Tuesday, September 24, 2013

Linux Reverse Path Filtering

I faced a issue today, thought its a simple task but digged for 30 to 40 minutes to overcome this.

Basically I have a server which has 4 NIC port and I have to configure two NIC with different subnet, thought its a simple task, but it didn't worked.

After configuration the working NIC stopped working as well as the newly configured.

Post to this after some digging found reverse path filtering has to be disabled, and did the following,

echo "0" > /proc/sys/net/ipv4/conf/em1/rp_filter
em1 - ethernet device name

This has to be done for all NIC's which has to be configured.

To permanently add,
"echo 'net.ipv4.conf.em1.rp_filter = 0' >> /etc/sysctl.conf"
em1 - ethernet device name

Add it for loopback interface as well,
"echo 'net.ipv4.conf.lo.rp_filter = 0' >> /etc/sysctl.conf"
 Finally to take effect,
"sysctl -p"
Thanks.

Friday, September 20, 2013

Pacemaker Basic Setup with Cent OS 6.4 (64bit)

Since after struggling so many days, I accomplished basic setup of Pacemaker with Corosync in Cent OS 6.4 and following are the steps, thought of sharing...

Hope Cent OS is installed already in both the host machines. Here am using 2-node clustering.


Networking
As a first step disable the selinux and iptables
# service iptables stop
# chkconfig iptables off
# setenforce 0
# sed -i.bak "s/SELINUX=enforcing/SELINUX=permissive/g" /etc/selinux/config
(to make permanent)
 Short node Names
We need to update /etc/sysconfig/network. This is what it should look like before we start.
# cat /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=pcmk-1.example.org
GATEWAY=
However we’re not finished. The machine wont normally see the host name until about it reboots, but we can force it to update.
# source /etc/sysconfig/network
# hostname $HOSTNAME
Now you can check the machine is using correct names
# uname -n
# pcmk-1.example.org
Configure SSH
SSH is a convenient and secure way to copy files and perform commands remotely. For the purposes of this guide, we will create a key without a password (using the -N option) so that we can perform remote actions without being prompted.

Creating and Activating a new SSH Key
# ssh-keygen -t dsa -f ~/.ssh/id_dsa -N ""
Generating public/private dsa key pair.
Your identification has been saved in /root/.ssh/id_dsa.
Your public key has been saved in /root/.ssh/id_dsa.pub.
The key fingerprint is:
91:09:5c:82:5a:6a:50:08:4e:b2:0c:62:de:cc:74:44 root@pcmk-1.clusterlabs.org
The key's randomart image is:
+--[ DSA 1024]----+
|==.ooEo.. |
|X O + .o o |
| * A + |
| + . |
| . S |
| |
| |
| |
| |
+-----------------+ 
# cp .ssh/id_dsa.pub .ssh/authorized_keys
Install the key on the other nodes and test that you can now run commands remotely, without being prompted
# scp -r .ssh pcmk-2.example.org:
The authenticity of host 'pcmk-2.example.org (192.168.122.102)' can't be established.
RSA key fingerprint is b1:2b:55:93:f1:d9:52:2b:0f:f2:8a:4e:ae:c6:7c:9a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'pcmk-2.example.org,192.168.122.102' (RSA) to the list of known hosts.root@pcmk-2.example.org's password:
id_dsa.pub 100% 616 0.6KB/s 00:00
id_dsa 100% 672 0.7KB/s 00:00
known_hosts 100% 400 0.4KB/s 00:00
authorized_keys 100% 616 0.6KB/s 00:00
# ssh pcmk-2.example.org -- uname -n
pcmk-2.example.org
Cluster Software Installation
# wget -P /etc/yum.repos.d/ http://download.opensuse.org/repositories/network:/ha-clustering:/Stable/CentOS_CentOS-6/network:ha-clustering:Stable.repo
# yum install -y pacemaker corosync
# yum install -y cman gfs2-utils gfs2-cluster
#yum install crmsh.x86_64
Configure Corosync
The instructions below only apply for a machine with a single NIC. If you have a more complicated setup, you should edit the configuration manually.
# export ais_port=4000
# export ais_mcast=239.255.1.1
Next we automatically determine the hosts address. By not using the full address, we make the configuration suitable to be copied to other nodes.
#export ais_addr=`ip addr | grep "inet " | tail -n 1 | awk '{print $4}' | sed s/255/0/g`
Display and verify the configuration options
# env | grep ais_
ais_mcast=239.255.1.1
ais_port=4000
ais_addr=192.168.122.0
Note: Please make sure you have multicast is enabled in your switch, if not enabled then you will face communication problem between your nodes. In my case I struggled and than changed to unicast, because multicast didn't worked for my setup. For unicast example file will be available in  this path by default "/etc/corosync/corosync.conf.example.udpu"

Once you’re happy with the chosen values, update the Corosync configuration
# cp /etc/corosync/corosync.conf.example /etc/corosync/corosync.conf
# sed -i.bak "s/.*mcastaddr:.*/mcastaddr:\ $ais_mcast/g" /etc/corosync/corosync.conf
# sed -i.bak "s/.*mcastport:.*/mcastport:\ $ais_port/g" /etc/corosync/corosync.conf
# sed -i.bak "s/.*\tbindnetaddr:.*/bindnetaddr:\ $ais_addr/g" /etc/corosync/corosync.conf
Lastly, you’ll need to enable quorum
cat << END >> /etc/corosync/corosync.conf
quorum {
provider: corosync_votequorum
expected_votes: 2
}
END


In my case my /etc/corosync/corosync.conf file looks like the following,
#cat /etc/corosync/corosync.conf
# Please read the corosync.conf.5 manual page
compatibility: whitetank
totem {
        version: 2
        secauth: off
        threads: 0
        interface {
                member {
                        memberaddr: 10.30.2.98
                }
                member {
                        memberaddr: 10.30.2.99
                }
                ringnumber: 0
                bindnetaddr: 10.30.2.0
                mcastport: 4000
                ttl: 1
        }
        transport: udpu
}
logging {
        fileline: off
        to_stderr: no
        to_logfile: yes
        logfile: /var/log/cluster/corosync.log
        to_syslog: yes
        debug: off
        timestamp: on
        logger_subsys {
                subsys: AMF
                debug: off
        }
}
quorum {
           provider: corosync_votequorum
           expected_votes: 2
}
Propagate the configuration to other node
# for f in /etc/corosync/corosync.conf /etc/hosts; do scp $f pcmk-2.example.org:$f ; done
Verify Corosync Installation
# /etc/init.d/corosync start
Starting Corosync Cluster Engine (corosync): [ OK ]
Check the cluster started correctly and that an initial membership was able to form
# grep -e "corosync.*network interface" -e "Corosync Cluster Engine" -e "Successfully read main configuration file" /var/log/messages
Aug 27 09:05:34 pcmk-1 corosync[1540]: [MAIN ] Corosync Cluster Engine ('1.1.0'): started and ready to provide service.
Aug 27 09:05:34 pcmk-1 corosync[1540]: [MAIN ] Successfully read main configuration file '/etc/corosync/corosync.conf'.
# grep TOTEM /var/log/messages
Aug 27 09:05:34 pcmk-1 corosync[1540]: [TOTEM ] Initializing transport (UDP/IP).
Aug 27 09:05:34 pcmk-1 corosync[1540]: [TOTEM ] Initializing transmit/receive security: libtomcrypt SOBER128/SHA1HMAC (mode 0).
Aug 27 09:05:35 pcmk-1 corosync[1540]: [TOTEM ] The network interface [192.168.122.101] is now up.
Aug 27 09:05:35 pcmk-1 corosync[1540]: [TOTEM ] A processor joined or left the membership and a new membership was formed.
Start Corosync in other node and check for any error messages.

Verify Pacemaker Insatllation
# grep pcmk_startup /var/log/messages
Aug 27 09:05:35 pcmk-1 corosync[1540]: [pcmk ] info: pcmk_startup: CRM: InitializedAug 27 09:05:35 pcmk-1 corosync[1540]: [pcmk ] Logging: Initialized pcmk_startup
Aug 27 09:05:35 pcmk-1 corosync[1540]: [pcmk ] info: pcmk_startup: Maximum core file size is: 18446744073709551615

Aug 27 09:05:35 pcmk-1 corosync[1540]: [pcmk ] info: pcmk_startup: Service: 9Aug 27 09:05:35 pcmk-1 corosync[1540]: [pcmk ] info: pcmk_startup: Local hostname: pcmk-1.example.org
Now try starting Pacemaker and check the necessary processes have been started
# /etc/init.d/pacemaker start
Starting Pacemaker Cluster Manager: [ OK ]
# grep -e pacemakerd.*get_config_opt -e pacemakerd.*start_child -e "Starting Pacemaker" /var/log/messages
Next, check for any ERRORs during startup - there shouldn’t be any.
# grep ERROR: /var/log/messages | grep -v unpack_resources
Repeat on the other node and display the cluster’s status.
# crm_mon -1
============
Last updated: Thu Aug 27 16:54:55 2009Stack: openais
Current DC: pcmk-1 - partition with quorum
Version: 1.1.5-bdd89e69ba545404d02445be1f3d72e6a203ba2f
2 Nodes configured, 2 expected votes
0 Resources configured.
============
Online: [ pcmk-1.example.org pcmk-2.example.org ]
So far we have build the basic setup, we have to add to resource, with Active/Passive or Active/Active clustering. Will be coming up in next coming posts. 

Thanks for reading, comments would be appreciated. Article taken from www.cluster.org.