C Agent Deploy Application - Installation Prerequisites

Setting Up SSH User Equivalence Using sshConnectivity.sh

The sshConnectivity.sh script is used on UNIX/Microsoft Windows platforms to set up SSH user equivalence from the (local) host on which it is run, to the specified remote hosts. After this script is executed, you can use SSH to run commands on the remote hosts, or copy files between the local and the remote hosts without being prompted for passwords or confirmations.

Before executing this script, you must ensure that the following environment variables are set:

• ORACLE_HOME

  Set this to the OMS home as an environment variable using the following command:

  For CSH shell

  setenv ORACLE_HOME /scratch/OracleHomes/oms10g
  
  

  For BASH shell

  export ORACLE_HOME= /scratch/OracleHomes/oms10g
  
  

• SSH_LOC

  You need not specify this if the ORACLE_HOME variable has already been set. If it has not been set, ensure that this value points to the directory that contains the SSH and remote interfaces JARS files (ssh.jar, remoteinterfaces.jar, jsch.jar).

• OUI_JAR

  You need not specify this if the ORACLE_HOME variable has already been set. If this variable has not been set, ensure that this value points to the OUI home directory.

• JAVAHOME

  You need not specify this if the ORACLE_HOME variable has already been set. If this variable has not been set, ensure that this value points to the JAVA home directory.

./sshConnectivity.sh -user <username> -hosts <space separated
hostlist> | -hostfile <absolute path of cluster configuration file>
[-asUser <user for which the setup needs to be done on the local machine, for example,SYSTEM>
[-asUserGrp <group that the specified asUser belongs to>]
-sshLocalDir <windows style full path of dir where keys should be
generated on the local machine for asUser>] [ -advanced ]
[-usePassphrase] [-logfile <absolute path of logfile> ] [-confirm]
[-shared] [-verify] [-exverify] [-remotePlatform <platform id (linux:46,
solaris:453, msplats:912>] [-obPassword <obfuscated password>] [-silent]
[-localPlatformGrp <unix,win>] [help]

./sshConnectivity.sh -user <username> -hosts <space separated 
hostlist> | -hostfile <absolute path of cluster configuration file>
[-remotePlatform <platform id (linux:46, solaris:453, msplats:912>]
[-shared] [-confirm]

./sshConnectivity.sh -user pjohn -hosts sidtest1
./sshConnectivity.sh -user alhammel -hosts zeke2 -remotePlatform 453

./sshConnectivity.sh -user<username> -localPlatformGrp win -asUser <user for which the setup needs to 
be done on the local machine, for example, SYSTEM> [-asUserGrp <group that the 
specified asUser belongs to>] -sshLocalDir <Windows style full 
path of dir where keys should be generated on the local machine for 
asUser> -hosts <space separated hostlist> | -hostfile <absolute path of 
cluster configuration file> [-remotePlatform <platform id (linux:46,
solaris:453, msplats:912>] [-shared] [-confirm]

Setting Up SSH on UNIX Using sshUserSetup.sh

Usage of this script is as follows:

sshUserSetup.sh -hosts "<hostlist>" -user <user name> [-verify] [-confirm] [-shared]

For example, sshUserSetup.sh -hosts "host1 host2" -user sjohn

Description

This script is used to set up SSH user equivalence from the host on which it is run to the specified remote hosts. After this script is run, you can use SSH to execute commands on the remote hosts, or copy files between the local host and the remote hosts without being prompted for passwords or confirmations.

The list of remote hosts and their user names are specified as command-line parameters to the script.

• -shared

  In case you have the home directory NFS-mounted or shared across the remote hosts, the script should be used with the -shared option.

  To determine whether or not an Oracle Home Directory is Shared or Not Shared, consider a scenario where you want to determine whether the Oracle home directory of user1 is shared across hosts A, B, and C or not.You can determine this by following these instructions:

  1. On host A, touch ~user1/checkSharedHome.tmp.

  2. On hosts B and C, execute ls -al ~user1/checkSharedHome.tmp.

     If the file is present on hosts B and C in the ~user1 directory and is identical on all nodes, it means that the user's home directory is shared.

  3. On host A, rm -f ~user1/checkSharedHome.tmp.

  Note:

  In the event that you accidentally pass the -shared option for nonshared homes or reverse, the SSH equivalence is set up for only a subset of the hosts. You will have to rerun the setup script with the correct option to rectify this issue.

• -verify

  The -verify option allows you to verify if SSH has been set up. In this case, the script does not set up SSH, but only checks if SSH user equivalence has been set up from the local host to the remote hosts. It then runs the date command on each remote host using SSH. In case you are prompted for a password or see a warning message for a particular host, it means the SSH user equivalence has not been set up correctly for that host.In case the -verify option is not specified, the script sets up SSH and then does the verification as well.

• -confirm

  The -confirm option allows you to set up SSH user equivalence with a forced change in the permissions on remote hosts. This means that the script will not prompt you to confirm the change in permissions, if you execute the script passing the -confirm option.

• -help

  Use this option to view the readme file for the sshUserSetup.sh script. The usage is as follows:

  sshUserSetup.sh -help 
  
  

The following examples provides usage of the previously mentioned options:

Local host = Z
Remote Hosts = A, B, and C
Local user = sjohn
Remote users = foo (non-shared)
        aime (shared)
./sshUserSetup.sh -user foo -hosts "A B C" -confirm

sshUserSetup.sh -hosts "A B C" -user foo 

sshUserSetup.sh -hosts "A B C" -user foo -confirm

./sshUserSetup.sh -hosts "A B C" -user foo -verify

Because the -verify option is specified, the script does not set up the SSH setup, but only verifies the existing setup.

Setting Up SSH Server (SSHD) on Microsoft Windows

Before starting with the SSHD setup, ensure you are not using OpenSSH and MKSNT when using the Agent Deploy application. The Agent Deploy application uses the complete Cygwin suite (full collection of the software tools packaged in Cygwin). To get the complete collection of Cygwin, do the following:

1. Ensure OpenSSH\bin and mksnt are not in your %PATH%. If they are, remove them by doing the following:

   1. Right-click on My Computer and go to Properties.

   2. In the System Properties window that appears, click Advanced.

   3. In this tab, click Environment Variables.

   4. Here, search for the Path system variable, select it, and if the OpenSSH\bin and mksnt are present in the PATH, click Edit.

   5. In the Edit System Variable dialog box that appears, delete these two values from the PATH, and click OK.

2. Now, stop the SSH Daemon if it is running from OpenSSH. To do this:

   1. Right-click on My Computer, and select Manage.

   2. In the Computer Management window that appears, go to Services under Services and Applications.

   3. In the right-pane, select the SSH daemon service and click the Stop Service icon.

      Note:

      Ensure you rename the installation directories of OpenSSH and MKSNT.

3. To install the full suite of Cygwin software, go to http://www.cygwin.com, and install Cygwin in your C:\cygwin directory.

   Note:

   If you are installing Cygwin into another directory than what has been previously mentioned, ensure you update the $OMS_HOME/sysman/prov/resources/ssPaths_msplats.properties file with the proper Cygwin binary values after installing Oracle Enterprise Manager Grid Control.

   Caution:

   If you are installing Cygwin at a directory that is other than C:\cygwin on a remote machine, you must also ensure that Cygwin is installed on the OMS machine at the exact same location.

   The Cygwin installation directory should not contain any spaces.

   While installing Cygwin, ensure you choose the following binaries:

   1. Zip, unzip binaries from the Archive package.

      Figure C-1 Zip Unzip Binaries

      
      

   2. OpenSSH and dependencies (automatically selected if you choose OpenSSH) from the Net package.

      Figure C-2 Net Packages

      
      

4. Modify the C:\cygwin\cygwin.bat file to add the following line:

   set CYGWIN=binmode tty ntsec
   
   

5. Ensure cygrunsrv is installed by going to C:\cygwin\bin and executing the following:

   bash
   cygrunsrv -h
   

   Note:

   If you are prompted to provide a Cygwin value, enter binmode tty ntsec. If this returns an error message stating "service does not exist", you are on the right track, and can proceed to the next step.

   If you encounter any other error message, (for example, "command cygrunsrv not found"), see AppendixA, "Troubleshooting the "command cygrunsrv not found" Error." for more information on troubleshooting this issue.

6. Open a new command prompt and execute the following:

   bashssh-host-config
   
   

   Note:

   Enter "no" when prompted to create sshd user account (message reads "sshd user account needs to be created").

   Enter "yes" at all other prompts.

   When prompted to answer the question "Which value should the environment variable CYGWIN have when sshd starts?", Oracle recommends that you set the value to at least "ntsec" as shown in the following example. This will enable you to change the user context without having to specify the password.

   As an answer to the previously mentioned question, specify a value that is similar to the following and press Enter:

   CYGWIN="binmode tty ntsec"
   

7. Now, open the /etc/passwd file, and remove only those entries of the user that you will use to connect to the OMS machine.

   For example,

   • If the user that you are employing to connect to the OMS machine is a local user, execute the following:

     /bin/mkpasswd -l –u <USER> >> /etc/passwd
     
     

   • If the user you are employing to connect to the OMS machine is a domain user, execute the following:

     /bin/mkpaswd.exe -d -u <USER> >> /etc/passwd
     /bin/mkgroup.exe -d >> /etc/group
     
     
     mkdir -p /home/<USER>  (for example, mkdir -p /home/pjohn)
     chown <USER> /home/<USER> (for example, chown pjohn /home/pjohn)
     
     

8. Start the SSH daemon.

   If the user you are employing to connect to the OMS machine is a domain user, do the following:

   1. Right-click on My Computer, and select Manage.

   2. In the Computer Management dialog box that appears, go to Services and Applications, and select CYGWIN sshd.

   3. Right-click CYGWIN sshd and select Properties.

   4. In the Properties dialog box, go to the Log On tab.

   5. Here, specify the domain/username and password. Click Apply.

   6. Now, go to the CYGWIN command prompt, and execute the following:

      chmod 644 /etc/ssh*
                 chmod <USERNAME> /var/empty
         chmod 755 /var/empty   chmod 644 /var/log/sshd.log
      
      

      Note:

      If /var/log/sshd.log does not exist, you do not have to execute the following command:

      chmod 644 /var/log/sshd.log
      

   7. Start the SSH daemon by executing:

      /usr/sbin/sshd
      
      

      Alternatively, from the same BASH prompt, you can also execute:

      cygrunsrv -S sshd
      

      Note:

      Use cygrunsrv -E sshd to stop the SSH daemon.

9. You can now test your cygwin setup.

   To do this, go to a different machine (that has the ssh client running), and execute the following command:

   ssh -l <USERNAME> <localhost> 'date'
   
   OR
   
   ssh -l <USERNAME> <this node> 'date'
   
   

   For example,

   ssh -l pjohn egal07.db.funds.com 'date'
   
   

   This command will prompt you to specify the password. When you specify the correct password, the command should return the accurate date.

Setting Up SSH on Microsoft WIndows Using sshUserSetupNT.sh

This is the script that should be executed to set up user equivalence on Microsoft Windows platforms. The usage of the script is as follows:

./sshUserSetupNT.sh -user -asUser -asUserGrp -sshLocalDir -homeDir -hosts -hostfile 

For example, ./sshUserSetupNT.sh -user pjohn -asUser SYSTEM -asUserGrp root-sshLocalDir "C:\cygwin\.ssh" -homeDir "C:\Documents and Settings\pjohn" -hosts "host1 host2"

ssh -l <username> host1 'date'

and then run:

ssh -l <username> host2 'date'

All the previously mentioned options are mandatory, and should be passed while executing the script.

HKEY_LOCAL_MACHINE\SOFTWARE\Cygnus Solutions\Cygwin\mounts v2\/

Description

This script is used on Microsoft Windows platforms to set up SSH user equivalence from the host on which it is run to the specified remote hosts. After this script is run, you can use SSH to execute commands on the remote hosts, or copy files between the local host and the remote hosts without being prompted for passwords or confirmations.

The list of remote hosts and their user names are specified as command-line parameters to the script.

• -asUser

  This is the user of the local machine on which the setup must be performed. For example, SYSTEM.

• -asuserGrp

  This is the group to which the specified asUser belongs.

• -sshLocalDir

  This is the full path to the directory where the keys should be generated for the asUser on the local machine.

• -homeDir

  This is the full path to the home directory of the current user.

  If the /home key (in regedit) is seen as a subkey under the Cygnus Solutions key, then the value of the /home key must have /<username> as a suffix and then be used as -homeDirm value.

  If the /home key is not found, go to the Cygwin BASH prompt and check the value of $HOME. You can now use the same value of $HOME as the value for -homeDir.

  If $HOME does not have any value (is empty), then you must update the /etc/passwd file.

  Identifying the Correct Entry in the /etc/passwd File

  If the /etc/passwd file has only one entry for the user, you can simply modify that value. In the event that there are multiple entries in this file, you must first identify the correct entry and then modify it.

  To identify the correct entry:

  • Execute the following command if you have specified a local user during SSH setup:

    /bin/mkpasswd -l -u <username>
    
    

  • Execute the following command if you have specified a domain user during SSH setup:

    /bin/mkpasswd -d -u <username>
    
    

  Now, match the output with the corresponding entry in the /etc/passwd file. This is the entry that you must modify.

  Updating the -homeDir value

  All values for all users are listed as colon (:) separated entries (or fields). To update the user entry that you have identified previously, go to the penultimate value (or field) of that user entry, and modify the value of the home directory for that user.

  Always specify the absolute path needed by Cygwin as value for the home directory. For example, if the path is C:\Documents and Settings\pjohn, modify it to:

  /cygdrive/c/Documents and Settings/pjohn 
  
  

  Or, if the path reads C:\cygwin\pjohn, modify this to:

  /cygdrive/c/cygwin/pjohn
  
  

  Now, save the password file and reenter the BASH shell.

Setting Up the Timezone Variable on Remote Hosts

This section lists the steps you must follow to set up the timezone environment variable on remote hosts.

To verify if the timezone environment variable (TZ) is accessible by the SSH server on the remote hosts, execute the following command from the OMS host:

ssh -l <user_name> -n <remote_node> 'echo $TZ'

If this command does not return the TZ environment variable value, you must set the TZ variable and ensure this is accessible by the SSH server. You can set the TZ environment variable on remote hosts in the following sections:

export TZ=<your machine's timezone>

setenv TZ <your machine's timezone>

TZ=PST8PDT; export TZ

setenv TZ PST8PDT

ssh -l <user_name> -n <node_name> 'echo $TZ'

Dropping SSH Connection

For dropping SSH connection for 10.2.0.1 and 10.2.0.2 release, do the following on the Oracle Management Service machine:

1. For UNIX operating systems, remove the $HOME/.ssh folder (use the rm -rf $HOME/.ssh command). In the 10.2.0.1 release, $HOME is the home directory of the user who runs sshConnectivity.sh/sshUserSetup.sh.

2. For Windows operating systems, in the cygwin bash prompt, go to $HOME folder (use the cd $HOME command).

   Note:

   If $HOME value has spaces, for example, C:\Documents and Settings\foo\, make sure that you type the value of $HOME in double-quotes. For example:

   cd "C:\Documents and Settings\foo"
   

3. Remove the .ssh folder as follows:

   rm -rf .ssh
   
   

4. Navigate to C:\cygwin, which is the default folder where agentpush assumes you installed cygwin. If cygwin is installed in folder X, go to folder X. Remove the .ssh folder.

   Note:

   The sub-key value of ' SOFTWARE->Cygnus Solutions->Cygwin -> mounts v2->/' is the installation directory of cygwin, by default. If you have changed it manually, go to that folder and remove the .ssh folder.

For Enterprise Manager 10.2.0.3.0 or higher, SSH is setup and dropped by the application itself. Dropping the SSH setup will bring back the previous existing setup, if any.

If SSH was set up by the user, by running sshConnectivity.sh and the application has used this existing setup, the user will need to follow the steps explained above for dropping SSH connection for 10.2.0.1 and 10.2.0.2 release. Dropping the SSH setup will not bring back any existing SSH setup.

Checking if SSH Connection is Removed

To check if SSH connection is removed, do the following:

1. Run the following command on the Oracle Management Service machine:

   ssh -l username <remote node> date
   sshConnectivity.sh/sshUserSetup.sh/sshUserSetupNT.sh
   
   

   where username is the value of the -user option used while running and remote node is one of the nodes used in the -hosts argument while running. For example:

   sshConnectivity.sh/sshUserSetup.sh/sshUserSetupNT.sh
   This command should NOT show date output. This command must stop for password conformation to proceed. 
   For Example:
   $ssh -l john mybox.mydomain.com 'date'
   The authenticity of host 'mybox.mydomain.com (111.222.333.444)' can't be established.
   RSA key fingerprint is ec:52:5d:63:bc:85:07:ef:fe:5b:74:d3:6b:18:04:1c.
   Are you sure you want to continue connecting (yes/no)?
   
   

   The above message ensures that the SSH connection is dropped from the Oracle Management Service to the remote node.

Location of Properties File

You can view the following properties files at <OMS_HOME>/sysman/prov/resources/:

• platformInfo.properties

• Paths.properties

• sPaths.properties

• ssPaths_sol.properties

• userPaths.properties

• system.properties

• ignoreMessages.txt

Location of Installation Logs

See Appendix F, "Installation and Configuration Log File Locations" for more information on the various installation and configuration logs that are created, and their locations.