Vinícius Ferrão
0d6929c427
Six modules wrote passwords to their own log and diagnostic messages, outside the daemon redaction pipeline. The z/VM plugin logged each smcli command line through printSyslog, with the disk read, write and multi passwords, the image password, the provision root password and the page volume parm disk password, passed the real disk passwords to checkSSH_Rc, which echoes the command to syslog and to the client on failure, and logged raw directory entries whose USER and MDISK statements carry the logon and disk passwords. The bmcconfig plugin logged the BMC password in its attribute report, in syslog and in the command response. The energy plugin logged the HCP password in a verbose message, and the CIM utilities dumped the whole HTTP request, with its basic authorization header, to the verbose callback. The PPC configuration module logged the HMC, FSP and BPA passwords in its verbose credential reports. Mask the passwords in the logged text. The executed commands keep the real values. The page volume log string is built by operand position, so a decoy value in another operand cannot divert the mask. The checkSSH_Rc calls receive the masked command string, as the routine documentation asks. Add redact_directory_entry to the z/VM utilities. The routine masks the USER, IDENTITY and IDENT logon password, the MDISK passwords after the access mode in the range form and in the DEVNO, V-DISK and T-DISK forms, the APPCPASS statement, and the keyword password assignments in the short and the full spelling. The match separators stay on one line, so a record without passwords never masks the record below it, and one or more comment stars do not hide a credential record from the rules. The COMMAND statement masks whole, because it can start any CP command with an inline password. Every directory query sink logs through it, and the clone loops redact the query output at the source, because the failure checker and the retained disk list reuse the text. The directory helpers keep their raw return value for the callers and hand a redacted copy to the failure checker. Every error branch that echoes a fetched record after the output check does so through the redactor, because a password can spell an error word and trip the check: the directory fetch, the mini disk keyword fetch, and the four disk list callers. The CIM dump masks the authorization header. The bmcconfig report now names the password state, set or missing, which the report needs for diagnosis.
xCAT
xCAT is a toolkit for deployment and administration of clusters of all sizes.
The xCAT sunset was only a quick eclipse
Dear xCAT Community,
The xCAT sunset has changed course. VersatusHPC has been invited to join the xCAT Consortium, and future development will move toward direct upstream contributions coordinated with the Consortium and its existing member companies.
That matters most for Enterprise Linux 10 (EL10). EL10 support is coming to xCAT, restoring a future operating-system path for sites that still rely on xCAT. This is an important change from the previous sunset guidance, where the lack of an EL10 path was one of the strongest reasons to move away from xCAT.
The xCAT Consortium continues to recommend Confluent as the long-term successor to xCAT, and that remains the Consortium position. Users planning new cluster-management deployments should evaluate Confluent and its xCAT comparison documentation.
At the same time, xCAT is no longer sunsetted. The Consortium and participating companies will continue updating xCAT while there is community and user demand for it.
In summary:
- xCAT development is continuing upstream through the Consortium and participating companies.
- Enterprise Linux 10 support is coming.
- Confluent remains the Consortium-recommended successor and migration path.
- xCAT updates will continue while there is community and user demand.
We want to thank the xCAT Consortium and community for keeping this project moving. The sun went behind the moon for a moment, but xCAT is still here.
For more information on Confluent and how to get started, please visit the Confluent: Project Page, Documentation or Confluent vs xCAT comparison.
With thanks,
The xCAT Consortium
Documentation
xCAT Documentation is hosted on Read The Docs: https://xcat-docs.readthedocs.io
Status
| xCAT Version | Build Status |
|---|---|
| Latest (master branch) | |
| Stable (latest release) |
Looking for older versions?
Open Source License
xCAT is made available under the EPL license: https://opensource.org/licenses/eclipse-1.0.php
Developers
Want to help? Check out the developers guide!