RAC (Linux) Security: "Unknown" Passwords for CRS, ASM, Oracle?

We're going through an audit (PCI) and the question of these shared accounts has come up. I do realize that ssh connectivity, with key exchange, is used in the maintenance of Oracle RAC clusters. What I'm thinking/wondering is if it's possible to have an "unknown" password for one or all of these accounts. This would mean that a 'sudo su' would still be allowed to the account if needed, and ssh key exchange would still work, but it would tighten up the security a bit (and make writing compensating controls a lot easier).
I'm wondering if anyone can help identify areas where actually having the crs, asm and oracle passwords will be required in the care and feeding of RAC? Also, or alternately, if someone can point me to the documentation where it shows having the password is a prerequisite, that would make my life a lot easier.
Thanks in advance for any assistance.

Hi,
If I understand your requirement correctly, yes, I believe it's possible.
If you're doing RAC, you must have "user equivalence" (i.e. ssh via password-less key based authentication) set up on all nodes in the cluster. In addition, it's possible to disable password authentication, once you have key authentication set up. Finally, once you're logged in, you still need sudo to work, correct? If password will not be known to you, you can set up sudo to work without a password, (look at NOPASSWD option) but consider that, you really need to set things up correctly, or you may jeopardize your system security.
Ideally, you would:
1.) set up ssh keys with passphrase.
2.) disable password authentication.
3.) set up ssh-agent and authentication forwarding.
I'm not an expert at all, I've just recently been reading up to try to do something similar in my environment.
I found this three-part article that seems to cover the subject pretty thoroughly:
http://www.ibm.com/developerworks/linux/library/l-keyc.html
Hope that helps,
-Mark

Similar Messages

PLZ help starting RAC Linux 10gR2 2 nodes cluster on ASM

The system was not reboot graciously; it was shutdown as a single instance; Then the servers were shutdown.
We can't restart it this morning.
I tried to enable the crs; then in CRS_HOME/bin/ ./crsctl start crs
It did not start the cluster
When I checked ./crs_stat -t
CRS-0184: Cannot communicate with the CRS daemon.
./crsctl check crs -it
Failure 1 contacting CSS daemon
Cannot communicate with CRS
Cannot communicate with EVM
Terry

Gangy,
The log does not give me enough information. The importance is to be able to start the cluster and the whole system. At the bottom, you can see a copy of the log.
Thank you so much.. Terry
h_master:13: I AM THE NEW OCR MASTER at incar 2. Node Number = 1
OCRRAW][1220598112]proprioo: for disk 0 (/dev/raw/raw1), id match (1), my id set (1669906634,945530461) total id sets (1), 1st set (1669906634,945530461), 2nd set (0,0) my votes (1), total votes (2)
OCRRAW][1220598112]proprioo: for disk 1 (/dev/raw/raw3), id match (1), my id set (1669906634,945530461) total id sets (1), 1st set (1669906634,945530461), 2nd set (0,0) my votes (1), total votes (2)
CRSD][1094719840]0Returned from grpstat with event 1
CRSD][1094719840]0Doing grpstat on crs_version group
CRSD][1094719840]0Returned from grpstat with event 1
CRSD][1094719840]0Doing grpstat on crs_version group
CRSD][1094719840]0Returned from grpstat with event 1
CRSD][1094719840]0Doing grpstat on crs_version group
OCRSRV][1231087968]th_select_handler: Failed to retrieve procctx from ht. constr = [14030880] retval lht [-27] Signal CV.
CRSEVT][1545783648]0Processing member leave for orcl2, incarnation: 3
CRSEVT][1545783648]0Do failover for: orcl2
CRSRES][1556273504]0startRunnable: setting CLI values
CRSRES][1556273504]0Attempting to start `ora.orcl2.vip` on member `orcl1`
CRSRES][1556273504]0Start of `ora.orcl2.vip` on member `orcl1` succeeded.
CRSRES][1566763360]0startRunnable: setting CLI values
CRSRES][1566763360]0Attempting to start `ora.orcl.db` on member `orcl1`
CRSRES][1566763360]0Start of `ora.orcl.db` on member `orcl1` succeeded.
CRSEVT][1545783648]0Post recovery done evmd event for: orcl2
CRSEVT][1545783648]0Processing RecoveryDone
OCRSRV][1231087968]th_select_handler: Failed to retrieve procctx from ht. constr = [14030880] retval lht [-27] Signal CV.
OCRSRV][1231087968]th_select_handler: Failed to retrieve procctx from ht. constr = [-1741332160] retval lht [-27] Signal CV.
OCRSRV][1231087968]th_select_handler: Failed to retrieve procctx from ht. constr = [-1741452176] retval lht [-27] Signal CV.
OCRSRV][1231087968]th_select_handler: Failed to retrieve procctx from ht. constr = [-1741332160] retval lht [-27] Signal CV.

HT5361 Security and password for emails on a shared computer

Security of email accounts on a shred computer mac

Alternatives for Help Resetting Security Questions and/or Rescue Mail
     1. If you have a valid rescue email address, then use this procedure:
         Rescue email address and how to reset Apple ID security questions.
     2. Fill out and submit this form. Select the topic, Account Security. You must
         have a Rescue Email to use this option.
     3. This is the only option if you do not already have a valid Rescue Email.
         These are telephone numbers for contacting Apple Support in your country.
         Apple ID- Contacting Apple for help with Apple ID account security. Select
         the appropriate country and call. Ask to speak to the Account Security Team.
Note: If you have already forgotten your security questions, then you cannot
         set up a rescue email address in order to reset them. You must set up
         the rescue email address beforehand.
Your Apple ID: Manage My Apple ID.
                         Apple ID- All about Apple ID security questions.

I am unable to select Options Security Save passwords for sites. The checkbox is dar and unselectable.

The checkbox is dark and unselectable.

Make sure that you do not run Firefox in permanent Private Browsing mode.
*https://support.mozilla.com/kb/Private+Browsing
*You enter Private Browsing mode if you select: Tools > Options > Privacy > History: Firefox will: "Never Remember History"
*To see all History and Cookie settings, choose: Tools > Options > Privacy, choose the setting <b>Firefox will: Use custom settings for history</b>
* Deselect: [ ] "Permanent Private Browsing mode"

Security Data : No WS-Security Header - UTL_HTTP for HTTPS calls -Oracle 9i

Hello,
I have a SOAP requests to transmitt a on the fly parsed XML file to UTL_HTTP to connect to a SSL connection. Oracle Wallet is installed and connectivity is working as expected. However, in the SOAP response I am getting
Security Data : No WS-Security Header I am not sure what I am missing? How can I resolve this error?
Below is the SOAP response that shows this error.
<?xml version="1.0" encoding="utf-8" ?>
- <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
- <soap:Header>
- <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
- <wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Timestamp-17449452">
<wsu:Created>2010-11-20T05:03:40.568Z</wsu:Created>
</wsu:Timestamp>
</wsse:Security>
</soap:Header>
- <soap:Body>
- <soap:Fault xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:c="urn:schemas-asource-com:transaction-data-1.0">
<faultcode>wsse:InvalidSecurity</faultcode>
<faultstring>Security Data : No WS-Security Header</faultstring>
</soap:Fault>
</soap:Body>
</soap:Envelope>Below is my compete code that generated above response.
BEGIN
         soap_request :=
               '<?xml version="1.0" encoding="utf-8"?>
                   <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:ns1="urn:schemas-asource-com:transaction-data-1.31">
<SOAP-ENV:Header xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wsswssecurity-
secext-1.0.xsd">
<wsse:Security SOAP-ENV:mustUnderstand="1">
<wsse:UsernameToken>
<wsse:Username>NPCOMMERCE_DEV</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wssusername-
token-profile-1.0#PasswordText">Il/vJa0jat7929f8xxklPjYZIMy5eBCqBMILeGaC+E/1NfIWv+I2KfgghlhkSOaN6rme70OQHEo3e4LJMlWvfC7UfYaN9bqyQwYACmrDFpoiQYCOS+XLnRshhLHMio5VY4+P3C/25tCEH4lBAMRjP1LmjIvZI/h4YJ/65x8OQrqO7tdggZ/KAgvOiNc1GSU+NhkgzLl4EKoEwgt4ZoL4T/U18ha/4jYp+CCGWGRI5o3quZ7vQ5AcSjd7gskyVa98LtR9ho31urJDBgAKasMWmiJBgI5L5cudGyGEscyKjlVjj4/cL/bm0IQfiUEAxGM/UuaMi9kj+Hhgn/rnHw5Cug==</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</SOAP-ENV:Header>'
            || '<SOAP-ENV:Body>'
            || '<ns1:requestMessage>'
            || '<ns1:merchantID>'
            || 'ACOMM_DEV'
            || '</ns1:merchantID>'
            || '<ns1:merchantReferenceCode>'
            || lv_sequence
            || '</ns1:merchantReferenceCode>'
            || '<ns1:billTo>'
            || '<ns1:firstName>'
            || p_cc_holder_name_first
            || '</ns1:firstName>'
            || '<ns1:lastName>'
            || p_cc_holder_name_last
            || '</ns1:lastName>'
            || '<ns1:street1>'
            || 'XXX Charleston Road'
            || '</ns1:street1>'
            || '<ns1:city>'
            || 'Mountain View'
            || '</ns1:city>'
            || '<ns1:state>'
            || 'CA'
            || '</ns1:state>'
            || '<ns1:postalCode>'
            || '94043'
            || '</ns1:postalCode>'
            || '<ns1:country>'
            || 'US'
            || '</ns1:country>'
            || '<ns1:email>'
            || '[email protected]'
            || '</ns1:email>'
            || '</ns1:billTo>'
            || '<ns1:item id="0">'
            || '<ns1:unitPrice>'
            || 12.34
            || '</ns1:unitPrice>'
            || '<ns1:quantity>'
            || 2
            || '</ns1:quantity>'
            || '</ns1:item>'
            || '<ns1:purchaseTotals>'
            || '<ns1:currency>'
            || 'USD'
            || '</ns1:currency>'
            || '</ns1:purchaseTotals>'
            || '<ns1:card>'
            || '<ns1:accountNumber>'
            || 111111111111111
            || '</ns1:accountNumber>'
            || '<ns1:expirationMonth>'
            || 12
            || '</ns1:expirationMonth>'
            || '<ns1:expirationYear>'
            || 2020
            || '</ns1:expirationYear>'
            || '</ns1:card>'
            || '<ns1:ccAuthService run="true"/>'
            || '</ns1:requestMessage>'
            || '</SOAP-ENV:Body>'
            || '</SOAP-ENV:Envelope>';
      EXCEPTION
         WHEN OTHERS
         THEN
            errx := SQLERRM;
            raise_application_error (-20003, errx);
      END;
      BEGIN
         UTL_HTTP.set_wallet
                            ('file:/p01/oracle/prj1db/9.2.0/appsutil/wallet',
                             'p4ssword'
      EXCEPTION
         WHEN OTHERS
         THEN
            errx := SQLERRM;
            raise_application_error (-20004, errx);
      END;
      BEGIN
         http_req :=
            UTL_HTTP.begin_request ('https://rvcotest.ss.com/commerce/999/tProcessor',
                                    'POST',
                                    'HTTP/1.1'
      EXCEPTION
         WHEN OTHERS
         THEN
            errx := SQLERRM;
            raise_application_error (-20005, errx);
      END;
      BEGIN
         UTL_HTTP.set_header (http_req, 'Content-Type', 'text/xml');
         UTL_HTTP.set_header (http_req,
                              'Content-Length',
                              LENGTH (soap_request)
         UTL_HTTP.set_header (http_req,
                              'SOAPAction',
                              'xmlns="urn:rvcotest.ss.com/commerce/999/tProcessor"'
      EXCEPTION
         WHEN OTHERS
         THEN
            errx := SQLERRM;
            raise_application_error (-20006, errx);
      END;
      BEGIN
         UTL_HTTP.write_text (http_req, soap_request);
         http_resp := UTL_HTTP.get_response (http_req);
         UTL_HTTP.read_text (http_resp, soap_respond);
         UTL_HTTP.end_response (http_resp);
      EXCEPTION
         WHEN UTL_HTTP.end_of_body
         THEN
            UTL_HTTP.end_response (http_resp);
         WHEN OTHERS
         THEN
            errx := SQLERRM;
            raise_application_error (-20007, errx);
      END;

Thank you Fahd for quick response.
I have gone through the note. So, it seems that I have to put a Header tag with username and password. But such tag definitions do not exist neither in my WSDL nor in my XSD that gets validation on destination server. In that case what do I do? :(
-R

How do I add "exceptions" to the "remember passwords for sites" feature in Tools/Options/Security?

I like when FireFox remembers and automatically posts user names and password when I go on to most sites. But there are some I do not wish to automatically be posted. However, when I select "Exceptions" within the Tools/Options/Security/Remember Passwords For Sites pathway, all I can do is see the sites that are exceptions. This facility doesn't seem to allow you to add a site (which would then become an exception). Please advise.

Tools > Options > Security > Passwords: Exceptions
Include those that you do not want to save passwords for, such as those regard banks, credit cards, or other financial institutions.
To remove one already created use the "Saved Passwords" on that dialog,
after supplying master password (twice if you view passwords),
:Select the site and use "Remove" to remove the unwanted password.
:Certainly hope you do assign a Master Password to provide some protection to your passwords.
I like that '''about:permissions''' noted by xr417, it does same as above, but allows you to modify something already in system easier. Don't think I've seen that before. Did a search on bank and found an old account/password -- don't even want an old one there.

SAP - Oracle RAC - Linux - VMware

Hi,
we would like to install SAP on a virtual environment (VMware) on Linux RedHat platform.
For the database, Oracle RAC is certified with OCFS2 (1.6) only with Oracle Linux and not RedHat Linux 5.
Can we intstall Oracle RAC database on 2 nodes with Oracle Linux and OCFS2 and other SAP components on Redhat Linux 5 ?
Are there any issues with SAP matrix compatibility ?
Thank you!
Dan

Hi Audun,
Thank you for the links.
I can see the ASM support is new (2.2.2011)
On Note 527843 from 25.01.2011 - Oracle RAC support in the SAP environment
Using raw devices and ASM (Automatic Storage Management) is not supported in the SAP environment. In the case of ASM, there is an exception regarding the Oracle Cluster Registry (OCR) and the voting disks
and
on Note 1550133 - Oracle Automatic Storage Management (ASM) from 2 Feb 2011 they support ASM but with restrictions:
ACFS is required for RAC installations with ASM
To use ASM now, you have to migrate your database to ASM manually
Some important functions of SAP BR*Tools like backup, restore, recovery, tablespace and datafile management are not supported at the moment
Support for tablespace and datafile management is planned for Q2/2011
Also ASM instance will introduce another layer in the system with its problems, failures and resources consumption. I see on the Oracle Metalink alot of problems related to ASM. From the marketin point of view is ok, let's oracle do everything but I think if you will keep it simple it will be better.
I didn't figure out if you can directly install Oracle 11.2.0.2, they say "Allows direct SAP system installations with Oracle 11.2"
We have a vBlock hardware with flash disks as FAST Cache so I believe with 1TB of cache IO will not be a problem.
Thank you!
Dan

Security startup password

May I know what is the security startup password for Oracle 9i?Is it the same as the password that I use in SQL Plus

I would suggest it is the same as the password you use for SYS, or a user with SYSDBA privileges.
Alison

Standard Username an Password for the new Release2 As Portal?

i have installed the Applicationserver Release2 with Portal , but i can not access to the Portal with the Standard Username and Password , i need the new Standard username and Password for the new Oracle Portal(Release2)
the same Problem is with the Standard Username and Password for the iasdb (IAS Database on the Infrastructure Server !)
thanx
Saleh Matani

Hi,
You are facing strange problems with SDN :). May be connection at your end is too slow..
For the problem:
It seems you need a login password page. If this is your reuirement. Simple solution is create a page with two labels,two input fields, save and reset buttons. The login/pwd on submitted with validated by quering the database. Is your question - how to query the database ?
May be you can create a javabean to do that (you can use jdbc for logic). Later import the JavaBean as JavaBeanModel in Web Dynpro. Map the model to context in the view and use the context.
Regards,
Ashwani Kr Sharma

Can't create 11gR1 Database with 11gR2 CRS/ASM non RAC, dbca ASM password

Hi,
try to create a 11gR1 SE Database on a single server with 11gR2 ASM up and running.
when dbca ask where to store the datafiles and i choose ASM, i have to give the asm sys password which i know (can connect with sql+).
dbca replies wrong password and i can NOT go further.
is it possible to use 11gR2 ASM with 11gR1 database and create a database with dbca?
any hint for this situation?
thanks
Michael
Edited by: user12132314 on 18.07.2010 22:24

Hello,
i tried again - still don't work
it is dbca step 6 from 16, storage option (or something simiular - dbca lang here is german)
the dialog looks like this
ASM-ID-Data (Titel)
enter ASM specific SYS password (prompt)
entering the correct pwd and push OK
dbca shows a error dialog with something like: password for user SYS not valid. Enter a valid password.
Any help?
Michael

Steps to stop / start CRS & ASM in RAC 11gr2

Hello Gurus,
Environment is as below:
RAC 2 nodes
Oracle RAC 11gr2
Enterprise Linux Server release 5.5 (Carthage)
I am new to Oracle RAC 11gr2 and facing some issues while stop / start crs & asm.
We want to reboot both nodes and for that I have done following steps.
1. srvctl stop database -d <db name> -- from one node
Databse is down now.2. srvctl stop nodeapps -n <hostname> -- from both nodes
services are down now.3. Now I want to stop asm
$ export ORACLE_HOME=/u01/app/11.2.0/grid ( Grid Home)
$ srvctl stop asm - This is not stopping ASM instance.
4. crsctl stop crs -- this is also not working.
I would appreciate if you please give me full steps.
Thanks and Regards,

In 11gr2, gsd remains offline. When I had checked with metalink, they said that it is fine.
In 11gr2 you can stop all resouces as below
<CRS_HOME>/bin/crsctl stop has
or you can stop in the following sequence
stop or relocate service using srvctl
stop instnace using srvctl
stop asm using srvctl
stop nodeapps using srvctl
stop cluster resources as root - <CRS_HOME>/bin/crsctl stop has
To start
<CRS_HOME>/bin/crsctl start has - it should bring all resources automatically
verify the services status and start or relocate it back.

Patching Strategy for CRS and ASM homes

I'm fairly new to RAC/ASM and haven't performed any patch set upgrades yet. Back in the simple days when I wanted to apply a patch set to a database, say from 10.2.0.4 to 10.2.0.5, I would create a brand new Oracle home ahead of time and apply the patch set to it. I'd name my homes like this:
/opt/oracle/product/10.2.0.4/db1
/opt/oracle/product/10.2.0.5/db1
During the maintenance window I would change /etc/oratab to point the database to the new 10.2.0.5 and complete the database upgrade scripts. The advantages of this strategy:
1 - Less risk installing software as nothing uses the new home yet. If something goes wrong in the install, no big deal. Research the problem and try again without being under the stress of a defined maintenance window.
2 - No need to backup old home for back-out purposes.
3 - Less time required for database to be down during actual patch window since Oracle Installer does not need to run.
Now with CRS and ASM, is there a way to pre-stage a new home for those, but not have them "active" to the node until later during the maintenance window?
For ASM, it seems like it would be possible to treat the same way as database and simply update ASM SID in /etc/oratab
+ASM1:/opt/oracle/product/10.2.0.5/asm1
but I'm not totally confident in that as I'm afraid the CRS home may already have references to the ASM home in the cluster registry.
For CRS, it seems like the home is pretty well hard-wired into the node startup scripts and installing a brand new CRS home will probably disrupt the running CRS home.
Any thoughts about this?

Hi,
user5448593 wrote:
I'm fairly new to RAC/ASM and haven't performed any patch set upgrades yet. Back in the simple days when I wanted to apply a patch set to a database, say from 10.2.0.4 to 10.2.0.5, I would create a brand new Oracle home ahead of time and apply the patch set to it.
Now with CRS and ASM, is there a way to pre-stage a new home for those, but not have them "active" to the node until later during the maintenance window?Although you have not mentioned the version you are actually on, it is a quite up-to-date question and dilemma.
Starting with 11.2 for Grid Infrastructure only "out-of-place" patchset upgrades are supported.
>
For ASM, it seems like it would be possible to treat the same way as database and simply update ASM SID in /etc/oratab
+ASM1:/opt/oracle/product/10.2.0.5/asm1
but I'm not totally confident in that as I'm afraid the CRS home may already have references to the ASM home in the cluster registry.
For CRS, it seems like the home is pretty well hard-wired into the node startup scripts and installing a brand new CRS home will probably disrupt the running CRS home.
Any thoughts about this?As of 11gR2 the ASM is part of the Grid Infrastructure, therefore it is running from the same home and not recommended to separate them. (although you can do that)
By the way, what is your upgrade path? It could be easier to answer your questions if we knew that as there has been a quite a few enhancements and changes in the upgrade/patching process from 10g to 11g. (even between 11gR1 and 11gR2)
Regards,
Jozsef

When I try to open an .ai/pdf file received through my email, it won't open and asks for a password. I have never set up any kind of password for email security, but have tried typing in my standard passwords. Nothing works. I wonder if it has anything to

When I try to open an .ai/pdf file received through my email, it won't open and asks for a password. I have never set up any kind of password for email security, but have tried typing in my standard passwords. Nothing works. I wonder if it has anything to do with the use of my Wacom3 Tablet...I've been having trouble with it and was getting the same message when trying to open the User's Manual in my Applications/WacomTablet file on my hard drive. Any suggestions? I just downloaded the latest version for the Wacom and recently upgraded to Snow Leopard 10.6.7 (which I hate, and my CS3 hates, etc.)

It sounds like you have a a password-protected PDF. The password was set by the person who encoded it.

I forgot My iCloud password, and i can not reset it as the system is not accepting the answer to the security questions and also the mail to my apple ID mail box is blocked, how can i reset my password for my apple ID.

I forgot My iCloud password, and i can not reset it as the system is not accepting the answer to the security questions and also the mail to my apple ID mail box is blocked, how can i reset my password for my apple ID.

Hello nmssns,
Thank you for contacting Apple Support Communities.
You can start with this article to reset your iCloud password. Depending on your exact circumstances, blocked email, forgot security questions, etc., there are links provided to guide you through those issues.
About Apple ID security questions
http://support.apple.com/kb/HT5665
Regards,
Jeff D.

I have forgotten my password for icloud, have an invalid email address and do not know my security answers. How can I transfer all my data from my old iphone to the new one?

I have forgotten my password for icloud, have an invalid email address and do not know my security answers. How can I transfer all my data from my old iphone to the new one?

In this case you won't be able to do that?

RAC (Linux) Security: "Unknown" Passwords for CRS, ASM, Oracle?

Similar Messages

Maybe you are looking for