<div dir="ltr">Honza,<div><br></div><div>In my CIB I see the infrastructure being set to cman. pcs status is reporting the same.</div><div><br></div><div><nvpair id="cib-bootstrap-options-cluster-infrastructure" name="cluster-infrastructure" value="<b>cman</b>"/><br></div><div><br></div><div><div>[root@node3 corosync]# pcs status</div><div>Cluster name: mycluster</div><div>Last updated: Wed Mar 16 16:57:46 2016</div><div>Last change: Wed Mar 16 16:56:23 2016</div><div>Stack: <b>cman</b></div></div><div><br></div><div>But corosync also is running fine.</div><div><br></div><div>[root@node2 nikhil]# pcs status nodes corosync<br></div><div><div>Corosync Nodes:</div><div> Online: node2 node3</div><div> Offline: node1</div></div><div><br></div><div>I did a cibadmin query and replace from cman to corosync but it doesn't change (even though replace operation succeeds)</div><div>I read that CMAN internally uses corosync but in corosync 2 CMAN support is removed.</div><div>Totally confused. Please help.</div><div><br></div><div>-Thanks</div><div>Nikhil</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 14, 2016 at 1:19 PM, Jan Friesse <span dir="ltr"><<a href="mailto:jfriesse@redhat.com" target="_blank">jfriesse@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Nikhil Utane napsal(a):<span class=""><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Follow-up question.<br>
I noticed that secauth was turned off in my corosync.conf file. I enabled<br>
it on all 3 nodes and restarted the cluster. Everything was working fine.<br>
However I just noticed that I had forgotten to copy the authkey to one of<br>
the node. It is present on 2 nodes but not the third. And I did a failover<br>
and the third node took over without any issue.<br>
How is the 3rd node participating in the cluster if it doesn't have the<br>
authkey?<br>
</blockquote>
<br></span>
It's just not possible. If you would enabled secauth correctly and you didn't have /etc/corosync/authkey, message like "Could not open /etc/corosync/authkey: No such file or directory" would show up. There are few exceptions:<br>
- you have changed totem.keyfile with file existing on all nodes<br>
- you are using totem.key then everything works as expected (it has priority over default authkey file but not over totem.keyfile)<br>
- you are using COROSYNC_TOTEM_AUTHKEY_FILE env with file existing on all nodes<br>
<br>
Regards,<br>
Honza<div class="HOEnZb"><div class="h5"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
On Fri, Mar 11, 2016 at 4:15 PM, Nikhil Utane <<a href="mailto:nikhil.subscribed@gmail.com" target="_blank">nikhil.subscribed@gmail.com</a>><br>
wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Perfect. Thanks for the quick response Honza.<br>
<br>
Cheers<br>
Nikhil<br>
<br>
On Fri, Mar 11, 2016 at 4:10 PM, Jan Friesse <<a href="mailto:jfriesse@redhat.com" target="_blank">jfriesse@redhat.com</a>> wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Nikhil,<br>
<br>
Nikhil Utane napsal(a):<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
I changed some configuration and captured packets. I can see that the<br>
data<br>
is already garbled and not in the clear.<br>
So does corosync already have this built-in?<br>
Can somebody provide more details as to what all security features are<br>
incorporated?<br>
<br>
</blockquote>
<br>
See man page corosync.conf(5) options crypto_hash, crypto_cipher (for<br>
corosync 2.x) and potentially secauth (for coorsync 1.x and 2.x).<br>
<br>
Basically corosync by default uses aes256 for encryption and sha1 for<br>
hmac authentication.<br>
<br>
Pacemaker uses corosync cpg API so as long as encryption is enabled in<br>
the corosync.conf, messages interchanged between nodes are encrypted.<br>
<br>
Regards,<br>
Honza<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-Thanks<br>
Nikhil<br>
<br>
On Fri, Mar 11, 2016 at 11:38 AM, Nikhil Utane <<br>
<a href="mailto:nikhil.subscribed@gmail.com" target="_blank">nikhil.subscribed@gmail.com</a>><br>
wrote:<br>
<br>
Hi,<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Does corosync provide mechanism to secure the communication path between<br>
nodes of a cluster?<br>
I would like all the data that gets exchanged between all nodes to be<br>
encrypted.<br>
<br>
A quick google threw up this link:<br>
<a href="https://github.com/corosync/corosync/blob/master/SECURITY" rel="noreferrer" target="_blank">https://github.com/corosync/corosync/blob/master/SECURITY</a><br>
<br>
Can I make use of it with pacemaker?<br>
<br>
-Thanks<br>
Nikhil<br>
<br>
<br>
<br>
</blockquote>
<br>
<br>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started: <a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
<br>
</blockquote>
<br>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started: <a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
</blockquote>
<br>
<br>
</blockquote>
<br>
<br>
<br>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started: <a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
</blockquote>
<br>
<br>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started: <a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
</div></div></blockquote></div><br></div>