Exadata Hardening Breaks the Exadata Backup Tool Scripts

Asset ID:	1-71-1485856.1
Update Date:	2013-01-18
Keywords:

Solution Type Technical Instruction Sure

Solution 1485856.1 : Exadata Hardening Breaks the Exadata Backup Tool Scripts

Applies to:

Exadata Database Machine V2 - Version All Versions to All Versions [Release All Releases]
Information in this document applies to any platform.

Goal

You have an Exadata Rack using ZFS Backup Storage, which runs the Exadata Backup Configuration Utility.

The script exadata_bcu no longer works after running Exadata Hardeneing, ie /opt/oracle.SupportTools/harden_passwords_reset_root_ssh.

Please note that External security hardening is allowed only on Exadata Database servers, not on cell servers.

Fix

Once Exadata Hardeneing, ie /opt/oracle.SupportTools/harden_passwords_reset_root_ssh, is run, the authorised ssh keys setup on the hosts are removed.

The Exadata Backup Configuration Utility script relies on these keys for authentication.

This has been logged as unpublished BUG 15802017 - SUNBT7181862 Exadata hardening (/opt/oracle.SupportTools/harden_passwords_reset.

This fix will be available in version 1.1.1 of the Exadata Backup Configuration Utility.

In the meanwhile you can use the following Workaround:

$ ./exadata_bcu (Exit after Step 1)

$ ssh root@dbnode-01
dbnode-01 # ssh-keygen -t rsa
dbnode-01 # dcli -l root -g ~oracle/dbs_group -k
dbnode-01 # exit

$ ./install_key -t exadata root@dbnode-01

$ ./exadata_bcu -t template/<db-name> (Resume and skip to Step 2)

After completing the Step 2, the ssh key setup may be removed.

$ ssh root@cell-01
dbnode-01 # dcli -l root -c dbnode-08 rm -rf .ssh
dbnode-01 # dcli -l root -c dbnode-07 rm -rf .ssh
...
dbnode-01 # dcli -l root -c dbnode-02 rm -rf .ssh
dbnode-01 # dcli -l root -c dbnode-01 rm -rf .ssh

There also has been an Enhancement Request filed to support sudo:

BUG 15810815 - SUNBT7192337 support non-root login through sudo to configure Exadata nodes

References

<BUG:7192337> - DB11R2E2 INSTANCE TERMINATED WITH FILE I/O ERROR USING ACFS
<BUG:14281620> - EXADATA HARDENING (/OPT/ORACLE.SUPPORTTOOLS/HARDEN_PASSWORDS_RESET_ROOT_SSH) BRE
<NOTE:1475967.1> - Known Issues - Exadata Backup Configuration Utility v1.1.0

Attachments

This solution has no attachment