Bug 1340048

Verified the steps provided in description. The steps mentioned resolves the issue of permission denied.

(In reply to Aravinda VK from comment #0)
> Document URL:
> https://access.redhat.com/documentation/en-US/Red_Hat_Storage/3.1/html/
> Administration_Guide/sect-Preparing_to_Deploy_Geo-replication.
> html#idp10809856
> 
> Section Number and Name: 
> 14.3.4.2. Setting Up your Environment for a Secure Geo-replication Slave
> 
> Describe the issue: (step 3)
> After the restorecon step, we need to add the following
> 
> chgrp -R <GROUP> /var/log/glusterfs/geo-replication-slaves
> chgrp -R <GROUP> /var/lib/glusterd/geo-replication
> chmod -R 770 /var/lib/glusterd/geo-replication
> chmod -R 770 /var/log/glusterfs/geo-replication-slaves
> 
> 
> Suggestions for improvement: 
> 
> Additional information:

Aravinda, need few more inputs/clarifications:

1. Do I need to document these steps as Step 4?

2. Could you please provide information on what these commands do and why should user perform this step.

Thanks!

(In reply to Divya from comment #5)

> 
> Aravinda, need few more inputs/clarifications:
> 
> 1. Do I need to document these steps as Step 4?
Yes, as Step 4

> 
> 2. Could you please provide information on what these commands do and why
> should user perform this step.
> 
> Thanks!

Non root SSH login is used when Geo-rep is started with non root configuration. Gsyncd at slave side will be started by the non root user, so read write permissions should be enabled for Glusterd workdir and log directories. Following commands allow access for geogroup to access these directories.


chgrp -R <GROUP> /var/log/glusterfs/geo-replication-slaves
chgrp -R <GROUP> /var/lib/glusterd/geo-replication
chmod -R 770 /var/lib/glusterd/geo-replication
chmod -R 770 /var/log/glusterfs/geo-replication-slaves

Example,


chgrp -R geogroup /var/log/glusterfs/geo-replication-slaves
chgrp -R geogroup /var/lib/glusterd/geo-replication
chmod -R 770 /var/lib/glusterd/geo-replication
chmod -R 770 /var/log/glusterfs/geo-replication-slaves

(In reply to Aravinda VK from comment #6)
> (In reply to Divya from comment #5)
> 
> > 
> > Aravinda, need few more inputs/clarifications:
> > 
> > 1. Do I need to document these steps as Step 4?
> Yes, as Step 4
> 
> > 
> > 2. Could you please provide information on what these commands do and why
> > should user perform this step.
> > 
> > Thanks!
> 
> Non root SSH login is used when Geo-rep is started with non root
> configuration. Gsyncd at slave side will be started by the non root user, so
> read write permissions should be enabled for Glusterd workdir and log
> directories. Following commands allow access for geogroup to access these
> directories.
> 
> 
> chgrp -R <GROUP> /var/log/glusterfs/geo-replication-slaves
> chgrp -R <GROUP> /var/lib/glusterd/geo-replication
> chmod -R 770 /var/lib/glusterd/geo-replication
> chmod -R 770 /var/log/glusterfs/geo-replication-slaves
> 
> Example,
> 
> 
> chgrp -R geogroup /var/log/glusterfs/geo-replication-slaves
> chgrp -R geogroup /var/lib/glusterd/geo-replication
> chmod -R 770 /var/lib/glusterd/geo-replication
> chmod -R 770 /var/log/glusterfs/geo-replication-slaves

I have updated the documentation based on your inputs. Please review and let me know if the changes are fine.

Link to the latest doc: http://jenkinscat.gsslab.pnq.redhat.com:8080/view/Gluster/job/doc-Red_Hat_Gluster_Storage-3.1.3-Administration_Guide%20%28html-single%29/lastBuild/artifact/tmp/en-US/html-single/index.html#Setting_Up_the_Environment_for_a_Secure_Geo-replication_Slave

Doc changes Looks good to me.

I have updated the documentation based on the bug description and Comment 6.

Link to the latest doc: http://jenkinscat.gsslab.pnq.redhat.com:8080/view/Gluster/job/doc-Red_Hat_Gluster_Storage-3.1.3-Administration_Guide%20%28html-single%29/lastBuild/artifact/tmp/en-US/html-single/index.html#Setting_Up_the_Environment_for_a_Secure_Geo-replication_Slave

Divya, After discussing with Rahul, we also need to add a note about not using multiple groups for Mountbroker setup. Multiple user accounts can be created but group should be same for all the Non root users.(After 1st point in 14.3.4.2 "Perform the following steps on all the Slave nodes to setup an auxiliary glusterFS mount for the unprivileged account: ")

(In reply to Aravinda VK from comment #10)
> Divya, After discussing with Rahul, we also need to add a note about not
> using multiple groups for Mountbroker setup. Multiple user accounts can be
> created but group should be same for all the Non root users.(After 1st point
> in 14.3.4.2 "Perform the following steps on all the Slave nodes to setup an
> auxiliary glusterFS mount for the unprivileged account: ")

Added the requried Note. Link to the doc: http://jenkinscat.gsslab.pnq.redhat.com:8080/view/Gluster/job/doc-Red_Hat_Gluster_Storage-3.1.3-Administration_Guide%20%28html-single%29/lastBuild/artifact/tmp/en-US/html-single/index.html#Setting_Up_the_Environment_for_a_Secure_Geo-replication_Slave

Awesome, Thanks Divya. Note section looks good to me along with the changes made at step 4. Moving the bz to verified state.