@The-Dealman said in RBAC functionality:

@Sebastian-Roth I was able to locate this but it’s kinda hard to tell where you are when you drill down into the role and you want to modify rules. Once I jump into the rules I can’t tell if i’m looking at the rules for just the role I created or if it’s all the default rules for all the roles, it feels like it should be some sort of bread crumb trail on the UI to indicate where you are at the time. Also I deleted the printers from the access control rules main menu as a test and it still shows up at the top menu bar, we are suppose to delete the access control rules we don’t want to show up right?

Sometimes occurs this XD, the problem in this case, I think but I am not very sure, is the order that the events run. One event “paint” the icon and another one “erase” it. The AccessControl plugin “erases” icons but if the “erase” event happens before the “paint” event, the icon appears in the webui XD. Try to add another rule and is probably that the icon desappears.

@The-Dealman said in RBAC functionality:

It would be great if we had some sort of RBAC functionality built into fog, it doesn’t need to be anything complex. My use case is that I have central office IT staff that will have full access to fog, but I have computer technicians at schools that I only want to be able to image computers and not to have access to the web interface. Can this be done?

The AccessControl plugin limits the access to the icons in the WebUI. With this plugin you can define which icons do you want to see in the menu bar and submenus.

You can define roles and rules:

• The roles are group of person, is a 1:N relationship. One role can have N persons but one person can be only in one role.
• The rules define the restrictions, what icons and submenus are not showed by the webui. The rules are asigned to the roles and one rule can be asigned to one or more roles, and viceversa.

With this, you can limit the access to the technicians to, for example, dashboard (is mandatory, if you add this rule the webui crashs), hosts, groups, images, snapin, tasks and logout. The technicioans don’t have access to the FOG configuration menus or storage nodes.

If you use this AccessControl Plugin with Site plugin, you can restrinct the access to the computers. With Site plugin you can asign computers to one Site and assign user to one site or sites, in this way the plugin create a realtionship User -> Site -> Computer. From the User tab you can restrinct the access to one user only to the computers that are in his/her site or sites.

@Tom-Elliott said in Multicast udpcast options:

Also, the recommendation for the max-bitrate issue is it already exists and is based on the Master Storage Node’s bitrate setting. The rexmit-hello-interval should also be added based on the Master storage node (as opposed to global values.)
This is simply because the global value means EVERYTHING that does multicast will use the same rexmit and bitrate settings. Having it per master storage node makes this much more dynamic and site specific.

You are right. Is better have a configuration per node than a global one.

I have done:

#git diff working-1.6…working – schema.php

And return me a lot of changes :( The new line in schema.php will be like this:

// 264
$this->schema[] = array(
    "ALTER TABLE `nfsGroupMembers` ADD COLUMN `ngmHelloInterval` "
    . "VARCHAR(8) AFTER `ngmMaxBitrate`",
);

I define the ngmHelloInterval like string and not like integer.

Hi @Sebastian-Roth,

The new code in the multicasttask.class.php from L418 to L494 is

    public function getCMD()
    {
        unset(
            $filelist,
            $buildcmd,
            $cmd
        );
        list(
            $address,
            $duplex,
            $multicastrdv,
            $maxwait,
            $maxbitrate,
            $rexmithello
        ) = self::getSubObjectIDs(
            'Service',
            array(
                'name' => array(
                    'FOG_MULTICAST_ADDRESS',
                    'FOG_MULTICAST_DUPLEX',
                    'FOG_MULTICAST_RENDEZVOUS',
                    'FOG_UDPCAST_MAXWAIT',
                    'FOG_MULTICAST_BITRATE',
                    'FOG_MULTICAST_HELLO'

                )
            ),
            'value',
            false,
            'AND',
            'name',
            false,
            ''
        );
        if ($address) {
            $address = long2ip(
                ip2long($address) + (
                    (
                        $this->getPortBase() / 2 + 1
                    ) % self::getSetting('FOG_MULTICAST_MAX_SESSIONS')
                )
            );
        }
        $buildcmd = array(
            UDPSENDERPATH,
            (
                $this->getBitrate() ?
                sprintf(' --max-bitrate %s', $this->getBitrate()) :
                null
            ),
            (
                $this->getInterface() ?
                sprintf(' --interface %s', $this->getInterface()) :
                null
            ),
            sprintf(
                ' --min-receivers %d',
                (
                    $this->getClientCount() ?
                    $this->getClientCount():
                    self::getClass('HostManager')->count()
                )
            ),
            sprintf(' --max-wait %s', '%d'),
            (
                $address ?
                sprintf(' --mcast-data-address %s', $address) :
                null
            ),
            (
                $multicastrdv ?
                sprintf(' --mcast-rdv-address %s', $multicastrdv) :
                null
            ),
            sprintf(' --portbase %s', $this->getPortBase()),
            sprintf(' %s', $duplex),
            (
                $maxbitrate ?
                sprintf(' --max-bitrate %s', $maxbitrate) :
                null
            ),
            (
                $rexmithello ?
                sprintf(' --rexmit-hello-interval %s', $rexmithello) :
                null
            ),
            ' --ttl 32',
            ' --nokbd',
            ' --nopointopoint',
        );
        $buildcmd = array_values(array_filter($buildcmd));

I added the $maxbitrate, $rexmithello variables and the options in the $buildcmd and two new global variables: ‘FOG_MULTICAST_BITRATE’ and ‘FOG_MULTICAST_HELLO’.

(
                $maxbitrate ?
                sprintf(' --max-bitrate %s', $maxbitrate) :
                null
            ),
            (
                $rexmithello ?
                sprintf(' --rexmit-hello-interval %s', $rexmithello) :
                null
            ),

Is necessary change the schema.php to add the two new global variables: ‘FOG_MULTICAST_BITRATE’, ‘FOG_MULTICAST_HELLO’. This variables are strings.

Hi @Sebastian-Roth and @Tom-Elliott ,

I have fixed this bug in my server making a little change in hostlogins function.

File: hostmanagementpage.class.php
Line: 3767

Route::listem('UserTracking');

To:

Route::listem('UserTracking',
            array(
                'hostID' => $this->obj->get('id'),
                'action' => array('', 0, 1)
            )
        );

I can push the changes but, maybe is better that Sebastian or Tom do them.

The answer is NO. The AccessControl plugin only restrincts the access in the WEBUI and not in the PXE booting.

@george1421 said in Use an external database:

@Fernando-Gietz said in Use an external database:

I can not say about the performance

I’m considering performance on a FOG system level.

<thinking out loud> There must have been a reason why Fernando made this change. He wouldn’t just make this change for fun?? There must have been some kind of issue with the integrated database to move it external. I wonder if he can tell performance wise the difference.

I only done a proof of concept, use an external database is a solution that is on the table. We wanted to answer the questioni if use an external database is possible. And the answer is YES, and without too much effort.

@Sebastian-Roth said in Use an external database:

@george1421 said in Use an external database:

There must have been some kind of issue with the integrated database to move it external. I wonder if he can tell performance wise the difference.

With 8000 hosts checking into your FOG server I can definitely see database queries being a bottleneck. FOG is not optimized to run in such huge environments (yet). Not saying that it cannot be done but some of the things have not been coded with such amount of clients in mind.

@Fernando-Gietz Which version of FOG do you currently run? I have pushed a couple of changes to the dev-branch (late last year I think) that should help performance wise. Not sure if you are aware of that.

The database is the bottleneck XD. In our case the server can not proccess all the SQL queries, the locks appear in the tables, these locks “lock” the apache server and noting works :( Yesterday the System guys moved the FOG server to a new VMWARE host and the MySQL performance has increased a lot of. But this is a temporal solution, as @Sebastian-Roth says FOG is not optimized for large environments. We have 8000 client in my server but I know an environment with 14000 client XD.

My FOG version is 1.5.5 for working branch, the last version.

@Wayne-Workman the university has a Galera Cluster, in case that we need use an external database, we wiil use an instance in this Galera environment.

Ummm … I can not say about the performance, I follow with my mysql performance problems XD both in one version and in another. I can say that the configuration in 5.5 version is different than 10.3, I have to retuning the my.cfg file.

Hi @george1421,

I tried to do it and worked fine!! You can use an external database changing the both files: /var/www/html/fog/lib/fog/config.class.php adn /opt/fog/.fogsettings.

snmysqluser='<MySQL_user>'
snmysqlpass='<password_of_your_MySQL_user>'
snmysqlhost='<ip_of_your_MySQL_Server>'

I don’t do any fresh install lastly, then I don’t know if the installer asks you about the location of your MySQL server or by default is always localhost. If the installer is not prepare to use an external database, I will suggest to implement this feature in future versions.

I want to take advantage of the occasion to say that the mariadb version, 5.5 is obsolete, I updated it to the last stable version the last month, MariaDB 10.3. Maybe will be interesant to update the installer to install this last version of MariaDB.

Under RedHat 7 the packages are MariaDB-client and MariaDB-server.

Hi @george1421 ,

The configutarion file is .fogsettings in /opt/fog?