MCSG & ident

[Doug O'Leary]

Hey;

I ran into this little issue twice while trying to update a cluster configuration. The error that I received, both times, is as follows:

# cmrunnode
Error: Fail to load data from configuration database.
Internal error: Unable to open communications to configuration daemon: Not owner
Error: Unable to connect to configuration database.
cmrunnode : Unable to determine the nodes on the current cluster
cmrunnode : Either no cluster configuration file exists, or the file is corrupted, or cmclconfd is unable to run

The first time it was pretty easy to fix. Examining the syslog.log showed messages about unable to connect to identd. Remove comment in /etc/inetd.conf and everything works.

Second time was bit more of an issue. identd wasn't commented in /etc/inetd.conf. After *LOTS* of troubleshooting, I found that port 113 was listed as auth, not ident, in /etc/services. Corrected and everything works.

This definitely gets added to the list of symptoms on the lessons learned page...

Hope this helps someone...

Doug O'Leary

[Marvin Strong]

hmm interesting, I have run into ident problems before with SG. But never had problems with /etc/services.

what do you suspect changed your /etc/services?

I think ident is 113 by default.

[Geoff Wild]

I have ident commented out of inetd.conf - and no issues with MC/SG.

It was part of a security initiative - to close down unnecessary ports...

Rgds...Geoff

[melvyn burnard]

hmm, did you update SG version, or install an SG patch?

You may wish to read the following documents regarding the new security bits in SG:
http://www.docs.hp.com/en/5874/securingserviceguard.pdf
http://www.docs.hp.com/en/6283/SGsecurityfiles.pdf

[Kent Ostby]

Doug -- if you could post the messages that you got on the second server to this thread, I can write up a certified document on the issue.

Best regards,

Kent M. Ostby

[Doug O'Leary]

Hey;

The message after the cmrunnode is the error from the second run. It's the same message for both runs.

Thanks for the links on MCSG security; I'll be reading them shortly.

Doug

[Stephen Doud]

I have seen an increase in the number of calls coming into the HP Solution Center pertaining to this issue.

I -believe- the 'auth' line comes from 10.20 install. 11.xx changes the port reference to 'ident' from what I have learned but I'm not certain if upgrading to 11.xx includes a conversion of the 'auth' reference to 'ident'.
Can anyone confirm this.

[Rashid Hamid]

Hi Doug O'Leary

I just hit the problems after edit the cluster configuration.

Thank you very much for the solution.


I wonder why the ident was comment off coz I did not touch inetd or any other configuration files except cluster and pkg configuration files.

Thanks again


Rashid Hamid