Discuss

discuss@lists.centos.org

34758 discussions

ESXi, KVM or Xen?
by Emmanuel Noobadmin 03 Jul '10

03 Jul '10

Which of these would be the recommended virtualization platform for mainly CentOS guest on CentOS host for running a virtualized mail server? From what I've read, objectively it seems that VMWare's still the way to go although I would had like to go with Xen or KVM just as a matter of subjective preference. VMWare's offering seems to have the best support and tools, plus likely the most matured of the options. Also given their market dominance, unlikely to just up and die in the near future. Xen would had been a possible option except Redhat appears to be focusing on KVM as their virtualization platform of choice to compete with VMWare and Citrix. So maybe Xen support will be killed shortly. Plus the modified xen kernel apparently causes conflict with certain software, at least based on previous incidents where I'd been advised not to use the CentOS xen kernel if not using xen virtualization. KVM would be ideal since it's opensource and would be supported in CentOS as far as can be reasonably foreseen. However, looking at available resources, it seems to have these key disadvantages 1. Poorer performance under load. http://wiki.xensource.com/xenwiki/Open_Topics_For_Discussion?action=AttachF… This 2008 XenSummit paper indicates that it dies on heavy network load as well as when there are more than a few VM doing heavy processing at the same time. But that's two years ago and they weren't using paravirtual drivers it seems. http://vmstudy.blogspot.com/2010/04/network-performance-test-xenkvm-vt-d.ht… This blog testing out Xen/KVM pretty recently. While the loads are not as drastic and neither the difference, it still shows that KVM does lag behind by about 10%. This is a concern since I plan to put storage on the network and the most heavy load the client has is basically the email server due to the volume plus inline antivirus and anti-spam scanning to be done on those emails. Admittedly, they won't be seeing as much emails as say a webhost but most of their emails come with relatively large attachments. 2. Security Some sites point out that KVM VM runs in userspace as threads. So a compromised guest OS would then give intruder access to the system as well as other VMs. Should I really be concerned or are these worries only for extreme situations and that KVM is viable for normal production situations? Are there other things I should be aware of?

7 7

Help: Please help me size my server requirements
by Sanjay Arora 03 Jul '10

03 Jul '10

I am looking to build a Workgroup Server. (Should be compatible/certified with both XEN & VMware hypervisors, as I am not sure which one I will settle with...comments requested) To run baremetal on hypervisor, with each of the following services running virtualized with minimum OS install (CentOS 5.x, latest stable release). - Multi-homed router-cum-border firewall (Access to Network Card limited to this instance...will act as router for rest of virtual machines). - DNS Server (djbDNS). - Mail Server (Qmail). - News Server (INN). - Webserver (Apache). - RDBMS (postgreSQL...highest load). In addition to above the server to provide Windows RDP &/or Linux Desktop Thinclient to 5 users running diskless thin clients or old desktops (second highest load). Server to have adequate amount of memory for the above and 500 GB/1 TB RAID 5 or better using SATA disks. What Server Specs. I am looking at? I understand DB load is major in this but assuming moderate to medium db load, what do I need. Will seperate the server & Thinclient server six months/year down the road. What budget? Recommendations for a processor/motherboard/ram/disks/sata card? With best regards and thanks in advance. Sanjay Arora.

1 0

kvm as non-root user
by David McGuffey 03 Jul '10

03 Jul '10

Tried as I might, I cannot get kvm on CentOS 5.4 to run as a non-root user. Have Googled and followed guidance I've found (put the regular user in the kvm group, change permissions on several files, etc.). Anyone have decent (e.g., working) guidance on how to do this? Dave M

2 3

Windows 2003 AD, Winbind, Kerberos and NFSv4
by James A. Peltier 03 Jul '10

03 Jul '10

Hi All, I'm having a bit of difficulty getting a CentOS 5.5 Kerberized NFSv4 server working. This server is configured as a Winbind client to a Windows 2003 Active Directory. I've successfully bound it to AD and I am able to authenticate. I've successfully created a NFSv4 entry in /etc/exports to export the /exports directory and I can successfully mount a non-Kerberized NFSv4 mount on a client machine. I now want to take it to the next step and add Kerberos and it doesn't seem to be working for me. Below are my configurations and the steps I performed. Fresh install of CentOS 5.5. Non-Kickstarted. Wanted to get it working manually first. Used the First Boot Authentication Wizard to configure Winbind Support for User Information. Configured Winbind and Kerberos under the Authentication Tab Checked Local auth is sufficient and Create home directories under options The computer successfully joins the domain and appears in the Computer container in AD. Below is the extract from /etc/samba/smb.conf for authconfig plus what I changed, everything else is stock. I disabled the firewall and SELinux is running in permissive mode on both the test server and test client. #======================= Global Settings ===================================== [global] #--authconfig--start-line-- # Generated by authconfig on 2010/07/01 18:32:54 # DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--) # Any modification may be deleted or altered by authconfig in future workgroup = MY.AD.NAME password server = MY.AD.SERVER realm = MY.AD.NAME security = ads idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 template shell = /bin/bash #--authconfig--end-line-- #-- my additions/changes-start -- template homedir = /home/%U winbind use default domain = true winbind offline logon = true winbind nested groups = true winbind refresh tickets = true use spnego = yes use kerberos keytab = yes #-- my additions/changes-end -- It also created an appropriate, I believe, /etc/krb5.conf to which I removed only the .example.com stuff resulting in the following file. [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = MY.AD.NAME dns_lookup_realm = false # with and without true tried for these dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes [realms] MY.AD.NAME = { kdc = MY.AD.SERVER admin_server = MY.AD.SERVER kdc = MY.AD.SERVER } [domain_realm] my.ad.name = MY.AD.NAME .my.ad.name = MY.AD.NAME [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } If I log into this host I am properly issued a Kerberos ticket from AD so it would appear that Kerberos is working properly [jpeltier@oak ~]$ ssh aconite klist jpeltier@aconite's password: klist: You have no tickets cached Ticket cache: FILE:/tmp/krb5cc_16777216_ltvWwy Default principal: jpeltier(a)MY.AD.NAME Valid starting Expires Service principal 07/02/10 10:46:43 07/02/10 20:46:43 krbtgt/MY.AD.NAME(a)MY.AD.NAME renew until 07/02/10 20:46:43 Kerberos 4 ticket cache: /tmp/tkt16777216 [jpeltier@oak ~]$ Now I configured NFSv4 exports on the server /exports *(rw,fsid=0) Edited /etc/sysconfig/nfs to change # Set to turn on Secure NFS mounts. #SECURE_NFS="yes" to # Set to turn on Secure NFS mounts. SECURE_NFS="yes" restarted NFS service and it appears as an export [root@aconite ~]# /etc/init.d/nfs restart Shutting down NFS mountd: [ OK ] Shutting down NFS daemon: [ OK ] Shutting down NFS quotas: [ OK ] Shutting down NFS services: [ OK ] Shutting down RPC svcgssd: [ OK ] Starting RPC svcgssd: [ OK ] Starting NFS services: [ OK ] Starting NFS quotas: [ OK ] Starting NFS daemon: [ OK ] Starting NFS mountd: [ OK ] [root@aconite ~]# exportfs /exports <world> [root@aconite ~]# To support NFSv4 with Kerberos security, we also need to generate service principal for NFS: [root@aconite ~]# net -U administrator ads keytab add nfs which then looks like this [root@aconite ~]# klist -k Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 3 host/aconite.my.ad.name(a)MY.AD.NAME 3 host/aconite.my.ad.name(a)MY.AD.NAME 3 host/aconite.my.ad.name(a)MY.AD.NAME 3 host/aconite(a)MY.AD.NAME 3 host/aconite(a)MY.AD.NAME 3 host/aconite(a)MY.AD.NAME 3 ACONITE$(a)MY.AD.NAME 3 ACONITE$(a)MY.AD.NAME 3 ACONITE$(a)MY.AD.NAME 3 nfs/aconite.my.ad.name(a)MY.AD.NAME 3 nfs/aconite.my.ad.name(a)MY.AD.NAME 3 nfs/aconite.my.ad.name(a)MY.AD.NAME 3 nfs/aconite(a)MY.AD.NAME 3 nfs/aconite(a)MY.AD.NAME 3 nfs/aconite(a)MY.AD.NAME Test on the client [root@celastrina ~]# showmount -e aconite Export list for aconite: /exports * [root@celastrina ~]# mount -t nfs4 aconite:/ /mnt [root@celastrina ~]# mount |grep -i nfs4 aconite:/ on /mnt type nfs4 (rw,addr=199.60.1.84) [root@celastrina ~]# So as you can see everything is now working *without* Kerberos. However, if I change the /etc/exports file on aconite to [root@aconite ~]# cat /etc/exports /exports gss/krb5(rw,fsid=0) [root@aconite ~]# exportfs /exports gss/krb5 and then try to mount with the -o sec=krb5 on the client [root@celastrina ~]# mount -t nfs4 -o sec=krb5 aconite:/ /mnt mount.nfs4: Permission denied and the entry in /var/log/messages on celastrina is Jul 2 11:21:57 celastrina rpc.gssd[3302]: Using keytab file '/etc/krb5.keytab' Jul 2 11:21:57 celastrina rpc.gssd[3302]: WARNING: Failed to obtain machine credentials for connection to server aconite.my.ad.name nothing appears in the logs on aconite. If you've been kind enough to read this entire thread could you be kind enough to let me know what I am missing or doing wrong? It seems so close now that I can taste it, but this one last piece doesn't seem to want to fall into place. :( -- James A. Peltier Systems Analyst (FASNet), VIVARIUM Technical Director HPC Coordinator Simon Fraser University - Burnaby Campus Phone : 778-782-6573 Fax : 778-782-3045 E-Mail : jpeltier(a)sfu.ca Website : http://www.fas.sfu.ca | http://vivarium.cs.sfu.ca http://blogs.sfu.ca/people/jpeltier MSN : subatomic_spam(a)hotmail.com TEAMWORK There's power in numbers. Learn to work together.

3 4

File sharing solution
by Jussi Hirvi 02 Jul '10

02 Jul '10

I would like to offer my isp clients a solution for sharing (big) files, basically on one-to-one basis. This is how I imagine it: - an anonymous or registered user can upload a file - on response (s)he will get a file-specific (or batch-specific) username/password - (s)he can send a link and un/pw by email - the receiver can download the file - the file will be automatically deleted from the server in n days There must exist an opensource solution for this, but I could not find it by google. Where to look for it? - Jussi -- Jussi Hirvi * Green Spot Topeliuksenkatu 15 C * 00250 Helsinki * Finland Tel. +358 9 493 981 * Mobile +358 40 771 2098 (only sms) jussi.hirvi(a)greenspot.fi * http://www.greenspot.fi

2 2

NIC config documentation?
by Les Mikesell 01 Jul '10

01 Jul '10

Does anyone have a favorite howto or other succinct document that that describes how to set up networking on a multi-nic host when you don't know ahead of time which nic is which? I usually muddle through it by plugging in one wire at a time, using mii-tool to see which link is up, then ifconfig on that interface to get the HWaddr to put in the corresponding /etc/sysconfig/network-scipts/ifcfg-eth? file. But now I need to train some other people how to do it and it seems like there should be a better way. -- Les Mikesell lesmikesell(a)gmail.com

1 0

Firefox slower on GMail since update to CentOS 5.5
by Mathieu Baudier 01 Jul '10

01 Jul '10

Hello, since I upgraded from CentOS x86_64 5.4 to 5.5, I noticed that Firefox has become significantly slower on GMail (or Google Apps Mail). The page becomes slow to scroll as soon as there are more than a few mails in a conversation (like in a typical CentOS mailing list thread). Did anyone else notice that as well? (I guess that I'm not the only GMail user around) Could I have missed something / do something wrong? More details: - I did a fresh install from the 5.5 install DVD, keeping only the home directories - I'm using the Nvidia driver from elrepo (but I had the pb also with the default driver) Cheers, Mathieu

8 20

Anyone seen the Adobe update?
by m.roth＠5-cent.us 01 Jul '10

01 Jul '10

Well, here it is, the day after the Adobe update was announced, and they say that I should go for 9.3.3... but there's still no update visible to yum. Anyone have an ETV on this? mark

1 0

GNBD/LVM problem
by Kwan Lowe 01 Jul '10

01 Jul '10

Hello all: I'm having a strange problem with GNBD and LVM on two fully updated CentOS 5.5 x86_64 systems. On node1, I have exported a gnbd volume. lvcreate -L 500M -n mirrortest_lv01 mirrorvg gnbd_serv gnbd_export -d /dev/mirrorvg/mirrortest_lv01 -e node1_lv01 On node2 I have imported the volume: gnbd_import -i node1 Next, on node2 I attempt to create a mirrored LV with the imported GNBD volume and a local disk: fdisk /dev/gnbd/node1_lv01 then create an LVM partition fdisk /dev/sdb then create an LVM partition I can then create a volume group with those two disks: pvs vgcreate mirrorvg /dev/sdb1 /dev/gnbd0 The problem occurs when I try to create a mirrored LV using the above VG. [root@vm-helios-002 ~]# lvcreate --mirrorlog core -L 256M -n mirroredlv01 -m 1 mirrortestvg Insufficient suitable allocatable extents for logical volume : 64 more required Unable to allocate extents for mirror(s). It doesn't matter what disk sizes are available. Even creating a non-mirrored LV causes issues: [root@vm-helios-002 ~]# lvcreate -L 256M -n mirroredlv01 mirrortestvg Error locking on node 192.168.8.152: device-mapper: create ioctl failed: Device or resource busy Error locking on node 192.168.8.151: Volume group for uuid not found: xCTR5M2kOEBiLM7eSRntez2y2VKy9vvqnSs6LTC99x9kIsAdNI2l8CH90h6BYKsH Aborting. Failed to activate new LV to wipe the start of it. [root@vm-helios-002 ~]# The other issue that's occurring is that even if I remove the GNBD PV from the mirrortestvg, it still gives the error (i.e., using just local disk). Not sure where to look at this point. I suspect it has something to do with the cluster locking, but the configuration is really basic and specifies no clustered volumes.

1 0

RHEL 6b2 Release
by b.j. mcclure 01 Jul '10

01 Jul '10

For those who might be interested, RHEL 6b2 has just been announced. http://www.redhat.com/rhel/beta Cheers, B.J. CentOS 5.5, Linux 2.6.18-194.3.1.el5 x86_64 10:47:08 up 8 days, 14:45, 1 user, load average: 0.56, 0.55, 0.49

5 5

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss