From ac33dffad49541ae5e9e27eea996ea43bbdd1327 Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Thu, 29 May 2014 15:02:15 +0000 Subject: NO-JIRA: HA documentation: security configuration troubleshooting Common issue for new users is cluster failing to start due to incorrect security configuration. Added some notes to highlight the need for security configuration and updated the troubleshooting section. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1598315 13f79535-47bb-0310-9956-ffa450edef68 --- .../book/src/cpp-broker/Active-Passive-Cluster.xml | 84 ++++++++++++++++------ 1 file changed, 62 insertions(+), 22 deletions(-) diff --git a/qpid/doc/book/src/cpp-broker/Active-Passive-Cluster.xml b/qpid/doc/book/src/cpp-broker/Active-Passive-Cluster.xml index 6e0225a2af..246a0a4ab5 100644 --- a/qpid/doc/book/src/cpp-broker/Active-Passive-Cluster.xml +++ b/qpid/doc/book/src/cpp-broker/Active-Passive-Cluster.xml @@ -219,6 +219,12 @@ under the License. The broker must load the ha module, it is loaded by default. The following broker options are available for the HA module. + + + Incorrect security settings are a common cause of problems when + getting started, see . + + Broker Options for High Availability Messaging Cluster @@ -822,8 +828,22 @@ connection = qpid.messaging.Connection.establish("node1", reconnect=True, reconn Please see for more details on enabling authentication and setting up Access Control Lists. + + + Unless you disable authentication with auth=no in + your configuration, you must set the options below + and you must have an ACL file with at least the + entry described below. + + + Backups will be unable to connect to the primary if + the security configuration is incorrect. See also + + - When authentication is enabled, HA brokers use the credentials set by the following options: + When authentication is enabled you must set the credentials used by HA + brokers with following options:
HA Security Options @@ -848,7 +868,13 @@ connection = qpid.messaging.Connection.establish("node1", reconnect=True, reconn ha-mechanism MECHANISM - Mechanism for HA brokers. + + + Mechanism for HA brokers. Any mechanism you enable for + broker-to-broker communication can also be used by a client, so + do not use ha-mechanism=ANONYMOUS in a secure environment. + + @@ -922,27 +948,41 @@ qpid-ha -b broker-address promote This section applies to clusters that are using rgmanager as the cluster manager. -
- Authentication failures +
+ No primary broker + + When you initially start a HA cluster, all brokers are in + joining mode. The brokers do not automatically select + a primary, they rely on the cluster manager rgmanager + to do so. If rgmanager is not running or is not + configured correctly, brokers will remain in the + joining state. See + +
+
+ Authentication and ACL failures - If a broker is unable to establish a connection to another broker - in the cluster due to authentication problems, the log will - contain SASL errors, for example: + If a broker is unable to establish a connection to another broker in the + cluster due to authentication or ACL problems the logs may contain + errors like the following: + +info SASL: Authentication failed: SASL(-13): user not found: Password verification failed + + +warning Client closed connection with 320: User anonymous@QPID federation connection denied. Systems with authentication enabled must specify ACL create link rules. + -2012-aug-04 10:17:37 info SASL: Authentication failed: SASL(-13): user not found: Password verification failed +warning Client closed connection with 320: ACL denied anonymous@QPID creating a federation link. - Set the SASL user name and password used to connect to other - brokers using the ha-username and ha-password properties when you - start the broker. Set the SASL mode using ha-mechanism. Any - mechanism you enable for broker-to-broker communication can also - be used by a client, so do not enable ha-mechanism=ANONYMOUS in a - secure environment. Once the cluster is running, run qpid-ha to - make sure that the brokers are running as one cluster. + Set the HA security configuration and ACL file as described in . Once the cluster is running and the primary is + promoted , run qpid-ha to make sure that the brokers + are running as one cluster.
-
+
Slow recovery times The following configuration settings affect recovery time. The @@ -950,7 +990,7 @@ qpid-ha -b broker-address promote loaded system. You should run tests to determine if the values are appropriate for your system and load conditions. -
+
cluster.conf: <rm status_poll_interval=1> @@ -970,7 +1010,7 @@ qpid-ha -b broker-address promote failing over the VIP to a new address.
-
+
qpidd.conf link-maintenance-interval=0.1 @@ -1006,7 +1046,7 @@ link-heartbeat-interval=5
-
+
Total cluster failure The cluster can only guarantee availability as long as there is at @@ -1047,7 +1087,7 @@ link-heartbeat-interval=5 If the surviving broker fails before that the cluster will fail in one of two modes (depending on the exact timing of failures) -
+
1. The cluster hangs All brokers are in joining or catch-up mode. rgmanager tries to @@ -1080,7 +1120,7 @@ service:qpidd-primary-service (20.0.10.33) stopped with clusvcadm, then restart (primary last)
-
+
2. The cluster reboots A new primary is promoted and the cluster is functional but all @@ -1088,7 +1128,7 @@ service:qpidd-primary-service (20.0.10.33) stopped
-
+
Fencing and network partitions A network partition is a a network failure that divides the -- cgit v1.2.1