Mar 4, 2010 at 4:23 AM, Jeff
Karpinski <span dir="ltr"><<a href="mailto:jeff@3d0g.net" target="_blank"><a href="mailto:jeff@3d0g.net">jeff@3d0g.net</a></a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Our
assigned Red Hat engineer was on-site today and pointed out the
blindingly obvious solution. Can't believe I didn't think of it: Run
NFS as a clustered service and have the VMs mount that. That way ANY
system - even outside of the cluster - can also access the data.<br>
</blockquote>
<div><br>
This is what we are doing, works great. We considered presenting the
raw devices from our SAN (fc connectivity instead of iSCSI) to the
VM's, but opted against it due to dynamics of changing # of VM's and
GFS requirements for journals / # of nodes, as well as multicast issues
(each dom0 uses a different routed network for VM's). Each VM mounts
NFS from its host.<br>
<br>
</div>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <br></blockquote></div></blockquote></div></div></blockquote><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#3333ff"><div class="im"><blockquote type="cite"><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
</blockquote>
</div>
</blockquote>
<br>
<br></div>
What kind of security do you apply, both to the NFS cluster, and the
data that get accessed on it?<br></div></blockquote><div><br>heya rudi, never realised u were on this list too ;)<br><br>the exports are controlled by source IP address in /etc/exports. The data on there is not sensitive data at all in our environment, and GFS is all server environment, with no user access... but I just tested using ACLs and it works 100% (added the acl option to gfs mount, and configured using setfacl). We are using ldap network authentication, so works nicely with group permissions ;)<br>
<br>(although we do have 1 luks volume image on the gfs filesystem that is mounted by one of the phy machines using a keyfile stored locally).<br><br> <br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#3333ff">
<pre cols="72">--
Kind Regards
Rudi Ahlers, SoftDux MD
Website: <a href="http://www.SoftDux.com" target="_blank"><a href="http://www.SoftDux.com">http://www.SoftDux.com</a></a>
Blog: <a href="http://Blog.SoftDux.com" target="_blank"><a href="http://Blog.SoftDux.com">http://Blog.SoftDux.com</a></a>
Support: <a href="http://Billing.SoftDux.com" target="_blank"><a href="http://Billing.SoftDux.com">http://Billing.SoftDux.com</a></a>
Office: 087 805 9573
Cell: 082 554 7532
Fax: 086 609 6128</pre>
</div>
<br>--<br>
Linux-cluster mailing list<br>
<a href="mailto:Linux-cluster@redhat.com"><a href="mailto:Linux-cluster@redhat.com">Linux-cluster@redhat.com</a></a><br>
<a href="https://www.redhat.com/mailman/listinfo/linux-cluster" target="_blank"><a href="https://www.redhat.com/mailman/listinfo/linux-cluster">https://www.redhat.com/mailman/listinfo/linux-cluster</a></a><br></blockquote></div><br>
</div></blockquote><blockquote type="cite"><div><span>--</span><br><span>Linux-cluster mailing list</span><br><span><a href="mailto:Linux-cluster@redhat.com">Linux-cluster@redhat.com</a></span><br><span><a href="https://www.redhat.com/mailman/listinfo/linux-cluster">https://www.redhat.com/mailman/listinfo/linux-cluster</a></span></div></blockquote></body></html>