Oracle 11gR2 RAC – sshUserSetup.sh script to swap ssh keys between hosts

Oracle 11gR2 RAC Grid install includes a useful script to establish and exchange ssh keys between hosts of the cluster.

The process to set up and exchange ssh keys between hosts to facilitate unchallenged logins between trusted users has been well documented already. Oracle simply provides a handy wrapper script over the whole process.

Although the main Grid install process will set up ssh keys, this is a useful verification step to ensure all nodes are reachable, as well as a prerequisite to having the cluvfy script succeed.

Without setting up ssh keys, the cluvfy script will fail with:

ERROR: User equivalence unavailable on all the nodes. Verification cannot proceed.

 
The sshUserSetup script is found in the Grid install directory under grid/sshsetup.

The following shows the sshUserSetup script being executed on a 2-node VMWare based RAC:

[oracle@orpheus sshsetup]$ ./sshUserSetup.sh \
-user oracle -hosts "orpheus eurydice" \
-noPromptPassphrase -confirm -advanced

The output of this script is also logged into /tmp/sshUserSetup_2012-12-21-14-16-49.log
Hosts are orpheus eurydice
user is oracle
Platform:- Linux 
Checking if the remote hosts are reachable
PING orpheus (10.10.1.10) 56(84) bytes of data.
64 bytes from orpheus (10.10.1.10): icmp_seq=1 ttl=64 time=0.018 ms
64 bytes from orpheus (10.10.1.10): icmp_seq=2 ttl=64 time=0.043 ms
64 bytes from orpheus (10.10.1.10): icmp_seq=3 ttl=64 time=0.046 ms
64 bytes from orpheus (10.10.1.10): icmp_seq=4 ttl=64 time=0.024 ms
64 bytes from orpheus (10.10.1.10): icmp_seq=5 ttl=64 time=0.030 ms

--- orpheus ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4000ms
rtt min/avg/max/mdev = 0.018/0.032/0.046/0.011 ms
PING eurydice (10.10.1.20) 56(84) bytes of data.
64 bytes from eurydice (10.10.1.20): icmp_seq=1 ttl=64 time=0.394 ms
64 bytes from eurydice (10.10.1.20): icmp_seq=2 ttl=64 time=0.380 ms
64 bytes from eurydice (10.10.1.20): icmp_seq=3 ttl=64 time=0.572 ms
64 bytes from eurydice (10.10.1.20): icmp_seq=4 ttl=64 time=0.315 ms
64 bytes from eurydice (10.10.1.20): icmp_seq=5 ttl=64 time=0.338 ms

--- eurydice ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4000ms
rtt min/avg/max/mdev = 0.315/0.399/0.572/0.094 ms
Remote host reachability check succeeded.
The following hosts are reachable: orpheus eurydice.
The following hosts are not reachable: .
All hosts are reachable. Proceeding further...
The script will setup SSH connectivity from the host orpheus to all
the remote hosts. After the script is executed, the user can use SSH to run
commands on the remote hosts or copy files between this host orpheus
and the remote hosts without being prompted for passwords or confirmations.

NOTE 1:
As part of the setup procedure, this script will use ssh and scp to copy
files between the local host and the remote hosts. Since the script does not
store passwords, you may be prompted for the passwords during the execution of
the script whenever ssh or scp is invoked.

NOTE 2:
AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY
AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE
directories.

Do you want to continue and let the script make the above mentioned changes (yes/no)?
Confirmation provided on the command line

The user chose yes
User chose to skip passphrase related questions.
Creating .ssh directory on local host, if not present already
Creating authorized_keys file on local host
Changing permissions on authorized_keys to 644 on local host
Creating known_hosts file on local host
Changing permissions on known_hosts to 644 on local host
Creating config file on local host
If a config file exists already at /home/oracle/.ssh/config, it would be backed up to /home/oracle/.ssh/config.backup.
Creating .ssh directory and setting permissions on remote host orpheus
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host orpheus. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host orpheus.
Warning: Permanently added 'orpheus,10.10.1.10' (RSA) to the list of known hosts.


oracle@orpheus's password: ENTER ORACLE PASSWORD HERE
Done with creating .ssh directory and setting permissions on remote host orpheus.
Creating .ssh directory and setting permissions on remote host eurydice
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host eurydice. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host eurydice.
Warning: Permanently added 'eurydice,10.10.1.20' (RSA) to the list of known hosts.
Done with creating .ssh directory and setting permissions on remote host eurydice.
Copying local host public key to the remote host orpheus
The user may be prompted for a password or passphrase here since the script would be using SCP for host orpheus.


oracle@orpheus's password: ENTER ORACLE PASSWORD AGAIN HERE
Done copying local host public key to the remote host orpheus
Copying local host public key to the remote host eurydice
The user may be prompted for a password or passphrase here since the script would be using SCP for host eurydice.
Done copying local host public key to the remote host eurydice
Creating keys on remote host orpheus if they do not exist already. This is required to setup SSH on host orpheus.

Creating keys on remote host eurydice if they do not exist already. This is required to setup SSH on host eurydice.

Updating authorized_keys file on remote host orpheus
Updating known_hosts file on remote host orpheus
Updating authorized_keys file on remote host eurydice
Updating known_hosts file on remote host eurydice
cat: /home/oracle/.ssh/known_hosts.tmp: No such file or directory
cat: /home/oracle/.ssh/authorized_keys.tmp: No such file or directory
SSH setup is complete.

------------------------------------------------------------------------
Verifying SSH setup
===================
The script will now run the date command on the remote nodes using ssh
to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP,
THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR
PASSWORDS. If you see any output other than date or are prompted for the
password, ssh is not setup correctly and you will need to resolve the
issue and set up ssh again.
The possible causes for failure could be:
1. The server settings in /etc/ssh/sshd_config file do not allow ssh
for user oracle.
2. The server may have disabled public key based authentication.
3. The client public key on the server may be outdated.
4. ~oracle or ~oracle/.ssh on the remote host may not be owned by oracle.
5. User may not have passed -shared option for shared remote users or
may be passing the -shared option for non-shared remote users.
6. If there is output in addition to the date, but no password is asked,
it may be a security alert shown as part of company policy. Append the
additional text to the /sysman/prov/resources/ignoreMessages.txt file.
------------------------------------------------------------------------
--orpheus:--
Running /usr/bin/ssh -x -l oracle orpheus date to verify SSH connectivity has been setup from local host to orpheus.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Fri Dec 21 14:17:10 PST 2012
------------------------------------------------------------------------
--eurydice:--
Running /usr/bin/ssh -x -l oracle eurydice date to verify SSH connectivity has been setup from local host to eurydice.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Fri Dec 21 14:17:10 PST 2012
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from orpheus to orpheus
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
bash: -c: line 0: unexpected EOF while looking for matching `"'
bash: -c: line 1: syntax error: unexpected end of file
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from orpheus to eurydice
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
bash: -c: line 0: unexpected EOF while looking for matching `"'
bash: -c: line 1: syntax error: unexpected end of file
------------------------------------------------------------------------
-Verification from complete-
SSH verification complete.

 
Despite the errors shown above, the script does actually succeed. You can now test ssh connectivity between both nodes:

[oracle@orpheus deinstall]$ ssh oracle@eurydice
Last login: Fri Dec 21 14:15:12 2012 from orpheus

[oracle@eurydice ~]$ ssh oracle@orpheus
Last login: Fri Dec 21 14:15:17 2012 from eurydice
[oracle@orpheus ~]$

 
You can re-execute the sshUserSetup.sh script any time, you will find it in the Oracle Home under the deinstall sub-directory:

Advertisements

One thought on “Oracle 11gR2 RAC – sshUserSetup.sh script to swap ssh keys between hosts

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s