HP UX Security Products and Features Software HP Serviceguard considerations, Administration

8 HP Serviceguard considerations

8.1 Overview

HP Serviceguard provides clustering services at the application level for HA. If a critical component failure occurs on the designated primary node of a product, HP Serviceguard activates the product on an alternate node through failover package scripting.

The failed-over product requires the same resources on the alternate nodes as were available on the primary node before the critical failure. These resources can include a set of loaded binaries, awakened processes, and reconfigured telecommunication ports. For an HA product to be entirely compatible with HP Serviceguard, enabling resources must be automated through the failover scripting.

WLI has no associated processes in user or kernel space. Therefore, failover packaging is not required for WLI by itself. However, a product that accesses files protected by WLI access policies might need some adjustments to its failover packaging.

WLI does not affect device special files with the exception of /dev/mem and /dev/kmem. A failover package does not need modification for WLI services with regard to the transitioning of communication and storage links between nodes.

The WLI database contains certain files unique to each platform that cannot be shared among cluster nodes. The WLI database must also reside on the root file system, which is mounted early following the kernel initialization phase of boot. Because the WLI database is not sharable among nodes, successful product failover depends on WLI administrative command operations being executed identically on each node following the initial installation.

Veritas Storage Foundation CFS is not supported by WLI. Policies assigned to files residing on CFS file systems are not enforced.

The shared library functions in /opt/wli/lib/libwliapi.so are not supported on HP Serviceguard clusters in this release.

8.2 Administration

Items for consideration are divided into the following general categories:

•The WLI database

•Policy protected files

8.2.1WLI database

To ensure the initial configuration of the WLI database is consistent across all nodes, HP recommends performing the following procedure:

1.Install WLI on all cluster nodes where it will be used, following the procedure in Section 4.2 (page 21).

2.On a single node only, complete the tasks described in “Configuring” (page 25), including generating a backup of the WLI database in /etc/wli.

3.Copy the WLI database generated in the previous step to all other cluster nodes where WLI is installed.

4.Copy the set of RSA keys to be authorized as WLI recovery and administrator keys to all nodes if they do not reside on a CFS file system. If the keys are copied, passphrases might vary but the RSA keys must be identical.

5.Restore the WLI database backup on all nodes where WLI is installed. Do not complete any of the “Configuring” (page 25) tasks.

6.The WLI configuration on the cluster nodes is complete. Execute the final configuration tasks of switching to restricted mode and rebooting on all nodes with WLI.

8.1 Overview 37