How to Prepare the Nodes

Steps

1. Configure the KDC (Key Distribution Center) server which will be used by the Cluster nodes.

   Refer to Solaris Kerberos/SEAM (Sun Enterprise Authentication Mechanism) documentation for details.

2. Set up the time synchronization.

   The KDC server must be time synchronized with the cluster nodes as well as any clients which will be using the Sun Cluster HA for NFS services from the cluster. The NTP (Network Time Protocol) method performs time corrections with greater granularity than other methods, and therefore the time synchronization is more reliable. In order to benefit from this greater reliability, use NTP for the time synchronization.

3. Verify the DNS client configuration.

   The DNS client configuration must be complete and working on all cluster nodes as well as on any NFS clients which will be using secure NFS services from the cluster. Use resolv.conf(4) to verify the DNS client configuration.

   The DNS domain name must be made known to the Kerberos configuration by keeping a mapping in the domain_realm section of krb5.conf(4) file.

   The following example shows a mapping of DNS domain name mydept.company.com to Kerberos realm ACME.COM.

   [domain_realm]
   .mydept.company.com = ACME.COM

4. Ensure that the Master KDC server is up when the Kerberos client software is configured on the cluster nodes.

5. Ensure that the same configuration file and the same service key table file are available to all cluster nodes.

   The /etc/krb5/krb5.conf file must be configured the same on all the cluster nodes. In addition, the default Kerberos keytab file (service key table), /etc/krb5/krb5.keytab, must be configured the same on all the cluster nodes. This can be achieved either by copying the files to all cluster nodes or by keeping a single copy of each file on a global file system and installing symbolic links to /etc/krb5/krb5.conf and /etc/krb5/krb5.keytab on all cluster nodes.

   You can also use a failover file system to make files available to all cluster nodes. However, a file a failover file system is visible on only one node at a time. Therefore, if Sun Cluster HA for NFS is being used in different resource groups, potentially mastered on different nodes, the files are not visible to all cluster nodes. In addition, this configuration complicates Kerberos client administrative tasks.

6. Ensure that all Kerberos-related entries in the file /etc/nfssec.conf are uncommented.

   On all cluster nodes, as well as on any NFS clients that are configured to use secure NFS services from the cluster, all Kerberos-related entries in the file /etc/nfssec.conf must be uncommented. See nfssec.conf(4).