OraclePitStop – Lets share some knowledge

CVE-2015-0235 – Ghost Vulnerability

oraclepitstop — Fri, 20 Feb 2015 03:36:53 +0000

Post applies to Exadata, Exalogic and Exalytics.

Here is a check script to check if a system is vulnerable to GHOST security vulnerability.

######### testghost.sh #########

/usr/sbin/clockdiff `python -c “print ‘0’ * $((0x10000 – 16 * 1 – 2 * 4 – 1 – 4))” `
echo $?

php -r ‘$e = “0”;for($i = 0; $i < 2500; $i++){ $e = “0$e”; } gethostbyname($e);’
echo $?

###############################

Note: If the first set gives “Segmentation fault” and second returns “139”, then

the vulnerability is present in glibc.

###########################################

[root@server-name ~]# sh testghost.sh
clockdiff: ebs-template: my host not found
1
testghost.sh: line 4: 17976 Segmentation fault php -r ‘$e = “0”;for($i = 0; $i < 2500; $i++){ $e = “0$e”; } gethostbyname($e);’
139
[root@ebs-template ~]#
###########################################

MOS documents to address the vulnerability

Exalogic : CVE-2015-0235 – Ghost Vulnerability – Patch Availability for Oracle Exalogic Linux Physical and Virtual Racks (Doc ID 1965975.1)

Exalytics : CVE-2015-0235 AKA “Ghost” vulnerability in glibc – Patch Availability Document for Oracle Exalytics Linux Physical and Virtual systems (Doc ID 1966284.1)

Exadata : glibc vulnerability (CVE-2015-0235) patch availability for Oracle Exadata Database Machine (Doc ID 1965525.1)

Process exiting status in Oracle Application R12

oraclepitstop — Mon, 11 May 2009 21:17:14 +0000

Issue:
======
a) Unable to launch the application or Home page hangs in Oracle Application Release R12
b) If you check the services on the web/Admin node, you can see process
ps -ef | grep -i exiting

– 647302 – – – exiting
– 708754 – – – exiting
– 925856 – – – exiting
– 983252 – – – exiting
– 1044536 – – – exiting
– 1134628 – – – exiting
– 1138768 – – – exiting

You can’t kill these process also
Only workaround is rebooting the box and start the services and it works fine.

This Issue will occur again after 2 weeks or less.

Application log error shows like below…….

java.io.IOException: Broken pipe
at sun.nio.ch.FileDispatcher.write0(Native Method)
at sun.nio.ch.SocketDispatcher.write(SocketDispatcher.java:47)
at sun.nio.ch.IOUtil.writeFromNativeBuffer(IOUtil.java:132)
at sun.nio.ch.IOUtil.write(IOUtil.java:103)
at sun.nio.ch.SocketChannelImpl.write(SocketChannelImpl.java:329)
at java.nio.channels.Channels.write(Channels.java:74)
at java.nio.channels.Channels.access$000(Channels.java:61)
at java.nio.channels.Channels$1.write(Channels.java:148)
at com.evermind.server.http.AJPOutputStream.endRequest(AJPOutputStream.java:117)
at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:306)
at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:187)
at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:303)
at java.lang.Thread.run(Thread.java:797)

Cause:
=======
pid directories are placed on shared mount point.

Solution:
=========
a) Make sure all your pid variables are pointing to local disk in Context File…

s_lock_pid_dir
s_pids_dir
s_web_pid_file

b) Change in all the nodes and run Autoconfig.

Note:
It is always better to keep the $INST_TOP on local disk to avoid performance Issues.

Oracle R12 Reports are failing with Rep 3000 error on IBM AIX

oraclepitstop — Tue, 24 Mar 2009 20:24:14 +0000

Issue :
In R12 on IBM AIX Reports are failing with Rep 3000 error

Description:
We all know that there is no concept of Display for generating reports in R12, there is…..:) but only on IBM AIX.
We need to set the display in IBM AIX for R12 to generate the reports output without error.

Solution ;

a) Go to CM(Admin) Node
b) Login in as Application User
c) Find the display from CONTEXT_FILE

Ex :
-bash-3.2$ grep -i display $CONTEXT_FILE
oratestdev:0.0

Here the display is 0.0

d) export DISPLAY=localhost:0.0
e) /usr/lpp/X11/bin/xinit /usr/lpp/X11/bin/mwm — :0 -vfb -force -x abx -x dbe -x GLX &
f) xhost +
g) Login as root
h) export DISPLAY=localhost:0.0
i) xhost +

Thanks,
Sam.

Oracle 11i forms crash in IE

oraclepitstop — Tue, 24 Mar 2009 19:41:12 +0000

Issue :
Unable to open forms due to IE Error in 11i or Forms crashes with IE Error or Jinitiator Issue
This is due to jvm incompatibility used by other Application or tools.

Solution :
a) Go to program files java ==> jre1.6.0_07 (Or recent jre you can download from java.sun.com)
Path : C:\Program Files\Java\jre1.6.0_07\bin\client
b) Copy the jvm.dll file
c) Go to C:\Program Files\Oracle\JInitiator 1.3.1.21\bin\hotspot
d) Take the backup of current jvm.dll file
e) Copy the jvm.dll file which you have copied from the above jre directory.
f) Close all the browsers and restart
g) You can access the forms now

Thanks,
Sam.

Is user equivelance really required at the OS level after RAC installation?

oraclepitstop — Thu, 18 Dec 2008 22:58:23 +0000

A wild though came to my head late this evening about the user equivelance in RAC. What will happen if i remove the user equivelance for the oracle home owner between the RAC nodes. What do you think – will this mess up the normal operation of the database ???

BTW, User Equivelance = Ability to ssh between rac nodes without password.

Assumptions

RAC Servers: RAC_NODE_1, RAC_NODE_2
DB Name : opitstop
DB Owner : orapstop

orapstop@RAC_NODE_1

1. srvctl stop database -d OPITSTOP
2. cd $HOME/.ssh && mv authorized_keys authorized_keys_old [ authorized_keys file holds the rsa/dsa keys, which enables ssh to other boxes without password]

At this stage, opitstop DB is down and RAC_NODE_2 cannot ssh to RAC_NODE_1 since RAC_NODE_1 authorized_keys file had been moved.

orapstop@RAC_NODE_2

cd $HOME/.ssh && mv authorized_keys authorized_keys_old

Now both the nodes cannot do ssh between them without password.

orapstop@RAC_NODE_1

Lets start the database, using srvctl to see if it errors out

srvctl start database -d OPITSTOP

NOPE, it doesnt … it works as before, started the instances on both RAC_NODE_1 and RAC_NODE_2.

At this stage in the alert log file, the database was able to get information about the other node and a select on gv$instance shows both instances too. I let the db to run for sometime … still there was no error.

Now lets revert back the user equivelance on both nodes.

orapstop@RAC_NODE_1: cd $HOME/.ssh && mv authorized_keys_old authorized_keys
orapstop@RAC_NODE_2: cd $HOME/.ssh && mv authorized_keys_old authorized_keys

So based on this excercise my conclusion is, user equivelance is required only for RAC installation’s / RAC binary upgrades viz., 10.2.0.1 to 10.2.0.3 or 4 / patching using opatch option napply and not for normal operations of the database.

Oh yeah, its a good feeling to mess up with the setup and to get it back working.

Happy Messing !!!

cheers,
OraclePitStop

Single Putty Window – Multiple Tabs – for multiple server connections

oraclepitstop — Thu, 18 Dec 2008 19:37:51 +0000

Is it possible to have a tabbed putty like firefox or internet explorer? Yes you can, check out below URL

Turbocharge PuTTY with 12 Powerful Add-Ons – Software for Geeks #3

Look for Putty connection Manager.

cheers,
OraclePitStop.

How to migrate PUTTY settings from one windows desktop/laptop to the other?

oraclepitstop — Thu, 18 Dec 2008 19:33:34 +0000

Migrating putty settings from one desktop/laptop to the other box comes in handy when you had already customized your putty with saved sessions. The migration will also help a new member of an exisitng DBA support team.

Here are the steps

Start -> Run (or Windows Button + R)
Type in ‘regedit’ and press enter – this command will open the registry editor window
Go to HKEY_CURRENT_USER -> Software -> SimonTatham
Right Click on SimonTatham and select Export
Provide a file name and save the file.

Copy and execute the exported file on the new box – voila .. you are all set with the putty on the new box.

Note: this will only bring the putty configurations and NOT the putty executable itself.

cheers,
OraclePitStop

Oracle Apps R12 : How to find the list of responsibilities assigned to user(s)

oraclepitstop — Wed, 17 Dec 2008 22:43:34 +0000

SELECT FURGA.USER_ID
, FU.USER_NAME
, FURGA.RESPONSIBILITY_ID
, FRTL.RESPONSIBILITY_NAME
, FURGA.RESPONSIBILITY_APPLICATION_ID
, FA.APPLICATION_SHORT_NAME
, FURGA.SECURITY_GROUP_ID
, FSG.SECURITY_GROUP_KEY
, FURGA.START_DATE
, FURGA.END_DATE
, FURGA.CREATED_BY
, FUCB.USER_NAME
, FURGA.CREATION_DATE
, FURGA.LAST_UPDATED_BY
, FULUB.USER_NAME
, FURGA.LAST_UPDATE_DATE
, FURGA.LAST_UPDATE_LOGIN
, FULUL.USER_NAME
FROM
FND_USER_RESP_GROUPS_ALL FURGA,
FND_USER FU,
FND_USER FUCB,
FND_USER FULUB,
FND_USER FULUL,
FND_APPLICATION FA,
FND_RESPONSIBILITY_TL FRTL,
FND_SECURITY_GROUPS FSG
WHERE
FURGA.USER_ID = FU.USER_ID (+)
AND FURGA.CREATED_BY = FUCB.USER_ID (+)
AND FURGA.LAST_UPDATED_BY = FULUB.USER_ID (+)
AND FURGA.LAST_UPDATE_LOGIN = FULUL.USER_ID (+)
AND FURGA.RESPONSIBILITY_APPLICATION_ID = FA.APPLICATION_ID (+)
AND FURGA.RESPONSIBILITY_ID = FRTL.RESPONSIBILITY_ID (+)
AND FRTL.LANGUAGE = ‘US’
AND FURGA.SECURITY_GROUP_ID = FSG.SECURITY_GROUP_ID (+)
ORDER BY START_DATE;

— ADD CONDITION ON START_DATE FOR RESPONSIBILITIES ADDED AFTER A SPECIFIC DATE LIKE “WHERE FURGA.START_DATE > TO_DATE(’22-JUL-2008′)”

cheers,
OraclePitStop

dbca – Creating RAC Database using dbca in silent mode

oraclepitstop — Tue, 16 Dec 2008 20:33:36 +0000

During the course of the DBA life, we all know how irritating it is to create a DB or to install a Oracle Software on a UNIX Flavour box from a remote machine using a X – Server. Each click would take minutes to react (My favourite is the tab button on the keyboard) but still at-times we have to make use of the mouse. Anyways, recently we installed 10203 on a HP server which already has cluster setup. Everything went good in terms of 10201 installation, 10203 upgrade (both binaries) and even dbca 14 screens. But nothing happened when clicked on the finish button in dbca (14th screen). No useful information in the log files. I pressed cancel and re-launched it again and did the dbca exercise all the way till the end, still no luck. By this time my patience level was minus 25. It is at this stage i thought how about creating the database in silent mode and you know what, creating the DB in silent mode is 200 times faster than the GUI and the db creation completed in less than 5 minutes.

Syntax to create a General Purpose RAC Database on a Cluster File System.

dbca -silent -createDatabase -templateName General_Purpose.dbc -gdbName opitstop -sid opitstop -sysPassword opitstop123 -systemPassword opitstop123 -emConfiguration NONE -datafileDestination /opt/oracle/oradata/opitstop -storageType CFS -nodelist RAC_NODE_1,RAC_NODE_2 -characterSet WE8IS08859P15 -listeners opitstop -memoryPercentage 30 -continueOnNonFatalErrors true

Place above command in a .sh file (shell script) say createRACDB.sh and just run it. Before running the script make sure the cluster services (crs) are running and also you have user equivelance between the rac nodes for the oracle owner ie., eg. if the oracle owner username is oraracdb in RAC_NODE_1 and RAC_NODE_2 then when you do a ssh from RAC_NODE_1 to RAC_NODE_2 it should go without asking for the password.

There are more options available with dbca. Some of them are -createDatabase, -createTemplateFromDB, -createCloneTemplate, -generateScripts, -deleteDatabase, -configureASM, -deleteInstance. For a complete list of the usage execute dbca -help.

DBCA Log Location: $ORACLE_HOME/cfgtoollogs/dbca/[SID]

Happy DB creation(s) !!!

cheers,
OraclePitStop.

Interesting enhancements in 12.0.6 – R12.ATG_PF.A.DELTA.6

oraclepitstop — Tue, 02 Dec 2008 16:03:45 +0000

Oracle Applications Technology Stack Release Update Pack 6 (R12.ATG_PF.A.DELTA.6)

Autoconfig has two new options

1. Parallel Mode
2. Profile Mode

Parallel Mode

This mode enables autoconfig to be executed parallel across all mid-tiers. Oh man, i love this feature … it really helps when you have multiple mid-tiers.

Just add -parallel to your normal adconfig command

Profile Mode

This option provides a drill down HTML report of the autoconfig run.

Just add -profile to your normal adconfig command

For more information on above options refer to Metalink Note 742110.1

cheers,
OraclePitStop