Serviceguard A.11.16 cluster setup

[Luk Vandenbussche]

Hi,
I have problems all day yet to configure a new A.11.16 cluster.

When I perform a query from node 1 (oraux01n), I receive the following error from the second node

Error: Permission denied accessing node oraux02n.
Error: Permission denied accessing node oraux02n.
Error: Unable to determine network configuration: failed to setup for probing th
e network on node oraux02n: Permission denied
Failed to probe network
Warning: Network interface lan0 on node oraux01n couldn't talk to itself.
Warning: Network interface lan1 on node oraux01n couldn't talk to itself.
Failed to gather configuration information.


When I perform the query from node 2 (oraux02n)

I receive the following output
Warning: Node oraux01n does not support enhanced security

Writing cluster data to cmclconf.ascii.

/etc/hosts is the same on both nodes, I placed + in cmclnodelist.


Any idea's

[Steven E. Protter]

Part of the network configuration in /etc/cmcluster/cmcconf.ascii or whatever you named it is not able to be verified.

You should make sure ipfilter firewal isn't on interfering with it and make sure everything is plugged in and pingable.

SEP

[Julio Yamawaki]

Hi,

Have you configured /.rhosts or /etc/cmcluster/cmclnodelist in order to acess the remote node?

Regards,

[Luk Vandenbussche]

All the system access is OK.
I created .rhosts and an rlogin works fine.
I don't have a firewall configured between the two systems

[melvyn burnard · Accepted solution]

With 11.16, the security has changed drastically.
I recommend you take a read of the folowing:


http://docs.hp.com/en/B3935-90078/B3935-90078.pdf

http://docs.hp.com/en/6283/SGsecurityfiles.pdf

http://docs.hp.com/en/6283/SGsecurityfiles.pdf

[Geoff Wild]

you need a cmclnodelist file for intial creation.

Rgds...Geoff

[melvyn burnard]

Just a thought, but have you checked the patch levels are the same for SG?
what /usr/lbin/cmcld

Also watch out for the identd disabling. If one node is disabled and the other enabled, then you could get this scenario.

[Luk Vandenbussche]

The cluster is running after modifying the inetd.conf refering to the document off Melvin.
Now I just receive this error in syslog
cmclconfd running with weak security (
identd disabled)

[melvyn burnard]

Well it is not an error, just a warning telling you you do not have full security set up.

[Geoff Wild]

Luk,

I had the same warning message on my clutsers as well - just been going throught eh latest consevative patches - and on my test cluster, I don't get that message - why? I believe it's because of the following patch PHSS_31075:

http://www1.itrc.hp.com/service/patch/patchDetail.do?BC=patch.breadcrumb.main|patch.breadcrumb.search|&patchid=PHSS_31075&context=hpux:800:11:11

On my Test cluster:
what /usr/lbin/cmcld |grep Date
A.11.16.00 Date: 11/29/04 Patch: PHSS_31075

On my QA and Prod:

what /usr/lbin/cmcld |grep Date
A.11.16.00 Date: 03/15/04

I'm patching my QA this weekend....I will know for sure then.

Rgds...Geoff

[Luk Vandenbussche]

Jeff,

This is my patching level
what /usr/lbin/cmcld |grep Date
A.11.16.00 Date: 03/14/05 Patch: PHSS_32731

I am working as a consultant and now I always install PHSS_32731, since this patch everything works normal, no problems with security exceptions.

Good Luck