/etc/hosts.allow & /etc/hosts.deny file permission on Exadata DB Nodes

Asset ID:	1-72-1450209.1
Update Date:	2015-09-29
Keywords:

Solution Type Problem Resolution Sure

Solution 1450209.1 : /etc/hosts.allow & /etc/hosts.deny file permission on Exadata DB Nodes

Applies to:

Exadata Database Machine X2-2 Hardware - Version All Versions and later
Oracle Exadata Hardware - Version 11.2.0.1 and later
Information in this document applies to any platform.

Symptoms

In the /var/log/messages messages similar to following may report if NFS volumes are mounted on the DB Node.

May 17 11:55:23 db01 portmap[6404]: warning: cannot open /etc/hosts.allow: Permission denied
May 17 11:55:23 db01 portmap[6404]: warning: cannot open /etc/hosts.deny: Permission denied
May 17 11:55:23 db01 portmap[6404]: warning: cannot open /etc/hosts.allow: Permission denied
May 17 11:55:23 db01 portmap[6404]: warning: cannot open /etc/hosts.deny: Permission denied
May 17 11:55:23 db01 portmap[18262]: connect from 10.204.77.100 to callit(ypserv): request from unauthorized host

Cause

The default permissions on Exatata DB Node for /etc/hosts.allow & /etc/hosts.deny are 600. Service portmap facilitates mount of NFS volumes on the DB Nodes. Service portmap run as user "rpc". rpc's [uid, gid] is [32,32]. User rpc cannot read /etc/hosts.deny, /etc/hosts.allow file owned by root user with 600 as the permission. Hence the permission change on /etc/hosts.allow and /etc/hosts.deny is required to mount NFS volumes on the DB Nodes. The /etc/hosts.* files are protected for security reasons. In out of the box settings, portmap is not run as NFS is not run by default.

Solution

To run portmap, the security on these two files to /etc/hosts.deny and /etc/hosts.allow need to be loosened (change to 644).
On the database nodes the permissions and contents of these files can be modified if needed. Please do not modify these on the cells.

To modify on all db nodes listed in dbs_group use following command:

$ dcli -g dbs_group -l root chmod 644 /etc/hosts.allow /etc/hosts.deny

Attachments

This solution has no attachment