Wednesday, April 15, 2015

Configuring SSH for Oracle RAC installation

User equivalence is required on all nodes during Oracle RAC installation which provides OUI to log into all remote notes to perform copy/install the software and perform other configuration tasks. We can use different approaches to setup the passwordless ssh connectivity.

1- Manually perform all steps as mentioned here by Tim Hall
2- During the installation, OUI would provide option to configure the ssh connectivity
3- Executing script <oracle_binaries_extrected_directory/sshsetup/sshUserSetup.sh>


I am discussing the 3rd method in the following by using sshUserSetup.sh script which can be run from either Grid Infrastructure extracted binaries directory or RDBMS software extracted binaries directory.  

Log in as user for which you want to configure user equivalence. I am using “oracle” user and configuring user equivalence for my 2 nodes salman1, and salman2 for installation of 12.1.0.2 RAC on Linux 7. Highlighted in red are the inputs provided by the user during configuration

[oracle@salman1 ~]$ cd /u02/12.1.0.2/database/sshsetup
[oracle@salman1 sshsetup]$ ./sshUserSetup.sh
Please specify a valid and existing cluster configuration file.
Either user name or host information is missing
Usage ./sshUserSetup.sh -user <user name> [ -hosts "<space separated hostlist>" | -hostfile <absolute path of cluster configuration file> ] [ -advanced ]  [ -verify] [ -exverify ] [ -logfile <desired absolute path of logfile> ] [-confirm] [-shared] [-help] [-usePassphrase] [-noPromptPassphrase]

[oracle@salman1 sshsetup]$ ./sshUserSetup.sh -user oracle -hosts "salman1 salman2"
The output of this script is also logged into /tmp/sshUserSetup_2015-04-14-16-51-44.log
Hosts are salman1 salman2
user is oracle
Platform:- Linux
Checking if the remote hosts are reachable
PING salman1.salman.com (192.231.231.40) 56(84) bytes of data.
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=1 ttl=64 time=0.022 ms
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=2 ttl=64 time=0.034 ms
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=3 ttl=64 time=0.077 ms
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=4 ttl=64 time=0.058 ms
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=5 ttl=64 time=0.030 ms

--- salman1.salman.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4001ms
rtt min/avg/max/mdev = 0.022/0.044/0.077/0.020 ms
PING salman2.salman.com (192.231.231.41) 56(84) bytes of data.
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=1 ttl=64 time=1.51 ms
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=2 ttl=64 time=1.34 ms
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=3 ttl=64 time=0.728 ms
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=4 ttl=64 time=0.613 ms
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=5 ttl=64 time=0.678 ms

--- salman2.salman.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4012ms
rtt min/avg/max/mdev = 0.613/0.975/1.510/0.375 ms
Remote host reachability check succeeded.
The following hosts are reachable: salman1 salman2.
The following hosts are not reachable: .
All hosts are reachable. Proceeding further...
firsthost salman1
numhosts 2
The script will setup SSH connectivity from the host salman1.salman.com to all
the remote hosts. After the script is executed, the user can use SSH to run
commands on the remote hosts or copy files between this host salman1.salman.com
and the remote hosts without being prompted for passwords or confirmations.

NOTE 1:
As part of the setup procedure, this script will use ssh and scp to copy
files between the local host and the remote hosts. Since the script does not
store passwords, you may be prompted for the passwords during the execution of
the script whenever ssh or scp is invoked.

NOTE 2:
AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY
AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE
directories.

Do you want to continue and let the script make the above mentioned changes (yes/no)?
yes

The user chose yes
Please specify if you want to specify a passphrase for the private key this script will create for the local host. Passphrase is used to encrypt the private key and makes SSH much more secure. Type 'yes' or 'no' and then press enter. In case you press 'yes', you would need to enter the passphrase whenever the script executes ssh or scp.
The estimated number of times the user would be prompted for a passphrase is 4. In addition, if the private-public files are also newly created, the user would have to specify the passphrase on one additional occasion.
Enter 'yes' or 'no'.
no

The user chose no
Creating .ssh directory on local host, if not present already
Creating authorized_keys file on local host
Changing permissions on authorized_keys to 644 on local host
Creating known_hosts file on local host
Changing permissions on known_hosts to 644 on local host
Creating config file on local host
If a config file exists already at /home/oracle/.ssh/config, it would be backed up to /home/oracle/.ssh/config.backup.
Creating .ssh directory and setting permissions on remote host salman1
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host salman1. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host salman1.
Warning: Permanently added 'salman1,192.231.231.40' (ECDSA) to the list of known hosts.
oracle@salman1's password:
Done with creating .ssh directory and setting permissions on remote host salman1.
Creating .ssh directory and setting permissions on remote host salman2
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host salman2. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host salman2.
Warning: Permanently added 'salman2,192.231.231.41' (ECDSA) to the list of known hosts.
oracle@salman2's password:
Done with creating .ssh directory and setting permissions on remote host salman2.
Copying local host public key to the remote host salman1
The user may be prompted for a password or passphrase here since the script would be using SCP for host salman1.
oracle@salman1's password:
Done copying local host public key to the remote host salman1
Copying local host public key to the remote host salman2
The user may be prompted for a password or passphrase here since the script would be using SCP for host salman2.
oracle@salman2's password:
Done copying local host public key to the remote host salman2
cat: /home/oracle/.ssh/known_hosts.tmp: No such file or directory
cat: /home/oracle/.ssh/authorized_keys.tmp: No such file or directory
SSH setup is complete.

------------------------------------------------------------------------
Verifying SSH setup
===================
The script will now run the date command on the remote nodes using ssh
to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP,
THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR
PASSWORDS. If you see any output other than date or are prompted for the
password, ssh is not setup correctly and you will need to resolve the
issue and set up ssh again.
The possible causes for failure could be:
1. The server settings in /etc/ssh/sshd_config file do not allow ssh
for user oracle.
2. The server may have disabled public key based authentication.
3. The client public key on the server may be outdated.
4. ~oracle or ~oracle/.ssh on the remote host may not be owned by oracle.
5. User may not have passed -shared option for shared remote users or
may be passing the -shared option for non-shared remote users.
6. If there is output in addition to the date, but no password is asked,
it may be a security alert shown as part of company policy. Append the
additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file.
------------------------------------------------------------------------
--salman1:--
Running /usr/bin/ssh -x -l oracle salman1 date to verify SSH connectivity has been setup from local host to salman1.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Tue Apr 14 16:52:53 SGT 2015
------------------------------------------------------------------------
--salman2:--
Running /usr/bin/ssh -x -l oracle salman2 date to verify SSH connectivity has been setup from local host to salman2.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Tue Apr 14 16:52:53 SGT 2015
------------------------------------------------------------------------
SSH verification complete.

--Verify the configuration 

[oracle@salman1 sshsetup]$ ./sshUserSetup.sh -user oracle -hosts "salman1 salman2" -verify
The output of this script is also logged into /tmp/sshUserSetup_2015-04-14-16-54-54.log
Hosts are salman1 salman2
user is oracle
Platform:- Linux
Checking if the remote hosts are reachable
PING salman1.salman.com (192.231.231.40) 56(84) bytes of data.
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=1 ttl=64 time=0.047 ms
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=2 ttl=64 time=0.075 ms
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=3 ttl=64 time=0.078 ms
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=4 ttl=64 time=0.055 ms
64 bytes from salman1.salman.com (192.231.231.40): icmp_seq=5 ttl=64 time=0.064 ms

--- salman1.salman.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4002ms
rtt min/avg/max/mdev = 0.047/0.063/0.078/0.015 ms
PING salman2.salman.com (192.231.231.41) 56(84) bytes of data.
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=1 ttl=64 time=3.84 ms
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=2 ttl=64 time=0.705 ms
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=3 ttl=64 time=1.73 ms
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=4 ttl=64 time=1.11 ms
64 bytes from salman2.salman.com (192.231.231.41): icmp_seq=5 ttl=64 time=1.08 ms

--- salman2.salman.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4006ms
rtt min/avg/max/mdev = 0.705/1.697/3.846/1.123 ms
Remote host reachability check succeeded.
The following hosts are reachable: salman1 salman2.
The following hosts are not reachable: .
All hosts are reachable. Proceeding further...
firsthost salman1
numhosts 2
Since user has specified -verify option, SSH setup would not be done. Only, existing SSH setup would be verified.

------------------------------------------------------------------------
Verifying SSH setup
===================
The script will now run the date command on the remote nodes using ssh
to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP,
THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR
PASSWORDS. If you see any output other than date or are prompted for the
password, ssh is not setup correctly and you will need to resolve the
issue and set up ssh again.
The possible causes for failure could be:
1. The server settings in /etc/ssh/sshd_config file do not allow ssh
for user oracle.
2. The server may have disabled public key based authentication.
3. The client public key on the server may be outdated.
4. ~oracle or ~oracle/.ssh on the remote host may not be owned by oracle.
5. User may not have passed -shared option for shared remote users or
may be passing the -shared option for non-shared remote users.
6. If there is output in addition to the date, but no password is asked,
it may be a security alert shown as part of company policy. Append the
additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file.
------------------------------------------------------------------------
--salman1:--
Running /usr/bin/ssh -x -l oracle salman1 date to verify SSH connectivity has been setup from local host to salman1.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Tue Apr 14 16:55:02 SGT 2015
------------------------------------------------------------------------
--salman2:--
Running /usr/bin/ssh -x -l oracle salman2 date to verify SSH connectivity has been setup from local host to salman2.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Tue Apr 14 16:55:03 SGT 2015
------------------------------------------------------------------------
SSH verification complete.


No comments: