Service-guard problem relating to identd entry

[Adam Noble]

Hi all,

I had a strange issue with one of our service-guard clusters at the weekend and would be grateful for any advice. The servers within the cluster were both patched with a MC bundle. On reboot one server complained that it could not rejoin the cluster as it could not get its configuration data suggesting it was corrupt. The thing is there were messages saying make sure the remote node is running identd. I checked the inetd.conf file on the host unable to join the cluster and sure enough identd was commented out. I uncommented and did an inetd -c and all was then fine.

The problem I have is that I can see from old backups that this entry had been commented out for many months so I have no idea how the cluster was communicating previously!!! Is identd only used a cluster formation?

Any advice would be appreciated!!!

Cheers

[Duncan Edmonstone · Accepted solution]

Adam,

I'm guessing we're talking about HP-UX11.11 and Serviceguard 11.16 here yes?

If so I expect this was as a result of applying a Serviceguard patch as part of the patch bundle you applied.

A patch released in 2004 changed the standard security mechanisms in 11.16 to use identd. This is documented in the patch special installaation instructions, which you should be careful to read.

Read more about the new security odel in these 2 white papers:

http://docs.hp.com/en/6283/SGsecurityfiles.pdf

http://docs.hp.com/en/5874/securingserviceguard_nov2005.pdf

HTH

Duncan

[Adam Noble]

its actually A.11.15.00 but may explain the issue.

[melvyn burnard]

SG A.11.15 will require identd after a certain patch level.
Check the patch that was installed and then lok for the special instrucions, it should be documented there

[Duncan Edmonstone]

Adam,

You are aware that 11.15 is ou of support (and has been since June 2006)?

11.16 is the only supported version on 11.11 now.

HTH

Duncan

[Adam Noble]

Duncan....well aware!! This is not my call. Anyway you are all right sure enough it was a patch that caused the issue. Much appreciated!!

[skt_skt]

i had faced the similar problem.SO in addition to enbling identd service; i had appended -i to the following entry on /etc/inetd.conf(that is what i recollect)

hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c -i