Kerberos Authentication with LDAP Authorization for Linux & Solaris (8 & 10) with Active Directory 2003 R2

This document will show the steps to authenticate (Using Kerberos) and authorize (Using LDAP) Solaris (8 & 10 have been tested, Solaris 9 should work the same as 10) and Linux with Active Directory 2003 R2.

My apology: I used word to create this post and then copy/paste the content to here, so the format has changed a bit... You can download the file from here.

Introduction

Here I'll explain the main components involved in this architecture:

• Kerberos - The world standard for secured strong network authentication. How it works?
  From wikipedia ( http://en.wikipedia.org/wiki/Kerberos_(protocol) ):
  
  AS = Authentication Server
  TGS = Ticket Granting Server
  SS = Service Server
  
  
1. A user enters a username and password on the client.
2. The client performs a one-way hash on the entered password, and this becomes the secret key of the client.
3. The client sends a clear-text message to the AS requesting services on behalf of the user. Sample Message: "User XYZ would like to request services". Note: Neither the secret key nor the password is sent to the AS.
4. The AS checks to see if the client is in its database. If it is, the AS sends back the following two messages to the client:
• Message A: Client/TGS session key encrypted using the secret key of the user.
• Message B: Ticket-Granting Ticket (which includes the client ID, client network address, ticket validity period, and the client/TGS session key) encrypted using the secret key of the TGS.
5. Once the client receives messages A and B, it decrypts message A to obtain the client/TGS session key. This session key is used for further communications with TGS. (Note: The client cannot decrypt the Message B, as it is encrypted using TGS's secret key.) At this point, the client has enough information to authenticate itself to the TGS.
6. When requesting services, the client sends the following two messages to the TGS:
• Message C: Composed of the Ticket-Granting Ticket from message B and the ID of the requested service.
• Message D: Authenticator (which is composed of the client ID and the timestamp), encrypted using the client/TGS session key.
7. Upon receiving messages C and D, the TGS decrypts message D (Authenticator) using the client/TGS session key and sends the following two messages to the client:
• Message E: Client-to-server ticket (which includes the client ID, client network address, validity period and Client/server session key) encrypted using the service's secret key.
• Message F: Client/server session key encrypted with the client/TGS session key.
8. Upon receiving messages E and F from TGS, the client has enough information to authenticate itself to the SS. The client connects to the SS and sends the following two messages:
• Message E from the previous step (the client-to-server ticket, encrypted using service's secret key).
• Message G: a new Authenticator, which includes the client ID, timestamp and is encrypted using client/server session key.
9. The SS decrypts the ticket using its own secret key and sends the following message to the client to confirm its true identity and willingness to serve the client:
• Message H: the timestamp found in client's recent Authenticator plus 1, encrypted using the client/server session key.
10. The client decrypts the confirmation using the client/server session key and checks whether the timestamp is correctly updated. If so, then the client can trust the server and can start issuing service requests to the server.
11. The server provides the requested services to the client.

• Directory Services – Use to store organization information in a tree hierarchy. The stored information is usually users, groups, computers, resources and more.
  
  
• LDAP – Lightweight Directory Access Protocol is the "SQL language" for querying and modifying directory services data.
  
  
• Active Directory – is Microsoft's implementation for the Kerberos (KDC) and LDAP server in one entity.
  
  
• Active Directory R2 – the release 2 of AD 2003 includes the directory schema extension for UNIX/Linux authorization (compliant with RFC 2307). With this release we can use AD to store information for UNIX like operating systems, this information includes users data like uid, gid, home directory, default shell and more.
  NOTE: Before R2 was released Microsoft created the "Microsoft Windows Services for UNIX" that can be downloaded from Microsoft's web site, this schema extension is not compliant with RFC 2307.

Active Directory 2003 R2

To be able to implement this solution we will need a running Active Directory 2003 R2 server, if this is the first R2 server in an existing forest you must first extend the schema with Adprep tool. Here you can find direction on how to correctly install R2.

The schema extension will add/modify the needed objects and attributes to the Active Directory for UNIX/Linux authorization, objects like group and user or attributes like "home directory" and "login shell". We can see the new information as a new tab ("UNIX Attributes") in the user/group dialog box at the "Active Directory Users and Computers" management console. With this dialog we can set the UNIX attributes for each user/group, attributes like uid, gid, home directory and login shell.

Installation and configuration with linux (Redhat ES4 Update 4)

Kerberos

Installing Kerberos

The first step in setting the authentication method to use Kerberos is to install the following RPMs:

· krb5-libs

· pam_krb5

· krb5-workstation

· krb5-auth-dialog

Configuring Kerberos

The second step is to configure the authentication mechanism to use Kerberos, Redhat provides authconfig tool that can be used to do the basic configuration, run this tool and follow the next steps:

· Select "Use Kerberos" in the first dialog and click next

· The next screen will ask for the Kerberos information:

o Realm – Fill the complete domain name in CAPITAL letters, for example: UXDC.CORP

o KDC – Fill the complete domain controller DNS name with port 88, for example: srvuxdc.corp:88

o Admin Server - Fill the complete domain controller DNS name with port 749, for example: srvuxdc.corp:749

o Select both checkboxes:

§ Use DNS to resolve hosts to realms

§ Use DNS to locate KDCs for realms

When you press Ok, authconfig will go back to command line. The files updated by authconfig are:

· /etc/krb5.conf – Kerberos 5 configuration file

· /etc/krb.conf – Kerberos 4 configuration file – This can be remove

· /etc/pam.d/system-auth – PAM configuration file for authentication mechanism

There is one more Kerberos 4 file that can be removed to avoid confusion: /etc/krb.realms, this file is used by Kerberos 4 for the realms map to domain names.

krb5.conf

The next step in the configuration is to edit Kerberos 5 configuration file: /etc/krb5.conf, we will need to change/add few parameters to the file, but before we will do it I'll explain the file structure:

· [logging] – sets the way Kerberos component will perform there logging, the components that use the logging parameters are the KDC and Kerberos Admin Server both are used when you will use Linux as the Kerberos server, our Kerberos server is the Active Directory so we can leave the default for the logging section.

· [libdefaults] - Contains various default values used by the Kerberos V5 library. Values like default encryption type and if to use dns lookups or not.

· [realms] – list of realms and where to find there Kerberos server and some other realm related information.

· [domain_realm] – this file the mapping file from domain names to Kerberos realms.

· [appdefaults] – Contains default values that can be used by Kerberos V5 applications.

Here is an example for krb5.conf file after the needed changes, the main lines are highlighted:

[logging]

default = FILE:/var/log/krb5libs.log

[libdefaults]

default_realm = UXDC.CORP

dns_lookup_realm = true

dns_lookup_kdc = true

default_keytab_name = FILE:/etc/krb5.keytab

default_tkt_enctypes = des-cbc-md5

default_tgs_enctypes = des-cbc-md5

[realms]

UXDC.CORP = {

kdc = SRVUXDC.LCARD.CORP:88

admin_server = SRVUXDC.LCARD.CORP:749

}

[domain_realm]

.uxdc.corp = UXDC.CORP

uxdc.com = UXDC.CORP

[appdefaults]

pam = {

debug = false

ticket_lifetime = 36000

renew_lifetime = 36000

forwardable = true

krb4_convert = false

}

So, what does it means? :

• default_realm – is the default realm to be used when no realm is specified by using @ for example: user1@UXDC.CORP
• default_keytab_name – the default path to find the server keytab, a keytab is a file containing pairs of Kerberos principals and DES-encrypted keys based on Kerberos password allowing the server services to access resources based on Kerberos authentication without the need to use a password.
• default_tkt_enctypes – the default encryption type will be requested by the client.
• Use des encryption only to support other unix tools, the encryption types can be one of des-cbc-crc or des-cbc-md5
• default_tgs_enctypes – the default encryption type will be returned by the KDC.
• Use des encryption only to support other unix tools, the encryption types can be one of des-cbc-crc or des-cbc-md5
• verify_ap_req_nofail - If this flag is set, then an attempt to get initial credentials will fail if the client machine does not have a keytab. The default for the flag is false. NOTE: For some reason this parameter is not working in linux, that’s why we will use "validate" in the /etc/pam.d/system-auth configuration file.

Configuring PAM

The next file we will change is /etc/pam.d/system-auth, this file is configured by authconfig to use Kerberos as one of the authentication mechanisms (first use Unix and than try Kerberos), the only thing that we will change in the file is adding the validate parameter to each pam_krb5.so line, the validate parameter tells pam to check the server keytab, this can be avoided when the verify_ap_req_nofail parameter in krb5.conf file will work properly in the future release:

auth required /lib/security/$ISA/pam_env.so

auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok

auth sufficient /lib/security/$ISA/pam_krb5.so use_first_pass validate

auth required /lib/security/$ISA/pam_deny.so

account required /lib/security/$ISA/pam_unix.so broken_shadow

account sufficient /lib/security/$ISA/pam_succeed_if.so uid <>

account [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_krb5.so validate

account required /lib/security/$ISA/pam_permit.so

password requisite /lib/security/$ISA/pam_cracklib.so retry=3

password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow

password sufficient /lib/security/$ISA/pam_krb5.so use_authtok validate

password required /lib/security/$ISA/pam_deny.so

session required /lib/security/$ISA/pam_limits.so

session required /lib/security/$ISA/pam_unix.so

session optional /lib/security/$ISA/pam_krb5.so validate

try_first_pass – with this parameter PAM will not ask the user to enter the Kerberos password if the Unix authentication failed and will use the first password enter by the user.

If we need to debug the Kerberos 5 pam module you can add "debug" to the end of Kerberos auth line:

auth sufficient /lib/security/$ISA/pam_krb5.so try_first_pass validate debug

Creating the server keytab

The final step is to create the server keytab:

• Create a domain user for the server, name the user as the name of the server, and use a secured password, also select "Password never expires" and "Use DES ecryption types for this account" in the account tab.
• Create the account keytab by using the ktpass command line:
• ktpass.exe princ host/@ mapuser -pass out .keytab
  For example, if my server name is linuxhost01.uxdc.corp:
  ktpass.exe princ host/linuxhost01.uxdc.corp@UXDC.CORP mapuser linuxhost01 -pass TheServerPassw0rd#6 out linuxhost01.keytab
• Copy the file to the server using secured connection like sftp/scp
• Connect to the server and run ktutil, and in the ktutil prompt run:
  rkt
  wkt /etc/krb5.keytab
  exit
• Remove the copied keytab file from the server:
  rm –f
  or the better way is to use shred utility to securely remove the file from the server, for example:
  shred –u linuxhost01.keytab

Testing Kerberos

Now we will try to obtain a Kerberos ticket for an existing domain user, for example:

kinit myuser@UXDC.CORP

Password for myuser@UXDC.CORP:

If no error returned run: "klist -5e" to view the obtained Kerberos ticket!!!!

LDAP

Now that we have Kerberos working we can set the ldap client to get the account information from Active Directory. The configuration files that we will use are:

• /etc/ldap.conf – LDAP configuration file
• /etc/nsswitch.conf - Name Service Switch configuration file

Installing LDAP

We will need to install the following RPM's:

• openldap
• nss_ldap

ldap.conf

The first file to edit is /etc/ldap.conf, this file contains the defaults to be applied when running ldap clients. The lines that we will need to change/add are:

• base – specifies the default base DN to use when performing ldap operations:
  base dc=uxdc,dc=corp
• uri – the way to specify the LDAP server(s) to witch ldap clients should connect. (URI parameter replaced the HOST parameter:
  uri ldap://srvuxdc.corp
• binddn – the default account to use for binding to ldap server:
  binddn uxldap@uxdc.corp
• bindpw – the password used for the binding account:
  bindpw Account#Password$
• scope – the search scope for ldap clients, can be one of:
• one – one level search
• sub – subtree search
• base – base object search

we will use sub option, for example:
scope sub

• Changing the time limits for ldap operations:
• timelimit 30 – sets the search time limit to 30 seconds
• bind_timelimit 30 – sets the binding time limit to 30 seconds
• idle_timelimit 3600 – the time limit for nss_ldap to close connections if the server has not been connected for this amount of seconds.
• pam_login_attribute – sets the ID attribute in the ldap server that is equivalent to the Unix uid attribute (uid attribute in unix ldap schema holds the username)
• Setting where and how to search for specific contexts:
  nss_base_passwd dc=uxdc,dc=corp?sub?&(objectCategory=user)
  nss_base_shadow dc=uxdc,dc=corp?sub
  nss_base_group dc=uxdc,dc=corp?sub?&(objectCategory=group)
• Now we will set all the other naming contexts from Active Directory to Unix/Linux:
  nss_map_objectclass posixAccount user
  nss_map_objectclass shadowAccount user
  nss_map_objectclass posixGroup group
  nss_map_attribute homeDirectory unixHomeDirectory
  nss_map_attribute gecos cn
  nss_map_attribute uniqueMember member

nsswitch.conf

The next file to configure is /etc/nsswitch.conf file, that file tells linux from where (which database) to get the needed information, all we need to do is to add the word ldap to the passwd, shadow and group databases:

passwd: ldap files

shadow: ldap files

group: ldap files

Testing ldap

After this is done, we can use getent utility to get information for user accound and groups defined in Active Directory but not in /etc/passwd, for example, to get information about the user account ux1 that is defined in Active Directory:

getent passwd ux1

To get information about the group unixgrp, defined in Active Directory:

getent group unixgrp

Now that every thing is set, we can try to login with a user account that is defined in Active Directory.

Installation and configuration with Solaris (8 & 10)

The Solaris configuration is pretty much the same to Linux configuration regarding to Kerberos, the main difference is in the ldap configuration.

Kerberos

Kerberos configuration files saved in /etc/krb5 directory, there are two main configuration files for Kerberos in Solaris:

• krb5.conf
• warn.conf – configure the warning massages to display when users Kerberos tickets are about to expire, we will not use this file in this manual.

krb5.conf

There is a difference between the implementation of Kerberos in Solaris 8 and Solaris 10, the main issue is that Solaris 8 does not support the validation of the server keytab!!! Other features that Solaris 8 doesn't support are:

• dns_lookup_realm
• dns_lookup_realm
• default_keytab_name
• And more…

We will use the same configuration file in both versions. Solaris 8 will ignore the unknown parameters in the configuration file as long as the syntax is correct.

Here is an example for krb5.conf file, there is nothing different here from the Linux configuration:

[libdefaults]

default_realm = UXDC.CORP

default_tkt_enctypes = des-cbc-md5

default_tgs_enctypes = des-cbc-md5

default_keytab_name = /etc/krb5/krb5.keytab

verify_ap_req_nofile = true

dns_lookup_realm = true

dns_lookup_realm = true

[realms]

UXDC.CORP = {

kdc = srvuxdc.corp:88

admin_server = srvuxdc.corp:749

}

[domain_realm]

.uxdc.corp = UXDC.CORP

uxdc.corp = UXDC.CORP

[appdefaults]

kinit = {

renewable = true

forwardable= true

}

Configuring PAM

In contrary to Linux, PAM configuration in Solaris is based on one file:

· /etc/pam.conf

We will need to use different configuration files for Solaris 8 and 10 because the difference between pam_krb5.so implementation in both versions. Solaris 10 version doesn’t support the use of "try_first_pass" because this behavior is implemented by default in the module.

In this file we will add the use of Kerberos authentication if the Unix authentication fails, here is an example:

login auth requisite pam_authtok_get.so.1

login auth required pam_dhkeys.so.1

login auth required pam_unix_auth.so.1

For Solaris 8:

login auth sufficient pam_krb5.so try_first_pass

For Solaris 10:

login auth sufficient pam_krb5.so

login auth required pam_dial_auth.so.1

other auth requisite pam_authtok_get.so.1

other auth required pam_dhkeys.so.1

other auth required pam_unix_auth.so.1

For Solaris 8:

other auth sufficient pam_krb5.so try_first_pass

For Solaris 10:

other auth sufficient pam_krb5.so

other account requisite pam_roles.so.1

other account required pam_projects.so.1

other account required pam_unix_account.so.1

other account required pam_krb5.so

other password required pam_dhkeys.so.1

other password requisite pam_authtok_get.so.1

other password requisite pam_authtok_check.so.1

other password sufficient pam_krb5.so

other password required pam_authtok_store.so.1

If we need to debug the Kerberos 5 pam module we can add "debug" to the end of Kerberos auth lines:

login auth sufficient pam_krb5.so debug

…

…

other auth sufficient pam_krb5.so debug

Configuring LDAP

The LDAP configuration in Solaris is done by ldapclient utility, the syntax has been changed between Solaris 8 and Solaris 10 (Solaris 9 syntax is the same as 10).

The files that will be changed by ldapclient are:

• /etc/defaultdomain – contains the default domain for ldap
• /var/ldap/ldap_client_cred – contains the account and password that will be used for binding to the ldap server (in our case, the active directory server)
• /var/ldap/ldap_client_file – the main LDAP configuration file
• /etc/nsswitch.conf

Solaris 8:

The command that we will run is:

ldapclient -i -a simple -r false \

-b "dc=uxdc,dc=corp" \

-D "cn=uxldap,cn=users,dc=uxdc,dc=corp" -w "Account#Password$" \

-d uxdc.corp -p 192.168.0.122 \

-s sub -o 30 -t 30 \

-R "passwd:gecos=cn" \

-R "passwd:gidnumber=gidNumber" \

-R "passwd:homedirectory=unixHomeDirectory" \

-R "passwd:loginshell=loginShell" \

-R "passwd:uidl=sAMAccountName" \

-R "shadow:uid=sAMAccountName" \

-M "group:posixGroup=group" \

-M "passwd:posixAccount=user" \

-M "shadow:shadowAccount=user" \

-S "passwd:dc=uxdc,dc=corp?sub" \

-S "shadow:dc=uxdc,dc=corp?sub" \

-S "group:dc=uxdc,dc=corp?sub?&(objectCategory=group)"

Here is an explanation for each line:

• ldapclient -i -a simple -r false
  Will configure ldap to use simple authentication and want follow ldap references,
  ldap references are URI's that could be returned by the ldap server.
• -b "dc=uxdc,dc=corp"
  sets the base DN to start the search from.
• -D "cn=uxldap,cn=users,dc=uxdc,dc=corp" -w "Account#Password$"
  sets the account and password that will be used for binding to the LDAP server
• -d uxdc.corp -p 192.168.0.122
  -d sets the default domain name
  -p sets the LDAP server IP, If we will use the LDAP server DNS name this command may hang
• -s sub -o 30 -t 30
  -s sets the search scope
  -o and –t sets the LDAP operations timeouts
• -R "passwd:gecos=cn"
  -R "passwd:gidnumber=gidNumber"
  -R "passwd:homedirectory=unixHomeDirectory"
  -R "passwd:loginshell=loginShell"
  -R "passwd:uidl=sAMAccountName"
  -R "shadow:uid=sAMAccountName"
  sets the attributes mapping
• -M "group:posixGroup=group"
  -M "passwd:posixAccount=user"
  -M "shadow:shadowAccount=user"
  sets the object class mapping
• -S "passwd:dc=uxdc,dc=corp?sub"
  -S "shadow:dc=uxdc,dc=corp?sub"
  -S "group:dc=uxdc,dc=corp?sub?&(objectCategory=group)"
  sets the search for each service

Solaris 10:

· ldapclient manual
manually configure LDAP client

· -a authenticationMethod=simple
-a credentialLevel=proxy
Use simple authentication (user and password) for binding to the LDAP server

· -a proxyDN=cn=uxldap,cn=users,dc=uxdc,dc=corp
-a proxyPassword=Account#Password$
sets the account and password for binding to the LDAP server

· -a defaultSearchBase=dc=uxdc,dc=corp
sets the base DN to start the search from.

· -a domainName=uxdc.corp
sets the default domain name

· -a defaultServerList=192.168.0.122
sets the LDAP server IP, If we will use the LDAP server DNS name this command may hang

· -a attributeMap=passwd:uniqueMember=member
-a attributeMap=passwd:gecos=cn
-a attributeMap=passwd:uid=sAMAccountName
-a attributeMap=passwd:homedirectory=unixHomeDirectory
-a attributeMap=passwd:loginshell=loginShell
-a attributeMap=shadow:uid=sAMAccountName
sets the attributes mapping

· -a objectClassMap=group:posixGroup=group
-a objectClassMap=passwd:posixAccount=user
-a objectClassMap=shadow:shadowAccount=user
sets the object class mapping

· -a serviceSearchDescriptor=passwd:dc=uxdc,dc=corp\?sub
-a serviceSearchDescriptor=shadow:dc=uxdc,dc=corp?sub
-a serviceSearchDescriptor=group:dc=uxdc,dc=corp\?sub\&(objectCategory=group)
sets the search for each service

If we would like to edit one of the ldap configuration files directly (without using the ldapclient utility) we would need to stop the ldap_client process before changing anything. ldap_client process role is to cache the ldap configuration for other ldap clients. The way to stop ldap_client process is to run: /etc/init.d/ldap_client stop
NOTE: Do not forget to start the ldap_client process after editing. More information about ldap_client process can be found in the man page of ldap_cachemgr.

Here is the result for /var/ldap/ldap_client_file after running ldapclient utility:

#

# Do not edit this file manually; your changes will be lost.Please use ldapclient (1M) instead.

#

NS_LDAP_FILE_VERSION= 2.0

NS_LDAP_SEARCH_BASEDN= dc=uxdc,dc=corp

NS_LDAP_AUTH= simple

NS_LDAP_SEARCH_REF= FALSE

NS_LDAP_SEARCH_SCOPE= sub

NS_LDAP_SEARCH_TIME= 30

NS_LDAP_SERVER_PREF= 172.16.7.75

NS_LDAP_CACHETTL= 0

NS_LDAP_CREDENTIAL_LEVEL= proxy

NS_LDAP_BIND_TIME= 30

NS_LDAP_ATTRIBUTEMAP= passwd:uniqueMember=member

NS_LDAP_ATTRIBUTEMAP= passwd:gecos=cn

NS_LDAP_ATTRIBUTEMAP= passwd:uid=sAMAccountName

NS_LDAP_ATTRIBUTEMAP= passwd:homedirectory=unixHomeDirectory

NS_LDAP_ATTRIBUTEMAP= passwd:loginshell=loginShell

NS_LDAP_ATTRIBUTEMAP= shadow:uid=sAMAccountName

NS_LDAP_OBJECTCLASSMAP= group:posixGroup=group

NS_LDAP_OBJECTCLASSMAP= passwd:posixAccount=user

NS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=user

NS_LDAP_SERVICE_SEARCH_DESC= passwd:dc=uxdc,dc=corp?sub

NS_LDAP_SERVICE_SEARCH_DESC= shadow:dc=uxdc,dc=corp?sub

NS_LDAP_SERVICE_SEARCH_DESC= group:dc=uxdc,dc=corp?sub?&(objectCategory=group)

The result for /var/ldap/ldap_client_cred is:

#

# Do not edit this file manually; your changes will be lost.Please use ldapclient (1M) instead.

#

NS_LDAP_BINDDN= cn=uxldap,cn=users,dc=uxdc,dc=corp

NS_LDAP_BINDPASSWD= {NS1}25c945dc7d61e0

You may wish to update /etc/nsswitch.conf file to remove the ldap from all lines excepts for passwd and group, also you would change the hosts entry to "files dns".

Testing ldap

We can use getent utility to test LDAP configuration just like we have done in the Linux machine.

Now that every thing is set, we can try to login with a user account that is defined in Active Directory.

Bibliography

• Microsoft Solutions Using Kerberos Authentication
• Step-by-Step Guide to Kerberos 5 (krb5 1.0) Interoperability
• Kerberos and LDAP Troubleshooting Tips
• Scott’s blog

Linux - Set static routes per ethernet device

This post will explain the way to add new static routes in Linux (RH).
The old way to do this was to add the route lines to /etc/rc.local.

The currently way to do this is to create a file named route-{Device Name} (Ex: route-eth0)
in /etc/sysconfig/network-scripts, and add the new routes for this device to the file in this format:

GATEWAY0=10.10.0.1
NETMASK0=255.0.0.0
ADDRESS0=10.0.0.0

GATEWAY1=10.2.0.1
NETMASK1=255.255.0.0
ADDRESS1=192.168.0.0

NOTE: http://kbase.redhat.com/faq/FAQ_79_2561.shtm

Oded.

oerr "tool" for windows

Hi,
This is an old post I wrote, but I'm rewriting it because I just had a customer that needed this tool.

I've created a small oerr "tool" for use in windows. I don't have databases on windows machines, but i do use windows as a client and when I get an error in sqlplus i don't wish to ssh to a linux/unix server and run oerr there.

The "tool" is a batch file with gawk and the message files from a 10g oracle installation. The zip file contain information about how to use other oracle version messages.

You can get the file from here.

Know your regular expressions

New article from IBM - Know your regular expressions, shows how few techniques that helps in creating regular expressions.

Unistall Oracle Clusterware+ASM+ASMLib+Database 10.2.0.2

Hi,
This week I've installed Oracle RAC + ASM + ASMLib on RHEL4 (update 5), and it was exhausting!
I've done the linux administration part of the installation, but I also participated in the Oracle aspect.
Well, the first thing that I would like to talk about is the oracle Clusterware voting & CRS disks,
Oracle Clusterware needs raw access to the disks, also, specific privileges on the raw devices.
Linux raw devices are deprecated! The other way to do this job is that the application will open the devices with O_DIRECT. Oracle database supports O_DIRECT by using OCFS or ASM with ASMLib but not for the Clusterware disks.

So we will need to use raw devices if we are using RAC with Oracle Clusterware.
The problem with the raw devices is:
- It's deprecated
- Need to create the devices on every boot and change the devices permissions for oracle usage
- depends on the device name (sda, sdb...)

Why depending on the device name is a problem? Because there is no way to assure that the device sda will still be sda after reboot or after storage changes (Ex. adding a new disk).

Well, the way to do all of this and assure that the Clusterware will load and start the instances is:
- Use Udev to map the devices name to be something like /dev/vote1, /dev/ocr1
- Use Udev to change the raw device privileges on boot
- Use /etc/sysconfig/rawdevices file to create the raw devices when the server starts

One more thing is the cluvfy script in the Clusterware installation disk, the script is good for RHEL3 and partially for RHEL4, the last step of the script is to check the rpms needed by the installation, the rpm list is for RHEL3 and not for RHEL4 so you can ignore this check and start the installation.

The other thing is the uninstall of the Oracle Clusterware, the way to fully uninstall oracle is:
- Run the universal installer to uninstall the software for the database, ASM and Clusterware.
- Manually remove the files remains in the installation directories ($ORACLE_HOME, $ASM_HOME & $CRS_HOME).
- remove /etc/oracle directory.
- remove "/etc/oratab".
- remove "/etc/oraInst.loc".
- remove "/etc/crstab*".
- remove "/etc/init.d/init.*".
- edit /etc/inittab and remove the lines oracle added (usually 3 lines at the end).
- remove the ASM disks using "/etc/init.d/oracleasm deletedisk".
- For the finale dd the first 50MB of the voting disks and the crs disks (Without this the cluster will use the old configuration!!).
- Just to make sure also dd the first 50MB of the ASM disks.

After that you can start the installation again...

Oded.

Rehdat Linux kickstart file for Oracle database server

I've created a kickstart file for RHEL that will install and configure your Redhat linux server for Oracle database installation.

You can get the file from here or copy & paste this:

#############################################################################
# This Kickstart file generated by Oded Maimon - Tangram Soft Ltd.
# License: Do what ever you wish to do with this file, I don't care
#
# This Kickstart file is used to install the minimum RHEL server for use with
# Oracle database. It also removes unnedded services.
#
# The defualt root password is: password
#
# Values to change before using are:
# - Set the network - The hostname & Network configuration (DHCP/Static)
# - Partitioning & Swap size
# - Set a different timezone if not located in israel
# - If going to use rawdevices comment the "chkconfig rawdevices off" line
# - Set the shmmax kernel parameter to the correct value
# - If you are not going to install Oracle RAC, you can comment the hangcheck
# line in this file
#
# Things to do after the server is installed:
# Change the root and oracle accounts password
# Create the needed filesystem and set the owner to oracle
# Change the ORACLE_BASE, ORACLE_SID environment variables in
# ~oracle/.bash_profile to the correct values
# Set the server default run level to 3 or 4 (if using NFS/CIFS)
#############################################################################

# Uncomment the next line to enable interactive installation
#interactive

# Comment the next line to use GUI installation
text

install

# From where to get the installation disks
cdrom
#url --url http://myserver/redhat/

lang en_US.UTF-8
langsupport --default=en_US.UTF-8 en_US.UTF-8
keyboard us
xconfig --resolution 800x600 --depth 16 --defaultdesktop gnome

# Change the hostname and peek the best eth configuration for you
network --device eth0 --bootproto dhcp --hostname srvoracle01
#network --device eth0 --bootproto static --ip x.y.z.v --netmask 255.255.255.0 --gateway x.y.z.v --nameserver x.y.z.t,x.y.z.v --hostname srvoracle01

rootpw --iscrypted $1$uKWECPhN$Im66UG8MpWd2/kpcHoyuy/
firewall --disabled
selinux --disabled
authconfig --enableshadow --enablemd5

# Set a different timezone if not located in israel
timezone Asia/Jerusalem

bootloader --location=mbr --append="rhgb quiet"


# Create a Volgroup device sda
clearpart --all --drives=sda
part /boot --fstype ext3 --size=100 --ondisk=sda
part pv.3 --size=0 --grow --ondisk=sda
volgroup vg00 --pesize=32768 pv.3

# Create the filesystems and logical volumes
logvol / --fstype ext3 --name=lvol00 --vgname=vg00 --size=2048
logvol /tmp --fstype ext3 --name=lvol01 --vgname=vg00 --size=2048
logvol /usr --fstype ext3 --name=lvol02 --vgname=vg00 --size=3500
logvol /usr/local --fstype ext3 --name=lvol03 --vgname=vg00 --size=1024
logvol /var --fstype ext3 --name=lvol04 --vgname=vg00 --size=1024
logvol /var/log --fstype ext3 --name=lvol05 --vgname=vg00 --size=1024
logvol /opt --fstype ext3 --name=lvol06 --vgname=vg00 --size=1024
logvol /home --fstype ext3 --name=lvol07 --vgname=vg00 --size=512

# Edit the swap space to be twice the size of the machine RAM, if you have 8GB of RAM or more set the swap to the same size as the RAM
logvol swap --fstype swap --name=lvol08 --vgname=vg00 --size=2048


# All packages needed by Oracle installation include Gnome desktop
%packages
@ system-tools
@ gnome-desktop
@ dialup
@ compat-arch-support
-openldap-clients
-ckermit
-wireshark
-bluez-pin
-OpenIPMI-tools
-samba-client
e2fsprogs
-screen
-xdelta
-zsh
-nmap
lvm2
sysstat
-open
kernel-smp
grub
binutils
compat-db
control-center
gcc
gcc-c++
glibc
glibc-common
gnome-libs
libstdc++
libstdc++-devel
make
pdksh
sysstat
xscreensaver


# This post script modify all the Oracle database prerequisites, includes oracle user and dba,oinstall groups
%post

# create user and groups
/usr/sbin/groupadd oinstall
/usr/sbin/groupadd dba
/usr/sbin/useradd -m -g oinstall -G dba oracle

# Change kernel parameters
cat >> /etc/sysctl.conf << EOF

##############################
# Oracle Database requirements
##############################

# The max value for shmmax on a 32bit machine is 4294967295
#kernel.shmmax = 536870912

kernel.shmall = 2097152
kernel.shmmni = 4096
kernel.sem = 250 32000 100 128
fs.file-max = 658576
net.ipv4.ip_local_port_range = 1024 65000
net.core.rmem_default = 262144
net.core.wmem_default = 262144
net.core.rmem_max = 1048536
net.core.wmem_max = 1048536
EOF

# Change ulimits for user oracle
cat >> /etc/security/limits.conf << EOF
oracle soft nproc 16384
oracle hard nproc 16384
oracle soft nofile 65536
oracle hard nofile 65536
EOF


# Add hangcheck-timer module for RAC
echo "options hangcheck-timer hangcheck_tick=30 hangcheck_margin=180" >> /etc/modprobe.conf
echo "modprobe hangcheck-timer" >> /etc/rc.local


# Set oracle account environment variables
cat >> /home/oracle/.bash_profile << EOF

# Oracle environment variables
export ORACLE_BASE=/software/oracle
#export ORACLE_HOME=\$ORACLE_BASE/10g
#export TNS_ADMIN=\$ORACLE_HOME/network/admin
export ORACLE_SID=orcl1
export LD_LIBRARY_PATH=\$ORACLE_HOME/lib
export PATH=\$PATH:\$ORACLE_HOME/bin

if [ "`ls -ld \$ORACLE_HOME | awk '{print \$3" "\$4}'`" != "oracle oinstall" ]
then
echo "The ORACLE_HOME (\$ORACLE_HOME) is not owned by oracle:oinstall"
fi
EOF

#############################
# Remove unneeded services!!!
#############################

# Comment this line if you are using Oracle Clusterware
chkconfig rawdevices off

# Enable Network filesystems support for run level 4 only
chkconfig --level 12356 portmap off
chkconfig --level 12356 nfslock off
chkconfig --level 12356 rpcgssd off
chkconfig --level 12356 rpcidmapd off
chkconfig --level 12356 autofs off
chkconfig --level 4 portmap on
chkconfig --level 4 nfslock on
chkconfig --level 4 rpcgssd on
chkconfig --level 4 rpcidmapd on
chkconfig --level 4 autofs on

# Enable xfs support for run level 5 only
chkconfig --level 12346 xfs off
chkconfig --level 5 xfs on

chkconfig sendmaill off
chkconfig cups off
chkconfig hplip off
chkconfig anacron off
chkconfig apmd off
chkconfig arptables_jf off
chkconfig atd off
chkconfig bluetooth off
chkconfig canna off
chkconfig cups-config-daemon off
chkconfig gpm off
chkconfig hidd off
chkconfig hpoj off
chkconfig iiim off
chkconfig isdn off
chkconfig pcmcia off

chkconfig rhnsd off
chkconfig auth off

# RHEL 5 only services
chkconfig yum-updatesd off
chkconfig setroubleshoot off
chkconfig restorecond off
chkconfig pcscd off
chkconfig mcstrans off
chkconfig avahi-dnsconfd off
chkconfig avahi-daemon off

##########################################################
##########################################################



Enjoy.

I'm trying to get this blog alive again, with a different blog name and a different purpose.
In the blog i will talk about Linux, open source, oracle and more.

EnterpriseDB release 2

Hi,

A recent mail I recieved from EnterpriseDB:

Dear Customer,

I’m excited to tell you that EnterpriseDB 2005 Release 2 is now available for download from our website. This general availability release incorporates the most recent production version of PostgreSQL (v8.0.4) and includes several important new features. Please download the new release and give it a try. As always, we’re looking forward to your feedback.

EnterpriseDB 2005 Release 2 includes a new high-speed bulk data loading capability that’s 30% faster than current native PostgreSQL. In addition, we’ve added Oracle-style cursors to further improve our compatibility. Also, we’ve made incorporation into ISV products easier, with new installation options and an easy-to-follow methodology. Finally, we have integrated JasperReports, the leading open source reporting technology, into the platform, and a ready-to-run Jasper module and sample reports are available on the website.

Thanks again to everyone for your interest and your support. Don’t forget to drop us a line to tell us about your EnterpriseDB experience.

Sincerely,

Denis

 

Regards,

Guy

oerr "tool" for windows

Hi,
I've created a small oerr "tool" for use in windows. I don't have databases on windows machines, but i do use windows as a client and when i get an error in sqlplus i don't wish to ssh to a linux/unix server and run oerr there.

The "tool" is a batch file with gawk and the message files from a 10g oracle installation. The zip file contain information about how to use other oracle version messages.

Press here to download.

Oded.

Oracle XE, Mysql or Postgresql ?

With the Oracle XE, the purchase of InnoDB and the integration to PHP, Oracle surly wishes to kill Mysql, But we can't know when Oracle will stop Oracle XE development or change the license, because of that I think it will be better to go with postgresql than with Oracle XE (Unless you know that you are going to upgrade to oracle enterprise in the future) or mysql. From now Postgresql should be the default for a simple free database like what mysql was untill now. Postgresql has no company behind it that some other company can buy and destroy, it is an open community developed database, a very good database and now it's also got the commercial release (EnterpriseDB).

Oded.

Oracle worm

This summary is not available. Please click here to view the post.