Configuring ssh key gen between database servers ( Linux / Aix, Oracle Method)

User Equivalence (Key-Based Authentication) Configuration on Linux/AIX

Basic Checks:

Turn on the SSH service and make sure it starts automatically on reboot.

# service sshd start
# chkconfig sshd onThe SSH service is configured using the "/etc/ssh/sshd_config" file. Configuration changes have to be followed by a restart of the service.

# service sshd restart
# # or
# service sshd reloadFirewall
The server must have the TCP port 22 open. This can be achieved by adding the following entry to the type of firewall script described here.

# Open port for NTP server.
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Step:1  : Check communication between all servers.

e.g., log in to 160.100.1.1 and do a ping. It should be succeded.

Step:2  : Add host names into /etc/hosts file of all required servers.

e.g. Server-1 IP : 160.100.1.2
Server-1 IP : 160.100.1.3

After entry:

$ cat /etc/hosts  (on 160.100.1.1)

160.100.2  prod-db2
160.100.1  prod-db3

$ cat /etc/hosts  (on 160.100.1.2)

160.100.1  prod-db3
160.100.2  prod-db2


Step: 3 : Find path of "sshUserSetup.sh" to generate ssh keys.

I found above file in 160.100.1.2.

/u01/SOFTWARE/database/sshsetup

Step: 4 : run sshUserSetup.sh

e.g.,
$ ./sshUserSetup.sh -user oracle -hosts "prod-db3 prod-db2" -advanced -noPromptPassphrase

If we pass in the basic parameters it will configure user equivalence for us.

Output:
$ ./sshUserSetup.sh -user oracle -hosts "prod-db3 prod-db2" -advanced -noPromptPassphrase
The output of this script is also logged into /tmp/sshUserSetup_2014-12-09-18-17-42.log
Hosts are prod-db3 prod-db2
user is oracle
Platform:- Linux 
Checking if the remote hosts are reachable
PING prod-db3 (160.100.1.1) 56(84) bytes of data.
64 bytes from prod-db3 (160.100.1.1): icmp_seq=1 ttl=64 time=0.032 ms
64 bytes from prod-db3 (160.100.1.1): icmp_seq=2 ttl=64 time=0.043 ms
64 bytes from prod-db3 (160.100.1.1): icmp_seq=3 ttl=64 time=0.033 ms
64 bytes from prod-db3 (160.100.1.1): icmp_seq=4 ttl=64 time=0.037 ms
64 bytes from prod-db3 (160.100.1.1): icmp_seq=5 ttl=64 time=0.041 ms

--- prod-db3 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4000ms
rtt min/avg/max/mdev = 0.032/0.037/0.043/0.005 ms
PING prod-db2 (160.100.1.2) 56(84) bytes of data.
64 bytes from prod-db2 (160.100.1.2): icmp_seq=1 ttl=64 time=0.336 ms
64 bytes from prod-db2 (160.100.1.2): icmp_seq=2 ttl=64 time=0.467 ms
64 bytes from prod-db2 (160.100.1.2): icmp_seq=3 ttl=64 time=0.296 ms
64 bytes from prod-db2 (160.100.1.2): icmp_seq=4 ttl=64 time=1.16 ms
64 bytes from prod-db2 (160.100.1.2): icmp_seq=5 ttl=64 time=0.600 ms

--- prod-db2 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4003ms
rtt min/avg/max/mdev = 0.296/0.573/1.169/0.317 ms
Remote host reachability check succeeded.
The following hosts are reachable: prod-db3 prod-db2.
The following hosts are not reachable: .
All hosts are reachable. Proceeding further...
firsthost prod-db3
numhosts 2
The script will setup SSH connectivity from the host prod-db3 to all
the remote hosts. After the script is executed, the user can use SSH to run
commands on the remote hosts or copy files between this host prod-db3
and the remote hosts without being prompted for passwords or confirmations.

NOTE 1:
As part of the setup procedure, this script will use ssh and scp to copy files between the local host and the remote hosts. Since the script does not store passwords, you may be prompted for the passwords during the execution of the script whenever ssh or scp is invoked.

NOTE 2:
AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY
AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE directories.

Do you want to continue and let the script make the above mentioned changes (yes/no)?
yes

The user chose yes
User chose to skip passphrase related questions.
Creating .ssh directory on local host, if not present already
Creating authorized_keys file on local host
Changing permissions on authorized_keys to 644 on local host
Creating known_hosts file on local host
Changing permissions on known_hosts to 644 on local host
Creating config file on local host
If a config file exists already at /home/oracle/.ssh/config, it would be backed up to /home/oracle/.ssh/config.backup.
Creating .ssh directory and setting permissions on remote host prod-db3
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host prod-db3. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host prod-db3.
Warning: Permanently added 'prod-db3,160.100.1.1' (RSA) to the list of known hosts.
oracle@prod-db3's password: 
Done with creating .ssh directory and setting permissions on remote host prod-db3.
Creating .ssh directory and setting permissions on remote host prod-db2
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR oracle. THIS IS AN SSH REQUIREMENT.
The script would create ~oracle/.ssh/config file on remote host prod-db2. If a config file exists already at ~oracle/.ssh/config, it would be backed up to ~oracle/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host prod-db2.
Warning: Permanently added 'prod-db2,160.100.1.2' (RSA) to the list of known hosts.
oracle@prod-db2's password: 
Done with creating .ssh directory and setting permissions on remote host prod-db2.
Copying local host public key to the remote host prod-db3
The user may be prompted for a password or passphrase here since the script would be using SCP for host prod-db3.
oracle@prod-db3's password: 
Done copying local host public key to the remote host prod-db3
Copying local host public key to the remote host prod-db2
The user may be prompted for a password or passphrase here since the script would be using SCP for host prod-db2.
oracle@prod-db2's password: 
Done copying local host public key to the remote host prod-db2
Creating keys on remote host prod-db3 if they do not exist already. This is required to setup SSH on host prod-db3.

Creating keys on remote host prod-db2 if they do not exist already. This is required to setup SSH on host prod-db2.

Updating authorized_keys file on remote host prod-db3
Updating known_hosts file on remote host prod-db3
Updating authorized_keys file on remote host prod-db2
Updating known_hosts file on remote host prod-db2
cat: /home/oracle/.ssh/known_hosts.tmp: No such file or directory
cat: /home/oracle/.ssh/authorized_keys.tmp: No such file or directory
SSH setup is complete.

------------------------------------------------------------------------
Verifying SSH setup
===================
The script will now run the date command on the remote nodes using ssh
to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP,
THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR
PASSWORDS. If you see any output other than date or are prompted for the
password, ssh is not setup correctly and you will need to resolve the
issue and set up ssh again.
The possible causes for failure could be:
1. The server settings in /etc/ssh/sshd_config file do not allow ssh
for user oracle.
2. The server may have disabled public key based authentication.
3. The client public key on the server may be outdated.
4. ~oracle or ~oracle/.ssh on the remote host may not be owned by oracle.
5. User may not have passed -shared option for shared remote users or
may be passing the -shared option for non-shared remote users.
6. If there is output in addition to the date, but no password is asked,
it may be a security alert shown as part of company policy. Append the
additional text to the <OMS HOME>/sysman/prov/resources/ignoreMessages.txt file.
------------------------------------------------------------------------
--prod-db3:--
Running /usr/bin/ssh -x -l oracle prod-db3 date to verify SSH connectivity has been setup from local host to prod-db3.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Tue Dec  9 18:18:10 IST 2014
------------------------------------------------------------------------
--prod-db2:--
Running /usr/bin/ssh -x -l oracle prod-db2 date to verify SSH connectivity has been setup from local host to prod-db2.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Tue Dec  9 18:19:59 IST 2014
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from prod-db3 to prod-db3
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
bash: -c: line 0: unexpected EOF while looking for matching `"'
bash: -c: line 1: syntax error: unexpected end of file
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from prod-db3 to prod-db2
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
bash: -c: line 0: unexpected EOF while looking for matching `"'
bash: -c: line 1: syntax error: unexpected end of file
------------------------------------------------------------------------


You should now be able to SSH and SCP between servers without entering passwords.

Note:

Remember to restart or reload the service after making any changes.

# service sshd reload