The following subsections provide a summary of security-related configuration settings for Business Continuity Clustering 1.1:
The following table lists the BCC configuration settings that are security-related or impact the security of BCC:
Table 10-2 BCC Security Configuration Settings
WARNING:You should not change the configuration settings for the NCS:BCC Settings attribute unless instructed to do so by Novell Support. Doing so can have adverse affects on your cluster nodes and BCC.
The following XML for the NCS:BCC Settings attribute is saved on the local Cluster object in eDirectory. The BCC must be restarted for changes to these settings to take effect. These are advanced settings that are intentionally not exposed in the BCC plug-in for iManager.
<bccSettings> <adminGroupName>bccgroup</adminGroupName> <authorizationCacheTTL>300</authorizationCacheTTL> <cimConnectTimeout>15</cimConnectTimeout> <cimReceiveTimeout>30</cimReceiveTimeout> <cimSendTimeout>30</cimSendTimeout> <idlePriorityThreshold>3</idlePriorityThreshold> <initialNormalThreads>3</initialNormalThreads> <initialPriorityThreads>2</initialPriorityThreads> <ipcResponseTimeout>15</ipcResponseTimeout> <maximumPriorityThreads>20</maximumPriorityThreads> <minimumPriorityThreads>2</minimumPriorityThreads> <resourceOfflineTimeout>300</resourceOfflineTimeout> <resourceOnlineTimeout>300</resourceOnlineTimeout> <scanForNewDevicesDelay>5</scanForNewDevicesDelay> </bccSettings>
Table 10-3 provides additional information on each setting:
Table 10-3 BCC XML Settings
Disabling SSL for inter-cluster communication should only be done for debugging purposes, and should not be done in a production environment or for an extended period of time.
To turn off SSL for inter-cluster communication, or to specify a different communication port, you need to modify the Novell Cluster Servicesā¢ Cluster object that is stored in eDirectory by using an eDirectory management tool such as iManager or ConsoleOneĀ®. See the Novell iManager 2.7 Administration Guide for information on using iManager.
Disabling SSL communication to a specific peer cluster requires changing the BCC management address to the peer cluster. The address is contained in the NCS:BCC Peers attribute that is stored on the NCS Cluster object.
For example, a default NCS:BCC Peers attribute could appear similar to the following example where https:// is assumed and is never specified explicitly:
<peer> <cluster>chicago_cluster</cluster> <tree>DIGITALAIRLINES-TREE</tree> <address>10.1.1.10</address> </peer>
To disable SSL for inter-cluster communication, you would change the <address> attribute to specify http:// with the IP address, as shown in the following example:
<peer> <cluster>chicago_cluster</cluster> <tree>DIGITALAIRLINES-TREE</tree> <address>http://10.1.1.10</address> </peer>
The BCC management address of chicago_cluster now specifies non-secure HTTP communication.
The BCC management port can also be changed by modifying the NCS:BCC Peers attribute values.
The default ports for secure and non-secure inter-cluster communication are 5989 and 5988 respectively.
For example, if you want to change the secure port on which OpenWBEM listens from port 5989 to port 1234, you would change the <address> attribute value in the above examples to:
<peer> <cluster>chicago_cluster</cluster> <tree>DIGITALAIRLINES-TREE</tree> <address>10.1.1.10:1234</address> </peer>
The attribute now specifies that inter-cluster communication uses HTTPS over port number 1234.
The NCS:BCC Peers attribute has a value for each peer cluster in the BCC. Attribute values are synchronized among peer clusters by the BCC-specific Identity Manager driver, so a change to an attribute value on one cluster causes that attribute value to be synchronized to each peer cluster in the BCC.
The changes do not take effect until either a reboot of each cluster node, or a restart of the Business Continuity Clustering software on each cluster node.
The following table provides an example of possible combinations of scheme and port specifier for the <address> tag for values of the NCS:BCC Peers attribute: