Configuring the cluster in secure mode | Symantec 5 guide

Installing and configuring VCS 69

Installing and configuring VCS 5.0 RU3

5Choose whether to use the same NIC details to configure private heartbeat links on other systems.

Are you using the same NICs for private heartbeat links on all systems? [y,n,q,b,?] (y)

If you want to use the NIC details that you entered for galaxy, make sure the same NICs are available on each system. Then, enter y at the prompt.

If the NIC device names are different on some of the systems, enter n. Provide the NIC details for each system as the program prompts.

6Verify and confirm the information that the installer summarizes.

Configuring the cluster in secure mode

If you want to configure the cluster in secure mode, make sure that you meet the prerequisites for secure cluster configuration.

The installvcs program provides different configuration modes to configure a secure cluster. Make sure that you completed the pre-configuration tasks for the configuration mode that you want to choose.

See “Preparing to configure the clusters in secure mode” on page 29.

To configure the cluster in secure mode

1Choose whether to configure VCS to use Symantec Product Authentication Service.

Would you like to configure VCS to use Symantec Security Services? [y,n,q] (n) y

■If you want to configure the cluster in secure mode, make sure you meet the prerequisites and enter y.

■If you do not want to configure the cluster in secure mode, enter n. You must add VCS users when the configuration program prompts. See “Adding VCS users” on page 71.

2Select one of the options to enable security.

Select the Security option you would like to perform [1-3,q,?]

Review the following configuration modes. Based on the configuration that you want to use, enter one of the following values:

Image 69

Symantec 5 manual Configuring the cluster in secure mode, See Preparing to configure the clusters in secure mode on

Contents

Veritas Cluster Server Installation Guide Legal Notice Veritas Cluster Server Installation Guide Symantec Corporation Ellis Street Mountain View, CA Contacting Technical Support Technical Support Customer service Licensing and registrationDocumentation feedback Additional enterprise services Maintenance agreement resources Contents Contents Chapter Configuring VCS clusters for data integrity 121 Chapter Adding and removing cluster nodes Index 173 171 Contents About Veritas Cluster Server About VCS basicsThis chapter includes the following topics About multiple nodes About shared storageExample of a four-node VCS cluster See About the LLT and GAB configuration files on About LLT and GABAbout network channels for heartbeating About VCS seeding About preexisting network partitions Veritas Installation Assessment Service About VCS featuresAbout VCS notifications About global clusters About VCS optional components About I/O fencingYou can add the following optional components to VCS About Symantec Product Authentication Service AT See Installing the Java Console on See Preparing to configure the clusters in secure mode onAbout Cluster Manager Java Console About Veritas Cluster Server Management Console About VCS optional components Page About planning to install VCS Hardware requirements1lists the hardware requirements for a VCS cluster Required disk space Hardware requirements for a VCS clusterDescription Kernel Architecture Supported operating systems Rhel Required Linux RPMs for VCS Supported software Planning to install VCS Supported software Preparing to configure the clusters in secure mode About preparing to install VCS 1depicts the flow of configuring VCS cluster in secure mode Workflow to configure VCS cluster in secure mode Preparatory tasks to configure a cluster in secure mode TasksThis task Installing the root broker for the security infrastructure See About Symantec Product Authentication Service AT on# ./installer Venus # vssat showprpl --pdrtype root \ Venus # vssat showalltrustedcreds Venus # vssat showbrokerhash Creating encrypted files for the security infrastructure Addprpl command RootBroker # vssat createpkg \ For example Performing preinstallation tasks Obtaining VCS license keys Task ReferenceHttps//licensing.symantec.com You can use network switches instead of hubs Setting up the private networkPage See About installing and configuring VCS on Configuring SuSE network interfaces Where ethX is the interface name For example Run the command# cd /etc/sysconfig # ifconfig -a Setting up inter-system communication # ifconfig eth0# cd /etc/sysconfig/network Setting up ssh on cluster systems Accept the default location of ~/.ssh/iddsa# ssh-keygen -t dsa See About setting up disk-based I/O fencing on Setting up shared storage# chmod 755 ~/.ssh # exec /usr/bin/ssh-agent $SHELL # ssh-add Setting the Path variable Setting the Manpath variableFor the C Shell csh or tcsh, type Setting the kernel.panic tunable Optimizing LLT media speed settings on private NICsCase of a panic, the node will reboot after 10 seconds Performing automated pre-installation check Mounting the product disc# mount -o ro /dev/cdrom /mnt/cdrom # ./installvcs -precheck galaxy nebula VCS About installing and configuring VCS To configure Veritas Cluster Server you need Example galaxy, nebulaExample vcscluster27 To configure VCS clusters in secure mode optional, you need To configure Smtp email notification optional, you needVar/tmp/privatedir/roothash To configure Snmp trap notification optional, you need To configure global clusters optional, you needOptional VCS RPMs Optional features of the installvcs program About the VCS installation programVRTSvcsmn Manual pages for VCS commands See About preparing to install VCS on About installvcs program command options Interacting with the installvcs programInstallvcs command usage takes the following form Optional action Reference Installvcs system1 system2... options Nooptionalpkgs Option and Syntax Description Configuring VCS using configure option Installing VCS using installonly option See Configuring the basic cluster on Installing and configuring VCS 5.0 RU33lists the installation and the configuration tasks Overview of tasks Starting the software installation Start the installvcs program Specifying systems for installation# ./installvcs -rsh # cd /clusterserver See Checking licensing information on the system on Licensing VCS Enter keys for additional product features Choosing VCS RPMs for installation Choosing to install VCS RPMs or configure VCS See Configuring VCS using configure option on Starting the software configuration Configuring the basic cluster Specifying systems for configuration# ./installvcs -configure # cd /dvdrom/clusterserverPage Configuring the cluster in secure mode Symantecexample.com East.symantecexample.comRoot@east.symantecexample.com Root/roothash Enter the user’s name, password, and level of privileges Configuring Smtp email notificationAdding VCS users To add a user, enter y at the prompt See Configuring Snmp trap notification on See Configuring global clusters on Configuring Snmp trap notificationIf you do not want to add, answer n Verify and confirm the Smtp notification information Verify and confirm the Snmp notification information Configuring global clusters See Creating VCS configuration files on Installing VCS RPMs Verifying the NIC configuration Creating VCS configuration files Completing the installation Starting VCSSet the Persistentname for all the NICs File description VCS node authentication broker Software requirements for the Java Console Installing the Java ConsoleHardware requirements for the Java Console See Software requirements for the Java Console on Installing the Java Console on a Windows system Installing the Java Console on Linux for IBM PowerNavigate to the folder that contains the RPMs # cd /mnt/cdrom/distarch/clusterserver/rpms Installing VCS Simulator on Unix systems Installing VCS SimulatorInstalling VCS Simulator on Windows systems Software requirements for VCS Simulator Reviewing the installation See About verifying the VCS installation on Verifying the cluster after installationVerifying and updating licenses on the system Checking licensing information on the system Replacing a VCS demo license with a permanent license Updating product licenses using vxlicinst# cd /opt/VRTS/bin # hastop -all -force To access the VCS documentation Accessing the VCS documentationStart VCS on each node # hastart About configuring VCS clusters for data integrity Configuring VCS clusters for data integrity About data disks About I/O fencing componentsAbout coordination points See About data disks on 1illustrates the tasks involved to configure I/O fencing About setting up disk-based I/O fencing Workflow to configure disk-based I/O fencing I/O fencing configuration files include Preparing to configure disk-based I/O fencing # fdisk -l Initializing disks as VxVM disks Libnamevidpid # vxddladm listsupport all Identifying disks to use as coordinator disks Checking shared disks for I/O fencingExample specifies the CDS format Verifying that the nodes have access to the same disk Testing the shared disks for SCSI-3See Testing the disks using vxfentsthdw utility on Testing the disks using vxfentsthdw utility See Removing permissions for communication on# /opt/VRTSvcs/vxfen/bin/vxfentsthdw If you use rsh for communication # /opt/VRTSvcs/vxfen/bin/vxfentsthdw -nDev/sdr Setting up coordinator disk groups Setting up disk-based I/O fencing manually# vxdg init vxfencoorddg sdx sdy sdz # vxdg -g vxfencoorddg set coordinator=on Creating I/O fencing configuration files For raw device configurationDeport the coordinator disk group Modifying VCS configuration to use I/O fencing Make a backup copy of the main.cf fileStop VCS on all nodes # hacf -verify /etc/VRTSvcs/conf/config Verifying I/O fencing configurationStart VCS # /etc/init.d/vxfen start # vxfenadm -d Removing permissions for communicationPage About the LLT and GAB configuration files About verifying the VCS installation Galaxy Nebula About the VCS configuration file main.cf Sample main.cf file for VCS clusters Page Sample main.cf file for global clusters ClusterAddress = Gcoip requires csgnic Wac requires gcoipApplication wac IP gcoip NIC csgnic Verify the content of the configuration files Verifying the LLT, GAB, and VCS configuration filesSee Setting the Path variable on Verifying LLT, GAB, and cluster operation See Verifying the cluster on Verifying LLTOutput on galaxy resembles Output on nebula resembles Eth1 UP Output resembles Verifying GAB Verifying the cluster Verifying the cluster nodes Current Eth1 UP eth2 UP Adding a node to a cluster About adding and removing nodes See Adding a license key on Setting up the hardware Preparing for a manual installation when adding a node See Mounting the product disc on Installing VCS RPMs for a manual installation Adding a license key Checking licensing information on the systemSLES10/ppc64, required Rpms See Configuring LLT and GAB on Setting up the node to run in secure modeSee Configuring the authentication broker on node saturn on See Setting up VCS related security configuration on Configuring the authentication broker on node saturn Setting up VCS related security configuration Configuring LLT and GAB On the new system, run the command # /sbin/lltconfig -cIf the file on one of the existing nodes resembles To verify GAB On the new node, run the command Adding the node to the existing clusterAdd the new system to the cluster Starting VCS and verifying the cluster Removing a node from a clusterStop VCS on the new node Start VCS on the new node Verifying the status of nodes and service groups Deleting the departing node from VCS configuration Check the status of the systems and the service groups# hastatus -summary # hagrp -switch grp3 -to nebula # hagrp -dep# haconf -makerw # hagrp -unlink grp4 grp1 Check the status Save the configuration, making it read onlyDelete the node from the cluster # hagrp -delete grp4 Removing security credentials from the leaving node Modifying configuration files on each remaining node To determine the RPMs to remove, enter Stop GAB and LLT# /etc/init.d/gab stop # /etc/init.d/llt stop # rpm -qa grep Vrts # rm /etc/llttab # rm /etc/gabtab # rm /etc/llthosts Remove the LLT and GAB configuration files Creating a single-node cluster using the installer program About installing VCS on a single node Starting the installer for the single node cluster Preparing for a single node installationTasks to create a single-node cluster using the installer See Starting the software installation on Creating a single-node cluster manually Installing the VCS software manually on a single nodeSee Licensing VCS on Set the path variable Modifying the startup files Renaming the LLT and GAB startup filesVerifying single-node operation # hastart -onenode Adding a node to a single-node cluster Installing VxVM or VxFS if necessary Setting up a node to join the single-node cluster See Setting up shared storage on Configuring the shared storageDisplay the service groups currently configured Bringing up the existing node Freeze the service groups Configuring LLTStop VCS on Node a Rename the GAB and LLT startup files so they can be used Setting up /etc/llttab Setting up /etc/llthostsLLT directives See LLT directives on Additional considerations for LLT LLT directivesDirective Description Reconfiguring VCS on the existing node Configuring GAB when adding a node to a single node clusterReconfigure VCS on the existing nodes Starting LLT and GAB Verifying configuration on both nodes Implement the new two-node configuration Unfreeze the service groupsStart the VCS on Node B Verify that VCS is up on both nodesPage About the uninstallvcs program Preparing to uninstall VCSSee About adding and removing nodes on Uninstalling VCS 5.0 RU3 # cd /opt/VRTS/install # ./uninstallvcsRemoving VCS 5.0 RU3 RPMs Running uninstallvcs from the VCS 5.0 RU3 disc Uninstallvcs program is not available in /opt/VRTS/install When to use LLT over UDP Using the UDP layer for LLTConfiguring LLT over UDP Following checklist is to configure LLT over UDP See Sample configuration links crossing IP routers on Link command in the /etc/llttab fileBroadcast address in the /etc/llttab file See Broadcast address in the /etc/llttab file on Table A-2describes the fields of the set-addr command Set-addr command in the /etc/llttab file Configuring the netmask for LLT Selecting UDP ports# setparms ipaddress Sample configuration direct-attached links Configuring the broadcast address for LLTFor second network interface # cat /etc/llttab File for Node 1 resembles UDP Figure A-2 Sample configuration links crossing IP routers /etc/llttab file on Node 0 resembles Performing automated VCS installations Example response file Syntax in the response fileOr, in the case of an integer value Or, in the case of a list Table A-3 Response file variables Variable Description Response file variable definitions $CPICFGOPTLICENSE $CPICFGOPTPKGPATH $CPICFGKEYS Table A-3 $CPICFGOPTUNINSTALL See Installing and configuring VCS 5.0 RU3 on # ./installvcs -responsefile /tmp/installvcs-uui.response Index GAB RAM VCS