Home / server / Questions / 686260
Accepted
Routhinator
Asked: 2015-04-29 12:08:47 +0800 CST

How do I force IPV4 with PCS? (Pacemaker/Corosync)

  • 772

I'm setting up a Pacemaker/Corosync cluster with a DRBD mount for a highly available Webapp in a secure environment. This is running on CentOS 7. The cluster is working. However to get this system ready for a security audit, I must disable all applications from listening on IPV6 and force IPV4.

I have disabled IPV6 systemwide:

# Contents of /etc/sysctl.conf
net.ipv6.conf.all.disable_ipv6 = 1

I have gone the extra step of disabling IPV6 at the network level as well:

# Contents of /etc/sysconfig/network
NETWORKING_IPV6=no
IPV6_AUTOCONF=no

However PCSD insists on listening on an IPV6 port:

# netstat -lnptu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1206/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1837/master
tcp6       0      0 :::2224                 :::*                    LISTEN      486/ruby
udp        0      0 192.168.4.100:60618     0.0.0.0:*                           10932/corosync
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           460/avahi-daemon: r
udp        0      0 192.168.4.100:5405      0.0.0.0:*                           10932/corosync
udp        0      0 0.0.0.0:57120           0.0.0.0:*                           460/avahi-daemon: r
udp        0      0 192.168.4.100:40891     0.0.0.0:*                           10932/corosync

There are no IPV6 Interfaces:

ip a l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:50:56:8d:d1:76 brd ff:ff:ff:ff:ff:ff
    inet 192.168.4.100/24 brd 192.168.4.255 scope global ens160
       valid_lft forever preferred_lft forever
    inet 192.168.4.110/24 brd 192.168.4.255 scope global secondary ens160
       valid_lft forever preferred_lft forever

I removed the IPV6 loopback from /etc/hosts as suggested in another forum:

# Contents of /etc/hosts
192.168.4.100   node1 node1.network.dmn
192.168.4.101   node2 node2.network.dmn
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

I also saw an old bug report from when PCSD would fail to start when IPV6 was disabled. This was resolved, and I can confirm that my instance starts just fine, however as noted in the comments on this bug, when IPV6 is disabled, PCSD is supposed to listen on IPV4, which it is not doing. So this seems like abnormal behaviour:

Source: https://bugzilla.redhat.com/show_bug.cgi?id=1104359

Created attachment 933288 [details]
proposed fix

test:

  1. Disable ipv6, add ipv6.disable=1 to kernel boot line and reboot
  2. Start pcsd service systemctl start pcsd.service
  3. Verify pcsd is running and listening on 0.0.0.0 netstat --inet -anp46 | grep 2224 tcp 0 0 0.0.0.0:2224 0.0.0.0:* LISTEN 1746/ruby
  4. Reboot with ipv6 enabled.
  5. Start pcsd service systemctl start pcsd.service
  6. Verify pcsd is running and listening on :: netstat --inet -anp46 | grep 2224 tcp6 0 0 :::2224 :::*
    LISTEN 356/ruby

Googling for a way to force IPV4 in the configuration has not produced any results. So I'm stuck at the moment. I MUST force this port to 0.0.0.0:2224 to pass security compliance.

Can anyone tell me how?

centos

1 Answers

  1. Best Answer

    Quite late but if you want that pcsd runs only in IPv4 you need to modify the file /etc/sysconfig/pcsd and replace the default (and commented)

    # PCSD_BIND_ADDR='::'

    for something like this :

     PCSD_BIND_ADDR='192.168.23.65'

    next you need to restart pcsd service and if you run netstat -tulpn you should see : 

     tcp   0  0 192.168.23.65:2224   0.0.0.0:*     LISTEN   5191/ruby
    • 2