RHBA-2015:2384 - Bug Fix Advisory

Topic

Updated fence-agents packages that fix multiple bugs and add various enhancements are now available for Red Hat Enterprise Linux 7.

Description

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Bugs fixed:

• The fence_kdump and fence_scsi agents now support the "monitor" action, which enables easier integration with a cluster stack. (BZ#1196068, BZ#1214919)
• The fence agent for Intelligent Platform Management Interface (IPMI) used by default the value of "0" instead of the ipmitool default value of "3", and it was not possible to log in to an IPMI device using default values. This update changes the default value to "3". (BZ#1203877)
• The fence agent for IPMI exposed the password to the log file. The password is no longer included in the created file. (BZ#1241648)
• The "timeout" attribute was not accepted by the fence agent. Now, the attribute is accepted as expected. (BZ#1257137)
• When using an Integrated Lights-Out 2 (iLO2) device with firmware version 2.27, iLO2 negotiation of the TLS protocol did not work properly. Consequently, the user could not connect or log in to the fencing device. With this update, the "--tls1.0" option has been added to the fence_ilo2 command, and TLC can be set without negotiation. (BZ#1256908)
• The fence_rhevm fence agent did not support cookie-based authentication, so user authentication was performed in every request. Now, the user needs to authenticate only once, and then an authentication token is used to minimize impact on Red Hat Enterprise Virtualization Manager (RHEV-M). (BZ#1145769)
• The fence_cisco_ucs fence agent set the URL prefix correctly only with the "--ssl" option. Now, the prefix is set correctly also without "--ssl" when "--ssl-(in)secure" is used. (BZ#1165591)
• The fence_scsi fence agent did not unfence a device if the node was not restarted via a cluster. After such a restart, SCSI reservation keys were no longer stored on the disk. Now, unfencing occurs even when registration keys are installed and fence_scsi can fence as expected. (BZ#1243485)
• The fence agent for HP Brocade switches could not enable and disable ports. (BZ#1274431)

Enhancements added:

• This update adds support for the fence_mpath fence agent, an I/O fencing agent that uses SCSI-3 persistent reservations to control access to multipath devices. See the fence_mpath(8) manual page. (BZ#1102727)
• This update adds support for the fence_emerson fencing agent for Emerson devices over Simple Network Management Protocol (SNMP). It is an I/O fencing agent that can be used with the MPX and MPH2 Emerson devices. See the fence_emerson(8) manual page. (BZ#1171732)
• Fence agents with the "list" action provide a new "list-status" action, which lists all outlets and virtual machines suitable for fencing and adds the power state for each of them. (BZ#1250586)
• Fence agents used only with single devices required complex configuration in pacemaker. Now, it is possible to use the "--port-as-ip" option to enter the IP address in the "port" option. (BZ#1214522)
• The fence_zvmip fence agent, which provides fencing support for IBM z/VM devices, has been added to fence-agents. (BZ#1140921, BZ#1188750)
• The fence_nova_host fencing agent, which provides fencing support for virtual machines using the OpenStack Nova compute service, has been added to fence-agents. (BZ#1241845)
• The fence_hpblade fencing agent now also supports HP Integrity Superdome with BL920s Blade platform. Fencing on this hardware is now fully supported. (BZ#1216997)
• The fence_rsa fencing agent, which provides fencing support for IBM RSA devices, has been added to fence-agents. (BZ#1185329)
• The fence-agents packages now support the fence_ilo_moonshot fence agent for HP Moonshot iLO devices. See the fence_ilo_moonshot(8) manual page. (BZ#1152917)

Solution

Users of fence-agents are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1145769 - [RFE] fence_rhevm should support authentication using cookies
• BZ - 1165591 - fence_cisco_ucs: Protocol prefix of URL is not set correctly with --ssl-(in)secure
• BZ - 1171732 - RFE: Support for Emerson device's MPX and MPH2
• BZ - 1199970 - ilo2 firmware +2.27 does not work with fence_ilo2
• BZ - 1203877 - Default cipher was IPMI was changed
• BZ - 1214359 - [RFE] Add fence_compute to fence-agents package
• BZ - 1214522 - Need 'port' to be an alias for 'ip' for agents that only control a single device
• BZ - 1216997 - [RFE] Support fence agent for HP Integrity Superdome-X with BL920s Blade platform
• BZ - 1241845 - [RFE] Add support for recoding fencing operations in attrd.
• BZ - 1259319 - fence_apc does not work with APC firmware 6.x

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal