Fedora Account System
Red Hat Associate
Red Hat Customer
Document URL: https://access.redhat.com/documentation/en-US/Red_Hat_Storage/3.1/html/Administration_Guide/sect-Preparing_to_Deploy_Geo-replication.html#idp10809856 Section Number and Name: 14.3.4.2. Setting Up your Environment for a Secure Geo-replication Slave Describe the issue: (step 3) After the restorecon step, we need to add the following chgrp -R <GROUP> /var/log/glusterfs/geo-replication-slaves chgrp -R <GROUP> /var/lib/glusterd/geo-replication chmod -R 770 /var/lib/glusterd/geo-replication chmod -R 770 /var/log/glusterfs/geo-replication-slaves Suggestions for improvement: Additional information:
Verified the steps provided in description. The steps mentioned resolves the issue of permission denied.
(In reply to Aravinda VK from comment #0) > Document URL: > https://access.redhat.com/documentation/en-US/Red_Hat_Storage/3.1/html/ > Administration_Guide/sect-Preparing_to_Deploy_Geo-replication. > html#idp10809856 > > Section Number and Name: > 14.3.4.2. Setting Up your Environment for a Secure Geo-replication Slave > > Describe the issue: (step 3) > After the restorecon step, we need to add the following > > chgrp -R <GROUP> /var/log/glusterfs/geo-replication-slaves > chgrp -R <GROUP> /var/lib/glusterd/geo-replication > chmod -R 770 /var/lib/glusterd/geo-replication > chmod -R 770 /var/log/glusterfs/geo-replication-slaves > > > Suggestions for improvement: > > Additional information: Aravinda, need few more inputs/clarifications: 1. Do I need to document these steps as Step 4? 2. Could you please provide information on what these commands do and why should user perform this step. Thanks!
(In reply to Divya from comment #5) > > Aravinda, need few more inputs/clarifications: > > 1. Do I need to document these steps as Step 4? Yes, as Step 4 > > 2. Could you please provide information on what these commands do and why > should user perform this step. > > Thanks! Non root SSH login is used when Geo-rep is started with non root configuration. Gsyncd at slave side will be started by the non root user, so read write permissions should be enabled for Glusterd workdir and log directories. Following commands allow access for geogroup to access these directories. chgrp -R <GROUP> /var/log/glusterfs/geo-replication-slaves chgrp -R <GROUP> /var/lib/glusterd/geo-replication chmod -R 770 /var/lib/glusterd/geo-replication chmod -R 770 /var/log/glusterfs/geo-replication-slaves Example, chgrp -R geogroup /var/log/glusterfs/geo-replication-slaves chgrp -R geogroup /var/lib/glusterd/geo-replication chmod -R 770 /var/lib/glusterd/geo-replication chmod -R 770 /var/log/glusterfs/geo-replication-slaves
(In reply to Aravinda VK from comment #6) > (In reply to Divya from comment #5) > > > > > Aravinda, need few more inputs/clarifications: > > > > 1. Do I need to document these steps as Step 4? > Yes, as Step 4 > > > > > 2. Could you please provide information on what these commands do and why > > should user perform this step. > > > > Thanks! > > Non root SSH login is used when Geo-rep is started with non root > configuration. Gsyncd at slave side will be started by the non root user, so > read write permissions should be enabled for Glusterd workdir and log > directories. Following commands allow access for geogroup to access these > directories. > > > chgrp -R <GROUP> /var/log/glusterfs/geo-replication-slaves > chgrp -R <GROUP> /var/lib/glusterd/geo-replication > chmod -R 770 /var/lib/glusterd/geo-replication > chmod -R 770 /var/log/glusterfs/geo-replication-slaves > > Example, > > > chgrp -R geogroup /var/log/glusterfs/geo-replication-slaves > chgrp -R geogroup /var/lib/glusterd/geo-replication > chmod -R 770 /var/lib/glusterd/geo-replication > chmod -R 770 /var/log/glusterfs/geo-replication-slaves I have updated the documentation based on your inputs. Please review and let me know if the changes are fine. Link to the latest doc: http://jenkinscat.gsslab.pnq.redhat.com:8080/view/Gluster/job/doc-Red_Hat_Gluster_Storage-3.1.3-Administration_Guide%20%28html-single%29/lastBuild/artifact/tmp/en-US/html-single/index.html#Setting_Up_the_Environment_for_a_Secure_Geo-replication_Slave
Doc changes Looks good to me.
I have updated the documentation based on the bug description and Comment 6. Link to the latest doc: http://jenkinscat.gsslab.pnq.redhat.com:8080/view/Gluster/job/doc-Red_Hat_Gluster_Storage-3.1.3-Administration_Guide%20%28html-single%29/lastBuild/artifact/tmp/en-US/html-single/index.html#Setting_Up_the_Environment_for_a_Secure_Geo-replication_Slave
Divya, After discussing with Rahul, we also need to add a note about not using multiple groups for Mountbroker setup. Multiple user accounts can be created but group should be same for all the Non root users.(After 1st point in 14.3.4.2 "Perform the following steps on all the Slave nodes to setup an auxiliary glusterFS mount for the unprivileged account: ")
(In reply to Aravinda VK from comment #10) > Divya, After discussing with Rahul, we also need to add a note about not > using multiple groups for Mountbroker setup. Multiple user accounts can be > created but group should be same for all the Non root users.(After 1st point > in 14.3.4.2 "Perform the following steps on all the Slave nodes to setup an > auxiliary glusterFS mount for the unprivileged account: ") Added the requried Note. Link to the doc: http://jenkinscat.gsslab.pnq.redhat.com:8080/view/Gluster/job/doc-Red_Hat_Gluster_Storage-3.1.3-Administration_Guide%20%28html-single%29/lastBuild/artifact/tmp/en-US/html-single/index.html#Setting_Up_the_Environment_for_a_Secure_Geo-replication_Slave
Awesome, Thanks Divya. Note section looks good to me along with the changes made at step 4. Moving the bz to verified state.