Oracle Rac setup ssh key ..
setup ssh key
Host detail !!
orarac12a 192.168.0.41
orarac12b 192.168.0.45
Imp!!!!
make a .ssh directory under user home directory on all nodes
mkdir ~/.ssh
chmod 700 ~/.ssh
cd ~/.ssh
[grid@orarac12a ~]$ mkdir ~/.ssh
[grid@orarac12a ~]$ chmod 700 ~/.ssh
[grid@orarac12a ~]$ cd ~/.ssh
command ssh-keygen -N '' -t rsa initiated the creation of the key pair without any password. private key will be saved in .ssh/id_rsa.
[grid@orarac12a .ssh]$ ssh-keygen -t rsa -N '' -f id_rsa
Generating public/private rsa key pair.
Your identification has been saved in id_rsa.
Your public key has been saved in id_rsa.pub.
The key fingerprint is:
6b:86:bf:f3:88:7b:7e:5c:fb:19:61:bd:34:ab:e0:98 grid@orarac12a
The key's randomart image is:
+--[ RSA 2048]----+
| |
| |
| |
| . |
| S oo.|
| . . ....+|
| . +. o ..o |
| =o.* o .o |
| o+=E.. oo |
+-----------------+
to append the authorized keys
[grid@orarac12a .ssh]$ cat id_rsa.pub > authorized_keys
[grid@orarac12a .ssh]$ ls -ltr
total 12
-rw-r--r--. 1 grid oinstall 396 Jun 3 10:07 id_rsa.pub
-rw-------. 1 grid oinstall 1675 Jun 3 10:07 id_rsa
-rw-r--r--. 1 grid oinstall 396 Jun 3 10:07 authorized_keys
[grid@orarac12a .ssh]$ cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIdWRKqwbanBGpx1KJUSdN/T4ozvyBfmSU/WC5HaiHgHRXRDfQ8S6pd02j/2MzmQ7LH7BhLefcRiiaeqd6+DxOOqVDGQ0iciVEYyjqenlgnVSVy1fgMda85XTFP5H0xFiiAS+gJq7CxTr57ixrCRLsjpLNUkr8Kc45lI52l9kBHBl+1zAqliImVYj96+fbx96xwkpj2x2AltNlXyzg7v+Mv3jJM4Fs9BoDmPusYQvP4rFYS70GmuQtwCztoiHjMK7RoQ2rt8KFv+W0zdlpuKOh/d6/ec4HrJwLhXrrSd4ivgjLhej3XmRtAUB2pwGatEi0wmJG6heD7QcqVWiCHN3l grid@orarac12a
######################################################################################
Repeat this action for every node in the the cluster, until you've added the last node
######################################################################################
To copy the key to other node
[grid@orarac12a .ssh]$ ssh-copy-id grid@192.168.0.45
The authenticity of host '192.168.0.45 (192.168.0.45)' can't be established.
ECDSA key fingerprint is b4:c0:5d:61:87:5b:f9:15:a8:c3:61:ba:f6:13:87:03.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
grid@192.168.0.45's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'grid@192.168.0.45'"
and check to make sure that only the key(s) you wanted were added.
[grid@orarac12a .ssh]$ ls -ltr
total 16
-rw-r--r--. 1 grid oinstall 396 Jun 3 10:07 id_rsa.pub
-rw-------. 1 grid oinstall 1675 Jun 3 10:07 id_rsa
-rw-r--r--. 1 grid oinstall 174 Jun 3 10:10 known_hosts
-rw-r--r--. 1 grid oinstall 792 Jun 3 10:10 authorized_keys
and from other node
ssh-copy-id grid@192.168.0.41
[grid@orarac12a .ssh]$ ssh 192.168.0.45
Last login: Sat Jun 3 10:04:52 2017
========================================
Oracle oracle user !!!!
or via sshUserSetup.sh
find -name sshUserSetup.sh /u01/app/19.0.0
find /u01/app/19.0.0 -name sshUserSetup.sh
cp /u01/app/19.0.0/grid/deinstall/sshUserSetup.sh /home/oracle/
cd /home/oracle/
ls -ltr
chmod 777 sshUserSetup.sh
[oracle@ora-rac1 ~]$ ./sshUserSetup.sh -user oracle -hosts 'ora-rac1 ora-rac2' -advanced -exverify -confirm
The output of this script is also logged into /tmp/sshUserSetup_2024-11-28-13-13-09.log
Hosts are ora-rac1 ora-rac2
user is oracle
Platform:- Linux
Checking if the remote hosts are reachable
PING ora-rac1.uk.com (192.168.1.214) 56(84) bytes of data.
64 bytes from ora-rac1.uk.com (192.168.1.214): icmp_seq=1 ttl=64 time=0.015 ms
64 bytes from ora-rac1.uk.com (192.168.1.214): icmp_seq=2 ttl=64 time=0.090 ms
64 bytes from ora-rac1.uk.com (192.168.1.214): icmp_seq=3 ttl=64 time=0.095 ms
64 bytes from ora-rac1.uk.com (192.168.1.214): icmp_seq=4 ttl=64 time=0.062 ms
64 bytes from ora-rac1.uk.com (192.168.1.214): icmp_seq=5 ttl=64 time=0.077 ms
--- ora-rac1.uk.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4003ms
rtt min/avg/max/mdev = 0.015/0.067/0.095/0.030 ms
PING ora-rac2.uk.com (192.168.1.215) 56(84) bytes of data.
64 bytes from ora-rac2.uk.com (192.168.1.215): icmp_seq=1 ttl=64 time=0.414 ms
64 bytes from ora-rac2.uk.com (192.168.1.215): icmp_seq=2 ttl=64 time=1.89 ms
64 bytes from ora-rac2.uk.com (192.168.1.215): icmp_seq=3 ttl=64 time=1.50 ms
64 bytes from ora-rac2.uk.com (192.168.1.215): icmp_seq=4 ttl=64 time=1.79 ms
64 bytes from ora-rac2.uk.com (192.168.1.215): icmp_seq=5 ttl=64 time=1.90 ms
--- ora-rac2.uk.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4009ms
rtt min/avg/max/mdev = 0.414/1.503/1.909/0.564 ms
Remote host reachability check succeeded.
The following hosts are reachable: ora-rac1 ora-rac2.
The following hosts are not reachable: .
All hosts are reachable. Proceeding further...
firsthost ora-rac1
numhosts 2
The script will setup SSH connectivity from the host ora-rac1 to all
the remote hosts. After the script is executed, the user can use SSH to run
commands on the remote hosts or copy files between this host ora-rac1
and the remote hosts without being prompted for passwords or confirmations.
NOTE 1:
As part of the setup procedure, this script will use ssh and scp to copy
files between the local host and the remote hosts. Since the script does not
store passwords, you may be prompted for the passwords during the execution of
the script whenever ssh or scp is invoked.
NOTE 2:
AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY
AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEGES TO THESE
directories.
Do you want to continue and let the script make the above mentioned changes (yes/no)?
Confirmation provided on the command line
The user chose yes
Please specify if you want to specify a passphrase for the private key this script will create for the local host. Passphrase is used to encrypt the private key and makes SSH much more secure. Type 'yes' or 'no' and then press enter. In case you press 'yes', you would need to enter the passphrase whenever the script executes ssh or scp. no
The estimated number of times the user would be prompted for a passphrase is 4. In addition, if the private-public files are also newly created, the user would have to specify the passphrase on one additional occasion.
Enter 'yes' or 'no'.
yes
The user chose yes
The files containing the client public and private keys already exist on the local host. The current private key may or may not have a passphrase associated with it. In case you remember the passphrase and do not want to re-run ssh-keygen, press 'no' and enter. If you press 'no', the script will not attempt to create any new public/private key pairs. If you press 'yes', the script will remove the old private/public key files existing and create new ones prompting the user to enter the passphrase. If you enter 'yes', any previous SSH user setups would be reset. If you press 'change', the script will associate a new passphrase with the old keys.
Press 'yes', 'no' or 'change'
yes
The user chose yes
Creating .ssh directory on local host, if not present already
Creating authorized_keys file on local host
Changing permissions on authorized_keys to 644 on local host
Creating known_hosts file on local host
Changing permissions on known_hosts to 644 on local host
Creating config file on local host
If a config file exists already at /home/oracle/.ssh/config, it would be backed up to /home/oracle/.ssh/config.backup.
Removing old private/public keys on local host
Running SSH keygen on local host
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Generating public/private rsa key pair.
Your identification has been saved in /home/oracle/.ssh/id_rsa.
Your public key has been saved in /home/oracle/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:aKt2G1srzXMU+mvmFx6J3YynuPlfALG7/qBBne/gCbU oracle@ora-rac1
The key's randomart image is:
+---[RSA 1024]----+
| . |
| o |
| o |
| . .. + |
| o S..+==. |
| . ...o.*++. |
| oo.oooE=. .|
| ..o++.*B+= . |
| ...oo.**==o+ |
+----[SHA256]-----+
Creating .ssh directory and setting permissions on remote host ora-rac1
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host ora-rac1. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host ora-rac1.
Warning: Permanently added 'ora-rac1,192.168.1.214' (ECDSA) to the list of known hosts.
oracle@ora-rac1's password:
Done with creating .ssh directory and setting permissions on remote host ora-rac1.
Creating .ssh directory and setting permissions on remote host ora-rac2
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host ora-rac2. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host ora-rac2.
Warning: Permanently added 'ora-rac2,192.168.1.215' (ECDSA) to the list of known hosts.
oracle@ora-rac2's password:
Done with creating .ssh directory and setting permissions on remote host ora-rac2.
Copying local host public key to the remote host ora-rac1
The user may be prompted for a password or passphrase here since the script would be using SCP for host ora-rac1.
oracle@ora-rac1's password:
Done copying local host public key to the remote host ora-rac1
Copying local host public key to the remote host ora-rac2
The user may be prompted for a password or passphrase here since the script would be using SCP for host ora-rac2.
oracle@ora-rac2's password:
Done copying local host public key to the remote host ora-rac2
Creating keys on remote host ora-rac1 if they do not exist already. This is required to setup SSH on host ora-rac1.
Creating keys on remote host ora-rac2 if they do not exist already. This is required to setup SSH on host ora-rac2.
Generating public/private rsa key pair.
Your identification has been saved in .ssh/id_rsa.
Your public key has been saved in .ssh/id_rsa.pub.
The key fingerprint is:
SHA256:LDKxIq7PO/YDJgPSXk/8IcIpEqPNTg+lTdRUqBeniko oracle@ora-rac2
The key's randomart image is:
+---[RSA 1024]----+
| ..o.o. |
|o o + . |
|.* *.+ + |
|= O Bo*.. |
|+=.*+*.oS. |
|+E*.oo... |
|.* . |
|o.o . |
|.o++.. |
+----[SHA256]-----+
Updating authorized_keys file on remote host ora-rac1
Updating known_hosts file on remote host ora-rac1
The script will run SSH on the remote machine ora-rac1. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
Updating authorized_keys file on remote host ora-rac2
Updating known_hosts file on remote host ora-rac2
The script will run SSH on the remote machine ora-rac2. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
cat: /home/oracle/.ssh/known_hosts.tmp: No such file or directory
cat: /home/oracle/.ssh/authorized_keys.tmp: No such file or directory
SSH setup is complete.
------------------------------------------------------------------------
Verifying SSH setup
===================
The script will now run the date command on the remote nodes using ssh
to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP,
THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR
PASSWORDS. If you see any output other than date or are prompted for the
password, ssh is not setup correctly and you will need to resolve the
issue and set up ssh again.
The possible causes for failure could be:
1. The server settings in /etc/ssh/sshd_config file do not allow ssh
for user oracle.
2. The server may have disabled public key based authentication.
3. The client public key on the server may be outdated.
4. ~oracle or ~oracle/.ssh on the remote host may not be owned by oracle.
5. User may not have passed -shared option for shared remote users or
may be passing the -shared option for non-shared remote users.
6. If there is output in addition to the date, but no password is asked,
it may be a security alert shown as part of company policy. Append the
additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file.
------------------------------------------------------------------------
--ora-rac1:--
Running /usr/bin/ssh -x -l oracle ora-rac1 date to verify SSH connectivity has been setup from local host to ora-rac1.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
The script will run SSH on the remote machine ora-rac1. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
Thu 28 Nov 13:13:38 GMT 2024
------------------------------------------------------------------------
--ora-rac2:--
Running /usr/bin/ssh -x -l oracle ora-rac2 date to verify SSH connectivity has been setup from local host to ora-rac2.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
The script will run SSH on the remote machine ora-rac2. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase.
Thu 28 Nov 13:13:38 GMT 2024
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from ora-rac1 to ora-rac1
------------------------------------------------------------------------
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Thu 28 Nov 13:13:38 GMT 2024
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from ora-rac1 to ora-rac2
------------------------------------------------------------------------
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Thu 28 Nov 13:13:38 GMT 2024
------------------------------------------------------------------------
-Verification from ora-rac1 complete-
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from ora-rac2 to ora-rac1
------------------------------------------------------------------------
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Thu 28 Nov 13:13:39 GMT 2024
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from ora-rac2 to ora-rac2
------------------------------------------------------------------------
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Thu 28 Nov 13:13:39 GMT 2024
------------------------------------------------------------------------
-Verification from ora-rac2 complete-
SSH verification complete.
[oracle@ora-rac1 ~]$
[oracle@ora-rac1 ~]$
[oracle@ora-rac1 ~]$ ssh ora-rac2
Last login: Thu Nov 28 13:10:06 2024 from ora-rac1.uk.com
[oracle@ora-rac2 ~]$ logout
Connection to ora-rac2 closed.
[oracle@ora-rac1 ~]$ ssh ora-rac1
Last login: Thu Nov 28 13:10:14 2024
[oracle@ora-rac1 ~]$
No comments:
Post a Comment