<div dir="ltr">Honza,<div><br></div><div>Actually this is only for a PoC (Proof of Concept) setup.</div><div>Next step is to move it to a different platform where we are cross-compiling from the sources. I'd like the PoC setup to have the same version as the final one.</div><div><br></div><div>Thanks.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 17, 2016 at 1:07 PM, Jan Friesse <span dir="ltr"><<a href="mailto:jfriesse@redhat.com" target="_blank">jfriesse@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Nikhil Utane napsal(a):<span class=""><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[root@node3 corosync]# corosync -v<br>
Corosync Cluster Engine, version '1.4.7'<br>
Copyright (c) 2006-2009 Red Hat, Inc.<br>
<br>
So it is 1.x :(<br>
When I begun I was following multiple tutorials and ended up installing<br>
multiple packages. Let me try moving to corosync 2.0.<br>
I suppose it should be as easy as doing yum install.<br>
</blockquote>
<br></span>
It depends of what distribution are you using (for example RHEL/CentOS has only 1.x + cman in 6.x and 2.x in 7.x). But main question is, why you want to upgrade? 1.x is fully supported and if it works for you there is no reason to upgrade to 2.x. It's best to stay with whatever your distro ships.<br>
<br>
Honza<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
On Wed, Mar 16, 2016 at 10:29 PM, Jan Friesse <<a href="mailto:jfriesse@redhat.com" target="_blank">jfriesse@redhat.com</a>> wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Nikhil Utane napsal(a):<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Honza,<br>
<br>
In my CIB I see the infrastructure being set to cman. pcs status is<br>
reporting the same.<br>
<br>
<nvpair id="cib-bootstrap-options-cluster-infrastructure"<br>
name="cluster-infrastructure" value="*cman*"/><br>
<br>
[root@node3 corosync]# pcs status<br>
Cluster name: mycluster<br>
Last updated: Wed Mar 16 16:57:46 2016<br>
Last change: Wed Mar 16 16:56:23 2016<br>
Stack: *cman*<br>
<br>
But corosync also is running fine.<br>
<br>
[root@node2 nikhil]# pcs status nodes corosync<br>
Corosync Nodes:<br>
Online: node2 node3<br>
Offline: node1<br>
<br>
I did a cibadmin query and replace from cman to corosync but it doesn't<br>
change (even though replace operation succeeds)<br>
I read that CMAN internally uses corosync but in corosync 2 CMAN support<br>
is<br>
removed.<br>
Totally confused. Please help.<br>
<br>
</blockquote>
<br>
Best start is to find out what versions you are using? If you have<br>
corosync 1.x and really using cman (what is highly probable), corosync.conf<br>
is completely ignored and instead cluster.conf (/etc/cluster/cluster.conf)<br>
is used. cluster.conf uses cman keyfile and if this is not provided,<br>
encryption key is simply cluster name. This is probably reason why<br>
everything worked when you haven't had authkey on one of nodes.<br>
<br>
Honza<br>
<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-Thanks<br>
Nikhil<br>
<br>
On Mon, Mar 14, 2016 at 1:19 PM, Jan Friesse <<a href="mailto:jfriesse@redhat.com" target="_blank">jfriesse@redhat.com</a>> wrote:<br>
<br>
Nikhil Utane napsal(a):<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Follow-up question.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I noticed that secauth was turned off in my corosync.conf file. I<br>
enabled<br>
it on all 3 nodes and restarted the cluster. Everything was working<br>
fine.<br>
However I just noticed that I had forgotten to copy the authkey to one<br>
of<br>
the node. It is present on 2 nodes but not the third. And I did a<br>
failover<br>
and the third node took over without any issue.<br>
How is the 3rd node participating in the cluster if it doesn't have the<br>
authkey?<br>
<br>
<br>
</blockquote>
It's just not possible. If you would enabled secauth correctly and you<br>
didn't have /etc/corosync/authkey, message like "Could not open<br>
/etc/corosync/authkey: No such file or directory" would show up. There<br>
are<br>
few exceptions:<br>
- you have changed totem.keyfile with file existing on all nodes<br>
- you are using totem.key then everything works as expected (it has<br>
priority over default authkey file but not over totem.keyfile)<br>
- you are using COROSYNC_TOTEM_AUTHKEY_FILE env with file existing on all<br>
nodes<br>
<br>
Regards,<br>
Honza<br>
<br>
<br>
<br>
On Fri, Mar 11, 2016 at 4:15 PM, Nikhil Utane <<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<a href="mailto:nikhil.subscribed@gmail.com" target="_blank">nikhil.subscribed@gmail.com</a>><br>
wrote:<br>
<br>
Perfect. Thanks for the quick response Honza.<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Cheers<br>
Nikhil<br>
<br>
On Fri, Mar 11, 2016 at 4:10 PM, Jan Friesse <<a href="mailto:jfriesse@redhat.com" target="_blank">jfriesse@redhat.com</a>><br>
wrote:<br>
<br>
Nikhil,<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Nikhil Utane napsal(a):<br>
<br>
Hi,<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
I changed some configuration and captured packets. I can see that the<br>
data<br>
is already garbled and not in the clear.<br>
So does corosync already have this built-in?<br>
Can somebody provide more details as to what all security features<br>
are<br>
incorporated?<br>
<br>
<br>
See man page corosync.conf(5) options crypto_hash, crypto_cipher (for<br>
</blockquote>
corosync 2.x) and potentially secauth (for coorsync 1.x and 2.x).<br>
<br>
Basically corosync by default uses aes256 for encryption and sha1 for<br>
hmac authentication.<br>
<br>
Pacemaker uses corosync cpg API so as long as encryption is enabled in<br>
the corosync.conf, messages interchanged between nodes are encrypted.<br>
<br>
Regards,<br>
Honza<br>
<br>
<br>
-Thanks<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Nikhil<br>
<br>
On Fri, Mar 11, 2016 at 11:38 AM, Nikhil Utane <<br>
<a href="mailto:nikhil.subscribed@gmail.com" target="_blank">nikhil.subscribed@gmail.com</a>><br>
wrote:<br>
<br>
Hi,<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Does corosync provide mechanism to secure the communication path<br>
between<br>
nodes of a cluster?<br>
I would like all the data that gets exchanged between all nodes to<br>
be<br>
encrypted.<br>
<br>
A quick google threw up this link:<br>
<a href="https://github.com/corosync/corosync/blob/master/SECURITY" rel="noreferrer" target="_blank">https://github.com/corosync/corosync/blob/master/SECURITY</a><br>
<br>
Can I make use of it with pacemaker?<br>
<br>
-Thanks<br>
Nikhil<br>
<br>
<br>
<br>
<br>
<br>
</blockquote>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started:<br>
<a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
<br>
<br>
_______________________________________________<br>
</blockquote>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started:<br>
<a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
<br>
<br>
</blockquote>
<br>
<br>
</blockquote>
<br>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started:<br>
<a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
<br>
<br>
</blockquote>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started: <a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
<br>
</blockquote>
<br>
<br>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started: <a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
<br>
</blockquote>
<br>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started: <a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
</blockquote>
<br>
<br>
<br>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started: <a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
<br>
</blockquote>
<br>
<br>
_______________________________________________<br>
Users mailing list: <a href="mailto:Users@clusterlabs.org" target="_blank">Users@clusterlabs.org</a><br>
<a href="http://clusterlabs.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://clusterlabs.org/mailman/listinfo/users</a><br>
<br>
Project Home: <a href="http://www.clusterlabs.org" rel="noreferrer" target="_blank">http://www.clusterlabs.org</a><br>
Getting started: <a href="http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf" rel="noreferrer" target="_blank">http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf</a><br>
Bugs: <a href="http://bugs.clusterlabs.org" rel="noreferrer" target="_blank">http://bugs.clusterlabs.org</a><br>
</div></div></blockquote></div><br></div>