I'm trying to configure pacemaker cluster with two hosts, I'm using two centos 7(CentOS Linux release 7.2.1511 (Core)) virtual machines.

What I did so far: I installed packages:

yum install pacemaker corosync haproxy pcs fence-agents-all

Set password for user hacluster on both servers. Edit /etc/hosts on both machines vm_haproxy1 vm_haproxy2

After that enabled services on both servers

systemctl enable pcsd.service pacemaker.service corosync.service haproxy.service

And started pcsd (on both servers)

systemctl start pcsd.service

Service is running on both, I can telnet from one to another on port 2224

telnet vm_haproxy1 2224
Connected to vm_haproxy1.
Escape character is '^]'.

Output from the netstat:

[root@vm_haproxy2 ~]# netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0    *               LISTEN      849/sshd            
tcp        0      0  *               LISTEN      946/master          
tcp6       0      0 :::2224                 :::*                    LISTEN      1949/ruby           
tcp6       0      0 :::22                   :::*                    LISTEN      849/sshd            
tcp6       0      0 ::1:25                  :::*                    LISTEN      946/master          
udp        0      0 *                           619/chronyd         
udp6       0      0 ::1:323                 :::*                                619/chronyd

Pcsd is binding to ipv6 but like I already said telnet works Selinux and firewalld are disabled.

Then I tried to authorise hosts with

pcs cluster auth vm_haproxy1 vm_haproxy2

but I got an error:

pcs cluster auth vm_haproxy1 vm_haproxy2
Username: hacluster
Error: Unable to communicate with vm_haproxy1
Error: Unable to communicate with vm_haproxy2

I didn't find any help on google. Maybe there is some one who had already solved that problem with pcs authorisation.


I typically don't use pcsd in my clusters, but the times that I have, I recall setting up the authentication after I had a working cluster; function first, frill later.

I would try using the following commands from both nodes to create the corosync configuration and start the cluster, before setting up your authentication:

# pcs cluster setup --local --name haproxy-cluster0 vm_haproxy1 vm_haproxy2
# systemctl start corosync
# systemctl start pacemaker

Once you see your nodes online in the output of crm_mon, try your steps for setting up the node authentication.


I had this issue. In my case I tracked it down to the environment variables for proxies being set.

To check this: first run the command with --debug enabled:

pcs --debug cluster auth clua club cluc

In the debug output I could see:

Sending HTTP Request to: https://club:2224/remote/check_auth
Data: None
Response Reason: Tunnel connection failed: 404 Not Found
"I, [2017-04-05T10:54:21.333320 #6755]  INFO -- : No response from: cluc request: /auth, exception: 404 \"Not Found\"\n",
"I, [2017-04-05T10:54:21.334344 #6755]  INFO -- : No response from: club request: /auth, exception: 404 \"Not Found\"\n",
"I, [2017-04-05T10:54:21.334852 #6755]  INFO -- : No response from: clua request: /auth, exception: 404 \"Not Found\"\n"

Running curl towards the URL it was trying to use gave more explicit information:

# curl https://club:2224/remote/check_auth
curl: (56) Received HTTP code 404 from proxy after CONNECT

Unsetting http_proxy and https_proxy enabled it to work.

If you don't have too many nodes, you can list them in the no_proxy environment variable. Otherwise it's a bit painful - you need to ensure you always run the pcs commands with no proxy environment variables set. I have so far not found any way to configured pcs not to use these variables.

You could write a little wrapper that unsets the variables and then calls pcs.


If you are using CentOS 7, check:

systemctl start pcsd.service 
systemctl enable pcsd.service 

The start will run it now. If that produces any error messages those should be addressed. The enable cause it to start automatically on the next boot.


If not answered , i face similar issues, i missed the firewall enable setting, after executing below commands, issue was solved for me

firewall-cmd --permanent --add-service=high-availability

firewall-cmd --add-service=high-availability

firewall-cmd –reload


For my case, i just opened port in firewall using:

firewall-cmd --add-port=2224/tcp --permanent && firewall-cmd --reload

then everything will be ok


I was getting this earlier:

[root@vm01 .ssh]# pcs cluster auth vm01 vm02 -u hacluster -p redhat
Error: Unable to communicate with vm02
vm01: Authorized

After flushing the iptables on both nodes, it worked.

[root@vm01 .ssh]# pcs cluster auth vm01 vm02 -u hacluster -p redhat
vm02: Authorized
vm01: Authorized
  • That means your iptables prevented communication. The OP says telnet between the nodes works. – RalfFriedl Sep 22 '18 at 18:21

I was facing the same issue and when tried creating the cluster locally to have the cluster.conf file created but it doesnt seems to work.

  1. yum install pacemaker corosync haproxy pcs fence-agents-all

  2. systemctl disable firewalld ; systemctl stop firewalld systemctl enable pcsd.service pacemaker.service corosync.service haproxy.service

  3. pcs cluster setup --local --name resource Openstackvm2.server.com OpenstackVm3.server.com --force

Shutting down pacemaker/corosync services...

Redirecting to /bin/systemctl stop pacemaker.service Redirecting to /bin/systemctl stop corosync.service Killing any remaining services... Removing all cluster configuration files.

  1. pcs cluster auth Openstackvm2.server.com OpenstackVm3.server.com

Username: hacluster


Error: Unable to communicate with Openstackvm2.server.com

Error: Unable to communicate with OpenstackVm3.server.com

It looks like there is a Bug posted int he Redhat site but I do not have the privileges to see the full thread.



Check /etc/hosts file entries.

cat /etc/hosts

IP Addr of host1 Hostname1 IP Addr of host2 Hostname2

It must in the above manner. Flush IP Tables on both the nodes us nodes:

iptable -F

  • 1
    Your iptables command is wrong, and you clearly didn't read the information in the question. And you formatted your whole answer wrong. – Andrew Schulman Apr 7 '18 at 17:54

I stop firewalld.service use the following command, and then pcs cluster auth is worked for me.

systemctl stop firewalld.service
  • Telling people to turn off their firewalls on their servers without telling them the consequences would be irresponsible, I think. – mforsetti Mar 3 at 4:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.