how to create password less connections to the server.

 Step 1: Create Authentication SSH-Keygen Keys on – (Source)


ssh-keygen -t rsa

Generating public/private rsa key pair.
Enter file in which to save the key (/home/sid/.ssh/id_rsa): [Press enter key]
Created directory '/home/sid/.ssh'.
Enter passphrase (empty for no passphrase): [Press enter key]
Enter same passphrase again: [Press enter key]
Your identification has been saved in /home/sid/.ssh/id_rsa.
Your public key has been saved in /home/sid/.ssh/id_rsa.pub.
The key fingerprint is:
5f:ad:40:00:8a:d1:9b:99:b3:b0:f8:08:99:c3:ed:d3 sid@appsolworld.com
The key's randomart image is:
+--[ RSA 2048]----+
|        ..oooE.++|
|         o. o.o  |
|          ..   . |
|         o  . . o|
|        S .  . + |
|       . .    . o|
|      . o o    ..|
|       + +       |

key will be generated in /user/.ssh/rsa_id/ folder


use without a passcode.



Step 2: Upload SSH Key to – (Target)

ssh-copy-id sid@192.168.1.121


ssh-copy-id user@i.p/hostname



Step 3: Test SSH Passwordless Login from Source to target.


ssh user@servername


ssh sid@192.168.1.121


For Cluster Setup
==============

Verify SSH Software is Installed


The supported version of SSH for Linux distributions is OpenSSH. 

OpenSSH should be included in the Linux distribution minimal installation. 

To confirm that SSH packages are installed, run the following command on nodes:


[root@node1 ~]# rpm -qa --queryformat "%{NAME}-%{VERSION}-%{RELEASE} (%{ARCH})\n"| grep ssh openssh-askpass-4.3p2-36.el5 (x86_64) openssh-clients-4.3p2-36.el5 (x86_64) openssh-4.3p2-36.el5 (x86_64) openssh-server-4.3p2-36.el5 (x86_64)


If you do not see a list of SSH packages, then install those packages for Linux distribution



[root@node1 ~]# mount -r /dev/cdrom /media/cdrom 

[root@node1 ~]# cd /media/cdrom/Server 

[root@node1 ~]# rpm -Uvh openssh-* 


Checking Existing SSH Configuration on the System


To determine if SSH is installed and running, enter the following command:


[sid@node1 ~]$ pgrep sshd 2535 19852


If SSH is running, then the response to this command is a list of process ID number(s). 

You need either an RSA or a DSA key for the SSH protocol. RSA is used with the SSH 1.5 protocol, 

while DSA is the default for the SSH 2.0 protocol. With OpenSSH, you can use either RSA or DSA. 


Configuring Passwordless SSH on Cluster Nodes


To configure passwordless SSH, you must first create RSA or DSA keys on each cluster node, 

and then copy all the keys generated on all cluster node members into an authorized keys file 

that is identical on each node. Note that the SSH files must be readable only by root and by the 

software installation user ( grid, oracle), as SSH ignores a private key file if it is accessible by others. 

In the examples that follow, the DSA key is used.


You must configure passwordless SSH separately for each Oracle software installation owner that you intend 

to use for installation ( grid, oracle).


To configure passwordless SSH, complete the following:


Create SSH Directory, and Create SSH Keys On Each Node


Complete the following steps on each node:


Log in as the software owner (in this example, the grid user).


[root@node1 ~]# su - grid


[grid@node1 ~]$ mkdir ~/.ssh 

[grid@node1 ~]$ chmod 700 ~/.ssh


[grid@racnode1 ~]$ /usr/bin/ssh-keygen -t dsa 

Generating public/private dsa key pair. 

Enter file in which to save the key (/home/grid/.ssh/id_dsa): [Enter] 

Enter passphrase (empty for no passphrase): [Enter] 

Enter same passphrase again: [Enter] 

Your identification has been saved in /home/grid/.ssh/id_dsa. 

Your public key has been saved in /home/grid/.ssh/id_dsa.pub. 

The key fingerprint is: 7b:e9:e8:47:29:37:ea:10:10:c6:b6:7d:d2:73:e9:03 


This command writes the DSA public key to the ~/.ssh/id_dsa.pub file and the private key to the ~/.ssh/id_dsa file.


Never distribute the private key to anyone not authorized to perform Oracle software installations.


Repeat steps for all remaining nodes that you intend to make a member of the cluster, using the DSA key ( node2).


Add All Keys to a Common authorized_keys File


Now that nodes contain a public and private key for DSA, you will need to create an authorized key file 


( authorized_keys) on one of the nodes. An authorized key file is nothing more than a single file that contains a 

copy of everyone's (every node's) DSA public key. Once the authorized key file contains all of the public keys, 

it is then distributed to all other nodes in the cluster.


The user's ~/.ssh/authorized_keys file on every node must contain the contents from all of the ~/.ssh/id_dsa.pub 

files that you generated on all cluster nodes.


Complete the following steps on one of the nodes in the cluster to create and then distribute the authorized key file. 



From node1 (the local node) determine if the authorized key file ~/.ssh/authorized_keys already exists in the .ssh 

directory of the owner's home directory. In most cases this will not exist 


[grid@node1 ~]$ touch ~/.ssh/authorized_keys 

[grid@node1 ~]$ ls -l ~/.ssh total 8 -rw-r--r-- 1 grid oinstall 0 Nov 12 12:34 authorized_keys -rw------- 1 grid oinstall 668 Nov 12 09:24 id_dsa -rw-r--r-- 1 grid oinstall 603 Nov 12 09:24 id_dsa.pub


In the .ssh directory, you should see the id_dsa.pub keys that you have created, and the blank file authorized_keys.


On the local node ( node1), use SCP (Secure Copy) or SFTP (Secure FTP) to copy the content of the ~/.ssh/id_dsa.pub public key 

from both nodes in the cluster to the authorized key file just created ( ~/.ssh/authorized_keys). Again, 

this will be done from node1. You will be prompted for the user account password for both nodes accessed.

The following example is being run from node1 and assumes a two-node cluster, with nodes ode1 and node2:



[grid@node1 ~]$ ssh node1 cat ~/.ssh/id_dsa.pub >> ~/.ssh/authorized_keys 


The authenticity of host 'racnode1 (192.168.1.151)' can't be established. 

RSA key fingerprint is 2f:0d:2c:da:9f:d4:3d:2e:ea:e9:98:20:2c:b9:e8:f5. 

Are you sure you want to continue connecting (yes/no)? yes Warning: 

Permanently added 'racnode1,192.168.1.151' (RSA) to the list of known hosts. 


grid@node1's password: xxxxx 

[grid@node1 ~]$ ssh node2 cat ~/.ssh/id_dsa.pub >> ~/.ssh/authorized_keys 

The authenticity of host 'racnode2 (192.168.1.152)' can't be established. 

RSA key fingerprint is 97:ab:db:26:f6:01:20:cc:e0:63:d0:d1:73:7e:c2:0a.

 Are you sure you want to continue connecting (yes/no)? yes 

 Warning: Permanently added 'racnode2,192.168.1.152' (RSA) to the list of known hosts. 

 

grid@node2's password: xxxxx

The first time you use SSH to connect to a node from a particular system, you will see a message similar to the following:


The authenticity of host 'racnode1 (192.168.1.151)' can't be established. 

RSA key fingerprint is 2f:0d:2c:da:9f:d4:3d:2e:ea:e9:98:20:2c:b9:e8:f5. 

Are you sure you want to continue connecting (yes/no)? yes

Enter yes at the prompt to continue. The public hostname will then be added to the 

known_hosts file in the ~/.ssh directory and you will not see this message again when you connect from this system to the same node.


At this point, we have the DSA public key from every node in the cluster in the authorized key file ( ~/.ssh/authorized_keys) 

on node1:


[grid@node1 ~]$ ls -l ~/.ssh total 16 -rw-r--r-- 1 grid oinstall 1206 Nov 12 12:45 

authorized_keys -rw------- 1 grid oinstall 668 Nov 12 09:24 

id_dsa -rw-r--r-- 1 grid oinstall 603 Nov 12 09:24 

id_dsa.pub -rw-r--r-- 1 grid oinstall 808 Nov 12 12:45

 known_hosts

We now need to copy it to the remaining nodes in the cluster. In our two-node cluster example, the only remaining node is node2. 

Use the scp command to copy the authorized key file to all remaining nodes in the cluster:


[grid@node2 ~]$ scp ~/.ssh/authorized_keys 

node2:.ssh/authorized_keys 

grid@node2's password: xxxxx authorized_keys 100% 1206 1.2KB/s 00:00


Change the permission of the authorized key file for both nodes in the cluster by logging into the node and running the following:


[grid@node1 ~]$ chmod 600 ~/.ssh/authorized_keys


Enable SSH User Equivalency on Cluster Nodes


After you have copied the authorized_keys file that contains all public keys to each node in the cluster, 

complete the steps in this section to ensure passwordless SSH connectivity between all cluster member nodes is 

configured correctly. 


[root@node1 ~]# su - grid

If SSH is configured correctly, you will be able to use the ssh and scp commands without being prompted 

for a password or pass phrase from the terminal session:


[grid@ode1 ~]$ ssh node1 "date;hostname" 


Fri Nov 13 09:46:56 EST 2009 racnode1 


[grid@ode1 ~]$ ssh node2 "date;hostname" Fri Nov 13 09:47:34 EST 2009 node2


Perform the same actions above from the remaining nodes in the cluster ( node2) 

to ensure they too can access all other nodes without being prompted for a password or passphrase and get 

added to the known_hosts file:


[grid@racnode1 ~]$ export DISPLAY=melody:0 

[grid@racnode1 ~]$ ssh racnode2 hostname Warning: No xauth data; using fake authentication data for X11 forwarding. node2

Note that having X11 Forwarding enabled will installation to fail. To correct this problem, 

create a user-level SSH client configuration file for the oracle OS user account that disables X11 Forwarding:


Using a text editor, edit or create the file ~/.ssh/config

Make sure that the ForwardX11 attribute is set to no. For example, insert the following into the ~/.ssh/config file:



Host * ForwardX11 no

Comments

Post a Comment

Popular posts from this blog

How to drop index and before dropping it how to get the DDL.

  Oracle DROP INDEX statement DROP INDEX [schema_name.]index_name; DECLARE index_count INTEGER; BEGIN SELECT COUNT(*) INTO index_count FROM USER_INDEXES WHERE INDEX_NAME = 'index_name' ; IF index_count > 0 THEN EXECUTE IMMEDIATE 'DROP INDEX index_name' ; END IF; END; / In case want to check whether index exists and then delete it. If try to drop a non-existing, you will get the following error: SQL Error : ORA -01418 : specified index does not exist In SQLplus, set these before running the commands set long 100000 set longchunksize 100000 select DBMS_METADATA.GET_DDL( 'INDEX' , 'index_name') from all_indexes where owner in ( USER , 'USER_OTHER_THAN_LOGGED_IN_USER' ); Use below script to fetch metadata other information. SELECT DBMS_METADATA,GET_GRANTED_DDL('SYSTEM_GRANT','SSO******') from dual;
Read more

PRVG-11250 : The check "RPM Package Manager database" was not performed because

Following message reported from cluvfy while performing pre-requisite for Clusterware Installation:  Verifying RPM Package Manager database ...INFORMATION PRVG-11250 : The check "RPM Package Manager database" was not performed because it needs 'root' user privileges. SOLUTION Execute runcluvfy manually with "-method root" option and enter root password when prompted : Example: $/runcluvfy.sh stage -pre crsinst -n <HOSTNAME1>,<HOSTNAME2> -method root Enter "ROOT" password: For reference metalink doc id :  2548970.1
Read more

ORA-00257:archiver error, connect internal only until freed

  Issue: Application log shows below error and users are unable to connect to the database. 0RA-00257:archiver error, connect internal only until freed (OR) 0RA-00257:archiver error, connect internal only until freed ORA-16020: less destinations available than specified by LOG_ARCHIVE_MIN_SUCCEED_DEST Fix: 1) Check if there are any errors for the archive destination(s). Make sure that the number of VALID archive destinations is greater than or equal to the value specified by LOG_ARCHIVE_MIN_SUCCEED_DEST initialization parameter. set pages 1000 col dest_name for a30 col destination for a60 SELECT dest_id, dest_name, binding, status, destination, error FROM v$archive_dest; SHOW PARAMETER log_archive_min_succeed_dest 2) If space is full in one or more of the archive destinations (or if destination is not available), take any of the following steps: 2.a) Manually move the archives to another location and delete them from archive destination.   (OR) 2.b) Change the archive des...
Read more

Verifying Daemon “Avahi-Daemon” Not Configured And Running …FAILED (PRVG-1360)

  Execute "/tmp/CVU_19.0.0.0.0_grid/runfixup.sh" as root user on nodes "shsebs7idb1" to perform the fix up operations manually Press ENTER key to continue after execution of "/tmp/CVU_19.0.0.0.0_grid/runfixup.sh" has completed on nodes "shsebs7idb1" Fix: Daemon "avahi-daemon" not configured and running   Node Name                             Status   ------------------------------------  ------------------------   shsebs7idb1                           failed ERROR: shsebs7idb1: PRVG-9023 : Manual fix up command "/tmp/CVU_19.0.0.0.0_grid/runfixup.sh" was not issued by root user on node "shsebs7idb1" Result: "Daemon "avahi-daemon" not configured and running" could not be fixed on nodes "shsebs7idb1" SOLUTION: To fix this error, stop and disable avahi-daemon service. 1. Check avahi-daemon status: [root@shsebs7idb1 ~]# ls -...
Read more

Linux OL7/RHEL7: PRVE-0421 : No entry exists in /etc/fstab for mounting /dev/shm

  This is due to below bugs: OL7 -  Unpublished Bug 21441387- 12.2/MAIN/OL7.1: CVU REPORTS /DEV/SHM NOT MOUNTED WHEN IT IS MOUNTED  21441387.8 RHEL 7 - Unpublished Bug 25907259 : RHEL7.2: CVU REPORTS /DEV/SHM NOT MOUNTED WHEN IT IS MOUNTED  25907259.8 As a work-around in OL7: In OL7, the /dev/shm is not mounted in /etc/fstab on a fresh system, it is done in: [root@testc140 u02]# ll /usr/lib/dracut/modules.d/99base/init.sh -rwxr-xr-x. 1 root root 11379 Mar 26 10:14 vi /usr/lib/dracut/modules.d/99base/init.sh and comment the below lines 62 if ! ismounted /dev/shm; then 63 mkdir -m 0755 /dev/shm 64 mount -t tmpfs -o mode=1777,nosuid,nodev,strictatime tmpfs /dev/shm >/dev/null 65 fi so, this validation is not really valid for OL7.    We can also safely ignore this message. For reference metalink id: -  Doc ID 2065603.1
Read more

SKIP DNS RESLOV.CONF CHECK DURING RAC CONFIGURATION

 shsebs7idb1: PRVG-2064 : There are no configured name servers in the file              '/etc/resolv.conf' on the nodes "shsebs7idb1" Solution: [root@shsebs7idb2 ~]# ls -ltr /etc/resolv.conf -rw-r--r--. 1 root root 78 Jul  3 11:02 /etc/resolv.conf [root@shsebs7idb2 ~]# mv /etc/resolv.conf /etc/resolv.conf.sid Rename resolv.conf to resolv.conf.sid for example and re run the installation again . It  worked for me
Read more

CPU Patch Analysis

 Oracle CPU patch analysis Identifying the Latest Critical Patch Update for Oracle E-Business Suite Release 12.2 (Doc ID 2484000.1) Database Quick-Link If you only care about the database patches, this MOS note steps you through really easily. Assistant: Download Reference for Oracle Database/GI Update, Revision, PSU, SPU(CPU), Bundle Patches, Patch sets and Base Releases (Doc ID 2118136.2) https://www.oracle.com/security-alerts/ Critical Patch Updates Critical Patch Updates provide security patches for supported Oracle on-premises products. They are available to customers with valid support contracts. Starting in April 2022, Critical Patch Updates are released on the third Tuesday of January, April, July, and October (They were previously published on the Tuesday closest to the 17th day of January, April, July, and October). The next four dates are: 16 April 2024 16 July 2024 15 October 2024 21 January 2025 A pre-release announcement will be published on the Thursday preceding eac...
Read more

How to write to a CSV file using Oracle SQL*Plus

  SPOOL command  The  SPOOL  command is  unavailable  in the browser-based SQL*Plus version,  iSQL*Plus . To generate files while using iSQL*Plus, change the necessary preference settings to directly output to a file. This is accomplished using the  SPOOL  statement. While  SPOOL  is  active , SQL*PLus will store the output of any query to the specified file. Therefore, the next command to enter is  spool : spool filepath Skipping ahead slightly,  after  your query is inserted, you also need to halt  spool  so the file output is closed by using the  spool off  command: spool off Insert the query  The last step after the settings are modified and  spool  is running is to insert your query. For our simple example, we’re outputting all books from our  books  table. SELECT   title,   author FROM   authors; Don’t forget the semi...
Read more

How to troubleshoot Long Running Concurrent Request in EBS 12.2

 The following points need to answer before jumping into troubleshooting: Are there any recent code changes done in the concurrent program?           Check long_running_sid and verify the recent code change of last_ddl_timestamp after a             discussion with the developer. Was this running long in the last few run as well, or was this time only?            ==> Check the program history. How much time does it take to complete?           Once again program history can give us some idea. Are these jobs fetching higher data compared to the last run           ===> Confirm on data change . Query Plan change will indicate this issue. Does this job runs at any specific time or it can be run anytime           ===> The nature of the job can help to understand the job's nature. Does this job fetch data using DB Link...
Read more

How To Manage Space of The FRA in the Oracle DB

  Delete Old files connect with the target database using RMAN RMAN target / Delete the old files RMAN> delete obsolete; Remove Restore Points SQL> SELECT name, storage_size FROM gv$restore_point; Drop the restore point SQL> DROP restore point RP; Delete the archive logs RMAN> DELETE archivelog ALL Increase the Space SQL> ALTER SYSTEM SET db_recovery_file_dest_size = 20G scope=both; Disable the Flashback ALTER DATABASE flashback off;
Read more