IT Tutorial IT Tutorial | Oracle DBA | SQL Server, Goldengate, Exadata, Big Data, Data ScienceTutorial
I will explain How To Setup PasswordLess SSH Connectivity Using SshUserSetup.sh in this post.
How To Setup SSH Connectivity Using SshUserSetup.sh
Normally, If you want to connect to any server from the other server, that server request the password of related user ( root, oracle,grid,weblogic or etc.. ). But sometimes you need to setup passwordless SSH User Equivalence ( (Key-Based Authentication) ) for these servers ( Nodes ).
Especially Cluster Nodes ( Servers ) need passwordless SSH connectivity between each other.
For example; Oracle RAC Cluster nodes must be passwordless SSH User Equivalence ( (Key-Based Authentication) between each nodes. Otherwise you cannot install the Oracle RAC and Grid Infrastructure.
These nodes are always communicating each other, so this communication must be passwordless SSH User Equivalence ( (Key-Based Authentication) ).
Setup passwordless SSH via sshUserSetup.sh Oracle sh.
There is a “sshUserSetup.sh” file under “sshsetup” directory in the Grid and Database Setup for Oracle 11gR2 and beyond.
Run this sshUserSetup.sh file to set up this passwordless SSH connectivity.
sshUserSetup.sh syntax is as follows.
./sshUserSetup.sh -user <user name> [ -hosts "<space separated hostlist>" | -hostfile <absolute path of cluster configuration file> ] [ -advanced ] [ -verify] [ -exverify ] [ -logfile <desired absolute path of logfile> ] [-confirm] [-shared] [-help] [-usePassphrase] [-noPromptPassphrase]
I will show you how to set up this passwordless communication with an example. In this example; I will set up passwordless SSH User Equivalence for oracle user and between msdbdbadm01, msdbdbadm02,….msdbdbadm08 nodes. Thus you and nodes can connect to each other passwordless with Oracle user.
[MSDB1]/home/oracle $ ./sshUserSetup.sh -user oracle -hosts "msdbadm01 msdbadm02 msdbadm03 msdbadm04 msdbadm05 msdbadm06 msdbadm07 msdbadm08" -noPromptPassphrase The output of this script is also logged into /tmp/sshUserSetup_2021-09-16-12-21-25.log Hosts are msdbadm01 msdbadm02 msdbadm03 msdbadm04 msdbadm05 msdbadm06 msdbadm07 msdbadm08 user is oracle Platform:- Linux Checking if the remote hosts are reachable PING msdbadm01.deveci.local (192.168.63.200) 56(84) bytes of data. 64 bytes from msdbadm01.deveci.local (192.168.63.200): icmp_seq=1 ttl=64 time=0.028 ms 64 bytes from msdbadm01.deveci.local (192.168.63.200): icmp_seq=2 ttl=64 time=0.030 ms 64 bytes from msdbadm01.deveci.local (192.168.63.200): icmp_seq=3 ttl=64 time=0.031 ms 64 bytes from msdbadm01.deveci.local (192.168.63.200): icmp_seq=4 ttl=64 time=0.040 ms 64 bytes from msdbadm01.deveci.local (192.168.63.200): icmp_seq=5 ttl=64 time=0.054 ms --- msdbadm01.deveci.local ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4114ms rtt min/avg/max/mdev = 0.028/0.036/0.054/0.011 ms PING msdbadm02.deveci.local (192.168.63.201) 56(84) bytes of data. 64 bytes from msdbadm02.deveci.local (192.168.63.201): icmp_seq=1 ttl=64 time=0.188 ms 64 bytes from msdbadm02.deveci.local (192.168.63.201): icmp_seq=2 ttl=64 time=0.142 ms 64 bytes from msdbadm02.deveci.local (192.168.63.201): icmp_seq=3 ttl=64 time=0.086 ms 64 bytes from msdbadm02.deveci.local (192.168.63.201): icmp_seq=4 ttl=64 time=0.085 ms 64 bytes from msdbadm02.deveci.local (192.168.63.201): icmp_seq=5 ttl=64 time=0.216 ms --- msdbadm02.deveci.local ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4073ms rtt min/avg/max/mdev = 0.085/0.143/0.216/0.053 ms PING msdbadm03.deveci.local (192.168.63.202) 56(84) bytes of data. 64 bytes from msdbadm03.deveci.local (192.168.63.202): icmp_seq=1 ttl=64 time=0.111 ms 64 bytes from msdbadm03.deveci.local (192.168.63.202): icmp_seq=2 ttl=64 time=0.090 ms 64 bytes from msdbadm03.deveci.local (192.168.63.202): icmp_seq=3 ttl=64 time=0.099 ms 64 bytes from msdbadm03.deveci.local (192.168.63.202): icmp_seq=4 ttl=64 time=0.135 ms 64 bytes from msdbadm03.deveci.local (192.168.63.202): icmp_seq=5 ttl=64 time=0.096 ms --- msdbadm03.deveci.local ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4074ms rtt min/avg/max/mdev = 0.090/0.106/0.135/0.017 ms PING msdbadm04.deveci.local (192.168.63.203) 56(84) bytes of data. 64 bytes from msdbadm04.deveci.local (192.168.63.203): icmp_seq=1 ttl=64 time=0.098 ms 64 bytes from msdbadm04.deveci.local (192.168.63.203): icmp_seq=2 ttl=64 time=0.102 ms 64 bytes from msdbadm04.deveci.local (192.168.63.203): icmp_seq=3 ttl=64 time=0.095 ms 64 bytes from msdbadm04.deveci.local (192.168.63.203): icmp_seq=4 ttl=64 time=0.088 ms 64 bytes from msdbadm04.deveci.local (192.168.63.203): icmp_seq=5 ttl=64 time=0.096 ms --- msdbadm04.deveci.local ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4071ms rtt min/avg/max/mdev = 0.088/0.095/0.102/0.013 ms PING msdbadm05.deveci.local (192.168.63.204) 56(84) bytes of data. 64 bytes from msdbadm05.deveci.local (192.168.63.204): icmp_seq=1 ttl=64 time=0.090 ms 64 bytes from msdbadm05.deveci.local (192.168.63.204): icmp_seq=2 ttl=64 time=0.152 ms 64 bytes from msdbadm05.deveci.local (192.168.63.204): icmp_seq=3 ttl=64 time=0.105 ms 64 bytes from msdbadm05.deveci.local (192.168.63.204): icmp_seq=4 ttl=64 time=0.117 ms 64 bytes from msdbadm05.deveci.local (192.168.63.204): icmp_seq=5 ttl=64 time=0.121 ms --- msdbadm05.deveci.local ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4073ms rtt min/avg/max/mdev = 0.090/0.117/0.152/0.020 ms PING msdbadm06.deveci.local (192.168.63.205) 56(84) bytes of data. 64 bytes from msdbadm06.deveci.local (192.168.63.205): icmp_seq=1 ttl=64 time=0.080 ms 64 bytes from msdbadm06.deveci.local (192.168.63.205): icmp_seq=2 ttl=64 time=0.082 ms 64 bytes from msdbadm06.deveci.local (192.168.63.205): icmp_seq=3 ttl=64 time=0.091 ms 64 bytes from msdbadm06.deveci.local (192.168.63.205): icmp_seq=4 ttl=64 time=0.084 ms 64 bytes from msdbadm06.deveci.local (192.168.63.205): icmp_seq=5 ttl=64 time=0.109 ms --- msdbadm06.deveci.local ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4074ms rtt min/avg/max/mdev = 0.080/0.089/0.109/0.012 ms PING msdbadm07.deveci.local (192.168.63.206) 56(84) bytes of data. 64 bytes from msdbadm07.deveci.local (192.168.63.206): icmp_seq=1 ttl=64 time=0.092 ms 64 bytes from msdbadm07.deveci.local (192.168.63.206): icmp_seq=2 ttl=64 time=0.101 ms 64 bytes from msdbadm07.deveci.local (192.168.63.206): icmp_seq=3 ttl=64 time=0.143 ms 64 bytes from msdbadm07.deveci.local (192.168.63.206): icmp_seq=4 ttl=64 time=0.066 ms 64 bytes from msdbadm07.deveci.local (192.168.63.206): icmp_seq=5 ttl=64 time=0.137 ms --- msdbadm07.deveci.local ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4061ms rtt min/avg/max/mdev = 0.066/0.107/0.143/0.031 ms PING msdbadm08.deveci.local (192.168.63.207) 56(84) bytes of data. 64 bytes from msdbadm08.deveci.local (192.168.63.207): icmp_seq=1 ttl=64 time=0.189 ms 64 bytes from msdbadm08.deveci.local (192.168.63.207): icmp_seq=2 ttl=64 time=0.122 ms 64 bytes from msdbadm08.deveci.local (192.168.63.207): icmp_seq=3 ttl=64 time=0.186 ms 64 bytes from msdbadm08.deveci.local (192.168.63.207): icmp_seq=4 ttl=64 time=0.140 ms 64 bytes from msdbadm08.deveci.local (192.168.63.207): icmp_seq=5 ttl=64 time=0.178 ms --- msdbadm08.deveci.local ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4074ms rtt min/avg/max/mdev = 0.122/0.163/0.189/0.027 ms Remote host reachability check succeeded. The following hosts are reachable: msdbadm01 msdbadm02 msdbadm03 msdbadm04 msdbadm05 msdbadm06 msdbadm07 msdbadm08. The following hosts are not reachable: . All hosts are reachable. Proceeding further... firsthost msdbadm01 numhosts 8 The script will setup SSH connectivity from the host msdbadm01.deveci.local to all the remote hosts. After the script is executed, the user can use SSH to run commands on the remote hosts or copy files between this host msdbadm01.deveci.local and the remote hosts without being prompted for passwords or confirmations. NOTE 1: As part of the setup procedure, this script will use ssh and scp to copy files between the local host and the remote hosts. Since the script does not store passwords, you may be prompted for the passwords during the execution of the script whenever ssh or scp is invoked. NOTE 2: AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEGES TO THESE directories. Do you want to continue and let the script make the above mentioned changes (yes/no)? yes The user chose yes User chose to skip passphrase related questions. Creating .ssh directory on local host, if not present already Creating authorized_keys file on local host Changing permissions on authorized_keys to 644 on local host Creating known_hosts file on local host Changing permissions on known_hosts to 644 on local host Creating config file on local host If a config file exists already at /home/oracle/.ssh/config, it would be backed up to /home/oracle/.ssh/config.backup. Creating .ssh directory and setting permissions on remote host msdbadm01 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host msdbadm01. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host msdbadm01. Warning: Permanently added 'msdbadm01,192.168.63.200' (ECDSA) to the list of known hosts. oracle@msdbadm01's password: Done with creating .ssh directory and setting permissions on remote host msdbadm01. Creating .ssh directory and setting permissions on remote host msdbadm02 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host msdbadm02. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host msdbadm02. Warning: Permanently added 'msdbadm02,192.168.63.201' (ECDSA) to the list of known hosts. oracle@msdbadm02's password: Done with creating .ssh directory and setting permissions on remote host msdbadm02. Creating .ssh directory and setting permissions on remote host msdbadm03 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host msdbadm03. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host msdbadm03. Warning: Permanently added 'msdbadm03,192.168.63.202' (ECDSA) to the list of known hosts. oracle@msdbadm03's password: Done with creating .ssh directory and setting permissions on remote host msdbadm03. Creating .ssh directory and setting permissions on remote host msdbadm04 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host msdbadm04. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host msdbadm04. Warning: Permanently added 'msdbadm04,192.168.63.203' (ECDSA) to the list of known hosts. oracle@msdbadm04's password: Done with creating .ssh directory and setting permissions on remote host msdbadm04. Creating .ssh directory and setting permissions on remote host msdbadm05 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host msdbadm05. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host msdbadm05. Warning: Permanently added 'msdbadm05,192.168.63.204' (ECDSA) to the list of known hosts. oracle@msdbadm05's password: Done with creating .ssh directory and setting permissions on remote host msdbadm05. Creating .ssh directory and setting permissions on remote host msdbadm06 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host msdbadm06. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host msdbadm06. Warning: Permanently added 'msdbadm06,192.168.63.205' (ECDSA) to the list of known hosts. oracle@msdbadm06's password: Done with creating .ssh directory and setting permissions on remote host msdbadm06. Creating .ssh directory and setting permissions on remote host msdbadm07 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host msdbadm07. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host msdbadm07. Warning: Permanently added 'msdbadm07,192.168.63.206' (ECDSA) to the list of known hosts. oracle@msdbadm07's password: Done with creating .ssh directory and setting permissions on remote host msdbadm07. Creating .ssh directory and setting permissions on remote host msdbadm08 THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT. The script would create ~oracle/.ssh/config file on remote host msdbadm08. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup. The user may be prompted for a password here since the script would be running SSH on host msdbadm08. Warning: Permanently added 'msdbadm08,192.168.63.207' (ECDSA) to the list of known hosts. oracle@msdbadm08's password: Done with creating .ssh directory and setting permissions on remote host msdbadm08. Copying local host public key to the remote host msdbadm01 The user may be prompted for a password or passphrase here since the script would be using SCP for host msdbadm01. oracle@msdbadm01's password: Done copying local host public key to the remote host msdbadm01 Copying local host public key to the remote host msdbadm02 The user may be prompted for a password or passphrase here since the script would be using SCP for host msdbadm02. oracle@msdbadm02's password: Done copying local host public key to the remote host msdbadm02 Copying local host public key to the remote host msdbadm03 The user may be prompted for a password or passphrase here since the script would be using SCP for host msdbadm03. oracle@msdbadm03's password: Done copying local host public key to the remote host msdbadm03 Copying local host public key to the remote host msdbadm04 The user may be prompted for a password or passphrase here since the script would be using SCP for host msdbadm04. oracle@msdbadm04's password: Done copying local host public key to the remote host msdbadm04 Copying local host public key to the remote host msdbadm05 The user may be prompted for a password or passphrase here since the script would be using SCP for host msdbadm05. oracle@msdbadm05's password: Done copying local host public key to the remote host msdbadm05 Copying local host public key to the remote host msdbadm06 The user may be prompted for a password or passphrase here since the script would be using SCP for host msdbadm06. oracle@msdbadm06's password: Done copying local host public key to the remote host msdbadm06 Copying local host public key to the remote host msdbadm07 The user may be prompted for a password or passphrase here since the script would be using SCP for host msdbadm07. oracle@msdbadm07's password: Done copying local host public key to the remote host msdbadm07 Copying local host public key to the remote host msdbadm08 The user may be prompted for a password or passphrase here since the script would be using SCP for host msdbadm08. oracle@msdbadm08's password: Done copying local host public key to the remote host msdbadm08 cat: /home/oracle/.ssh/known_hosts.tmp: No such file or directory cat: /home/oracle/.ssh/authorized_keys.tmp: No such file or directory SSH setup is complete. ------------------------------------------------------------------------ Verifying SSH setup =================== The script will now run the date command on the remote nodes using ssh to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP, THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR PASSWORDS. If you see any output other than date or are prompted for the password, ssh is not setup correctly and you will need to resolve the issue and set up ssh again. The possible causes for failure could be: 1. The server settings in /etc/ssh/sshd_config file do not allow ssh for user oracle. 2. The server may have disabled public key based authentication. 3. The client public key on the server may be outdated. 4. ~oracle or ~oracle/.ssh on the remote host may not be owned by oracle. 5. User may not have passed -shared option for shared remote users or may be passing the -shared option for non-shared remote users. 6. If there is output in addition to the date, but no password is asked, it may be a security alert shown as part of company policy. Append the additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file. ------------------------------------------------------------------------ --msdbadm01:-- Running /usr/bin/ssh -x -l oracle msdbadm01 date to verify SSH connectivity has been setup from local host to msdbadm01. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Thu Sep 16 12:22:32 +03 2021 ------------------------------------------------------------------------ --msdbadm02:-- Running /usr/bin/ssh -x -l oracle msdbadm02 date to verify SSH connectivity has been setup from local host to msdbadm02. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Thu Sep 16 12:22:32 +03 2021 ------------------------------------------------------------------------ --msdbadm03:-- Running /usr/bin/ssh -x -l oracle msdbadm03 date to verify SSH connectivity has been setup from local host to msdbadm03. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Thu Sep 16 12:22:33 +03 2021 ------------------------------------------------------------------------ --msdbadm04:-- Running /usr/bin/ssh -x -l oracle msdbadm04 date to verify SSH connectivity has been setup from local host to msdbadm04. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Thu Sep 16 12:22:33 +03 2021 ------------------------------------------------------------------------ --msdbadm05:-- Running /usr/bin/ssh -x -l oracle msdbadm05 date to verify SSH connectivity has been setup from local host to msdbadm05. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Thu Sep 16 12:22:33 +03 2021 ------------------------------------------------------------------------ --msdbadm06:-- Running /usr/bin/ssh -x -l oracle msdbadm06 date to verify SSH connectivity has been setup from local host to msdbadm06. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Thu Sep 16 12:22:34 +03 2021 ------------------------------------------------------------------------ --msdbadm07:-- Running /usr/bin/ssh -x -l oracle msdbadm07 date to verify SSH connectivity has been setup from local host to msdbadm07. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Thu Sep 16 12:22:34 +03 2021 ------------------------------------------------------------------------ --msdbadm08:-- Running /usr/bin/ssh -x -l oracle msdbadm08 date to verify SSH connectivity has been setup from local host to msdbadm08. IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR. Thu Sep 16 12:22:35 +03 2021 ------------------------------------------------------------------------ SSH verification complete. You have new mail in /var/spool/mail/oracle [MSDB1]/home/oracle $
You can do this example for all users ( root, oracle,grid,weblogic or etc.. )
Passwordless SSH Connectivity has been established again with sshUserSetup.sh.
Do you want to learn Linux System Administration for Beginners, then read the following articles.
https://ittutorial.org/linux-administration-tutorial-for-beginners/
Do you want to learn Oracle Database for Beginners, then read the following articles.
https://ittutorial.org/oracle-database-19c-tutorials-for-beginners/
