MC/SG and trusted mode

[Enrico Venturi]

Hello colleagues,
someone told me that MC/SG isn't fully compatible with the HP-UX configured in trusted mode.

Is it true?
What does it happen exactly?

regards
Enrico

[Geoff Wild]

There seems to be quite a lot on this in the forums:

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0xf5a33a1c04ffd61190050090279cd0f9%2C00.html&admit=716493758+1068212930619+28353475

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0xecb1afe90f1cd71190050090279cd0f9%2C00.html&admit=716493758+1068212975260+28353475

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0x25f2cdec06f1d61190050090279cd0f9%2C00.html&admit=716493758+1068212988487+28353475


Rgds...Geoff

[melvyn burnard]

I would suggest you reply to that person saying that it does work fine with the nodes configured as Trusted Nodes.

[Marco Santerre]

Having enabled Trusted Mode on my Service Guard nodes, I can attest that it does work fine.

[Thomas Schler_1]

Enrico,

I, also, can tell you that we have MC/SG running on two nodes in trusted mode without any problem. It's really fine.

[Jeff Schussele]

Hi Enrico,

Being in Trusted mode or not has no impact on MC/SG.
But I've seen application SW that can be impacted by the conversion, so check the SW before converting.

Rgds,
Jeff

[Rainer von Bongartz]

Enrico,

I have MC/SG running on one cluster with both nodes trusted without any problem.

I even have another cluster with one trusted and one not-trusted node.

Regards
Rainer

[Uday_S_Ankolekar]

Service guard works well with Trusted servers, I have configured cluster with such environment and so far no problem.
Well, if you have any specific problem then let forum know about this.


-USA..

[aparna challagulla]

Hi Enrico,

All our production servers(hp-ux 11i) are MCSG two node clusters and both the nodes are trusted.
We have never had any issues with this configuration.
So its not true.

HTH
aparna

[Stephen Doud · Accepted solution]

UXSGKBAN00000032
What security versions are compatible with MC/ServiceGuard?


Trusted Systems security levels are ranked from strongest A - verified, B -
mandatory, C - discretionary, D - minimal with subrankings in each category.
C2 is not "high" security by U.S. government standards: levels A and B
provide greater security. However, C2 is a high rating for business computing
products.

--Supported HP-UX Releases--
Serviceguard is supported on HP-UX 10.20, 11.0, 11.11, 11i v1.6 and 11i v2.
Serviceguard is not supported with the B-Level Security (BLS) and
Compartmented Mode Workstation (CMW) versions of HP-UX.
Serviceguard does support the C2 security option (Trusted Systems)
enabled on standard HP-UX 10.x and 11.x releases.

HP-UX IPsec - Version A.01.07 contains the following new features:
HP-UX IPSec can secure MC/ServiceGuard clusters (MC/ServiceGuard version
A.11.14 and A.11.15). HP-UX IPSec includes a script that monitors HP-UX
IPSec availability, and you can configure this script as a package service
so a package will failover if HP-UX IPSec is unavailable. HP-UX IPSec also
works with the MC/ServiceGuard local link failover feature.

IPSEC: Available on all hardware platforms supporting HP-UX 11.0 and beyond
(except HP-UX 11.20 and HP-UX 11i version 1.6). Also supported on VVOS
11.04 (Virtual Vault). NOTE: HP-UX IPSec version A.01.07 is supported
on HP-UX 11i version 1 only. Version A.01.06 is supported on HP-UX 11i
version 2 only. If you want to install HP-UX IPSec on an HP-UX 11.0 or
11.04 system, you must download version A.01.05.


--HP-UX 10.20--
Only the HFS file system can support the C2 level security because the 10.20
implementation of JFS (Journal File System) does not support ACL's (Access
Control Lists)

--HP-UX 11.00, 11i--
11.00 (with JFS 3.3 patches) and 11.11 (11i) JFS 3.3 support ACLS on a VxFS root
file system. Hence, C2 level security works on a VxFS root file system.

### END ###
-Stephen Doud