Node is refusing service gaurd communications

[Mohamed shamy]

HI all
I'm trying to build a 2 node cluster using Serviceguard 11.17 but each time i run the command # cmquerycl -C /etc/cmcluster/test.conf -n momsrv02 -n momsrv01
I receive the following output message:
Permission denied to 172.20.10.9
Permission denied to 172.20.51.46
Permission denied to 100.100.1.2
Permission denied to 127.0.0.1
Looking for other clusters ... Done
Node momsrv02 is refusing Serviceguard communication.
Please make sure that the proper security access is configured on node
momsrv02 through either file-based access (pre-A.11.16 version) or role-based
access (version A.11.16 or higher) and/or that the host name lookup
on node momsrv02 resolves the IP address correctly.
Failed to gather configuration information.


although my .rhosts is configured well and i'm allowed to rlogin and remsh between the 2 servers also the /etc/hosts contains all the entries for both servers .

thanks

attached is a snap shot of the error.

[melvyn burnard]

It look slike you have an issue with your hostname lookups.
Please make sure you read:
http://docs.hp.com/en/6283/SGsecurityfiles.pdf
http://docs.hp.com/en/5874/securingserviceguard_nov2005.pdf

[Jeff Schussele]

Hi memo,

This is probably due to the 11.16 MC/SG requirement for identd.
Edit your /etc/inetd.conf adding -i files as follows:

hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd -c -i
hacl-probe stream tcp nowait root /opt/cmom/lbin/cmomd /opt/cmom/lbin/cmomd -i -f /var/opt/cmom/cmomd.log -r /var/opt/cmom

Remember to reread inetd.conf with inetd -c
You'll get "weak security" msgs in syslog.log but the nodes will at least talk to each other.
We're forbiden to use identd in our shop so we had no choice but to use the above fix.

HTH,
Jeff

[Steven E. Protter]

Shalom,

I think there is an access problem between the noces.

Perhaps a conflict between /etc/hosts networking and the cmnodelist file that controls access.

SEP

[Stephen Doud · Accepted solution]

Use the ITRC Knowledge Database to view the document titled:
Cluster Configuration Commands Fail with "permission denied"

Doc. ID:UMCSGKBRC00008185

[Mohamed shamy]

Dear doud
I couldn't find the document you mentioned in you reply in the ITRC knowledge base.

[Mohamed shamy]

Dear all

When it continued troubleshooting the problem i found that an old cluster was already running on the 2 nodes at the time when i changed the hostname of the 2 nodes , so i decided to return back the old hostnames and it worked.
Now how can i change the hostnames of the 2 nodes in the presence of a cluster , do i have to just halt down the cluster before going for the hostname changes because i tried to do that using the command #cmhaltcl but the same problem continued , or is there is another way to destroy the old cluster completely .

thanks

[Stephen Doud]

I was able to locate UMCSGKBRC00008185 in the knowledge database.
But now your issue has changed.
The cluster expects the old hostnames.
To migrate the cluster to new hostnames, do the following:
# cd /etc/cmcluster
# cmgetconf cluster.ascii
o Edit cluster.ascii - updating the hostnames with the new names.
# cmhaltcl -f
# cmdeleteconf -f == does more than zero out the cluster binary file... it also de-clusters the shared volume groups. ie, it removes the cluster ID from those VGs so that they will be marked with the new cluster ID.

ON BOTH NODES:
o Edit /etc/rc.config.d/netconf, modify the hostname entry.
# hostname
o Add hostnames to /etc/cmcluster/cmclnodelist, on both nodes.
o Activate cluster lock VG (if any)
# cmapplyconf -C /etc/cmcluster/cluster.ascii
# cmapplyconf -P -P ...

[Uday_S_Ankolekar]

Rename cmclconfig and move it to a different directory and then run cmquerycl
-USA..

[Stephen Doud]

Renaming cmclconfig will not remove the cluster ID from the volume groups. When building a new cluster, the old cluster ID must be removed from the VGs or they will not pass a cmapplyconf due to the old cluster ID.
Removing the cluster ID from a VG can be done by:
# cmdeleteconf -f
# cmapplyconf -C ... with a VG NOT listed in the cluster.ascii
# vgchange -c n