update static and schema information

[pve-docs.git] / pvecm.adoc

diff --git a/pvecm.adoc b/pvecm.adoc
index ecddd3768ddf5eaab90d040fdb98dcfa627e123b..cbbcf60fe8e0d55fcd29d98dbbd9f1a73475ec6c 100644 (file)
--- a/pvecm.adoc
+++ b/pvecm.adoc
@@ -327,11 +327,11 @@ After powering off the node hp4, we can safely remove it from the cluster.
 
 ----
  hp1# pvecm delnode hp4
+ Killing node 4
 ----
 
-If the operation succeeds no output is returned, just check the node
-list again with `pvecm nodes` or `pvecm status`. You should see
-something like:
+Use `pvecm nodes` or `pvecm status` to check the node list again. It should
+look something like:
 
 ----
 hp1# pvecm status
@@ -869,6 +869,48 @@ pvecm status
 If you see a healthy cluster state, it means that your new link is being used.
 
 
+Role of SSH in {PVE} Clusters
+-----------------------------
+
+{PVE} utilizes SSH tunnels for various operations.
+
+* Proxying terminal sessions of node and containers between nodes
++
+When you connect another nodes shell through the web interface, for example, a
+non-interactive SSH tunnel is started in order to forward the necessary ports
+for the VNC connection.
+
+* VM and CT memory and local-storage migration, if the cluster wide migration
+  settings are not configured 'insecure' mode. During a VM migration an SSH
+  tunnel is established between the target and source nodes.
+
+* Storage replication
+
+.Pitfalls due to automatic execution of `.bashrc` and siblings
+[IMPORTANT]
+====
+In case you have a custom `.bashrc`, or similar files that get executed on
+login by the configured shell, `ssh` will automatically run it once the session
+is established successfully. This can cause some unexpected behavior, as those
+commands may be executed with root permissions on any above described
+operation. That can cause possible problematic side-effects!
+
+In order to avoid such complications, it's recommended to add a check in
+`/root/.bashrc` to make sure the session is interactive, and only then run
+`.bashrc` commands.
+
+You can add this snippet at the beginning of your `.bashrc` file:
+
+----
+# Early exit if not running interactively to avoid side-effects!
+case $- in
+    *i*) ;;
+      *) return;;
+esac
+----
+====
+
+
 Corosync External Vote Support
 ------------------------------