COROSYNC-QNETD(8)

💖 COROSYNC-QNETD 💖

okay bestie, welcome to the corosync-qnetd page — that's the QNet daemon, straight outta the System Manager's Manual. pull up a chair, grab a strawberry 🍓, and let's get into it.

---

✨ NAME ✨

corosync-qnetd — the QNet daemon 👑

---

🌸 SYNOPSIS 🌸

corosync-qnetd [-46dfhv] [-l listen_addr] [-p listen_port] [-s tls] [-c
client_cert_required] [-m max_clients] [-S
option=value[,option2=value2,...]]"

---

🦋 DESCRIPTION 🦋

So corosync-qnetd is a daemon, and the whole vibe is: it runs outside of the cluster. Its entire job? Handing out a vote to the corosync-qdevice model net. 💅

It's built to serve multiple clusters at once, and honestly it's giving "almost configuration and state free" — brand new clusters just get handled dynamically, like, there is no configuration file at all. none. zero. iconic behavior fr fr.

It can also run as a non-root user, which is lowkey the recommended way to do it. 🔥

The connection between the corosync-qdevice model net client can optionally be set up with TLS client certificate checking. And the communication protocol between server and client? Designed to be super simple and to allow backwards compatibility. periodt. 💖

---

💅 OPTIONS 💅

• -4 — and its counterpart -6 are how you force IPv4 or IPv6 communication. By default it listens on both address families, no cap.
• -d — turns on debug logging. Normally the messages going to syslog are purely operational, but this option sends extra debug messages too. Wanna bump the syslog messages priority up to info? Pass -d twice. yes, twice. 😭
• -f — do not daemonize. Just run it in the foreground. 🫶
• -h — shows the short help text.
• -v — shows version plus the supported communication protocol messages/options.
• -l — the IP address to listen on. By default the daemon listens on all addresses (wildcard). 🌈
• -p — the TCP port to listen on. Default port is 5403.
• -s — decides whether TLS should be used, and it's one of on/off/required (the default is on). on means TLS is enabled but the client isn't required to start TLS. off means TLS is completely disabled. required means TLS is required, periodt. Heads up: on and required both need the NSS database to be properly initialized by running the corosync-qnetd-certutil command. 👑
• -c — can be set to on/off. This only makes sense if TLS is enabled. When -c is on, a client is required to send its client certificate (that's the default).
• -m — maximum simultaneous clients. The default is 0, which means no limit.
• -S — set advanced settings, which get their own section down below. This option shouldn't generally be used, because most of those options are not safe to change. ⚠️

---

🎀 UNPRIVILEGED USER CONFIGURATION 🎀

okay so the general recommendation is: run corosync-qnetd as a non root user. If you got a package from a distribution, it's highly possible the packager already did all the hard work for you. 💖 But if you're installing from source code, there's a few steps you gotta take. no skipping.

First, you need to create an unprivileged user/group. These commands can be used (and they get executed as root):

# groupadd -r coroqnetd
# useradd -r -g coroqnetd -d / -s /sbin/nologin -c "User for corosync-qnetd" coroqnetd

Next step: set the correct owner and group on /etc/corosync/qnetd and /var/run/corosync-qnetd directories.

# chown -R coroqnetd:coroqnetd /etc/corosync/qnetd /var/run/corosync-qnetd

Now, some systems have the /var/run directory sitting on a tmpfs file system, which gets discarded after a reboot. 🙈 The solution is to use an initscript or a systemd unit, because both of them take care of the /var/run/corosync-qnetd creation and set the correct owner and permissions. slay.

Last step: make sure corosync-qnetd is actually executed as an unprivileged user. For initscript systems, it's enough to set the line COROSYNC_QNETD_RUNAS in the /etc/(sysconfig|default)/corosync-qnetd file. If that file isn't already installed, then use the one provided in the corosync source code (init/corosync-qnetd.sysconfig.example). For systemd, overwrite/copy the corosync-qnetd.service unit file and uncomment/change the "User=" directive. 💅

---

🔐 TLS CONFIGURATION 🔐

For TLS to work, it's necessary to create the NSS database. If pcs is being used, then the following steps aren't needed, because pcs does them automatically. 🧚

corosync-qnetd-certutil is the tool that performs the required actions. Just run:

# corosync-qnetd-certutil -i

If TLS is not required, then simply edit /etc/(sysconfig|default)/corosync-qnetd or the systemd unit file and add the parameter -s off in the proper place.

Depending on the configuration of NSS (stored in the nss.config file, usually in the /etc/crypto-policies/back-ends/ directory), disabled ciphers or too short keys may be rejected. The proper solution is to regenerate the NSS databases for both the corosync-qnetd and corosync-qdevice daemons. As a quick workaround, it's also possible to set the environment variable NSS_IGNORE_SYSTEM_POLICY=1 before running the corosync-qnetd daemon.

When NSS is updated, it may also be needed to upgrade the database into the new format. There's no consensus on the recommended way, but the following command seems to work just fine (if the qnetd sysconfdir is set to /etc):

# certutil -N -d /etc/corosync/qnetd/nssdb -f /etc/corosync/qnetd/nssdb/pwdfile.txt

---

⭐ ADVANCED SETTINGS ⭐

These get set by the -S option. The default value is shown in parentheses, bestie — don't lose track. 👑

💜 listen_backlog

Parameter passed to the listen syscall on the network socket. (10)

💜 max_client_send_buffers

Maximum number of send buffers for one client. (32)

💜 max_client_send_size

Maximum size of one send buffer (message) to be sent to a client. (32768)

💜 max_client_receive_size

Maximum size of the receive buffer for a client message (maximum allowed message size received by client). (32768)

💜 nss_db_dir

NSS database directory. (/etc/corosync/qnetd/nssdb)

💜 cert_nickname

NSS nickname of qnetd server certificate. (QNetd Cert)

💜 heartbeat_interval_min

Minimum heartbeat timeout accepted by server in ms. (1000)

💜 heartbeat_interval_max

Maximum heartbeat timeout accepted by server in ms. (120000)

💜 dpd_enabled

Dead peer detection enabled. (on)

💜 dpd_interval_coefficient

Value is multiplied with heartbeat interval sent by qdevice client and used as a timeout for dead peer detection. (1.5)

💜 lock_file

Lock file location. (/var/run/corosync-qnetd/corosync-qnetd.pid)

💜 local_socket_file

Internal IPC socket file location. (/var/run/corosync-qnetd/corosync-qnetd.sock)

💜 local_socket_umask

Octal value of umask used before creating of internal IPC socket file, or empty if umask shouldn't be modified. ("")

💜 local_socket_gid

Sets the group ownership for the internal IPC socket file. This can be specified as a group name or a numeric GID. An empty value or the default of -1 leaves the group ownership unchanged. (-1)

💜 local_socket_backlog

Parameter passed to listen syscall on the local socket. (10)

💜 ipc_max_clients

Maximum allowed simultaneous IPC clients. (10)

💜 ipc_max_receive_size

Maximum size of a message received by IPC client. (4096)

💜 ipc_max_send_size

Maximum size of a message sent to an IPC client. (10485760)

💜 keep_active_partition_tie_breaker

When a tie happens, prefer the partition with members of the previously active (quorate) partition. This is hard-coded behavior of the LMS algorithm, so this setting affects only the FFSplit algorithm. (off)

---

🌈 SEE ALSO 🌈

corosync-qnetd-tool(8) corosync-qnetd-certutil(8) corosync-qdevice(8)

---

👑 AUTHOR 👑

Jan Friesse

---

that's the whole page bestie, you ate it 💖 this one came from the System Manager's Manual, dated 2025-10-16, and it's filed under COROSYNC-QNETD(8) — go forth and cluster responsibly, mwah 💅✨🦋