LFCE 111 🐧 Pacemaker and Corosync — Setup
Pacemaker and Corosync form the standard high-availability stack on Linux. Corosync provides the cluster membership layer: it detects nodes, exchanges heartbeat messages, and maintains quorum. Pacemaker sits above it as the resource manager: it decides which node runs which service, starts and stops resources, and moves them when a node fails. Neither component is useful alone. Corosync without Pacemaker is a messaging layer with no policy; Pacemaker without Corosync has no reliable way to know which nodes are alive.
This chapter covers the setup phase: installing the packages, configuring the firewall, enabling the services, authenticating the nodes, and creating the cluster. It does not cover resource configuration or fencing in depth—those belong to later chapters. The goal here is a functioning two-node cluster that reports healthy status and accepts resource definitions. By the end, you will have a cluster named and running, with pcs status returning clean output and both nodes visible as online.
Key point: Cluster setup is not a single command. It is a sequence: install packages identically on every node, open the correct ports, set the same hacluster password everywhere, authenticate once from one node, then create the cluster. Skipping any step in that sequence produces authentication failures or silent membership problems.
Why this setup sequence exists
The identical installation problem. Pacemaker and Corosync must be installed on every node before any cluster command can succeed. A cluster is not a server you log into; it is a set of peers that must all speak the same protocol with the same tooling. If one node lacks pcs or has a mismatched pacemaker version, pcs cluster setup will authenticate against it but fail to bring it online, leaving a partially formed cluster that looks configured but is not .
The authentication boundary problem. pcs does not trust nodes by default. It uses the pcsd daemon on TCP port 2224 to communicate with each node, and it authenticates as the hacluster user. That user’s password must be set on every node and must match, because pcs host auth from one node logs into all the others. A mismatched password is the most common reason a node refuses to join during setup .
The firewall assumption problem. Corosync uses UDP 5405 for cluster communication and pcsd uses TCP 2224. On a default Linux install with firewalld enabled, both are blocked. The cluster will appear to configure—pcs cluster setup returns without error—but pcs status will show the second node as offline because the heartbeat never arrives. Opening the high-availability firewalld service resolves this in one step .
The manual configuration trap. Older documentation describes editing /etc/corosync/corosync.conf by hand, generating authkeys, and copying files between nodes. Modern pcs does all of this during pcs cluster setup. The manual approach is still possible, but it is error-prone and no longer necessary for a standard setup. The setup chapter exists to make the automated path explicit and to explain what pcs is actually writing on your behalf.
a. Installing the packages
The package set is consistent across RHEL-family distributions: pcs, pacemaker, and the resource and fence agents. On Debian and Ubuntu, the package names differ slightly, and fence-agents is split into base and extra packages .
# On RHEL, CentOS, Oracle Linux, Rocky, Alma
sudo dnf install pcs pacemaker resource-agents fence-agents-all
# On Debian and Ubuntu
sudo apt update
sudo apt install pacemaker corosync pcs fence-agents-base fence-agents-extraThe pcs package provides the command-line tool and the pcsd daemon. pacemaker provides the resource manager. The resource agents are the scripts Pacemaker calls to start, stop, and monitor services; without them, pcs resource create has nothing to invoke. The fence agents are for STONITH, which is not configured in this chapter but must be installed before it can be configured later.
Installing these packages creates the hacluster system user with a disabled password. That user is the identity pcs uses for inter-node authentication. It has no shell and no password until you set one, which is the next step.
b. Setting the hacluster password and enabling pcsd
The hacluster password must be identical on every node in the cluster. This is not a security recommendation; it is a functional requirement. pcs host auth from one node authenticates against all the others using that same credential. If the passwords differ, the command succeeds for the local node and fails for the remote ones .
# On every node, set the same password
sudo passwd hacluster
# On every node, enable and start the pcsd daemon
sudo systemctl enable --now pcsd.serviceThe enable --now combination does two things: it starts pcsd immediately and marks it to start at boot. Both matter. If pcsd is not running, pcs cannot communicate with the node, and the cluster setup command will time out.
c. Opening the firewall
If firewalld is active, the high-availability service definition opens the required ports. This is the simplest and least error-prone method, because the port list is maintained by the distribution rather than copied from documentation.
# On every node, open the HA ports permanently and in the running config
sudo firewall-cmd --permanent --add-service=high-availability
sudo firewall-cmd --add-service=high-availabilityThe high-availability service opens TCP 2224 for pcsd, TCP 3121 for Pacemaker Remote nodes, TCP 21064 for DLM, and UDP 5404 and 5405 for Corosync . If you are not using firewalld, the same ports must be opened manually in iptables or nftables. The two that matter for basic cluster membership are TCP 2224 and UDP 5405; a cluster can form without the others, but remote nodes and DLM resources will fail later.
d. Authenticating and creating the cluster
Cluster creation is a two-step process from a single node: authenticate, then setup. Authentication tells pcs which nodes it is allowed to manage and verifies the hacluster credentials. Setup writes the Corosync configuration and starts the cluster services on every node.
# From node1, authenticate against both nodes
# Use resolvable hostnames, or add addr=IP if DNS is not configured
sudo pcs host auth node1 node2 -u hacluster
# Create the cluster, start it, and enable it at boot
sudo pcs cluster setup mycluster node1 node2 --start --enableThe host auth command prompts for the hacluster password once and uses it for all listed nodes. If the hostnames are not resolvable, supply the IPs explicitly: sudo pcs host auth node1 addr=192.168.10.11 node2 addr=192.168.10.12 -u hacluster . The cluster setup command writes /etc/corosync/corosync.conf on each node with the node list, generates the authentication key, distributes it, and starts corosync and pacemaker. The --start flag starts the cluster immediately; --enable ensures it starts at boot.
After setup, pcs status should show both nodes online and the cluster name as configured. If a node appears offline, the most common causes are a firewall blocking UDP 5405 or a hostname that does not resolve from the other node.
Complete Example Session
# ============================================
# PART 1: PREPARE HOSTNAMES AND HOSTS FILE
# ============================================
# On node1
sudo hostnamectl set-hostname node1
# On node2
sudo hostnamectl set-hostname node2
# On both nodes, add resolvable entries
sudo tee -a /etc/hosts <<'EOF'
192.168.10.11 node1
192.168.10.12 node2
EOF
# Verify resolution from each node
ping -c 2 node1
ping -c 2 node2# ============================================
# PART 2: INSTALL PACKAGES ON BOTH NODES
# ============================================
# RHEL family
sudo dnf install -y pcs pacemaker resource-agents fence-agents-all
# Debian/Ubuntu alternative
# sudo apt install -y pacemaker corosync pcs fence-agents-base fence-agents-extra# ============================================
# PART 3: SET HACLUSTER PASSWORD ON BOTH NODES
# ============================================
# Must be the same password on every node
sudo passwd hacluster
# Enable and start pcsd on both nodes
sudo systemctl enable --now pcsd.service# ============================================
# PART 4: OPEN FIREWALL ON BOTH NODES
# ============================================
sudo firewall-cmd --permanent --add-service=high-availability
sudo firewall-cmd --add-service=high-availability
# If firewalld is not in use, open the ports manually:
# TCP 2224 (pcsd), UDP 5405 (Corosync)# ============================================
# PART 5: AUTHENTICATE FROM ONE NODE
# ============================================
# From node1, authenticate against both nodes
sudo pcs host auth node1 node2 -u hacluster
# Enter the hacluster password when prompted# ============================================
# PART 6: CREATE AND START THE CLUSTER
# ============================================
sudo pcs cluster setup mycluster node1 node2 --start --enable
# The command writes corosync.conf, distributes authkey,
# and starts corosync and pacemaker on both nodes.# ============================================
# PART 7: VERIFY CLUSTER STATUS
# ============================================
sudo pcs status
# Expected output shows:
# Cluster name: mycluster
# 2 nodes configured
# Online: [ node1 node2 ]
# No resources# ============================================
# PART 8: CHECK COROSYNC MEMBERSHIP
# ============================================
sudo corosync-cfgtool -s
# Output shows the ring status and member count
# Both node1 and node2 should appear as members# ============================================
# PART 9: CHECK QUORUM
# ============================================
sudo corosync-quorumtool
# Output shows the expected votes and quorum status
# A two-node cluster with no QDevice has quorum
# only when both nodes are online# ============================================
# PART 10: CLEAN UP A FAILED SETUP (IF NEEDED)
# ============================================
# If a node did not join, tear down and retry:
# sudo pcs cluster destroy
# Then verify firewall, hostname resolution,
# and hacluster password parity before retrying.The ten parts covered the full setup path: hostname preparation, package installation, hacluster password parity, firewall configuration, authentication, cluster creation, status verification, Corosync membership, quorum check, and recovery from a failed setup.
Quick Reference
The required packages
| Package (RHEL) | Package (Debian) | Purpose |
|---|---|---|
pcs | pcs | Cluster management tool and pcsd daemon |
pacemaker | pacemaker | Resource manager |
resource-agents | resource-agents | Scripts for starting/stopping services |
fence-agents-all | fence-agents-base + extra | STONITH agents |
The required ports
| Port | Protocol | Service |
|---|---|---|
| 2224 | TCP | pcsd |
| 3121 | TCP | Pacemaker Remote |
| 21064 | TCP | DLM |
| 5405 | UDP | Corosync cluster |
| 5404 | UDP | Corosync multicast |
The setup commands
| Command | Effect |
|---|---|
passwd hacluster | Set authentication password (same on all nodes) |
systemctl enable --now pcsd | Start pcsd and enable at boot |
pcs host auth <nodes> -u hacluster | Authenticate from one node |
pcs cluster setup <name> <nodes> --start --enable | Write config, start cluster |
pcs status | Verify cluster health |
corosync-cfgtool -s | Verify Corosync ring status |
The verification commands
| Command | What it shows |
|---|---|
pcs status | Cluster name, node status, resource status |
corosync-cfgtool -s | Ring ID, node IDs, link status |
corosync-quorumtool | Quorum votes and status |
Best Practices
✅ Do This:
# Set the same hacluster password on every node
sudo passwd hacluster # ✅# Use --start --enable in cluster setup for a working cluster immediately
sudo pcs cluster setup mycluster node1 node2 --start --enable # ✅# Open the high-availability firewalld service, not individual ports
sudo firewall-cmd --add-service=high-availability # ✅# Verify hostname resolution before authentication
ping -c 2 node1 && ping -c 2 node2 # ✅# Check corosync membership after setup
sudo corosync-cfgtool -s # ✅# Use addr=IP in pcs host auth if DNS is unreliable
sudo pcs host auth node1 addr=192.168.10.11 node2 addr=192.168.10.12 -u hacluster # ✅❌ Don’t Do This:
# Set different hacluster passwords on different nodes
# This breaks pcs host auth for remote nodes
sudo passwd hacluster # ❌ (different values)# Skip the firewall configuration and hope Corosync works
# UDP 5405 blocked means no heartbeat and offline nodes
# sudo firewall-cmd --add-service=high-availability # ❌ (skipped)# Edit /etc/corosync/corosync.conf manually after pcs setup
# pcs owns that file; manual edits are overwritten or ignored
vim /etc/corosync/corosync.conf # ❌# Run pcs cluster setup without first authenticating
# It will fail with "unable to communicate with node"
sudo pcs cluster setup mycluster node1 node2 # ❌ (no auth)# Assume a two-node cluster has quorum when one node is down
# It does not; a QDevice or third node is required
# Check with: corosync-quorumtool # ❌ (assumption)# Use IP addresses in /etc/hosts but hostnames in pcs commands
# without addr= fallback; this fails when DNS is absent
sudo pcs host auth node1 node2 -u hacluster # ❌ (if unresolvable)Common Pitfalls
| Pitfall | Why It Happens | Fix |
|---|---|---|
pcs host auth fails for remote node | hacluster passwords differ between nodes | Set the identical password on every node with passwd hacluster |
| Node shows OFFLINE after setup | UDP 5405 blocked by firewall | Open high-availability firewalld service on both nodes |
pcs cluster setup times out | pcsd not running or TCP 2224 blocked | systemctl enable --now pcsd and open TCP 2224 |
| Hostname not resolvable during auth | /etc/hosts missing entries or DNS not configured | Add entries to /etc/hosts on all nodes, or use addr=IP |
| Cluster forms but quorum is lost when one node stops | Two-node cluster without QDevice has no quorum with one node | Add a QDevice, or accept that the surviving node cannot manage resources |
pcs status shows “Unable to connect to node” | pcsd stopped or password changed after setup | Restart pcsd, re-authenticate with pcs host auth |
Real-World Examples
1. Minimal two-node setup on RHEL
dnf install -y pcs pacemaker resource-agents fence-agents-all
passwd hacluster
systemctl enable --now pcsd
pcs host auth node1 node2 -u hacluster
pcs cluster setup mycluster node1 node2 --start --enable2. Setup with explicit IP addresses (no DNS)
pcs host auth node1 addr=192.168.10.11 node2 addr=192.168.10.12 -u hacluster
pcs cluster setup mycluster node1 addr=192.168.10.11 node2 addr=192.168.10.123. Debian/Ubuntu package installation
apt install -y pacemaker corosync pcs fence-agents-base fence-agents-extra
passwd hacluster
systemctl enable --now pcsd4. Opening the firewall with firewalld
firewall-cmd --permanent --add-service=high-availability
firewall-cmd --add-service=high-availability5. Verifying Corosync membership after setup
corosync-cfgtool -s
# Ring ID 0, node1 and node2 listed6. Checking quorum on a two-node cluster
corosync-quorumtool
# With both nodes online: Quorate: Yes
# With one node down: Quorate: No7. Destroying a failed cluster for retry
pcs cluster destroy
# Then re-authenticate and re-run setup8. Checking pcsd status
systemctl status pcsd
# Active: active (running)9. Viewing the generated corosync.conf
cat /etc/corosync/corosync.conf
# Shows nodelist with node1 and node210. Checking cluster version compatibility
pcs --version
pacemakerd --features | head -1
# Both nodes should match or be compatibleVisual
The setup sequence from bare nodes to cluster
┌─────────────────────────────────────────────────────────────┐
│ SETUP SEQUENCE │
│ │
│ node1 node2 │
│ │ │ │
│ ├─ install packages ───────────┤ │
│ ├─ set hacluster password ─────┤ (identical) │
│ ├─ enable pcsd ────────────────┤ │
│ ├─ open firewall ──────────────┤ │
│ │ │ │
│ ├─ pcs host auth node1 node2 ──┤ (authenticate once) │
│ │ │ │
│ ├─ pcs cluster setup ──────────┤ (writes corosync.conf) │
│ │ │ │
│ ▼ ▼ │
│ corosync starts ─────────────► corosync starts │
│ pacemaker starts ────────────► pacemaker starts │
│ │ │ │
│ └──────── pcs status ──────────┘ │
│ both Online │
└─────────────────────────────────────────────────────────────┘The port map for a two-node cluster
┌─────────────────────────────────────────────────────────────┐
│ REQUIRED PORTS │
│ │
│ node1 ─────────── TCP 2224 ─────────── node2 │
│ (pcsd, cluster management) │
│ │
│ node1 ─────────── UDP 5405 ─────────── node2 │
│ (corosync, heartbeat and membership) │
│ │
│ node1 ─────────── TCP 2224 ─────────── node2 │
│ (pcs commands from admin workstation) │
│ │
│ Without 5405: nodes appear OFFLINE │
│ Without 2224: pcs commands timeout │
└─────────────────────────────────────────────────────────────┘Authentication and setup flow
┌─────────────────────────────────────────────────────────────┐
│ pcs host auth vs pcs cluster setup │
│ │
│ pcs host auth │
│ ├─ contacts pcsd on each node (TCP 2224) │
│ ├─ logs in as hacluster │
│ ├─ verifies password matches on all nodes │
│ └─ stores authorization token │
│ │
│ pcs cluster setup │
│ ├─ uses the stored token │
│ ├─ writes /etc/corosync/corosync.conf on each node │
│ ├─ generates and distributes corosync authkey │
│ └─ starts corosync and pacemaker │
│ │
│ If auth fails, setup fails. Order matters. │
└─────────────────────────────────────────────────────────────┘Two-node quorum behavior
┌─────────────────────────────────────────────────────────────┐
│ TWO-NODE CLUSTER QUORUM │
│ │
│ Both nodes online: │
│ node1 (1 vote) + node2 (1 vote) = 2 votes │
│ Quorum: YES → resources can run │
│ │
│ One node offline: │
│ node1 (1 vote) │
│ Quorum: NO → resources stop (default policy) │
│ │
│ This is why two-node clusters need a QDevice: │
│ node1 (1) + node2 (1) + QDevice (1) = 3 votes │
│ One node down: 2 votes → quorum survives │
└─────────────────────────────────────────────────────────────┘Summary
| Item | Value |
|---|---|
| Packages (RHEL) | pcs pacemaker resource-agents fence-agents-all |
| Packages (Debian) | pacemaker corosync pcs fence-agents-base fence-agents-extra |
| Authentication user | hacluster (password must match on all nodes) |
pcsd port | TCP 2224 |
| Corosync cluster port | UDP 5405 |
| Firewall shortcut | firewall-cmd --add-service=high-availability |
| Auth command | pcs host auth <nodes> -u hacluster |
| Setup command | pcs cluster setup <name> <nodes> --start --enable |
| Status verification | pcs status |
| Membership verification | corosync-cfgtool -s |
| Quorum verification | corosync-quorumtool |
Key takeaways:
- Setup is a sequence, not a single command. Packages, password, firewall, auth, and setup must happen in that order on every node.
- The
haclusterpassword is a functional requirement, not a suggestion. It must be identical across nodes becausepcsauthenticates as that user everywhere. - The firewall is the silent failure point. A blocked UDP 5405 lets setup succeed but leaves the second node permanently offline.
pcs cluster setupwrites Corosync’s configuration for you. Manual editing ofcorosync.confis unnecessary and fragile in thepcsworkflow.- A two-node cluster has no quorum when one node stops. This is expected behavior, not a bug. Plan for a QDevice or a third node if the surviving node must continue managing resources.
- Verify with three commands.
pcs status,corosync-cfgtool -s, andcorosync-quorumtooltogether confirm that the cluster is formed, members are communicating, and quorum is held.
Remember: Pacemaker and Corosync setup is the foundation that every later cluster chapter assumes. If pcs status shows both nodes online and quorum is held, the setup is correct. If a node is offline, the problem is almost always one of three things: a firewall blocking UDP 5405, a mismatched hacluster password, or an unresolvable hostname. Check those three before touching any other configuration. The cluster is not “mostly working” when a node is offline—it is not working, and no resource configuration will fix it.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!