cmquerycl and cmcheckconf gives error "" does not support enhanced security"

[jolight]

Warning: Node wbnd2 does not support enhanced security
Error: A cluster is already configured with enhanced security enabled.
One or more nodes in the attempted configuration do not support enhanced security.
cmcheckconf : Unable to verify cluster security.


Any one got this error earlier? verified the cmclnodelist and /etc/hosts file.

[Steven E. Protter]

Shalom,

As I recall node2 needs a cmnodelist file with the same permissions and listing.

In spite of what you post there may be an inconsistency. Perhaps the local DNS server has on inconsistent entry.

Check:
/etc/nsswtich.conf
/etc/resolv.conf
/etc/inetd.conf

SEP

[melvyn burnard · Accepted solution]

What version of Serviceguard and which patch do you have on each node?
use :
what /usr/lbin/cmcld
and check EACH node and compare.
I suspect you have a node that has not got the enhanced securty patch or has it disabled in inetd.conf

[Fabio Ettore]

Hi jolight,

since the October 2004 Serviceguard was hardened:

http://www.docs.hp.com/en/5874/securingserviceguard_nov2005.pdf

You can obtain that level of security by installing SG patch of October 2004 or later. Please follow Melvyn's suggestions to obtain the current installed patches and check that all nodes in cluster have the same SG patch level.

Hope that helps you.

Best regards,
Fabio

[Siju Vadakkan]

check the following :

1. Make sure every node has the /etc/cmcluster/cmclnodelist file in place and
a complete list of hostname/username and IP address/username for all machines in the cluster.

2.
# more /etc/inetd.conf | grep auth
auth stream tcp6 wait root /usr/lbin/identd identd
#

3.
# ll /etc/cmcluster/cmclnodelist
-rw-r--r-- 1 root sys 84 Mar 18 2007 /etc/cmcluster/cmclnodelist

[jolight]

Hi All


First of all sorry for the late reply.

The problem was because of the patch level.
one node was not having the patch PHSS_32660.
I have installed latest patches on both the nodes and now cmquerycl and cmcheckconf commands not showing any security error.

Thank you guys for the solution..

George.

[jolight]

Pls check previous note.