In many cases, it might be desired to use node-specific certificates for certain service, e.g.:
– Make the SSH certificates persist through full re-installation.
– Use different Kerberos key tables per node.
The node installer is aready doing something similar when it copies the node’s certificate from the NFS share /cm/node-installer/certificates of the head node, to each node.
To do that for any other type of certificate you will need to create a certifcate store directory, e.g. /cm/certificates on the head node or NFS server and export it to the nodes:
$ mkdir /cm/certificates $ cmsh [headnode]% device use headnode [headnode->device[headnode]]% fsexports [headnode->device[headnode]->fsexports]% add /cm/certificates [headnode->device*[headnode*]->fsexports*[/cm/certificates*]]% set hosts internalnet [headnode->device*[headnode*]->fsexports*[/cm/certificates*]]% set write no [headnode->device*[headnode*]->fsexports*[/cm/certificates*]]% commit [headnode->device[headnode]->fsexports[/cm/certificates]]%
You will need to place the node-specific files in a sub-directory under that certificate store directory. The subdirectory is given the name of the node.
E.g.:
- For node001 create /cm/certificates/node001 and place the certificates within the node001 directory
- For node002, create /cm/certificates/node002 and place the certificates within the node002 directory.
and so on.
After that you will need to modify the finalize script for the node’s category:
$ cmsh [headnode]% category use default [headnode->category[default]]% set finalizescript (A text editor session will start) [headnode->category[default]]% commit
The finalize script could be:
#!/bin/bash mkdir /tmp/certificates mount master:/cm/certificates /tmp/certificates cp -an /tmp/certificates/$CMD_HOSTNAME/* /localdisk/etc/ssh umount /tmp/certificates rm -rf /tmp/certificates