]>
Commit | Line | Data |
---|---|---|
12329c57 SD |
1 | ---------------------------------------------- |
2 | The Corosync Cluster Engine Installation Guide | |
3 | ---------------------------------------------- | |
4 | Please read LICENSE for a description of the licensing of this software. | |
5 | ||
6 | All cryptographic software in this package is subject to the following legal | |
7 | notice: | |
8 | This package includes publicly available encryption source code which, | |
9 | together with object code resulting from the compiling of publicly | |
10 | available source code, may be exported from the United States under License | |
11 | Exception TSU prsuant to 15 C.F.R Section 740.13(e). | |
12 | ||
13 | ---------------------------- | |
14 | * Building from subversion * | |
15 | ---------------------------- | |
16 | When building and installing from subversion, automake 2.61 or later is | |
17 | required. Prior versions will result in build failures. | |
18 | ||
19 | Step 1: check out a read only copy of the repository | |
20 | svn checkout http://svn.fedoraprojects.org/svn/corosync | |
21 | ||
22 | Find the version you want to build. Usually this will be the "trunk" version | |
23 | located in the trunk directory. If you want to build a specific released | |
24 | version check in the tags directory. | |
25 | ||
26 | Step 2: Generate the makefiles | |
27 | balance:~/corosync/trunk% ./autogen.sh | |
28 | ||
29 | Step 3: Run the configure script | |
30 | balance:~/corosync/trunk% ./configure | |
31 | ||
32 | Step 4: Install the binaries | |
33 | balance:~/corosync/trunk% su | |
34 | balance:~/corosync/trunk# make install | |
35 | ||
36 | ------------------------- | |
37 | * Building from tarball * | |
38 | ------------------------- | |
39 | The tarball is distributed with pregenerated makefiles. There is no need | |
40 | to run the autogen.sh script in this case. | |
41 | ||
42 | Step 1: Run the configure script | |
43 | balance:~/corosync/trunk% ./configure | |
44 | ||
45 | Step 2: Install the binaries | |
46 | balance:~/corosync/trunk% su | |
47 | balance:~/corosync/trunk# make install | |
48 | ||
49 | ------------------------ | |
50 | * Configuring Corosync * | |
51 | ------------------------ | |
52 | The corosync executive will automatically determine cluster membership by | |
53 | communicating on a specified multicast address and port. | |
54 | ||
45bc8323 | 55 | The directory conf contains the file corosync.conf.example |
12329c57 SD |
56 | |
57 | # Please read the corosync.conf.5 manual page | |
58 | totem { | |
59 | version: 2 | |
60 | secauth: off | |
61 | threads: 0 | |
62 | interface { | |
63 | ringnumber: 0 | |
64 | bindnetaddr: 192.168.1.1 | |
65 | mcastaddr: 226.94.1.1 | |
66 | mcastport: 5405 | |
67 | } | |
68 | } | |
69 | ||
70 | logging { | |
71 | fileline: off | |
72 | to_stderr: yes | |
73 | to_file: yes | |
74 | to_syslog: yes | |
75 | logfile: /tmp/corosync.log | |
76 | debug: off | |
77 | timestamp: on | |
78 | } | |
79 | ||
80 | The totem section contains three values. All three values must be set | |
81 | or the corosync executive wll exit with an error. | |
82 | ||
83 | bindnetaddr specifies the address which the corosync Executive should bind to. | |
84 | This address should always end in zero. If the local interface taffic | |
85 | should routed over is 192.168.5.92, set bindnetaddr to 192.168.5.0. | |
86 | ||
87 | mcastaddr is a multicast address. The default should work but you may have | |
88 | a different network configuration. Avoid 224.x.x.x because this is a "config" | |
89 | multicast address. | |
90 | ||
91 | mcastport specifies the UDP port number. It is possible to use the same | |
92 | multicast address on a network with the corosync services configured for | |
93 | different UDP ports. | |
94 | ||
95 | The timeout section contains seven values. This section is not normally used, | |
96 | but rather used to override the program defaults for the purposes of fine | |
97 | tuning for a given networking/processor combination or for debugging purposes. | |
98 | Be careful to use the same timeout values on each of the nodes in the cluster | |
99 | or unpredictable results may occur. | |
100 | ||
101 | Do not use DOS style termination. This breaks the parser. | |
102 | ||
103 | Configure Host | |
104 | -------------- | |
105 | For security reasons, corosync only allows a process that had the EGID/GID | |
106 | of "ais" to connect to it. To make development easier, it is recommended to | |
107 | create an "ais" user with the "ais" group. | |
108 | ||
109 | [root@balance root]# adduser ais -g ais | |
110 | ||
111 | Set the ais user's password: | |
112 | ||
113 | [root@balance root]# passwd ais | |
114 | Changing password for user ais. | |
115 | New password: | |
116 | Retype new password: | |
117 | passwd: all authentication tokens updated successfully. | |
118 | ||
119 | Generate a private key | |
120 | ---------------------- | |
121 | corosync uses cryptographic techniques to ensure authenticity and privacy of | |
122 | messages. A private key must be generated and shared by all processors for | |
123 | correct operation. | |
124 | ||
125 | First generate the key on one of the nodes: | |
126 | ||
127 | unix# exec/keygen | |
128 | Corosync Authentication key generator. | |
129 | Gathering 1024 bits for key from /dev/random. | |
130 | Writing corosync key to /etc/ais/authkey. | |
131 | ||
132 | After this is complete, a private key will be in the file /etc/ais/authkey. | |
133 | This private key must be copied to every processor that will be a member of | |
134 | the cluster. If the private key isn't the same for every node, those nodes | |
135 | with nonmatching private keys will not be able to join the same configuration. | |
136 | ||
137 | Copy the key to some transportable storage or use ssh to transmit the key | |
138 | from node to node. Then install the key with the command: | |
139 | ||
140 | unix# install -D --group=0 --owner=0 --mode=0400 /path_to_authkey/authkey /etc/ais/authkey | |
141 | ||
142 | If the message invalid digest appears, the keys are not the same on each node. | |
143 | ||
144 | Run the corosync executive | |
145 | ------------------------- | |
146 | Get one or more nodes and run the corosync executive on each node. A list of | |
147 | node IPs should be logged when the nodes join a configuration. Run the | |
148 | corosync daemon after following the previous directions. The daemon must be | |
149 | run as UID 0(root). | |
150 | ||
151 | please read SECURITY to understand the threat model assumed by corosync | |
152 | and the techniques corosync use to overcome these threats. | |
153 | ||
154 | Before running any of the test programs | |
155 | --------------------------------------- | |
156 | The corosync executive will ensure security by only allowing the ais group (or | |
157 | uid root) to connect to the service. Switch to the ais group before | |
158 | running any applications linked to the ais apis, or the applications will | |
159 | not be authenticated and won't be able to access services. | |
160 | ||
161 | [sdake@balance sdake]$ su ais | |
162 | Password: | |
163 | [ais@balance sdake]$ id | |
164 | uid=501(ais) gid=502(ais) groups=502(ais) | |
165 | ||
166 | Try out the corosync cpg functionality | |
167 | -------------------------------------- | |
168 | After corosync is running | |
169 | ||
170 | su to ais user | |
171 | ||
172 | Run test/testcpg on multiple nodes or on the same node. Messages can be typed | |
173 | which will then be sent to other testcpg applications in the cluster. |