Linux HA Clusters with Heartbeat

by R.I. Pienaar | Nov 25, 2007 | Usefull Things

I played with heartbeat a year or so ago and while it was ok, I was not convinced it was 100% there yet, it lacked monitoring capabilities of resources it managed which was a major drawback in my mind.
I again had a need for a cluster recently so had another look. Since the previous time they’ve released Heartbeat version 2 which has a full resource manager like you’ll find in more mature systems.
The only time I’ve previously used a cluster system extensively was on Windows 2003 Enterprise with MS SQL Server Enterprise, the setup then was a active-passive SQL cluster with shared fibre storage. The windows cluster services works quite well, have a solid GUI and supports many nodes in a cluster.

It was out of date and didn’t take into account the fact that not everyone is on the same version. Instead, you should refer to crm.dtd on your system (which is always appropriate to your version).

Heartbeat does provide a GUI but I found it immature, inconsistent and often had error messages pop up with no contents in them other than an ‘OK’ button. It also lacked some features, while evaluating it I decided if I had to rely on the GUI in any way as it stands today I would not use Heartbeat for my cluster as it would invalidate any high availability hopes I had. It is useful though to monitor and visualise your cluster, especially if you have a lot of groups.

GMail IMAP

by R.I. Pienaar | Nov 1, 2007 | Usefull Things

Recently Google announced that all gmail users are getting IMAP, this is fantastic news. I won’t actually use it with an IMAP client but I will use it to backup my mail and my meta data! It might even help me to slowly import years and years of old mail into GMail.
So how to do a backup, first you need imapsync or something similar, I’ll use imapsync since that’s what I know.
Second you need a local imap server to dump your gmail account into, I am using my current server that already has other mail in it so I made a sub-folder called GMail to sync into.
Once you have imapsync installed its pretty simple with the following command line:

imapsync --host1 imap.gmail.com --ssl1 --user1 you@gmail.com \
--password1 secret --host2 your.imap.com --user2 you --password2 secret \
--prefix2 INBOX.GMail. --authuser1 you@gmail.com --authmech1 LOGIN \
--authmech2 LOGIN --syncinternaldates

You’ll need to look at that command and set appropriate options for your user, password and imap account. Also if you’re going to run this on a shared machine where other user accounts exist, you should use the –passfile1 and –passfile2 options to not show your password in the output of ps.
The process is slow, and creates some duplicates for instance you’ll have a [Gmail]/All Mail folder that contains all your mail but you’ll also have folders for each tag that would have copies of messages that are already in your All Mail. This to me is a small price to pay for the peace of mind that solid off-site backups provide as the thought of my mail on a 3rd party system has been keeping me awake 🙂

IPSEC On RedHat Enterprise

by R.I. Pienaar | Jun 23, 2007 | Usefull Things

I’ve had the miss-fortune of configuring IPSEC on many FreeBSD machines and other devices in the past and in all cases it’s been a pain, as a result I’ve been putting off securing connections between 3 machines that I knew needed IPSEC.
Last night I figured I may as well start looking at what is involved in building a star topology between the three hosts where comms between each node and each other node is encrypted. Turns out it could not possibly have been simpler.
This is well documented in the RedHat docs – RHEL 3, RHEL 4, RHEL 5 – but it’s worth repeating because it really is clean and simple and elegant.
Being that these are point-to-point tunnels it makes a lot of sense to see the connections as new network cards and this is the approach redhat took, simply create /etc/sysconfig/network-scripts/ifcfg-ipsecX files where X is any number. This is a sample:

DST=x.x.x.x
TYPE=IPSEC
ONBOOT=yes
IKE_METHOD=PSK

And do the same on your other host. Now create a pre-shared key in /etc/sysconfig/network-scripts/keys-ipsecX with file mode 600:

IKE_PSK=s3cret

This key has to be the same on both hosts, run ifup ipsecX and it should negotiate, check /var/log/messages for diagnostics.
It is that easy, you can use tcpdump to verify that all is working good.
Under the covers the redhat scripts still use racoon and all the standard stuff, it creates files in /etc/racoon and you can use tools such as setkey etc to diagnose problems.
This is a simple p2p VPN, the RedHat docs shows how to do it on your gateway device – it’s as simple.