# Linstor drbd: one side with authentication, one without?

**URL:** <https://forums.linbit.com/t/linstor-drbd-one-side-with-authentication-one-without/1291>\
**Category:** LINSTOR\
**Tags:** drbd\
**Created:** [October 9, 2026, 11:22am UTC](https://forums.linbit.com/t/linstor-drbd-one-side-with-authentication-one-without/1291 "2026-10-09T11:22:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![candlerb](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@candlerb](https://forums.linbit.com/u/candlerb)\
**Post date:** [October 9, 2026, 11:22am UTC](https://forums.linbit.com/t/linstor-drbd-one-side-with-authentication-one-without/1291/1 "2026-10-09T11:22:21Z")

</div>

Has anyone seen this problem before? After upgrading a node we have some resources which won’t connect, and this is because two nodes have “cram-hmac-alg” and “shared-secret” set, but the third (most recently updated one) does not have those settings configured on the resources.

```auto
root@virtual1:~# ls /var/lib/linstor.d/*.res | wc -l
17
root@virtual1:~# grep shared-secret /var/lib/linstor.d/*.res | wc -l
14

root@virtual5:~# ls /var/lib/linstor.d/*.res | wc -l
17
root@virtual5:~# grep shared-secret /var/lib/linstor.d/*.res | wc -l
14

root@virtual6:~# ls /var/lib/linstor.d/*.res | wc -l
17
root@virtual6:~# grep shared-secret /var/lib/linstor.d/*.res | wc -l
0

```

**DETAILS**

- virtual1 is not yet upgraded, still on PVE8 + drbd 9.2.15
- virtual5 was upgraded yesterday, now on PVE9 with drbd-dkms 9.3.4-1 under kernel 7.0.14-22-pve
- virtual6 upgraded today, now on PVE9 with drbd-dkms 9.3.4-1 under kernel 7.0.14-23-pve (note that Proxmox released a one click upgrade between the two)

There are no primaries on virtual6 - everything was shunted off prior to upgrade.

Problem observed: lots of resources won’t connect. Specifically, those which are still primary on virtual1:

```auto
root@virtual6:~# drbdadm status linstor_db
linstor_db role:Secondary
  disk:Outdated quorum:no open:no
  virtual1 connection:Connecting
  virtual5 connection:Connecting

```

I get this kernel message on the primary:

```auto
[31703144.418159] drbd linstor_db virtual6: conn( Unconnected -> Connecting ) [connecting]
[31703156.741598] drbd linstor_db/0 drbd1002: new current UUID: 5B055C6F1206E6C9 weak: FFFFFFFFFFFFFFFC
[31703288.167071] drbd linstor_db virtual6: Handshake to peer 2 successful: Agreed network protocol version 123
[31703288.167429] drbd linstor_db virtual6: Feature flags enabled on protocol level: 0x7f TRIM THIN_RESYNC WRITE_SAME WRITE_ZEROES RESYNC_DAGTAG
[31703288.176696] drbd linstor_db virtual6: expected AuthChallenge packet, received: P_PROTOCOL (0x000b)
[31703288.176958] drbd linstor_db virtual6: Authentication of peer failed
[31703288.177212] drbd linstor_db virtual6: conn( Connecting -> Disconnecting )

```

which led me to [this post](https://lists.linbit.com/pipermail/drbd-user/2013-June/019968.html) (from 2013!) which hinted the problem is mismatched auth configuration, and indeed this is the case:

```auto
root@virtual1:~# drbdadm dump linstor_db
...
    options {
        auto-promote no;
        on-no-data-accessible io-error;
        on-no-quorum io-error;
        on-suspended-primary-outdated force-secondary;
        quorum majority;
    }
    net {
        cram-hmac-alg sha1;
        shared-secret XXXXXXXX;
        verify-alg sha256;
    }
}

root@virtual5:~# drbdadm dump linstor_db
...
    options {
        auto-promote no;
        on-no-data-accessible io-error;
        on-no-quorum io-error;
        on-suspended-primary-outdated force-secondary;
        quorum majority;
    }
    net {
        cram-hmac-alg sha1;
        shared-secret XXXXXXXX;
        verify-alg sha256;
    }
}

root@virtual6:~# drbdadm dump linstor_db
...
    options {
        auto-promote no;
        on-no-data-accessible io-error;
        on-no-quorum io-error;
        on-suspended-primary-outdated force-secondary;
        quorum majority;
    }
    net {
        verify-alg sha256;
    }
}

```

Note the missing “cram-hmac-alg” and “shared-secret” on virtual6.

But those which are primary on virtual5 _do_ connect, and these have matching resource definitions across all three hosts (all without authentication)

```auto
root@virtual1:~# drbdadm dump pm-eb40ca57
...
    options {
        on-no-quorum io-error;
        quorum majority;
    }
    net {
        allow-two-primaries yes;
        verify-alg sha256;
    }
}

root@virtual5:~# drbdadm dump pm-eb40ca57
...
    options {
        on-no-quorum io-error;
        quorum majority;
    }
    net {
        allow-two-primaries yes;
        verify-alg sha256;
    }
}

root@virtual6:~# drbdadm dump pm-eb40ca57
...
    options {
        on-no-quorum io-error;
        quorum majority;
    }
    net {
        allow-two-primaries yes;
        verify-alg sha256;
    }
}

```

The only thing which I can _think_ of which might be related is:

1. Yesterday I upgraded virtual5

2. Linstor was failing to configure drbd resources at all, because it was trying to use the “crct10dif” verify algorithm which is no longer available - [see thread](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/11)

3. I gave the following commands:

Then there is the kernel difference between 7.0.14-22-pve and 7.0.14-23-pve but that seems unlikely.

linstor versions are pinned to exactly the same everywhere (of course, since the satellite won’t talk to a different version controller)

```auto
root@virtual6:~# dpkg-query -l | grep -v ^ii
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================================-====================================-============-================================================================================
hi drbd-dkms 9.3.4-1 all RAID 1 over TCP/IP for Linux module source
hi drbd-reactor 1.12.0-1 amd64 Monitors DRBD resources via plugins.
hi drbd-utils 9.35.0-1 amd64 RAID 1 over TCP/IP for Linux (user utilities)
hi linstor-common 1.32.3-1 all DRBD distributed resource management utility
hi linstor-controller 1.32.3-1 all DRBD distributed resource management utility
hi linstor-satellite 1.32.3-1 all DRBD distributed resource management utility
hi openjdk-17-jre-headless:amd64 17.0.16+8-1~deb12u1 amd64 OpenJDK Java runtime, using Hotspot JIT (headless)

```

(Oddly, there is no tag v1.32.3 in the linstor-server repository: there are v1.32.2 and v1.33.0)

---

<div class="post-metadata">

**Author:** ![candlerb](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@candlerb](https://forums.linbit.com/u/candlerb)\
**Post date:** [October 9, 2026, 12:04pm UTC](https://forums.linbit.com/t/linstor-drbd-one-side-with-authentication-one-without/1291/2 "2026-10-09T12:04:50Z")

</div>

(Looks in source for v1.32.2, being the nearest version tagged)

```auto
            /* No sha1 on WinDRBD, sorry */
            if (autoVerifyAlgo == null || autoVerifyAlgo.equalsIgnoreCase("windrbd"))
            {
                supportsCramHmac = false;
            }
...
                if (supportsCramHmac)
                {
                    // TODO: make configurable
                    appendLine("cram-hmac-alg sha1;");
                    // TODO: make configurable
                    appendLine("shared-secret \"%s\";", rscDfnData.getSecret());
                }

```

Ergh - so it looks like disabling autoVerifyAlgo also disables the network shared secret!

I have:

```auto
root@virtual1:~# linstor c lp -p | egrep -i 'verify|alg'
| DrbdOptions/Net/verify-alg | sha256 |
| DrbdOptions/auto-verify-algo-allowed-list | crct10dif;crc32c;sha384;sha512;sha256;sha1;md5;windrbd |
| DrbdOptions/auto-verify-algo-disable | true |

```

Therefore I think I need to re-enable autoVerifyAlgo, but remove crct10dif from the list of algorithms. So now I try:

```auto
root@virtual1:~# linstor c sp DrbdOptions/auto-verify-algo-allowed-list "crc32c;sha384;sha512;sha256;sha1;md5;windrbd"
ERROR:
Description:
    The key 'DrbdOptions/auto-verify-algo-allowed-list' is not whitelisted
Details:
    Controller

```

Nope, that is not accepted. What if I just re-enable autoVerifyAlgo, now that 2 of the 3 nodes have the new drbd version?

```auto
root@virtual1:~# linstor c sp DrbdOptions/auto-verify-algo-disable false
INFO:
    Updated linstor_db DRBD auto verify algorithm to 'sha512'
INFO:
    Updated pm-335713f4 DRBD auto verify algorithm to 'sha512'
INFO:
...

root@virtual6:~# grep shared-secret /var/lib/linstor.d/*.res | wc -l
0

```

Nope.

```auto
root@virtual6:~# systemctl restart linstor-satellite; sleep 60
root@virtual6:~# grep shared-secret /var/lib/linstor.d/*.res | wc -l
17

```

Aha! But still not connecting ☹

```auto
root@virtual6:~# drbdadm status linstor_db
linstor_db role:Secondary
  disk:Outdated quorum:no open:no
  virtual1 connection:Connecting
  virtual5 connection:Connecting

root@virtual6:~# drbdadm dump linstor_db | grep -3 secret
    }
    net {
        cram-hmac-alg sha1;
        shared-secret XXXXXXXX;
        verify-alg sha256;
    }
}

```

All three nodes now show the same.

Force a disconnect and reconnect?

```r
oot@virtual6:~# drbdadm disconnect linstor_db
root@virtual6:~# drbdadm connect linstor_db
root@virtual6:~# drbdadm status linstor_db
linstor_db role:Secondary
  disk:Outdated quorum:no open:no
  virtual1 connection:Connecting
  virtual5 connection:Connecting

```

Still no good.

What about disconnect and reconnect from the primary side? Trying a different one here.

```auto
root@virtual1:~# drbdadm status pm-f00a673d
pm-f00a673d role:Primary
  disk:UpToDate open:yes
  virtual5 role:Secondary
    peer-disk:UpToDate
  virtual6 connection:StandAlone

root@virtual1:~# drbdadm disconnect pm-f00a673d
root@virtual1:~# drbdadm connect pm-f00a673d
root@virtual1:~# drbdadm status pm-f00a673d
pm-f00a673d role:Primary
  disk:UpToDate open:yes
  virtual5 role:Secondary
    peer-disk:UpToDate
  virtual6 role:Secondary
    replication:SyncSource peer-disk:Inconsistent done:1.60

root@virtual1:~# drbdadm status pm-f00a673d
pm-f00a673d role:Primary
  disk:UpToDate open:yes
  virtual5 role:Secondary
    peer-disk:UpToDate
  virtual6 role:Secondary
    replication:SyncSource peer-disk:Inconsistent done:4.31

```

That looks like it might be the way.

---

<div class="post-metadata">

**Author:** ![Devin](https://yyz1.discourse-cdn.com/flex003/user_avatar/forums.linbit.com/devin/32/26_2.png) [@Devin](https://forums.linbit.com/u/Devin)\
**Post date:** [October 14, 2026, 11:07pm UTC](https://forums.linbit.com/t/linstor-drbd-one-side-with-authentication-one-without/1291/3 "2026-10-14T23:07:00Z")

</div>

This was indeed a rare, but known issue. LINSTOR had some logic it used to determine which verify-alg to use automatically. On occasion when a node was updated and the allowed algorithm list might change, it might choose incorrectly. We believe we have since fixed this.

See this bug report for more details: [LINSTOR sets wrong verify-alg · Issue #302 · LINBIT/linstor-server · GitHub](https://github.com/LINBIT/linstor-server/issues/302)