NAME

       corosync-qnetd - QNet daemon

SYNOPSIS

       corosync-qnetd  [-46dfhv]  [-l  listen_addr]  [-p  listen_port]  [-s  tls]  [-c client_cert_required] [-m
       max_clients] [-S option=value[,option2=value2,...]]"

DESCRIPTION

       corosync-qnetd is a daemon running outside of the cluster with the purpose of providing  a  vote  to  the
       corosync-qdevice  model  net.  It's designed to support multiple clusters and be almost configuration and
       state free. New clusters are handled dynamically and no configuration file exists.  It's also able to run
       as  non-root user - which is recommended. Connection between the corosync-qdevice model net client can be
       optionally configured with TLS client certificate checking.  The communication  protocol  between  server
       and client is designed to be very simple and allow backwards compatibility.

OPTIONS

       -4     and  its  counterpart -6 are used to force IPv4 or IPv6 communication. The default is to listen on
              both address families.

       -d     Turn on debug logging. By default the messages sent to syslog are purely operational, this  option
              sends  additional  debug  messages.  For  bumping  syslog  messages  priority  to info, use the -d
              parameter twice.

       -f     Do not daemonize, run in the foreground.

       -h     Show short help text

       -v     Show version and supported communication protocol messages/options.

       -l     IP address to listen on. By default the daemon listens on all addresses (wildcard).

       -p     TCP port to listen on. Default port is 5403.

       -s     Determines if TLS should be used and can be one of on/off/required (the default is on ).  on means
              TLS  is enabled but the client is not required to start TLS, off means TLS is completely disabled,
              and required means TLS is required.  on and required require  the  NSS  database  to  be  properly
              initialized by running the corosync-qnetd-certutil command.

       -c     can  be  set to on/off.  This option only makes sense if TLS is enabled. When -c is on a client is
              required to send its client certificate (default).

       -m     Maximum simultaneous clients. The default is 0 which means no limit.

       -S     Set advanced settings described in its own section below. This option shouldn't be generally  used
              because most of the options are not safe to change.

UNPRIVILEGED USER CONFIGURATION

       It's  generally  recommended  to  run  corosync-qnetd  as  a  non  root user. If you get a package from a
       distribution its highly possible that  the  packager  has  done  all  the  hard  work  for  you.  If  the
       installation is performed from source code, a few steps have to be taken.

       First  it's  necessary to create an unprivileged user/group. The following commands can be used (executed
       as root):

       # groupadd -r coroqnetd
       # useradd -r -g coroqnetd -d / -s /sbin/nologin -c "User for corosync-qnetd" coroqnetd

       The next step is to set the correct owner and group on  /etc/corosync/qnetd  and  /var/run/corosync-qnetd
       directories.

       # chown -R coroqnetd:coroqnetd /etc/corosync/qnetd /var/run/corosync-qnetd

       Some  systems have the /var/run directory on a tmpfs file system which gets discarded after a reboot. The
       solution  is  to  use  an  initscript  or  systemd  unit,  because  both  of  them  takes  care  of   the
       /var/run/corosync-qnetd creation and sets the correct owner and permissions.

       The  last  step is to make sure corosync-qnetd is really executed as an unprivileged user. For initscript
       systems it's enough to set the line COROSYNC_QNETD_RUNAS in /etc/(sysconfig|default)/corosync-qnetd file.
       If  the  file  is  not  already  installed  then  use  the  one  provided  in  the  corosync  source code
       (init/corosync-qnetd.sysconfig.example). For systemd, overwrite/copy the corosync-qnetd.service unit file
       and uncomment/change the "User=" directive.

TLS CONFIGURATION

       For TLS to work its necessary to create the NSS database. If pcs is used then the following steps are not
       needed because pcs does them automatically.

       corosync-qnetd-certutil is the tool to perform required actions. Just run:

       # corosync-qnetd-certutil -i

       If TLS is not required then simply edit /etc/(sysconfig|default)/corosync-qnetd or systemd unit file  and
       add the parameter -s off in the proper place.

       Depending  on  configuration of NSS (stored in nss.config file usually in /etc/crypto-policies/back-ends/
       directory) disabled ciphers or too short keys may be rejected.  Proper  solution  is  to  regenerate  NSS
       databases  for both corosync-qnetd and corosync-qdevice daemons. As a quick workaround it's also possible
       to set environment variable NSS_IGNORE_SYSTEM_POLICY=1 before running corosync-qnetd daemon.

       When NSS is updated it may also be needed to upgrade database into new format. There is no  consensus  on
       recommended way, but following command seems to work just fine (if qnetd sysconfdir is set to /etc)

       # certutil -N -d /etc/corosync/qnetd/nssdb -f /etc/corosync/qnetd/nssdb/pwdfile.txt

ADVANCED SETTINGS

       Set by the -S option. The default value is shown in parentheses.

       listen_backlog
              Parameter passed to the listen syscall on the network socket. (10)

       max_client_send_buffers
              Maximum number of send buffers for one client. (32)

       max_client_send_size
              Maximum size of one send buffer (message) to be sent to a client. (32768)

       max_client_receive_size
              Maximum  size of the receive buffer for a client message (maximum allowed message size received by
              client). (32768)

       nss_db_dir
              NSS database directory. (/etc/corosync/qnetd/nssdb)

       cert_nickname
              NSS nickname of qnetd server certificate. (QNetd Cert)

       heartbeat_interval_min
              Minimum heartbeat timeout accepted by server in ms. (1000)

       heartbeat_interval_max
              Maximum heartbeat timeout accepted by server in ms. (120000)

       dpd_enabled
              Dead peer detection enabled. (on)

       dpd_interval_coefficient
              Value is multiplied with heartbeat interval sent by qdevice client and used as a timeout for  dead
              peer detection. (1.5)

       lock_file
              Lock file location. (/var/run/corosync-qnetd/corosync-qnetd.pid)

       local_socket_file
              Internal IPC socket file location. (/var/run/corosync-qnetd/corosync-qnetd.sock)

       local_socket_backlog
              Parameter passed to listen syscall on the local socket. (10)

       ipc_max_clients
              Maximum allowed simultaneous IPC clients. (10)

       ipc_max_receive_size
              Maximum size of a message received by IPC client. (4096)

       ipc_max_send_size
              Maximum size of a message sent to an IPC client. (10485760)

       keep_active_partition_tie_breaker
              When  tie happens prefer partition with members of previously active (quorate) partition.  This is
              hard-coded behavior of LMS algorithm so this setting affects only FFSplit algorithm. (off)

SEE ALSO

       corosync-qnetd-tool(8) corosync-qnetd-certutil(8) corosync-qdevice(8)

AUTHOR

       Jan Friesse

                                                   2020-11-18                                  COROSYNC-QNETD(8)