Example : Manually setup of passwordless connection between 2 node on grid user.
Hostname:
sgdcplm01,sgdcplm02
Command :
oracle user
./sshUserSetup.sh -user oracle -hosts "sgdcplm01 sgdcplm02" -advanced -exverify –noPromptPassphrase
grid user
./sshUserSetup.sh -user grid -hosts "sgdcplm01 sgdcplm02" -advanced -exverify –noPromptPassphrase
#########################################################################
grid@sgdcplm02:/u04/oracle_grid_software/grid/sshsetup> ./sshUserSetup.sh -user oracle -hosts "sgdcplm01 sgdcplm02" -advanced -exverify –noPromptPassphrase
The output of this script is also logged into /tmp/sshUserSetup_2019-06-04-09-06-49.log
Hosts are sgdcplm01 sgdcplm02
user is oracle
Platform:- Linux
Checking if the remote hosts are reachable
PING sgdcplm01.xxx.com (10.xx.xx.xx) 56(84) bytes of data.
64 bytes from sgdcplm01.xxx.com (10.xx.xx.xx) : icmp_seq=1 ttl=64 time=0.083 ms
64 bytes from sgdcplm01.xxx.com (10.xx.xx.xx) : icmp_seq=2 ttl=64 time=0.083 ms
64 bytes from sgdcplm01.xxx.com (10.xx.xx.xx) : icmp_seq=3 ttl=64 time=0.096 ms
64 bytes from sgdcplm01.xxx.com (10.xx.xx.xx) : icmp_seq=4 ttl=64 time=0.076 ms
64 bytes from sgdcplm01.xxx.com (10.xx.xx.xx) : icmp_seq=5 ttl=64 time=0.088 ms
--- sgdcplm02.xxx.com (10.xx.xx.xx) ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4082ms
rtt min/avg/max/mdev = 0.076/0.085/0.096/0.008 ms
PING sgdcplm02.xxx.com (10.xx.xx.xx) 56(84) bytes of data.
64 bytes from sgdcplm02.xxx.com (10.xx.xx.xx): icmp_seq=1 ttl=64 time=0.011 ms
64 bytes from sgdcplm02.xxx.com (10.xx.xx.xx): icmp_seq=2 ttl=64 time=0.020 ms
64 bytes from sgdcplm02.xxx.com (10.xx.xx.xx): icmp_seq=3 ttl=64 time=0.039 ms
64 bytes from sgdcplm02.xxx.com (10.xx.xx.xx): icmp_seq=4 ttl=64 time=0.030 ms
64 bytes from sgdcplm02.xxx.com (10.xx.xx.xx): icmp_seq=5 ttl=64 time=0.031 ms
--- sgdcplm02.xxx.com (10.xx.xx.xx) ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4094ms
rtt min/avg/max/mdev = 0.011/0.026/0.039/0.010 ms
Remote host reachability check succeeded.
The following hosts are reachable: sgdcplm01 sgdcplm02.
The following hosts are not reachable: .
All hosts are reachable. Proceeding further...
firsthost sgdcplm01
numhosts 2
The script will setup SSH connectivity from the host sgdcplm02 to all
the remote hosts. After the script is executed, the user can use SSH to run
commands on the remote hosts or copy files between this host sgdcplm02
and the remote hosts without being prompted for passwords or confirmations.
NOTE 1:
As part of the setup procedure, this script will use ssh and scp to copy
files between the local host and the remote hosts. Since the script does not
store passwords, you may be prompted for the passwords during the execution of
the script whenever ssh or scp is invoked.
NOTE 2:
AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY
AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE
directories.
Do you want to continue and let the script make the above mentioned changes (yes/no)?
yes
The user chose yes
Please specify if you want to specify a passphrase for the private key this script will create for the local host. Passphrase is used to encrypt the private key and makes SSH much more secure. Type 'yes' or 'no' and then press enter. In case you press 'yes', you would need to enter the passphrase whenever the script executes ssh or scp.
The estimated number of times the user would be prompted for a passphrase is 4. In addition, if the private-public files are also newly created, the user would have to specify the passphrase on one additional occasion.
Enter 'yes' or 'no'.
The user chose
The files containing the client public and private keys already exist on the local host. The current private key may have a passphrase associated with it. In case you find using passphrase inconvenient(although it is more secure), you can change to it empty through this script. Press 'change' if you want the script to change the passphrase for you. Press 'no' if you want to use your old passphrase, if you had one.
yes
The user chose yes
Creating .ssh directory on local host, if not present already
Creating authorized_keys file on local host
Changing permissions on authorized_keys to 644 on local host
Creating known_hosts file on local host
Changing permissions on known_hosts to 644 on local host
Creating config file on local host
If a config file exists already at /home/grid/.ssh/config, it would be backed up to /home/grid/.ssh/config.backup.
Removing old private/public keys on local host
Running SSH keygen on local host
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Generating public/private rsa key pair.
Your identification has been saved in /home/grid/.ssh/id_rsa.
Your public key has been saved in /home/grid/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:KS3TTKMYZhi8U8JO51qosZzesQV0ho7zlSUYWk9wcQM grid@sgdcplm02
The key's randomart image is:
+---[RSA 1024]----+
| o.+=Eoo |
| B**+... |
| +=B*.+ o |
|.o==o= * o |
|.++++ = S |
|oo.o . + |
|. . + |
| . o |
| |
+----[SHA256]-----+
Creating .ssh directory and setting permissions on remote host sgdcplm01
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host sgdcplm01. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host sgdcplm01.
Warning: Permanently added 'sgdcplm01,10.33.105.63' (ECDSA) to the list of known hosts.
Password:
Done with creating .ssh directory and setting permissions on remote host sgdcplm01.
Creating .ssh directory and setting permissions on remote host sgdcplm02
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host sgdcplm02. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host sgdcplm02.
Warning: Permanently added 'sgdcplm02,10.xx.xx.xx' (ECDSA) to the list of known hosts.
Password:
Done with creating .ssh directory and setting permissions on remote host sgdcplm02.
Copying local host public key to the remote host sgdcplm01
The user may be prompted for a password or passphrase here since the script would be using SCP for host sgdcplm01.
Password:
Done copying local host public key to the remote host sgdcplm01
Copying local host public key to the remote host sgdcplm02
The user may be prompted for a password or passphrase here since the script would be using SCP for host sgdcplm02.
Password:
Done copying local host public key to the remote host sgdcplm02
Creating keys on remote host sgdcplm01 if they do not exist already. This is required to setup SSH on host sgdcplm01.
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Creating keys on remote host sgdcplm02 if they do not exist already. This is required to setup SSH on host sgdcplm02.
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Updating authorized_keys file on remote host sgdcplm01
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Updating known_hosts file on remote host sgdcplm01
Enter passphrase for key '/home/grid/.ssh/id_rsa':
./sshUserSetup.sh: line 540: [: =: unary operator expected
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Updating authorized_keys file on remote host sgdcplm02
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Updating known_hosts file on remote host sgdcplm02
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Enter passphrase for key '/home/grid/.ssh/id_rsa':
./sshUserSetup.sh: line 540: [: =: unary operator expected
Enter passphrase for key '/home/grid/.ssh/id_rsa':
SSH setup is complete.
------------------------------------------------------------------------
Verifying SSH setup
===================
The script will now run the date command on the remote nodes using ssh
to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP,
THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR
PASSWORDS. If you see any output other than date or are prompted for the
password, ssh is not setup correctly and you will need to resolve the
issue and set up ssh again.
The possible causes for failure could be:
1. The server settings in /etc/ssh/sshd_config file do not allow ssh
for user oracle.
2. The server may have disabled public key based authentication.
3. The client public key on the server may be outdated.
4. ~oracle or ~oracle/.ssh on the remote host may not be owned by oracle.
5. User may not have passed -shared option for shared remote users or
may be passing the -shared option for non-shared remote users.
6. If there is output in addition to the date, but no password is asked,
it may be a security alert shown as part of company policy. Append the
additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file.
------------------------------------------------------------------------
--sgdcplm01:--
Running /usr/bin/ssh -x -l oracle sgdcplm01 date to verify SSH connectivity has been setup from local host to sgdcplm01.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
./sshUserSetup.sh: line 587: [: =: unary operator expected
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Tue Jun 4 09:07:51 CEST 2019
------------------------------------------------------------------------
--sgdcplm02:--
Running /usr/bin/ssh -x -l oracle sgdcplm02 date to verify SSH connectivity has been setup from local host to sgdcplm02.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
./sshUserSetup.sh: line 587: [: =: unary operator expected
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Tue Jun 4 09:07:52 CEST 2019
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from sgdcplm01 to sgdcplm01
------------------------------------------------------------------------
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Tue Jun 4 09:07:55 CEST 2019
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from sgdcplm01 to sgdcplm02
------------------------------------------------------------------------
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Tue Jun 4 09:07:57 CEST 2019
------------------------------------------------------------------------
-Verification from sgdcplm01 complete-
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from sgdcplm02 to sgdcplm01
------------------------------------------------------------------------
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Tue Jun 4 09:08:00 CEST 2019
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from sgdcplm02 to sgdcplm02
------------------------------------------------------------------------
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Enter passphrase for key '/home/grid/.ssh/id_rsa':
Tue Jun 4 09:08:01 CEST 2019
------------------------------------------------------------------------
-Verification from sgdcplm02 complete-
SSH verification complete.
grid@sgdcplm02:/u04/MasterDB/oracle_grid_software/grid/sshsetup>