In this article, we will see the step by step SSH Connectivity methods in Oracle RAC.
We will look at the below methods to do the SSH connectivity across the cluster.
- Manual User Equivalence (Manual Method)
- ssh (Oracle Method)
- Automatic User Equivalence (GUI Method)
Manual User Equivalence (Manual Method)
This method is a totally manually, here first we will create the rsa and dsa keys and later will create a file authorized keys and then copy both keys across the nodes for both users.
Now we will understand this method practically.
Step 1) we need to login through respective user and go to .ssh directory which is inside home location.
|
1 2 |
[grid@rac1 .ssh]$ pwd /home/grid/.ssh |
Step 2) now we will create rsa and dsa keys.
Note: – Same you need to do for the second node as well
Step 3)now we will create the authorized keys files and then will swap the keys between the nodes.
In Rac node 1 authorized keys file, we will copy rsa and dsa keys of rac node 2.
Step 4) Now check the password less connectivity for grid user from both the nodes.
We can see from above output that we are able to do password less connectivity for grid user from both the nodes.
Note: – Same steps you need to follow for Oracle user to perform ssh connectivity.
Step 5) I am only showing the output of the password less connectivity from oracle user.
sshUserSetup.sh (Oracle Method)
Now we will look at the second method of ssh connectivity. First we will do for Grid user and later for Oracle user.
Step 1) I have executed command from root user for both the users.
Command: –.
|
1 |
/sshUserSetup.sh -user grid -hosts ‘rac1 rac2’ -noPromptPassphrase -confirm –advanced |
Output of Rac1 node for grid user: –
[root@rac1 sshsetup]#
|
1 |
./sshUserSetup.sh -user grid -hosts 'rac1 rac2' -noPromptPassphrase -confirm -advanced |
The output of this script is also logged into /tmp/sshUserSetup_2020-07-15-21-26-19.log
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 |
Hosts are rac1 rac2 user is grid Platform:- Linux Checking if the remote hosts are reachable PING rac1.ktexpert.com (147.43.0.10) 56(84) bytes of data. 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=1 ttl=64 time=0.032 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=2 ttl=64 time=0.058 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=3 ttl=64 time=0.055 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=4 ttl=64 time=0.054 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=5 ttl=64 time=0.059 ms --- rac1.ktexpert.com ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4008ms rtt min/avg/max/mdev = 0.032/0.051/0.059/0.012 ms PING rac2.ktexpert.com (147.43.0.11) 56(84) bytes of data. 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=1 ttl=64 time=3.18 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=2 ttl=64 time=0.465 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=3 ttl=64 time=0.869 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=4 ttl=64 time=1.34 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=5 ttl=64 time=0.729 ms --- rac2.ktexpert.com ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4020ms rtt min/avg/max/mdev = 0.465/1.319/3.189/0.977 ms Remote host reachability check succeeded. The following hosts are reachable: rac1 rac2. The following hosts are not reachable: . All hosts are reachable. Proceeding further... firsthost rac1 numhosts 2 The script will setup SSH connectivity from the host rac1.ktexpert.com to all the remote hosts. After the script is executed, the user can use SSH to run commands on the remote hosts or copy files between this host rac1.ktexpert.com and the remote hosts without being prompted for passwords or confirmations. NOTE 1: As part of the setup procedure, this script will use ssh and scp to copy files between the local host and the remote hosts. Since the script does not store passwords, you may be prompted for the passwords during the execution of the script whenever ssh or scp is invoked. NOTE 2: AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEGES TO THESE directories. Do you want to continue and let the script make the above mentioned changes (yes/no)? Confirmation provided on the command line The user chose yes User chose to skip passphrase related questions. Creating .ssh directory on local host, if not present already Creating authorized_keys file on local host Changing permissions on authorized_keys to 644 on local host Creating known_hosts file on local host Changing permissions on known_hosts to 644 on local host Creating config file on local host If a config file exists already at /root/.ssh/config, it would be backed up to /root/.ssh/config.backup. Removing old private/public keys on local host Running SSH keygen on local host with empty passphrase Generating public/private rsa key pair. Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: 79:aa:ce:fa:5d:34:50:76:bd:7e:41:c2:da:46:4c:12 root@rac1.ktexpert.com The key's randomart image is: +--[ RSA 1024]----+ | oE*o | | o ..=.. | | . + o. | | o .o.. | | S + .. .| | + . . .| | . . . | | . o . | | .+= . | +-----------------+ Creating .ssh directory and setting permissions on remote host rac1 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR grid. THIS IS AN SSH REQUIREMENT. The script would create ~grid/.ssh/config file on remote host rac1. If a config file exists already at ~grid/.ssh/config, it would be backed up to ~grid/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host rac1. Warning: Permanently added 'rac1,147.43.0.10' (RSA) to the list of known hosts. grid@rac1's password: -------> Give Grid Password Done with creating .ssh directory and setting permissions on remote host rac1. Creating .ssh directory and setting permissions on remote host rac2 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR grid. THIS IS AN SSH REQUIREMENT. The script would create ~grid/.ssh/config file on remote host rac2. If a config file exists already at ~grid/.ssh/config, it would be backed up to ~grid/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host rac2. Warning: Permanently added 'rac2,147.43.0.11' (RSA) to the list of known hosts. grid@rac2's password:-------> Give Grid Password Done with creating .ssh directory and setting permissions on remote host rac2. Copying local host public key to the remote host rac1 The user may be prompted for a password or passphrase here since the script would be using SCP for host rac1. grid@rac1's password: -------> Give Grid Password Done copying local host public key to the remote host rac1 Copying local host public key to the remote host rac2 The user may be prompted for a password or passphrase here since the script would be using SCP for host rac2. grid@rac2's password:-------> Give Grid Password Done copying local host public key to the remote host rac2 Creating keys on remote host rac1 if they do not exist already. This is required to setup SSH on host rac1. Creating keys on remote host rac2 if they do not exist already. This is required to setup SSH on host rac2. Updating authorized_keys file on remote host rac1 Updating known_hosts file on remote host rac1 Updating authorized_keys file on remote host rac2 Updating known_hosts file on remote host rac2 SSH setup is complete. ------------------------------------------------------------------------ Verifying SSH setup =================== The script will now run the date command on the remote nodes using ssh to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP, THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR PASSWORDS. If you see any output other than date or are prompted for the password, ssh is not setup correctly and you will need to resolve the issue and set up ssh again. The possible causes for failure could be: The server settings in /etc/ssh/sshd_config file do not allow ssh for user grid. The server may have disabled public key based authentication. The client public key on the server may be outdated. ~grid or ~grid/.ssh on the remote host may not be owned by grid. User may not have passed -shared option for shared remote users or may be passing the -shared option for non-shared remote users. If there is output in addition to the date, but no password is asked, it may be a security alert shown as part of company policy. Append the additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file. ------------------------------------------------------------------------ --rac1:-- Running /usr/bin/ssh -x -l grid rac1 date to verify SSH connectivity has been setup from local host to rac1. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Wed Jul 15 21:26:47 IST 2020 ------------------------------------------------------------------------ --rac2:-- Running /usr/bin/ssh -x -l grid rac2 date to verify SSH connectivity has been setup from local host to rac2. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Wed Jul 15 21:26:48 IST 2020 ------------------------------------------------------------------------ ------------------------------------------------------------------------ Verifying SSH connectivity has been setup from rac1 to rac1 IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Wed Jul 15 21:26:47 IST 20 ------------------------------------------------------------------------ ------------------------------------------------------------------------ Verifying SSH connectivity has been setup from rac1 to rac2 IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Wed Jul 15 21:26:49 IST 2020= ------------------------------------------------------------------------ -Verification from complete- SSH verification complete. |
Output of Rac2 node for grid user: –
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 |
[root@rac2 sshsetup]# ./sshUserSetup.sh -user grid -hosts 'rac1 rac2' -noPromptPassphrase -confirm -advanced The output of this script is also logged into /tmp/sshUserSetup_2020-07-15-21-31-47.log Hosts are rac1 rac2 user is grid Platform:- Linux Checking if the remote hosts are reachable PING rac1.ktexpert.com (147.43.0.10) 56(84) bytes of data. 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=1 ttl=64 time=0.655 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=2 ttl=64 time=0.786 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=3 ttl=64 time=0.827 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=4 ttl=64 time=0.703 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=5 ttl=64 time=0.630 ms --- rac1.ktexpert.com ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4004ms rtt min/avg/max/mdev = 0.630/0.720/0.827/0.077 ms PING rac2.ktexpert.com (147.43.0.11) 56(84) bytes of data. 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=1 ttl=64 time=0.050 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=2 ttl=64 time=0.057 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=3 ttl=64 time=0.055 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=4 ttl=64 time=0.055 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=5 ttl=64 time=0.126 ms --- rac2.ktexpert.com ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4004ms rtt min/avg/max/mdev = 0.050/0.068/0.126/0.030 ms Remote host reachability check succeeded. The following hosts are reachable: rac1 rac2. The following hosts are not reachable: . All hosts are reachable. Proceeding further... firsthost rac1 numhosts 2 The script will setup SSH connectivity from the host rac2.ktexpert.com to al the remote hosts. After the script is executed, the user can use SSH to run commands on the remote hosts or copy files between this host rac2.ktexpert.com and the remote hosts without being prompted for passwords or confirmations. NOTE 1: As part of the setup procedure, this script will use ssh and scp to copy files between the local host and the remote hosts. Since the script does not store passwords, you may be prompted for the passwords during the execution of the script whenever ssh or scp is invoked. NOTE 2: AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE directories. Do you want to continue and let the script make the above mentioned changeses/no)? Confirmation provided on the command line The user chose yes User chose to skip passphrase related questions. Creating .ssh directory on local host, if not present already Creating authorized_keys file on local host Changing permissions on authorized_keys to 644 on local host Creating known_hosts file on local host Changing permissions on known_hosts to 644 on local host Creating config file on local host If a config file exists already at /root/.ssh/config, it would be backed up to /root/.ssh/config.backup. Removing old private/public keys on local host Running SSH keygen on local host with empty passphrase Generating public/private rsa key pair. Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: a3:f7:74:cf:f1:c0:02:88:06:50:fb:06:db:c1:b9:61 root@rac2.ktexpert.com The key's randomart image is: +--[ RSA 1024]----+ | ... | | . o . | | + E | | B = . | | . B S . | | o . . . . | | . . . o + | | . o . + + | | . o .| +-----------------+ Creating .ssh directory and setting permissions on remote host rac1 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR grid. THIS IS AN SSH REQUIREMENT. The script would create ~grid/.ssh/config file on remote host rac1. If a config file exists already at ~grid/.ssh/config, it would be backed up to ~grid/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host rac1. Warning: Permanently added 'rac1,147.43.0.10' (RSA) to the list of known hosts. grid@rac1's password:-------> Give Grid Password Done with creating .ssh directory and setting permissions on remote host rac1. Creating .ssh directory and setting permissions on remote host rac2 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR grid. THIS IS AN SSH REQUIREMENT. The script would create ~grid/.ssh/config file on remote host rac2. If a config file exists already at ~grid/.ssh/config, it would be backed up to ~grid/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host rac2. Warning: Permanently added 'rac2,147.43.0.11' (RSA) to the list of known hosts. grid@rac2's password:-------> Give Grid Password Done with creating .ssh directory and setting permissions on remote host rac2. Copying local host public key to the remote host rac1 The user may be prompted for a password or passphrase here since the script would be using SCP for host rac1. grid@rac1's password:-------> Give Grid Password Done copying local host public key to the remote host rac1 Copying local host public key to the remote host rac2 The user may be prompted for a password or passphrase here since the script would be using SCP for host rac2. grid@rac2's password:-------> Give Grid Password Done copying local host public key to the remote host rac2 Creating keys on remote host rac1 if they do not exist already. This is required to setup SSH on host rac1. Creating keys on remote host rac2 if they do not exist already. This is required to setup SSH on host rac2. Updating authorized_keys file on remote host rac1 Updating known_hosts file on remote host rac1 Updating authorized_keys file on remote host rac2 Updating known_hosts file on remote host rac2 SSH setup is complete. ------------------------------------------------------------------------ Verifying SSH setup =================== The script will now run the date command on the remote nodes using ssh to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP, THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR PASSWORDS. If you see any output other than date or are prompted for the password, ssh is not setup correctly and you will need to resolve the issue and set up ssh again. The possible causes for failure could be: The server settings in /etc/ssh/sshd_config file do not allow ssh for user grid. The server may have disabled public key based authentication. The client public key on the server may be outdated. ~grid or ~grid/.ssh on the remote host may not be owned by grid. User may not have passed -shared option for shared remote users or may be passing the -shared option for non-shared remote users. If there is output in addition to the date, but no password is asked, it may be a security alert shown as part of company policy. Append the additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file. ----------------------------------------------- Running /usr/bin/ssh -x -l grid rac1 date to verify SSH connectivity has been setup from local host to rac1. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Wed Jul 15 21:32:06 IST 2020 ------------------------------------------------------------------------ --rac2:-- Running /usr/bin/ssh -x -l grid rac2 date to verify SSH connectivity has been setup from local host to rac2. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Wed Jul 15 21:32:07 IST 2020 ------------------------------------------------------------------------ ------------------------------------------------------------------------ Verifying SSH connectivity has been setup from rac1 to rac1 IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Wed Jul 15 21:32:07 IST 2020 ------------------------------------------------------------------------ ------------------------------------------------------------------------ Verifying SSH connectivity has been setup from rac1 to rac2 IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Wed Jul 15 21:32:08 IST 2020 ------------------------------------------------------------------------ -Verification from complete- SSH verification complete. |
Output of Rac1 node for Oracle user: –
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 |
[root@rac1 sshsetup]# ./sshUserSetup.sh -user oracle -hosts 'rac1 rac2' -noPromptPassphrase -confirm -advanced The output of this script is also logged into /tmp/sshUserSetup_2020-07-15-21-35-20.log Hosts are rac1 rac2 user is oracle Platform:- Linux Checking if the remote hosts are reachable PING rac1.ktexpert.com (147.43.0.10) 56(84) bytes of data. 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=1 ttl=64 time=0.034 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=2 ttl=64 time=0.055 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=3 ttl=64 time=0.055 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=4 ttl=64 time=0.054 ms 64 bytes from rac1.ktexpert.com (147.43.0.10): icmp_seq=5 ttl=64 time=0.080 ms --- rac1.ktexpert.com ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4021ms rtt min/avg/max/mdev = 0.034/0.055/0.080/0.016 ms PING rac2.ktexpert.com (147.43.0.11) 56(84) bytes of data. 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=1 ttl=64 time=1.24 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=2 ttl=64 time=0.725 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=3 ttl=64 time=0.714 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=4 ttl=64 time=0.784 ms 64 bytes from rac2.ktexpert.com (147.43.0.11): icmp_seq=5 ttl=64 time=0.986 ms --- rac2.ktexpert.com ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4016ms rtt min/avg/max/mdev = 0.714/0.891/1.248/0.205 ms Remote host reachability check succeeded. The following hosts are reachable: rac1 rac2. The following hosts are not reachable: . All hosts are reachable. Proceeding further... firsthost rac1 numhosts 2 The script will setup SSH connectivity from the host rac1.ktexpert.com to all the remote hosts. After the script is executed, the user can use SSH to run commands on the remote hosts or copy files between this host rac1.ktexpert.com and the remote hosts without being prompted for passwords or confirmations. NOTE 1: As part of the setup procedure, this script will use ssh and scp to copy files between the local host and the remote hosts. Since the script does not store passwords, you may be prompted for the passwords during the execution of the script whenever ssh or scp is invoked. NOTE 2: AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE directories. Do you want to continue and let the script make the above mentioned changes (yes/no)? Confirmation provided on the command line The user chose yes User chose to skip passphrase related questions. Creating .ssh directory on local host, if not present already Creating authorized_keys file on local host Changing permissions on authorized_keys to 644 on local host Creating known_hosts file on local host Changing permissions on known_hosts to 644 on local host Creating config file on local host If a config file exists already at /root/.ssh/config, it would be backed up to /root/.ssh/config.backup. Creating .ssh directory and setting permissions on remote host rac1 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host rac1. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host rac1. Warning: Permanently added 'rac1,147.43.0.10' (RSA) to the list of known hosts. oracle@rac1's password: --------> Give Oracle Password Done with creating .ssh directory and setting permissions on remote host rac1. Creating .ssh directory and setting permissions on remote host rac2 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host rac2. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host rac2. Warning: Permanently added 'rac2,147.43.0.11' (RSA) to the list of known hosts. oracle@rac2's password:--------> Give Oracle Password Done with creating .ssh directory and setting permissions on remote host rac2. Copying local host public key to the remote host rac1 The user may be prompted for a password or passphrase here since the script would be using SCP for host rac1. oracle@rac1's password:--------> Give Oracle Password Done copying local host public key to the remote host rac1 Copying local host public key to the remote host rac2 The user may be prompted for a password or passphras here since the script would be using SCP for host rac2. oracle@rac2's password:--------> Give Oracle Password Done copying local host public key to the remote host rac2 Creating keys on remote host rac1 if they do not exist already. This is required to setup SSH on host rac1. Creating keys on remote host rac2 if they do not exist already. This is required to setup SSH on host rac2. Updating authorized_keys file on remote host rac1 Updating known_hosts file on remote host rac1 Updating authorized_keys file on remote host rac2 Updating known_hosts file on remote host rac2 SSH setup is complete. ------------------------------------------------------------------------ Verifying SSH setup =================== The script will now run the date command on the remote nodes using ssh to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP, THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR PASSWORDS. If you see any output other than date or are prompted for the password, ssh is not setup correctly and you will need to resolve the issue and set up ssh again. The possible causes for failure could be: The server settings in /etc/ssh/sshd_config file do not allow ssh for user oracle. The server may have disabled public key based authentication. The client public key on the server may be outdated. ~oracle or ~oracle/.ssh on the remote host may not be owned by oracle. User may not have passed -shared option for shared remote users or may be passing the -shared option for non-shared remote users. If there is output in addition to the date, but no password is asked, it may be a security alert shown as part of company policy. Append the additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file. ------------------------------------------------------------------------ --rac1:-- Running /usr/bin/ssh -x -l oracle rac1 date to verify SSH connectivity has been setup from local host to rac1. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Wed Jul 15 21:35:38 IST 2020 ------------------------------------------------------------------------ --rac2:-- Running /usr/bin/ssh -x -l oracle rac2 date to verify SSH connectivity has been setup from local host to rac2. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Wed Jul 15 21:35:39 IST 2020 ------------------------------------------------------------------------ ------------------------------------------------------------------------ Verifying SSH connectivity has been setup from rac1 to rac1 IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Wed Jul 15 21:35:38 IST 2020 ------------------------------------------------------------------------ ------------------------------------------------------------------------ Verifying SSH connectivity has been setup from rac1 to rac2 IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Wed Jul 15 21:35:39 IST 2020 ------------------------------------------------------------------------ -Verification from complete- SSH verification complete. |
Automatic User Equivalence (GUI Method)
Last method is Automatic User Equivalence which is GUI (Graphical User Interface method).
Step 1) Add both the server name first after that click on the ssh connectivity tab.
Step 2) Give the grid password and then click on Setup button to setup the connectivity.
Step 3)ssh setup is in progress.
Step 4) when it will complete, you will get below output.
We can see from above output the SSH connectivity has been successfully completed for grid user.
Note: – Please follow the same steps for Oracle user.
Thank you for giving your valuable time to read the above information. Please click here to subscribe for further updates
KTEXPERTS is always active on below social media platforms.
Facebook : https://www.facebook.com/ktexperts/
LinkedIn : https://www.linkedin.com/company/ktexperts/
Twitter : https://twitter.com/ktexpertsadmin
YouTube : https://www.youtube.com/c/ktexperts
Note: Please test scripts in Non Prod before trying in Production.
Loading...
