topic Re: Service-guard problem relating to identd entry in Operating System - HP-UX

Service-guard problem relating to identd entry

Adam Noble — Mon, 12 Nov 2007 06:09:16 GMT

Hi all,

I had a strange issue with one of our service-guard clusters at the weekend and would be grateful for any advice. The servers within the cluster were both patched with a MC bundle. On reboot one server complained that it could not rejoin the cluster as it could not get its configuration data suggesting it was corrupt. The thing is there were messages saying make sure the remote node is running identd. I checked the inetd.conf file on the host unable to join the cluster and sure enough identd was commented out. I uncommented and did an inetd -c and all was then fine.

The problem I have is that I can see from old backups that this entry had been commented out for many months so I have no idea how the cluster was communicating previously!!! Is identd only used a cluster formation?

Any advice would be appreciated!!!

Cheers

Re: Service-guard problem relating to identd entry

Duncan Edmonstone — Mon, 12 Nov 2007 06:19:01 GMT

Adam,

I'm guessing we're talking about HP-UX11.11 and Serviceguard 11.16 here yes?

If so I expect this was as a result of applying a Serviceguard patch as part of the patch bundle you applied.

A patch released in 2004 changed the standard security mechanisms in 11.16 to use identd. This is documented in the patch special installaation instructions, which you should be careful to read.

Read more about the new security odel in these 2 white papers:

http://docs.hp.com/en/6283/SGsecurityfiles.pdf

http://docs.hp.com/en/5874/securingserviceguard_nov2005.pdf

HTH

Duncan

Re: Service-guard problem relating to identd entry

Adam Noble — Mon, 12 Nov 2007 06:24:53 GMT

its actually A.11.15.00 but may explain the issue.

Re: Service-guard problem relating to identd entry

melvyn burnard — Mon, 12 Nov 2007 06:33:39 GMT

SG A.11.15 will require identd after a certain patch level.
Check the patch that was installed and then lok for the special instrucions, it should be documented there

Re: Service-guard problem relating to identd entry

Duncan Edmonstone — Mon, 12 Nov 2007 06:51:48 GMT

Adam,

You are aware that 11.15 is ou of support (and has been since June 2006)?

11.16 is the only supported version on 11.11 now.

HTH

Duncan

Re: Service-guard problem relating to identd entry

Adam Noble — Mon, 12 Nov 2007 06:55:45 GMT

Duncan....well aware!! This is not my call. Anyway you are all right sure enough it was a patch that caused the issue. Much appreciated!!

Re: Service-guard problem relating to identd entry

skt_skt — Tue, 13 Nov 2007 15:01:53 GMT

i had faced the similar problem.SO in addition to enbling identd service; i had appended -i to the following entry on /etc/inetd.conf(that is what i recollect)

hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c -i