xCAT + BMC(IPMI) = лыжи не едут

root@xcatmn:/home/worker# mkdef -t node groups=all,x86_64 --template x86_64-template mgt=openbmc cons=openbmc bmc=192.168.0.220 bmcusername=root bmcpassword=0penBmc ip=10.0.0.1 cn1

1 object definitions have been created or modified.

root@xcatmn:/home/worker# lsdef cn1
Object name: cn1
    arch=x86_64
    bmc=192.168.0.220
    bmcpassword=0penBmc
    bmcusername=root
    cons=openbmc
    getmac=ipmi
    groups=all,x86_64
    ip=10.0.0.1
    mgt=openbmc
    netboot=xnba
    postbootscripts=otherpkgs
    postscripts=syslog,remoteshell,syncfiles
    serialport=0
    serialspeed=115200
    usercomment=the system X node definition

root@xcatmn:/home/worker# rpower cn1 status
Error: [xcatmn]: openbmc plugin bug, pid 22399, process description: 'xcatd SSL: rpower to cn1 for root@localhost6: openbmc instance' with error 'malformed JSON string, neither tag, array, object, number, string or atom, at character offset 0 (before "Not Found") at /opt/xcat/lib/perl/xCAT_plugin/openbmc.pm line 2558.
' while trying to fulfill request for the following nodes: cn1

my $ipmiv2       = 0;
...
if ($sessdata->{ipmisession}->{ipmiversion} eq '2.0') {
        $ipmiv2 = 1;
    }

bmcdiscover --range 192.168.0.220 -u root -p 0penBmc -z -w
Warning: [xcatmn]: No bmc found.

root@xcatmn:/home/worker# tabdump ipmi
#node,bmc,bmcport,taggedvlan,bmcid,username,password,comments,disable
"cn1","192.168.0.220",,,,"root","0penBmc",,

root@xcatmn:/home/worker# chdef cn1 bmcid="cn1"
Error: [xcatmn]: 'bmcid' is not a valid attribute name for an object type of 'node'.
Error: [xcatmn]: Skipping to the next attribute.
Error: [xcatmn]: One or more errors occured when attempting to create or modify xCAT object definitions.

root@xcatmn:/home/worker# rpower cn1 status
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm

Disable MD5 authentication in the cipher list using the site table keyword xcatsslciphers.

Check if MD5 is already disabled: tabdump site | grep xcatssl
If nothing is set, add ALL:!MD5 to the cipher list: chtab key=xcatsslciphers site.value='ALL:!MD5'
Restart xcat: service xcatd restart

"xcatsslciphers","kDH:kEDH:kRSA:!SSLv3:!SSLv2:!aNULL:!eNULL:!MEDIUM:!LOW:!MD5:!EXPORT:!CAMELLIA:!ECDH",,

$cmdref->{cwd}->[0] = cwd();

root@xcatmn:/opt/xcat/bin# rpower cn1 status -V
12345678cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: timeout

warning: the client certificates under /home/worker/.xcat/ are not setup correctly, please run '/opt/xcat/share/xcat/scripts/setup-local-client.sh worker' as 'root' to generate the client certificates; otherwise, the SSL connection between xcat client and xcatd will be setup without certificate verification and open to Man-In-The-Middle attacks.
Error: Permission denied for request

sudo /opt/xcat/share/xcat/scripts/setup-local-client.sh worker
[sudo] password for worker: 
Generating RSA private key, 2048 bit long modulus (2 primes)
................+++++
.+++++
e is 65537 (0x010001)
Using configuration from openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 5 (0x5)
        Validity
            Not Before: Jan  1 01:01:01 1960 GMT
            Not After : Sep 24 08:32:36 2042 GMT
        Subject:
            commonName                = worker
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: 
                Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication
            Netscape Cert Type: 
                SSL Client, S/MIME, Object Signing
            Netscape Comment: 
                OpenSSL Generated Client Certificate
            X509v3 Subject Key Identifier: 
                97:54:89:74:31:98:5E:3A:F5:E2:5B:3A:21:97:7C:24:E7:6E:6A:6C
            X509v3 Authority Key Identifier: 
                keyid:C3:2D:84:C5:58:AA:EE:9E:86:28:5E:F2:BA:02:4D:BC:6C:0D:DF:AF

Certificate is to be certified until Sep 24 08:32:36 2042 GMT (7300 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

worker@xcatmn:~$ /opt/xcat/bin/rpower cn1 status
Error: Permission denied for request

worker@xcatmn:~$ sudo /opt/xcat/bin/rpower cn1 status
12345678cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: timeout

#!/usr/bin/env perl
# IBM(c) 2007 EPL license http://www.eclipse.org/legal/epl-v10.html

# Used as a standard client cmd that can be used for many of the xcat cmds.
# It grabs the arguments, noderange, and stdin and then submits the request to
# xcatd and waits for responses.  Most of the client/server communication is
# contained in Client.pm.

# To use this, sym link your cmd name to this script.
BEGIN { $::XCATROOT = $ENV{'XCATROOT'} ? $ENV{'XCATROOT'} : -d '/opt/xcat' ? '/opt/xcat' : '/usr'; }
use lib "$::XCATROOT/lib/perl";
print " 1";
use Cwd;
#use IO::Socket::SSL;
#use IO::Socket::INET;
print " 2";
use File::Basename;
print " 3";
#use Data::Dumper;
use xCAT::Client;
print " 4";
use strict;
print " 5";
my $bname = basename($0);
print " 6";
my $cmdref;
print " 7";
if ($bname =~ /xcatclient/) { $cmdref->{command}->[0] = shift @ARGV; } # xcatclient was invoked directly and the 1st arg is cmd name that is used to locate the plugin
else { $cmdref->{command}->[0] = $bname; } # the cmd was sym linked to xcatclient
print " 8";
my $my_cwd = cwd();
print " 9 my_cwd=" . $my_cwd;
$cmdref->{cwd}->[0] = $my_cwd;
print " 10";
my $data;
print " 11";
# allows our plugins to get the stdin of the cmd that invoked the plugin
if ((($^O =~ /^linux/i) && ($ENV{'SHELL'} =~ /\/ksh$/)) || !defined($ENV{'TERM'}))
{
    my $rin = "";
    my $rout;
    vec($rin, fileno(STDIN), 1) = 1;
    my $nfound = select($rout = $rin, "", "", 1);
    if ($nfound)
    {
        while (<STDIN>) { $data .= $_; }
        $cmdref->{stdin}->[0] = $data;
    }
}
else
{
    if (-p STDIN) {
        while (<STDIN>) { $data .= $_; }
        $cmdref->{stdin}->[0] = $data;
    }
}

print " 12";
my $arg;
my @tmpargv = @ARGV;

# lslite needs to handle imagename besides noderange
# so do not fill {noderange} if imagename given
my $str = join(',', @tmpargv);
print " 13";
if (($bname =~ /lslite/) && $str =~ /-i/)
{
    $arg = "NO_NODE_RANGE";
}
else
{ # Consider the 1st non-hyphen arg to be the noderange.  All others (before and after) go on the arg list.
    $arg = shift(@ARGV);
    while ($arg =~ /^-/) {
        push(@{ $cmdref->{arg} }, $arg);
        $arg = shift(@ARGV);
    }
}
print " 14";
if ($arg ne "NO_NODE_RANGE") {

    # The noderange can be specified through a noderange file,
    # the noderange file can be a relative path,
    # convert the relative path to a full path.
    # an ideal way is converting the relative path in xCAT::Noderange::noderange,
    # but the existing xCAT::Noderange::noderange can not get the cwd(),
    # needs to change all the callers to pass the cwd(),
    # there are more than 100 callers.
    my @tempnr = ();
    foreach my $nr (split(/,/, $arg)) {
        if ($nr =~ /^\^(.*)$/) {
            my $nrf = $1;
            if ($nrf !~ /^\//) {    #relative path
                $nrf = Cwd::abs_path($nrf);
            }
            $nrf = "\^" . $nrf;
            push @tempnr, $nrf;
        } else {
            push @tempnr, $nr;
        }
    }
    $arg = join(',', @tempnr);
    $cmdref->{noderange}->[0] = $arg;
}
print " 15";
if (@ARGV) {
    push(@{ $cmdref->{arg} }, @ARGV);
}
print " 16";
foreach (keys %ENV) {
    if (/^XCAT_/) {
        $cmdref->{environment}->{$_} = $ENV{$_};
    }
}
print " 17";
# Allow to print server information when -V/--verbose
foreach (reverse(@ARGV)) {
    if ($_ eq '-V' || $_ eq '--verbose') {
        $ENV{'XCATSHOWSVR'} = 1;
        last;
    }
}

print " 18";
xCAT::Client::submit_request($cmdref, \&xCAT::Client::handle_response);
print " 19";
exit $xCAT::Client::EXITCODE;

root@xcatmn:/home/worker# rpower cn1 status
 1 2 3 4 5 6 7 8cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: Invalid authentication algorithm
cn1: [xcatmn]: Error: ERROR: timeout
 9 my_cwd=/home/worker 10 11 12 13 14 15 16 17 18 19root@xcatmn:/home/worker# 

my $pre_cmd = "$IPMIXCAT -H $bmc_addr -I lanplus -C 17 -U $bmc_userid";

worker@xcatmn:~$ /opt/xcat/bin/rpower cn1 status
 0 1 2 3 4 5 6 7 8Error: Permission denied for request
 9 my_cwd=/home/worker 10 11 12 13 14 15 16 17 18 19worker@xcatmn:~$

print " 18";
exit 0;
xCAT::Client::submit_request($cmdref, \&xCAT::Client::handle_response);

root@xcatmn:/opt/xcat/bin# rpower cn1 status
 0 1 2 3 4 5 6 7 8 9 my_cwd=/opt/xcat/bin 10 11 12 13 14 15 16 17 18root@xcatmn:/opt/xcat/bin#