Service guard and rexec/remsh

[Donald R. Wedig]

Does Service guard utilize rexec or remsh to handle information transfer or cluster stability?

[Sanjay_6]

Hi,

no i don't think service guard uses either remsh or rexec to handle communication betweeb nodes.

Hope this helps.

Regds

[James R. Ferguson]

Hi Donald:

No, MC/Serviceguard does not need this enabled. In fact, you can avoid the '.rhosts' file too, '/etc/cmcluster/cmclnodelist' for it. This generally tightens security if/where it is desirable to avoid'.rhosts' files.

Regards!

...JRF...

[Crystal_1]

Hi,

I got the same question. Our Sys Admin told me that MC Service Guard requires to have .rhost file. I am a security admin and require not to have .rhost file on a system.

Could you please tell me how to configure the specific file (/etc/clumster) to replace the .rhost file?


Tx, Crystal

[Bill Hassell]

rcp is needed to distribute the cluster config files. Without remsh capability, you must manually update the cluster files every time there is a change to the cluster(s). Eliminating the remsh command will greatly increase sysadmin overhead and will likely generate a number of cluster integrity problems from time to time (because someone forgot to redistribute the new versions).

.rhosts is not a security risk by itself...it is a risk based on the contents. Since clustered machines are virtually equal and can therefore trust each other. .rhosts must never be readable by anyone except the owner (permissions=600) and must contain the name(s) of the clustered machines plus the user name.

[Stephen Doud · Accepted solution]

Hello Don,

The system administrator must manually copy package control scripts to the same directories on other nodes when the scripts are altered.

It is not essential to copy the cluster configuration file or package configuration files to the other servers, because the ServiceGuard daemon (cmcld) works with the binary cmclconfig file - which was created as a result of the cmapplyconf command with the cluster and package configuration files. These configuration files can be reconstructed using the cmgetconf(1m) command.

Once configured and running, ServiceGuard uses tcp and udp ports (see "hacl" lines in /etc/services) to communicate between cluster nodes.

-s.