Configure user equivalence for agent OS owner running script sshUserSetup.sh from agent home like below:
###################################################################################################################
[oraag12c@bwmdsp03 u01]$ ./core/12.1.0.1.0/oui/prov/resources/scripts/sshUserSetup.sh -user oraag12c -hosts "bwmdsp03 bwmdsp04 bwmdsp08 bwmdsp09" -usePassphrase 123mudar -noPromptPassphrase
The output of this script is also logged into /tmp/sshUserSetup_2012-04-13-21-15-30.log
Hosts are bwmdsp03 bwmdsp04 bwmdsp08 bwmdsp09
user is oraag12c
Platform:- Linux
Checking if the remote hosts are reachable
PING bwmdsp03.b2w (192.168.201.111) 56(84) bytes of data.
64 bytes from bwmdsp03.b2w (192.168.201.111): icmp_seq=1 ttl=64 time=0.018 ms
64 bytes from bwmdsp03.b2w (192.168.201.111): icmp_seq=2 ttl=64 time=0.017 ms
64 bytes from bwmdsp03.b2w (192.168.201.111): icmp_seq=3 ttl=64 time=0.032 ms
64 bytes from bwmdsp03.b2w (192.168.201.111): icmp_seq=4 ttl=64 time=0.032 ms
64 bytes from bwmdsp03.b2w (192.168.201.111): icmp_seq=5 ttl=64 time=0.053 ms
--- bwmdsp03.b2w ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4000ms
rtt min/avg/max/mdev = 0.017/0.030/0.053/0.013 ms
PING bwmdsp04.b2w (192.168.201.112) 56(84) bytes of data.
64 bytes from bwmdsp04.b2w (192.168.201.112): icmp_seq=1 ttl=64 time=0.114 ms
64 bytes from bwmdsp04.b2w (192.168.201.112): icmp_seq=2 ttl=64 time=0.123 ms
64 bytes from bwmdsp04.b2w (192.168.201.112): icmp_seq=3 ttl=64 time=0.102 ms
64 bytes from bwmdsp04.b2w (192.168.201.112): icmp_seq=4 ttl=64 time=0.098 ms
64 bytes from bwmdsp04.b2w (192.168.201.112): icmp_seq=5 ttl=64 time=0.100 ms
--- bwmdsp04.b2w ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 3999ms
rtt min/avg/max/mdev = 0.098/0.107/0.123/0.013 ms
PING bwmdsp08.b2w (192.168.201.114) 56(84) bytes of data.
64 bytes from bwmdsp08.b2w (192.168.201.114): icmp_seq=1 ttl=64 time=0.216 ms
64 bytes from bwmdsp08.b2w (192.168.201.114): icmp_seq=2 ttl=64 time=0.160 ms
64 bytes from bwmdsp08.b2w (192.168.201.114): icmp_seq=3 ttl=64 time=0.158 ms
64 bytes from bwmdsp08.b2w (192.168.201.114): icmp_seq=4 ttl=64 time=0.340 ms
64 bytes from bwmdsp08.b2w (192.168.201.114): icmp_seq=5 ttl=64 time=0.167 ms
--- bwmdsp08.b2w ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 3999ms
rtt min/avg/max/mdev = 0.158/0.208/0.340/0.069 ms
PING bwmdsp09.b2w (192.168.201.115) 56(84) bytes of data.
64 bytes from bwmdsp09.b2w (192.168.201.115): icmp_seq=1 ttl=64 time=0.171 ms
64 bytes from bwmdsp09.b2w (192.168.201.115): icmp_seq=2 ttl=64 time=0.259 ms
64 bytes from bwmdsp09.b2w (192.168.201.115): icmp_seq=3 ttl=64 time=0.158 ms
64 bytes from bwmdsp09.b2w (192.168.201.115): icmp_seq=4 ttl=64 time=0.180 ms
64 bytes from bwmdsp09.b2w (192.168.201.115): icmp_seq=5 ttl=64 time=0.174 ms
--- bwmdsp09.b2w ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4000ms
rtt min/avg/max/mdev = 0.158/0.188/0.259/0.038 ms
Remote host reachability check succeeded.
The following hosts are reachable: bwmdsp03 bwmdsp04 bwmdsp08 bwmdsp09.
The following hosts are not reachable: .
All hosts are reachable. Proceeding further...
The script will setup SSH connectivity from the host bwmdsp03 to all
the remote hosts. After the script is executed, the user can use SSH to run
commands on the remote hosts or copy files between this host bwmdsp03
and the remote hosts without being prompted for passwords or confirmations.
NOTE 1:
As part of the setup procedure, this script will use ssh and scp to copy
files between the local host and the remote hosts. Since the script does not
store passwords, you may be prompted for the passwords during the execution of
the script whenever ssh or scp is invoked.
NOTE 2:
AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY
AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE
directories.
Do you want to continue and let the script make the above mentioned changes (yes/no)?
yes
The user chose yes
User chose to skip passphrase related questions.
Creating .ssh directory on local host, if not present already
Creating authorized_keys file on local host
Changing permissions on authorized_keys to 644 on local host
Creating known_hosts file on local host
Changing permissions on known_hosts to 644 on local host
Creating config file on local host
If a config file exists already at /home/oraag12c/.ssh/config, it would be backed up to /home/oraag12c/.ssh/config.backup.
Removing old private/public keys on local host
Running SSH keygen on local host with empty passphrase
Generating public/private rsa key pair.
Your identification has been saved in /home/oraag12c/.ssh/id_rsa.
Your public key has been saved in /home/oraag12c/.ssh/id_rsa.pub.
The key fingerprint is:
9c:6c:1a:03:02:0e:65:1b:62:f2:03:ff:c1:88:a8:0e oraag12c@bwmdsp03
Creating .ssh directory and setting permissions on remote host bwmdsp03
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oraag12c. THIS IS AN SSH REQUIREMENT.
The script would create ~oraag12c/.ssh/config file on remote host bwmdsp03. If a config file exists already at ~oraag12c/.ssh/config, it would be backed up to ~oraag12c/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host bwmdsp03.
Warning: Permanently added 'bwmdsp03,192.168.201.111' (RSA) to the list of known hosts.
oraag12c@bwmdsp03's password:
Done with creating .ssh directory and setting permissions on remote host bwmdsp03.
Creating .ssh directory and setting permissions on remote host bwmdsp04
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oraag12c. THIS IS AN SSH REQUIREMENT.
The script would create ~oraag12c/.ssh/config file on remote host bwmdsp04. If a config file exists already at ~oraag12c/.ssh/config, it would be backed up to ~oraag12c/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host bwmdsp04.
Warning: Permanently added 'bwmdsp04,192.168.201.112' (RSA) to the list of known hosts.
oraag12c@bwmdsp04's password:
Done with creating .ssh directory and setting permissions on remote host bwmdsp04.
Creating .ssh directory and setting permissions on remote host bwmdsp08
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oraag12c. THIS IS AN SSH REQUIREMENT.
The script would create ~oraag12c/.ssh/config file on remote host bwmdsp08. If a config file exists already at ~oraag12c/.ssh/config, it would be backed up to ~oraag12c/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host bwmdsp08.
Warning: Permanently added 'bwmdsp08,192.168.201.114' (RSA) to the list of known hosts.
oraag12c@bwmdsp08's password:
Done with creating .ssh directory and setting permissions on remote host bwmdsp08.
Creating .ssh directory and setting permissions on remote host bwmdsp09
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oraag12c. THIS IS AN SSH REQUIREMENT.
The script would create ~oraag12c/.ssh/config file on remote host bwmdsp09. If a config file exists already at ~oraag12c/.ssh/config, it would be backed up to ~oraag12c/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host bwmdsp09.
Warning: Permanently added 'bwmdsp09,192.168.201.115' (RSA) to the list of known hosts.
oraag12c@bwmdsp09's password:
Done with creating .ssh directory and setting permissions on remote host bwmdsp09.
Copying local host public key to the remote host bwmdsp03
The user may be prompted for a password or passphrase here since the script would be using SCP for host bwmdsp03.
oraag12c@bwmdsp03's password:
Done copying local host public key to the remote host bwmdsp03
Copying local host public key to the remote host bwmdsp04
The user may be prompted for a password or passphrase here since the script would be using SCP for host bwmdsp04.
oraag12c@bwmdsp04's password:
Done copying local host public key to the remote host bwmdsp04
Copying local host public key to the remote host bwmdsp08
The user may be prompted for a password or passphrase here since the script would be using SCP for host bwmdsp08.
oraag12c@bwmdsp08's password:
Done copying local host public key to the remote host bwmdsp08
Copying local host public key to the remote host bwmdsp09
The user may be prompted for a password or passphrase here since the script would be using SCP for host bwmdsp09.
oraag12c@bwmdsp09's password:
Done copying local host public key to the remote host bwmdsp09
The script will run SSH on the remote machine bwmdsp03. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
The script will run SSH on the remote machine bwmdsp04. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
The script will run SSH on the remote machine bwmdsp08. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
The script will run SSH on the remote machine bwmdsp09. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
cat: /home/oraag12c/.ssh/known_hosts.tmp: No such file or directory
cat: /home/oraag12c/.ssh/authorized_keys.tmp: No such file or directory
SSH setup is complete.
------------------------------------------------------------------------
Verifying SSH setup
===================
The script will now run the date command on the remote nodes using ssh
to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP,
THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR
PASSWORDS. If you see any output other than date or are prompted for the
password, ssh is not setup correctly and you will need to resolve the
issue and set up ssh again.
The possible causes for failure could be:
1. The server settings in /etc/ssh/sshd_config file do not allow ssh
for user oraag12c.
2. The server may have disabled public key based authentication.
3. The client public key on the server may be outdated.
4. ~oraag12c or ~oraag12c/.ssh on the remote host may not be owned by oraag12c.
5. User may not have passed -shared option for shared remote users or
may be passing the -shared option for non-shared remote users.
6. If there is output in addition to the date, but no password is asked,
it may be a security alert shown as part of company policy. Append the
additional text to the
------------------------------------------------------------------------
--bwmdsp03:--
Running /usr/bin/ssh -x -l oraag12c bwmdsp03 date to verify SSH connectivity has been setup from local host to bwmdsp03.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
The script will run SSH on the remote machine bwmdsp03. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
Fri Apr 13 21:16:31 BRT 2012
------------------------------------------------------------------------
--bwmdsp04:--
Running /usr/bin/ssh -x -l oraag12c bwmdsp04 date to verify SSH connectivity has been setup from local host to bwmdsp04.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
The script will run SSH on the remote machine bwmdsp04. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
Fri Apr 13 21:16:31 BRT 2012
------------------------------------------------------------------------
--bwmdsp08:--
Running /usr/bin/ssh -x -l oraag12c bwmdsp08 date to verify SSH connectivity has been setup from local host to bwmdsp08.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
The script will run SSH on the remote machine bwmdsp08. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
Fri Apr 13 21:16:31 BRT 2012
------------------------------------------------------------------------
--bwmdsp09:--
Running /usr/bin/ssh -x -l oraag12c bwmdsp09 date to verify SSH connectivity has been setup from local host to bwmdsp09.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
The script will run SSH on the remote machine bwmdsp09. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
Fri Apr 13 21:16:31 BRT 2012
------------------------------------------------------------------------
SSH verification complete.
[oraag12c@bwmdsp03 u01]$ cd /opt/oracle/products/crs/bin/
[oraag12c@bwmdsp03 bin]$ ./cluvfy comp crs -n bwmdsp03,bwmdsp04
Verifying CRS integrity
Checking CRS integrity...
Checking daemon liveness...
Liveness check passed for "CRS daemon".
Checking daemon liveness...
Liveness check passed for "CSS daemon".
Checking daemon liveness...
Liveness check passed for "EVM daemon".
Checking CRS health...
CRS health check passed.
CRS integrity check passed.
Verification of CRS integrity was successful.
###################################################################################################################
Best Regards,
Paulo Portugal
No comments:
Post a Comment