Chapter 3. Installing SAP HANA for a 2-node HA cluster setup

Procedure

1. Create the sapsys group. Use the prepared group ID, for example, ID 10001:

   [root]# groupadd -g 10001 sapsys

2. Create the sapadm user as a member of the sapsys group. The user does not need a login shell. Use the prepared user ID, for example ID, 10200:

   [root]# useradd -u 10200 -g sapsys sapadm \
   -c 'SAP Local Administrator' -s /sbin/nologin

3. Create the <sid>adm user as a member of the sapsys group. Use the prepared user ID, for example, ID 10210 for user rh1adm:

   [root]# useradd -u 10210 -g sapsys rh1adm \
   -c 'SAP HANA Administrator' -s /bin/sh

   As the user shell, we recommend that you either use /bin/sh or /bin/csh. SAP installations provide user profiles and useful shell aliases in these shells.

4. Repeat the steps on all nodes.

Verification

1. Check that the users sapadm and <sid>adm exist and have the correct groups and IDs configured, for example:

   [root]# id sapadm rh1adm

   uid=10200(sapadm) gid=10001(sapsys) groups=10001(sapsys)
   uid=10210(rh1adm) gid=10001(sapsys) groups=10001(sapsys)

2. Check that the users have the correct description, home directory and shell defined:

   [root]# grep -E 'sapadm|rh1adm' /etc/passwd

   sapadm:x:10200:10001:SAP Local Administrator:/home/sapadm:/sbin/nologin
   rh1adm:x:10210:10001:SAP HANA Administrator:/home/rh1adm:/bin/sh

3. Repeat the check on all nodes and verify that the names and IDs are identical.

Procedure

1. Generate an ssh key pair. When no key type is defined, it creates an Ed25519 key by default, like in the following example for the root user:

   [root]# ssh-keygen

2. Option 1, if you have ssh PasswordAuthentication enabled on the remote system: Use the ssh-copy-id tool to add the ssh public key to the authorized_keys on the remote system. This automatically creates the .ssh/ directory and authorized_keys file with correct permissions for the target user on the remote system. Run it on the host on which you created the ssh key in the previous step and enter the target user password when prompted:

   [root]# ssh-copy-id <remote_system>

   In the case of the root user, this only works if the ssh config allows PermitRootLogin and you can provide the root user password in the prompt. Check the ssh configuration setting on the remote system if you face access permission issues even after you have enabled PasswordAuthentication. Consult your security policies before you enable these parameters on your HANA systems.

3. Option 2, if password login to the target user on the remote host is prohibited or otherwise not possible: Configure the ssh key access on the remote system manually.

   1. Create the .ssh/ directory in the target user’s home path on the remote system, if it does not exist yet. Run this on the remote system, for example, for the root user:

      [root]# mkdir /root/.ssh

   2. Change the permissions of the new .ssh/ directory. For security reasons the ssh key access does not work when the permissions are not correct. Run this on the remote system:

      [root]# chmod 0700 /root/.ssh

   3. Copy the ssh public key from the .pub file that was created by the previous ssh-keygen, for example, id_ed25519.pub in the default setting:

      [root]# cat /root/.ssh/id_ed25519.pub

      ssh-ed25519 … root@<node1>

   4. Add the public key to the authorized_keys file. The command creates the file if it does not exist yet, otherwise it appends the key to the existing content. Run this on the remote system, for example, on node2:

      [root]# cat << EOF >> /root/.ssh/authorized_keys
      ssh-ed25519 … root@<node1>
      EOF

   5. Ensure that the authorized_keys file has the correct permissions, otherwise the ssh key access is blocked for security reasons:

      [root]# chmod 0600 /root/.ssh/authorized_keys

4. Access each system and log in from any source host to any remote host that you require for the setup. On first login you must accept each new connection once in an interactive prompt. This saves each host and key in the ssh known_hosts file by default.

   1. Option 1: Log in from each host to each other host and accept the key fingerprint once to save it to the local known_hosts file. Subsequent logins to the same host will not require further interaction, unless the key changes. This is a security measure to prevent unsolicited changes of the ssh keys. The following example confirms the authenticity of host node2:

      [root]# ssh node2

      The authenticity of host 'node2 (***)' can't be established.
      ED25519 key fingerprint is SHA256:*********************************.
      This key is not known by any other names
      Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
      …

   2. Option 2: If you configure ssh key access between multiple systems you can use ssh-keyscan to collect the public host key from multiple hosts and save it to the local known_hosts file in a single step per host. Run this on each system for which you distributed the public key and list all remote hosts that you potentially access from this node and user, for example, for the root user on host node1:

      [root]# [root]# ssh-keyscan node2 >> /root/.ssh/known_hosts

      # node2:22 SSH-2.0-OpenSSH_8.7
      node2 ssh-ed25519 …

      • The >> shell redirection after the scan command directly appends the collected keys to the known_hosts file. If the file does not exist yet it is created in the process.

Procedure

1. Go to the directory which contains the installation media, for example /sapmedia/hana:

   [root]# cd /sapmedia/hana

2. Unpack the installation media:

   [root]# unzip <sap_hana_software>.ZIP

3. Go into the path of the unpacked installation media:

   [root]# cd /sapmedia/hana/DATA_UNITS/HDB_LCM_LINUX_<arch>

4. Run the SAP HANA Lifecycle Management tool (HDBLCM) for an interactive installation:

   [root]# ./hdblcm

   In the interactive mode the installer asks you for all the required information, including the System ID (SID), Installation Number (instance), the filesystem location of data and log volumes, and more.

   Optionally you can use the batch mode of the command-line installation tool and provide your configuration parameters in one step. For more details see Use Batch Mode to Perform Platform LCM Tasks in the SAP HANA Server Installation and Update Guide.

5. Repeat the steps on all nodes.

Verification

1. Switch to the <sid>adm user:

   [root]# su - rh1adm

2. Check the HANA instance runtime information as user <sid>adm:

   rh1adm$ HDB info

   USER          PID     PPID  %CPU        VSZ        RSS COMMAND
   rh1adm      17897    17895   0.0       8972       5248 -sh
   rh1adm      24461    17897   0.0       7524       3840  \_ /bin/sh /usr/sap/RH1/HDB02/HDB info
   rh1adm      24490    24461   0.0      10104       3456      \_ ps fx -U rh1adm -o user:8,pid:8,ppid:8,pcpu:5,vsz:10,rss:10,args
   rh1adm      12924        1   0.0     581456      40072 hdbrsutil  --start --port 34203 --volume 3 --volumesuffix ...
   rh1adm      12284        1   0.0     581376      40000 hdbrsutil  --start --port 34201 --volume 1 --volumesuffix ...
   rh1adm      12193        1   0.0       9028       3028 sapstart pf=/usr/sap/RH1/SYS/profile/RH1_HDB02_node1
   rh1adm      12200    12193   0.0     476372      87652  \_ /usr/sap/RH1/HDB02/node1/trace/hdb.sapRH1_HDB02 -d -nw -f /usr/sap/RH1/HDB02/node1/daemon.ini pf=/usr/sap/RH1/SYS/profile/RH1_HDB02_node1
   rh1adm      12222    12200   9.6   19986956   16126960      \_ hdbnameserver
   rh1adm      12787    12200   0.3    1464980     214468      \_ hdbcompileserver
   rh1adm      12790    12200  94.0    7669612    6970948      \_ hdbpreprocessor
   rh1adm      12828    12200  12.7   19716232   14994012      \_ hdbindexserver -port 34203
   rh1adm      12831    12200   1.1    4995088    1465724      \_ hdbxsengine -port 34207
   rh1adm      13269    12200   0.4    2660096     461776      \_ hdbwebdispatcher
   rh1adm      12016        1   0.0     499404      58336 /usr/sap/RH1/HDB02/exe/sapstartsrv pf=/usr/sap/RH1/SYS/profile/RH1_HDB02_node1

3. Additionally, you can verify the landscapeHostConfiguration.py output for status ok:

   rh1adm$ cdpy; python landscapeHostConfiguration.py

   | Host  | Host   | Host   | Failover | Remove | Storage   | Storage   | Failover | Failover | NameServer | NameServer | IndexServer | IndexServer | Host   | Host   | Worker  | Worker  |
   |       | Active | Status | Status   | Status | Config    | Actual    | Config   | Actual   | Config     | Actual     | Config      | Actual      | Config | Actual | Config  | Actual  |
   |       |        |        |          |        | Partition | Partition | Group    | Group    | Role       | Role       | Role        | Role        | Roles  | Roles  | Groups  | Groups  |
   | ----- | ------ | ------ | -------- | ------ | --------- | --------- | -------- | -------- | ---------- | ---------- | ----------- | ----------- | ------ | ------ | ------- | ------- |
   | node1 | yes    | ok     |          |        |         1 |         1 | default  | default  | master 1   | master     | worker      | master      | worker | worker | default | default |
   
   overall host status: ok

4. Check that the systemd units are installed for the HANA instance and the SAP Host Agent:

   [root]# systemctl list-unit-files --all sap* SAP*

   UNIT FILE            STATE     PRESET
   sapmedia.mount       generated -
   saphostagent.service enabled   disabled
   sapinit.service      generated -
   SAPRH1_02.service    enabled   disabled
   SAP.slice            static    -
   
   5 unit files listed.

5. Repeat the steps on all nodes. Note that the HANA profiles contain the individual node name in the format <SID>_HDB<instance>_<node>.

Procedure

1. Go to the HANA instance profile directory:

   [root]# cd /hana/shared/<SID>/profile

2. Edit the instance profile:

   [root]# vi <SID>_HDB<instance>_<hostname>

   Ensure that Autostart is set to 0.

3. Repeat the previous steps for each HANA instance that will be managed as part of the HA cluster.