ClusteringQuickInstallationGuide. forpacketfenceversion6.2.1

Transcription

1 ClusteringQuickInstallationGuide forpacketfenceversion6.2.1

2 ClusteringQuickInstallationGuide byinverseinc. Version6.2.1-Jul2016 Copyright 2015Inverseinc. Permissionisgrantedtocopy,distributeand/ormodifythisdocumentunderthetermsoftheGNUFreeDocumentationLicense,Version 1.2oranylaterversionpublishedbytheFreeSoftwareFoundation;withnoInvariantSections,noFront-CoverTexts,andnoBack-Cover Texts.Acopyofthelicenseisincludedinthesectionentitled"GNUFreeDocumentationLicense". ThefontsusedinthisguidearelicensedundertheSILOpenFontLicense,Version1.1.ThislicenseisavailablewithaFAQat: scripts.sil.org/ofl Copyright ŁukaszDziedzic, Copyright RaphLevien,

3 TableofContents AboutthisGuide... 1 Assumptions...2 InstallationonCentOS Step1:Installthereplicateddatabase... 3 Step2:Serverconfiguration... 9 InstallationonCentOS Step1:Installthereplicateddatabase...11 Step2:Serverconfiguration Step3:Createanewcluster Step4:Connectaslavepacketfenceserver...22 Advancedconfiguration Removingaserverfromthecluster Resynchronizingtheconfigurationmanually Addingfilestothesynchronization...25 haproxydashboard...25 Unsupportedfeaturesinactive/active...26 Appendix SettingtheinterfacesnameonCentOS Copyright 2015Inverseinc. iii

4 Chapter1 AboutthisGuide Thisguidehasbeencreatedtogiveaquickstarttoinstallactive/activeclusteringinPacketFence 5+.Thisguidedoesnotincludeadvancedtroubleshootingoftheactive/activeclustering.Referto thedocumentationofhaproxyandkeepaliveforadvancedfeatures. Copyright 2015Inverseinc. AboutthisGuide 1

5 Chapter2 Assumptions YouhaveatleasttwoserverswithafreshinstallofPacketFence5+ Bothserversareidenticalcopiesforthenetworkinterfaces BothserversarerunningCentOS6or7 Bothservershaveaccesstothesamelayer2networkonalltheirnetworkinterfaces Bothservershaveanempty,unformattedpartitionforthedatabase BothservershostnamemustberesolvableviaaDNSresolution Copyright 2015Inverseinc. Assumptions 2

6 Chapter3 InstallationonCentOS6 Step1:Installthereplicateddatabase Note Inthisexample,thedatabaseisreplicatedinactive/passiveacrosstwoserversthatare partofthepacketfencecluster.active/activereplicationisalsopossibleusingmariadb Galeraclusterbutthissubjectisnotcoveredinthisguide. InstallingDRBD CreationoftheDRBDpartition DuringtheOSinstallation,reducethesizeofthemainpartitionandcreateanewone(thatwill beusedforthereplicatedmysqldatabase)of30g.donotcreatethatpartitionduringtheinstall process,wewilldoitlater. Partitioning Aftertheinstallation,youneedtocreatetheextrapartitionforDRBD.Usingfdisk,createyournew partitionandsavethetable.youwillprobablyneedtorebootyourserverafterthisstep. DRBDandLinux-HAInstallation AddtherepositoryELRepo. # yum localinstall EdittherepofiletodisableELRepobydefault: /etc/yum.repos.d/elrepo.repo Copyright 2015Inverseinc. InstallationonCentOS6 3

7 Chapter3 [elrepo] name=elrepo.org Community Enterprise Linux Repository - el6 baseurl= mirrorlist= enabled=0 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/rpm-gpg-key-elrepo.org protect=0 InstallnowthepackageDRBDv8.4enabling. yum install kmod-drbd84 --enablerepo=elrepo DRBDConfigurationandsetup Caution Initializing,configuringandtroubleshootingDRBDisnotstraightforward!Westrongly recommendthatyoureadtheonlinedocumentationavailablefromthedrbdwebsite soyouhaveabetterideaabouthowitworks. Hereweassumethenameofthepartitionismysql. LoadtheDRBDkernelmodule: modprobe drbd Edit/etc/drbd.d/global_common.confwiththefollowingcontent: global { usage-count yes; common { protocol C; startup { degr-wfc-timeout 120; syncer { rate 100M; al-extents 257; disk { on-io-error detach; Copyright 2015Inverseinc. InstallationonCentOS6 4

8 Chapter3 Createthefile/etc/drbd.d/mysql.reswiththefollowingcontent: resource mysql { on <pf1_server_name> { device /dev/drbd0; disk <storage_device>; meta-disk internal; address <ha_interface_ip_address_1>:7788; on <pf2_server_name> { device /dev/drbd0; disk <storage_device>; meta-disk internal; address <ha_interface_ip_address_2>:7788; handlers { split-brain "/usr/lib/drbd/notify-split-brain.sh alert@acme.com"; where: mysqlisthenameofthepartitionyoucreatedwheninstallingtheos pf1_server_nameandpf2_server_namebytherealservernames(fqdn) ha_interface_ip_address_1 and ha_interface_ip_address_2 by the IP addresses of the managementinterfaceonbothservers. storage_deviceisthedevicetouseforthemysqlpartition(ie./dev/sda2) Theninitializethepartition: [root@pf1 ~]# drbdadm create-md mysql Writing meta data... initializing activity log NOT initialized bitmap New drbd meta data block successfully created. success StartDRBDonbothservers: # /etc/init.d/drbd start Youshouldseesomethingsimilartothiswhentypingcat/proc/drbd:... 0: cs:connected ro:secondary/secondary ds:inconsistent/inconsistent C r---- ns:0 nr:0 dw:0 dr:0 al:0 bm:0 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos: Note Ifyougetconnectivityissuesmakesureyouriptablesaredisabled. Copyright 2015Inverseinc. InstallationonCentOS6 5

9 Chapter3 Synchronizetheserversbyforcingonetobecometheprimary.Soonpf1do: # drbdadm primary --force mysql Afterissuingthiscommand,theinitialfullsynchronizationwillstart.Youwillbeabletomonitorits progressvia/proc/drbd.itmaytakesometimedependingonthesizeofthedevice.waituntil itcompletes. Whenthesynciscomplete,createthefilesystemontheprimarynodeonly: # mkfs.ext4 /dev/drbd0 MakesureDRBDisstartedatboottime: # chkconfig --level 2345 drbd on Restartbothservers. Whendone,lookin/proc/drbdandmakesureyousee:... 0: cs:connected ro:primary/secondary ds:uptodate/uptodate C r--- ns:0 nr:0 dw:0 dr:0 al:0 bm:0 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos:0 MySQLConfiguration Firstyouneedtoensureitwillnotstartonboot: ```chkconfigmysqloff``` Note BydefaultMySQLputsitsdatain/var/lib/mysql.Inordertoreplicatedatabetween thetwoservers,wemountthedrbdpartitionunder/var/lib/mysql. WhenfirststartingMySQL,thepartitionmustbemounted. Inordertodoso: Onthemasterserver(theserveryouareworkingon),tellDRBDtobecometheprimarynodewith: # drbdadm primary mysql mysqlbeingthenameofthedrbdpartition. Thecommandcat /proc/drbdshoulddisplaysomethinglike:... 0: cs:connected ro:primary/secondary ds:uptodate/uptodate C r---- ns: nr:4448 dw: dr:10490 al:31 bm:14 lo:0 pe:0 ua:0 ap:0 ep:1 wo:d oos:0 Copyright 2015Inverseinc. InstallationonCentOS6 6

10 Chapter3 StopandbackuppreviousMySQLdata # service mysqld stop # mkdir /var/lib/mysql.bak # mv /var/lib/mysql/* /var/lib/mysql.bak/ Mountthepartitionwith: # mount /dev/drbd0 /var/lib/mysql StartMySQL # service mysqld start Executethesecureinstallationscriptinordertosettherootpassword,removethetestdatabases andanonymoususercreatedbydefault: # /usr/bin/mysql_secure_installation MakesureMySQLdoesnotstartatboottime: # chkconfig --level 2345 mysqld off Heartbeatconfiguration InstalltheEPELrepository # yum localinstall In/etc/yum.repos.d/epel.repo,disabletherepository [epel] name=extra Packages for Enterprise Linux 6 - $basearch #baseurl= mirrorlist= failovermethod=priority enabled=0 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/rpm-gpg-key-epel-6 NowinstallHeartbeat # yum install heartbeat --enablerepo=epel Create/etc/ha.d/ha.cfwiththefollowingcontent: Copyright 2015Inverseinc. InstallationonCentOS6 7

11 Chapter3 bcast eth0 keepalive 2 warntime 30 deadtime 60 auto_failback off initdead 120 node pf1.example.com node pf2.example.com use_logd yes logfile /var/log/ha-log HereweassumethattheconnectionfortheHeartbeatbetweenthe2serversisoneth0.Make sureyouchangepf1.example.comandpf2.example.comtothehostnamesofyourservers. Create/etc/ha.d/haresourceswiththefollowingcontent: pf1.example.com drbddisk::mysql Filesystem::/dev/drbd0::/var/lib/mysql::ext4 \ mysqld Asforthepreviousfile,makesuretoadjusthostname,inthiscasepf1.example.com,accordingly foreachservers. Create/etc/ha.d/authkeyswiththefollowingcontent(makesuretochangethehashforsecurity concerns): auth 1 1 sha1 10abf064f24a3e807dde7b945d f10777d andchangeitsrightslikethis: # chmod 600 /etc/ha.d/authkeys Changingthehashcanbeachievedbyrunningecho -n password sha1sum awk '{print $1', wherepasswordwouldbeapasswordofyourchoice. StartHeartbeat: Note Makesureudpport694isopened(throughiptables)onbothservers.Importantmainly ifanexistingiptablesconfigurationisinplaceontheserver.packetfencedoesallow itonit shigh-availabilityinterface. # service heartbeat start LookatHeartbeatlogfile/var/log/ha-logtomakesurethateverythingisfine. EnableHBautomaticstart # chkconfig --level 345 heartbeat on Copyright 2015Inverseinc. InstallationonCentOS6 8

12 Chapter3 MySQLnetworkconfiguration InorderforyourPacketFenceclustertocommunicateproperlywiththeMySQLdatabase,youneed tohavemysqlbindonthemanagementipaddress. AdjustyourMySQLconfigurationin/etc/my.cnfonbothserversandmakesurethebind_address lineis: bind_address=<management_ip_address> Step2:Serverconfiguration YouwillneedtoconfiguretheserversotheservicescanbindonIPaddressestheydon tcurrently haveconfigured.thisallowsfasterfailoveroftheservices. OnCentOS,addthefollowinglinein/etc/sysctl.confandthenreloadwithsysctl-p net.ipv4.ip_nonlocal_bind = 1 CreatethePEMthatcombinesthekeyandcertificateforthehttpservices.Adapttoyourown pathsifyouareusingdifferentcertificates. # cd /usr/local/pf/conf/ssl # cat server.key server.crt > server.pem MySQLconfiguration InorderforPacketFencetocommunicateproperlywithyourMySQLcluster,youneedtochange thefollowing. Inconf/pf.conf: [database] host= [monitoring] db_host= Inconf/pfconfig.conf: [mysql] host= Copyright 2015Inverseinc. InstallationonCentOS6 9

13 Chapter3 MakesureyourestartMySQL,packetfence-configandpacketfence # service mysqld restart # service packetfence-config restart # service packetfence restart Next,youneedtoremovetheemptyusersfromyourMySQLdatabase # mysql mysql> delete from mysql.user where user = '' ; mysql> flush privileges; Copyright 2015Inverseinc. InstallationonCentOS6 10

14 Chapter4 InstallationonCentOS7 Firstmakesurethatyousystemiscorrectlyconfiguredandup-to-date # yum update /etc/hostsmustcontain: ha_interface_ip_address_1 pf1_server_name ha_interface_ip_address_2 pf2_server_name Sethostnameoneachserver: # hostnamectl set-hostname pf1_server_name # hostnamectl set-hostname pf2_server_name Disableselinux # setenforce 0 pf1_server_nameandpf2_server_namebytherealservernames(fqdn) ha_interface_ip_address_1 and ha_interface_ip_address_2 by the IP addresses of the managementinterfaceonbothservers. Step1:Installthereplicateddatabase Note Inthisexample,thedatabaseisreplicatedinactive/passiveacrosstwoserversthatare partofthepacketfencecluster.active/activereplicationisalsopossibleusingmariadb Galeraclusterbutthissubjectisnotcoveredinthisguide. Copyright 2015Inverseinc. InstallationonCentOS7 11

15 Chapter4 InstallingDRBD CreationoftheDRBDpartition DuringtheOSinstallation,reducethesizeofthemainpartitionandcreateanewone(thatwill beusedforthereplicatedmysqldatabase)of30g.donotcreatethatpartitionduringtheinstall process,wewilldoitlater. Partitioning Afterinstallation,youneedtocreatetheextrapartitionforDRBD.Usingfdisk,createyournew partitionandsavethetable.youwillprobablyneedtorebootyourserverafterthisstep. PacemakerandCorosyncinstallationandconfiguration Installpcs(pacemaker/corosync)configurationsystem # yum install -y pcs Firstyouneedtodisablefirewalldandreplaceitbyiptables # systemctl disable firewalld # yum install -y iptables-services # systemctl enable iptables.service # iptables -F # iptables -X # iptables -t nat -F # iptables -t nat -X # iptables -t mangle -F # iptables -t mangle -X # iptables -P INPUT ACCEPT # iptables -P FORWARD ACCEPT # iptables -P OUTPUT ACCEPT # service iptables save Nextyouneedtosetupapasswordforthepcsadministrationaccountnamedhacluster # echo "passwd" passwd hacluster --stdin Startandenabletheservice # systemctl start pcsd.service # systemctl enable pcsd.service Enablecorosyncandpacemaker Copyright 2015Inverseinc. InstallationonCentOS7 12

16 Chapter4 # systemctl enable corosync # systemctl enable pacemaker Createanewcluster: # pcs cluster auth ha_interface_ip_address_1 ha_interface_ip_address_2 -u hacluster -p passwd # pcs cluster setup --name mysql_cluster ha_interface_ip_address_1 ha_interface_ip_address_2 -u hacluster -p passwd # pcs cluster start --all DRBDConfigurationandsetup AddtherepositoryELREpo. # yum localinstall EdittherepofiletodisableELRepobydefault: /etc/yum.repos.d/elrepo.repo [elrepo] name=elrepo.org Community Enterprise Linux Repository - el7 baseurl= mirrorlist= enabled=0 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/rpm-gpg-key-elrepo.org protect=0 InstallnowthepackageDRBDv8.4enabling. # yum install kmod-drbd84 --enablerepo=elrepo Caution Initializing,configuringandtroubleshootingDRBDisnotstraightforward!Westrongly recommendthatyoureadtheonlinedocumentationavailablefromthedrbdwebsite soyouhaveabetterideaabouthowitworks. Hereweassumethenameofthepartitionismysql. LoadtheDRBDkernelmodule: Copyright 2015Inverseinc. InstallationonCentOS7 13

17 Chapter4 modprobe drbd Createthefile/etc/drbd.d/global_common.conf: cat << EOL >/etc/drbd.d/global_common.conf global { usage-count yes; common { protocol C; startup { degr-wfc-timeout 120; syncer { rate 100M; al-extents 257; EOL disk { on-io-error detach; Createthefile/etc/drbd.d/mysql.res: Copyright 2015Inverseinc. InstallationonCentOS7 14

18 Chapter4 cat << EOL >/etc/drbd.d/mysql.res resource mysql { protocol C; meta-disk internal; device /dev/drbd0; disk storage_device; handlers { split-brain "/usr/lib/drbd/notify-split-brain.sh root"; net { allow-two-primaries no; after-sb-0pri discard-zero-changes; after-sb-1pri discard-secondary; after-sb-2pri disconnect; rr-conflict disconnect; disk { on-io-error detach; syncer { verify-alg sha1; on pf1 { address ha_interface_ip_address_1:7789; on pf2 { address ha_interface_ip_address_2:7789; EOL where: ha_interface_ip_address_1 and ha_interface_ip_address_2 by the IP addresses of the managementinterfaceonbothservers. storage_deviceisthedevicetouseforthemysqlpartition(ie./dev/sda2) Theninitializethepartition: [root@pf1 ~]# drbdadm create-md mysql Writing meta data... initializing activity log NOT initialized bitmap New drbd meta data block successfully created. success StartDRBDonbothservers: # systemctl start drbd Youshouldseesomethingsimilartothiswhentypingcat/proc/drbd: Copyright 2015Inverseinc. InstallationonCentOS7 15

19 Chapter4... 0: cs:connected ro:secondary/secondary ds:inconsistent/inconsistent C r---- ns:0 nr:0 dw:0 dr:0 al:0 bm:0 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos: Note Ifyougetconnectivityissuesmakesureyouriptablesaredisabled. Synchronizetheserversbyforcingonetobecometheprimary.Soonpf1do: # drbdadm primary --force mysql Afterissuingthiscommand,theinitialfullsynchronizationwillstart.Youwillbeabletomonitorits progressvia/proc/drbd.itmaytakesometimedependingonthesizeofthedevice.waituntil itcompletes. Whenthesynciscomplete,createthefilesystemontheprimarynodeonly: # mkfs.ext4 /dev/drbd0 MakesureDRBDisstartedatboottime: # systemctl enable drbd Restartbothservers. Whendone,dodrbd-overviewandmakesureyousee:... 0:mysql/0 Connected Primary/Secondary UpToDate/UpToDate MariaDBConfiguration Firstyouneedtoensureitwillnotstartonboot: ```systemctldisablemariadb``` Note BydefaultMariaDBputsitsdatain/var/lib/mysql.Inordertoreplicatedatabetween thetwoservers,wemountthedrbdpartitionunder/var/lib/mysql. WhenfirststartingMariaDB,thepartitionmustbemounted. Inordertodoso: Onthemasterserver(theserveryouareworkingon),tellDRBDtobecometheprimarynodewith: # drbdadm primary mysql Copyright 2015Inverseinc. InstallationonCentOS7 16

20 Chapter4 mysqlbeingthenameofthedrbdpartition. Thecommandcat /proc/drbdshoulddisplaysomethinglike:... 0: cs:connected ro:primary/secondary ds:uptodate/uptodate C r---- ns: nr:4448 dw: dr:10490 al:31 bm:14 lo:0 pe:0 ua:0 ap:0 ep:1 wo:d oos:0 StopandbackuppreviousMariaDBdata # systemctl stop mariadb # mkdir /var/lib/mysql.bak # mv /var/lib/mysql/* /var/lib/mysql.bak/ Mountthepartitionwith: # mount /dev/drbd0 /var/lib/mysql StartMariaDB # systemctl start mariadb Executethesecureinstallationscriptinordertosettherootpassword,removethetestdatabases andanonymoususercreatedbydefault: # /usr/bin/mysql_secure_installation MakesureMariaDBdoesnotstartatboottime: # systemctl disable mariadb MariaDBnetworkconfiguration InorderforyourPacketFenceclustertocommunicateproperlywiththeMariaDBdatabase,you needtohavemariadbbindonthemanagementipaddress. AdjustyourMariaDBconfigurationin/etc/my.cnfonbothserversandmakesurethebind_address lineis: bind_address=<management_ip_address> Step2:Serverconfiguration You need to make sure the interfaces name will be the same on both servers. See Setting the interfacesnameoncentos7intheappendixsectionofthisdocument. Copyright 2015Inverseinc. InstallationonCentOS7 17

21 Chapter4 YouwillneedtoconfiguretheserversotheservicescanbindonIPaddressestheydon tcurrently haveconfigured.thisallowsfasterfailoveroftheservices. OnCentOS,addthefollowinglinein/etc/sysctl.confandthenreloadwithsysctl-p net.ipv4.ip_nonlocal_bind = 1 CreatethePEMthatcombinesthekeyandcertificateforthehttpservices.Adapttoyourown pathsifyouareusingdifferentcertificates. # cd /usr/local/pf/conf/ssl # cat server.key server.crt > server.pem Corosyncconfiguration # pcs cluster start --all # pcs cluster cib clust_cfg # pcs -f clust_cfg property set stonith-enabled=false # pcs -f clust_cfg property set no-quorum-policy=ignore # pcs -f clust_cfg resource defaults resource-stickiness=200 # pcs -f clust_cfg resource create DRBD ocf:linbit:drbd \ drbd_resource=mysql \ op monitor interval=30s # pcs -f clust_cfg resource master MySQLClone DRBD \ master-max=1 master-node-max=1 \ clone-max=2 clone-node-max=1 \ notify=true # pcs -f clust_cfg resource create DRBD_fs Filesystem \ device="/dev/drbd0" \ directory="/var/lib/mysql" \ fstype="ext4" # pcs -f clust_cfg constraint colocation add DRBD_fs with MySQLClone \ INFINITY with-rsc-role=master # pcs -f clust_cfg constraint order promote MySQLClone then start DRBD_fs Copyright 2015Inverseinc. InstallationonCentOS7 18

22 Chapter4 # pcs -f clust_cfg resource create MariaDB ocf:heartbeat:mysql \ binary="/usr/bin/mysqld_safe" \ config="/etc/my.cnf" \ datadir="/var/lib/mysql" \ pid="/var/lib/mysql/mariadb.pid" \ socket="/var/lib/mysql/mysql.sock" \ op start timeout=60s \ op stop timeout=60s \ op monitor interval=20s timeout=30s # pcs -f clust_cfg constraint colocation add MariaDB with DRBD_fs INFINITY # pcs -f clust_cfg constraint order DRBD_fs then MariaDB # pcs cluster cib-push clust_cfg # pcs status Checkthestatusofthecluster: # pcs status Thentryafailover: # pcs cluster standby pf1_server_name # pcs status ```Clustername:mysql_clusterLastupdated:TueApr1909:38:562016Lastchange:TueApr 19 09:38: by root via crm_attribute on pf1 Stack: corosync Current DC: pf2 (version el7_2.2-44eb2dd)-partitionwithquorum2nodesand4resourcesconfigured Nodepf1_server_name:standbyOnline:[pf2_server_name] Fulllistofresources: Master/Slave Set: MySQLClone [DRBD] Masters: [ pf2 ] Stopped: [ pf1 ] DRBD_fs (ocf::heartbeat:filesystem): Started pf2_server_name MariaDB (ocf::heartbeat:mysql): Started pf2_server_name PCSDStatus:pf1:Onlinepf2:Online DaemonStatus:corosync:active/disabledpacemaker:active/disabledpcsd:active/enabled``` # pcs cluster unstandby pf1_server_name Copyright 2015Inverseinc. InstallationonCentOS7 19

23 Chapter4 InorderforPacketFencetocommunicateproperlywithyourMySQLcluster,youneedtochange thefollowing. Inconf/pf.conf: [database] host= [monitoring] db_host= Inconf/pfconfig.conf: [mysql] host= MakesureyourestartMySQL,packetfence-configandpacketfence # systemctl restart mariadb # systemctl restart packetfence-config # systemctl restart packetfence Next,youneedtoremovetheemptyusersfromyourMySQLdatabase # mysql mysql> delete from mysql.user where user = '' ; mysql> flush privileges; Step3:Createanewcluster Inordertocreateanewcluster,theonlythingneededistoconfigure/usr/local/pf/conf/cluster.conf Youwillneedtoconfigureitwithyourserverhostname.Togetituse:hostnameinacommandline. Inthecaseofthisexampleitwillbepf1.example.com. TheCLUSTERsectionrepresentsthevirtualIPaddressesofyourclusterthatwillbesharedbyyour servers. Inthisexample,eth0isthemanagementinterface,eth1.2istheregistrationinterfaceandeth1.3 istheisolationinterface. Createaconfigurationsimilartothis: Copyright 2015Inverseinc. InstallationonCentOS7 20

24 Chapter4 [CLUSTER] management_ip= [CLUSTER interface eth0] ip= type=management,high-availability [CLUSTER interface eth1.2] ip= type=internal [CLUSTER interface eth1.3] ip= type=internal [pf1.example.com] management_ip= [pf1.example.com interface eth0] ip= type=management,high-availability mask= [pf1.example.com interface eth1.2] enforcement=vlan ip= type=internal mask= [pf1.example.com interface eth1.3] enforcement=vlan ip= type=internal mask= Oncethisconfigurationisdone,restartPacketFencetohaveitapplied.Ifdoneproperlythisshould starttwoadditionnalservices:haproxyandkeepalived YoushouldnowhaveserviceontheIPaddressesdefinedintheCLUSTERsections Additionnalsteps Itishighlyrecommendedtomodifythekeepalivesharedsecretinyourclustertopreventattacks. In the administration interface, go in Configuration/Clustering and change the Shared KEY. Make sureyourestartkeepaliveonyourserverusing/usr/local/pf/bin/pfcmd service keepalived restart Copyright 2015Inverseinc. InstallationonCentOS7 21

25 Chapter4 Step4:Connectaslavepacketfenceserver First,connecttheservertothedatabaseclusterusingtheinstructionsabove OnCentOS,addthefollowinglinein/etc/sysctl.confandthenreloadwithsysctl-p net.ipv4.ip_nonlocal_bind = 1 Gothroughtheconfiguratortosetuptheinterfacesandthenstop GetthewebservicesuserandpasswordonthemasternodeinConfiguration/WebServicesIfthere s none,settheuser,passwordandthenrestarthttpd.webservices Do(andmakesureitdoesitwithoutanyerrors): # /usr/local/pf/bin/cluster/sync --from= api-user=packet --apipassword=fence Where: isthemanagementIPoftheotherPacketFencenode packetisthewebservicesusernameonthemasternode fenceisthewebservicespasswordonthemasternode Edit/usr/local/pf/conf/cluster.confandcreatetheserver sconfigurationusingtheothernodeas anexample. Reloadtheconfiguationandstartthewebservicesonthenewserver # service packetfence-config restart # /usr/local/pf/bin/pfcmd configreload # /usr/local/pf/bin/pfcmd service haproxy restart # /usr/local/pf/bin/pfcmd service httpd.webservices restart Makesurethatthisserverisbindingtoit sownmanagementaddress.ifit snot,verifythe/usr/ local/pf/conf/cluster.confmanagementinterfaceconfiguration. # netstat -nlp grep 9090 Nowreplicatethisserverconfigurationtotheothernodesinthecluster # /usr/local/pf/bin/cluster/sync --as-master Makesureatleast/usr/local/pf/conf/cluster.confwasreplicatedtotheotherservers Copyright 2015Inverseinc. InstallationonCentOS7 22

26 Chapter4 Now restart packetfence on each cluster server keeping the new node as the last one to be restarted. Copyright 2015Inverseinc. InstallationonCentOS7 23

27 Chapter5 Advancedconfiguration Removingaserverfromthecluster Note RemovingaserverfromtheclusterrequiresarestartofthePacketFenceserviceon allnodes. First,youwillneedtostopPacketFenceonyourserverandputitoffline. # service packetfence stop # shutdown -h 0 Thenyouneedtoremovealltheconfigurationassociatedtotheserverfrom/usr/local/pf/conf/ cluster.confononeoftheremainingnodes.configurationforaserverisalwaysprefixedbythe server shostname. Once you have removed the configuration, you need to reload it and synchronize it with the remainingnodesinthecluster. # /usr/local/pf/bin/pfcmd configreload hard # /usr/local/pf/bin/cluster/sync --as-master NowrestartPacketFenceonalltheserverssothattheremovednodeisnotpartoftheclustering configuration. Resynchronizingtheconfigurationmanually Ifyoudidamanualchangeinaconfigurationfile,anadditionnalstepisnowneeded. Inordertobesuretheconfigurationisproperlysynchedonallnodes,youwillneedtoenterthis commandonthepreviouslyselectedmasternode. # /usr/local/pf/bin/cluster/sync --as-master Copyright 2015Inverseinc. Advancedconfiguration 24

28 Chapter5 Addingfilestothesynchronization Intheeventthatyoudomodificationstonon-synchronizedfileslikeswitchmodules,filesinraddb/, etc,youcanaddthosefilestobesynchronizedwhenusing/usr/local/pf/bin/cluster/sync. Ononeofthenodes,create/usr/local/pf/conf/cluster-files.txt Addtheadditionnalfilesoneperlineinthisfile.Weadviseyouaddthisfiletothesynchronization too. Example: /usr/local/pf/conf/cluster-files.txt /usr/local/pf/raddb/modules/mschap haproxydashboard Youhavethepossibilitytoconfigurethehaproxydashboardwhichwillgiveyoustatisticsaboutthe currentstateofyourcluster. Inordertoactiveituncommentthefollowinglinesfrom/usr/local/pf/conf/haproxy.conf listen stats %%active_active_ip%%:1025 mode http timeout connect 10s timeout client 1m timeout server 1m stats enable stats uri /stats stats realm HAProxy\ Statistics stats auth admin:packetfence Note Westronglyadviseyouchangetheusernameandpasswordtosomethingelsethan admin/packetfencealthoughaccesstothisdashboarddoesn tcompromisetheserver. Next,uncommentthefollowinglinefrom/usr/local/pf/conf/iptables.conf Caution Ifyou reupgradingfromaversionpriorto5.0,thelinemaynotbethere.additclose totheothermanagementrules Copyright 2015Inverseinc. Advancedconfiguration 25

29 Chapter5 -A input-management-if --protocol tcp --match tcp --dport jump ACCEPT Nowrestarthaproxyandiptablesinordertocompletetheconfiguration # /usr/local/pf/bin/pfcmd service haproxy restart # /usr/local/pf/bin/pfcmd service iptables restart YoushouldnowbeabletoconnecttothedashboardonthefollowingURL: stats Unsupportedfeaturesinactive/active Thefollowingfeaturesarenotsupportedwhenusingactive/activeclustering. SwitchesusingSNMPbasedenforcement(port-security,linkup/down, ) SNMProamingwiththeAerohivecontroller.(4.7+includessupportforaccountingroaming) Copyright 2015Inverseinc. Advancedconfiguration 26

30 Chapter6 Appendix SettingtheinterfacesnameonCentOS7 OnCentOS7youneedtomakesurethatalltheserversintheclusterusethesameinterfaces name.thissectioncovershowtosettheinterfacestotheethxformat.notethatyoucansetitto theformatyoudesireaslongasthenamesarethesameonallservers. First,goin/etc/default/grubandaddnet.ifnames=0tothevariable:GRUB_CMDLINE_LINUX. GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=centos/root rd.lvm.lv=centos/swap rhgb quiet net.ifnames=0" ThenregeneratetheGRUBconfigurationbyexecutingthefollowingcommand: # grub2-mkconfig -o /boot/grub2/grub.cfg Then,renamethenetworkscriptofyourmanagementinterface(eno inthisexample)to beintheethxform(eth0inthisexample) # mv /etc/sysconfig/network-scripts/ifcfg-eno /etc/sysconfig/networkscripts/ifcfg-eth0 Andrenamethenameoftheinterfaceinthescript(makingsureyoureplaceeno andeth0 bytheappropriatevalues): # sed -i.bak "s/eno /eth0/g" /etc/sysconfig/network-scripts/ifcfg-eth0 Applythelasttwostepsforanyotherinterfaceyouhaveonyourserver.Keepinmind,youcan usethepacketfenceconfiguratortoreconfigurethemlateraslongasyourmanagementinterface iscorrectlyconfiguredandisaccessibleonyournetwork. Now,rebootyourserverandwhenitfinishesstarting,yourinterfacesnameshouldnowbeusing theformatethx Copyright 2015Inverseinc. Appendix 27