189 8069 5689
在我们安装Oracle RAC的时候，要求操作系统的主机名都要小写，8个字符以内，不要使用下划线，不然我们在配置互信验证的时候是无法通过的，在配置EMCC的时候也可能有问题。
AIX + 11G RAC 手动配置互信
分别在grid用户和oracle用户下 执行
$ ./sshsetup/sshUserSetup.sh -user grid -hosts "test1a test1b" -advanced -noPromptPassphrase
The output of this script is also logged into /tmp/sshUserSetup_2018-03-20-22-42-12.log
Hosts are test1a test1b
user is grid
Platform:- AIX
Checking if the remote hosts are reachable
PING test1a: (20.1.1.3): 56 data bytes
64 bytes from 20.1.1.3: icmp_seq=0 ttl=255 time=0 ms
64 bytes from 20.1.1.3: icmp_seq=1 ttl=255 time=0 ms
64 bytes from 20.1.1.3: icmp_seq=2 ttl=255 time=0 ms
64 bytes from 20.1.1.3: icmp_seq=3 ttl=255 time=0 ms
64 bytes from 20.1.1.3: icmp_seq=4 ttl=255 time=0 ms
--- test1a ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0/0/0 ms
PING test1b: (20.1.1.4): 56 data bytes
64 bytes from 20.1.1.4: icmp_seq=0 ttl=255 time=0 ms
64 bytes from 20.1.1.4: icmp_seq=1 ttl=255 time=0 ms
64 bytes from 20.1.1.4: icmp_seq=2 ttl=255 time=0 ms
64 bytes from 20.1.1.4: icmp_seq=3 ttl=255 time=0 ms
64 bytes from 20.1.1.4: icmp_seq=4 ttl=255 time=0 ms
--- test1b ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0/0/0 ms
Remote host reachability check succeeded.
The following hosts are reachable: test1a test1b.
The following hosts are not reachable: .
All hosts are reachable. Proceeding further...
firsthost test1a
numhosts 2
The script will setup SSH connectivity from the host test1a to all
the remote hosts. After the script is executed, the user can use SSH to run
commands on the remote hosts or copy files between this host test1a
and the remote hosts without being prompted for passwords or confirmations.
NOTE 1:
As part of the setup procedure, this script will use ssh and scp to copy
files between the local host and the remote hosts. Since the script does not
store passwords, you may be prompted for the passwords during the execution of
the script whenever ssh or scp is invoked.
NOTE 2:
AS PER SSH REQUIREMENTS, THIS SCRIPT WILL SECURE THE USER HOME DIRECTORY
AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE
directories.
Do you want to continue and let the script make the above mentioned changes (yes/no)?
yes
The user chose yes
User chose to skip passphrase related questions.
Creating .ssh directory on local host, if not present already
Creating authorized_keys file on local host
Changing permissions on authorized_keys to 644 on local host
Creating known_hosts file on local host
Changing permissions on known_hosts to 644 on local host
Creating config file on local host
If a config file exists already at /home/grid/.ssh/config, it would be backed up to /home/grid/.ssh/config.backup.
Removing old private/public keys on local host
Running SSH keygen on local host with empty passphrase
Generating public/private rsa key pair.
Your identification has been saved in /home/grid/.ssh/id_rsa.
Your public key has been saved in /home/grid/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:EF3sifhL3fQcDNDryrwYFuLS54euDwn6K75GJewXQMY grid@test1a
The key's randomart image is:
+---[RSA 1024]----+
| oo .. ooo |
| .E .. . o |
| . . .. o . + |
| o o ... o o o |
| . o....S. + o . |
| o..+ oo.. o o |
| .... =.+= . |
| o. . =oo= |
| oooo..+=... |
+----[SHA256]-----+
Creating .ssh directory and setting permissions on remote host test1a
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR grid. THIS IS AN SSH REQUIREMENT.
The script would create /home/grid/.ssh/config file on remote host test1a. If a config file exists already at /home/grid/.ssh/config, it would be backed up to /home/grid/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host test1a.
Warning: Permanently added 'test1a,20.1.1.3' (ECDSA) to the list of known hosts.
grid@test1a's password:
Done with creating .ssh directory and setting permissions on remote host test1a.
Creating .ssh directory and setting permissions on remote host test1b
THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR group AND others ON THE HOME DIRECTORY FOR grid. THIS IS AN SSH REQUIREMENT.
The script would create /home/grid/.ssh/config file on remote host test1b. If a config file exists already at /home/grid/.ssh/config, it would be backed up to /home/grid/.ssh/config.backup.
The user may be prompted for a password here since the script would be running SSH on host test1b.
Warning: Permanently added 'test1b,20.1.1.4' (ECDSA) to the list of known hosts.
grid@test1b's password:
Done with creating .ssh directory and setting permissions on remote host test1b.
Copying local host public key to the remote host test1a
The user may be prompted for a password or passphrase here since the script would be using SCP for host test1a.
grid@test1a's password:
Done copying local host public key to the remote host test1a
Copying local host public key to the remote host test1b
The user may be prompted for a password or passphrase here since the script would be using SCP for host test1b.
grid@test1b's password:
Done copying local host public key to the remote host test1b
Creating keys on remote host test1a if they do not exist already. This is required to setup SSH on host test1a.
Creating keys on remote host test1b if they do not exist already. This is required to setup SSH on host test1b.
Generating public/private rsa key pair.
Your identification has been saved in .ssh/id_rsa.
Your public key has been saved in .ssh/id_rsa.pub.
The key fingerprint is:
SHA256:hcmrstSGW5DnyeR2jCZHXpIhZXO5yL9oUMYuhji+auw grid@test1b
The key's randomart image is:
+---[RSA 1024]----+
| + .. |
| o +.o |
| .o..+.. |
| o*o.o |
| . .o+*.S |
|o . +%.B. |
|o. .=o/.o. |
| + . @o.. |
|=E. o. |
+----[SHA256]-----+
Updating authorized_keys file on remote host test1a
Updating known_hosts file on remote host test1a
Updating authorized_keys file on remote host test1b
Updating known_hosts file on remote host test1b
cat: 0652-050 Cannot open /home/grid/.ssh/known_hosts.tmp.
cat: 0652-050 Cannot open /home/grid/.ssh/authorized_keys.tmp.
SSH setup is complete.
------------------------------------------------------------------------
Verifying SSH setup
===================
The script will now run the date command on the remote nodes using ssh
to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP,
THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR
PASSWORDS. If you see any output other than date or are prompted for the
password, ssh is not setup correctly and you will need to resolve the
issue and set up ssh again.
The possible causes for failure could be:
1. The server settings in /etc/ssh/sshd_config file do not allow ssh
for user grid.
2. The server may have disabled public key based authentication.
3. The client public key on the server may be outdated.
4. /home/grid or /home/grid/.ssh on the remote host may not be owned by grid.
5. User may not have passed -shared option for shared remote users or
may be passing the -shared option for non-shared remote users.
6. If there is output in addition to the date, but no password is asked,
it may be a security alert shown as part of company policy. Append the
additional text to the /sysman/prov/resources/ignoreMessages.txt file.
------------------------------------------------------------------------
--test1a:--
Running /usr/bin/ssh -x -l grid test1a date to verify SSH connectivity has been setup from local host to test1a.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Tue Mar 20 22:42:37 CST 2018
------------------------------------------------------------------------
--test1b:--
Running /usr/bin/ssh -x -l grid test1b date to verify SSH connectivity has been setup from local host to test1b.
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR.
Tue Mar 20 08:41:35 CST 2018
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from test1a to test1a
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Tue Mar 20 22:42:38 CST 2018
------------------------------------------------------------------------
------------------------------------------------------------------------
Verifying SSH connectivity has been setup from test1a to test1b
IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL.
Tue Mar 20 08:41:37 CST 2018
------------------------------------------------------------------------
-Verification from complete-
SSH verification complete.
$ hostanme
ksh: hostanme: not found.
$ hostname
test1a
$ ssh test1b
Last unsuccessful login: Tue Mar 20 08:36:55 CST 2018 on ssh from 20.1.1.3
Last login: Tue Mar 20 08:41:37 CST 2018 on ssh from 20.1.1.3
*******************************************************************************
* *
* *
* Welcome to AIX Version 7.1! *
* *
* *
* Please see the README file in /usr/lpp/bos for information pertinent to *
* this release of the AIX Operating System. *
* *
* *
*******************************************************************************
$ ssh test1a
Last unsuccessful login: Tue Mar 20 22:37:46 CST 2018 on ssh from 20.1.1.3
Last login: Tue Mar 20 22:42:38 CST 2018 on ssh from 20.1.1.3
*******************************************************************************
* *
* *
* Welcome to AIX Version 7.1! *
* *
* *
* Please see the README file in /usr/lpp/bos for information pertinent to *
* this release of the AIX Operating System. *
* *
* *
*******************************************************************************
$
输入一次yes,四次密码
验证方法
date;ssh 远端主机名 date 另外有需要云服务器可以了解下创新互联cdcxhl.cn，海内外云服务器15元起步，三天无理由+7*72小时售后在线，公司持有idc许可证，提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案，具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势，专为企业上云打造定制，能够满足用户丰富、多元化的应用场景需求。