From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ryan O'Hara Date: Mon, 23 Feb 2009 14:24:13 -0600 Subject: [Cluster-devel] unfencing In-Reply-To: <20090223190958.GD12791@redhat.com> References: <20090220214431.GC23911@redhat.com> <1235370440.7816.209.camel@cerberus.int.fabbione.net> <20090223181530.GB12791@redhat.com> <1235413889.7816.256.camel@cerberus.int.fabbione.net> <20090223184030.GC12791@redhat.com> <1235415175.7816.261.camel@cerberus.int.fabbione.net> <20090223190958.GD12791@redhat.com> Message-ID: <20090223202413.GC14849@redhat.com> List-Id: To: cluster-devel.redhat.com MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit On Mon, Feb 23, 2009 at 01:09:58PM -0600, David Teigland wrote: > On Mon, Feb 23, 2009 at 07:52:55PM +0100, Fabio M. Di Nitto wrote: > > What can stop a user to run fence_node -U from another node to do remote > > (un)fencing? > > It would work. Users can do anything they like, that's beside the point. It would not work for scsi reservations. With scsi reservations, an unfence operation is as simple a registering with the device(s). It cannot be done remotely. A registration exists on an "IT nexus"; the relationship between initiator and target. Bottom line is that a remote node cannot register another node --- the registration (sg_persist command) has to be run on the node that wants to "unfence" itself.