API tools faq
paste
Advertisement
Guest User

EM12c R4 SSL Security Checkup Script v1.6

a guest
Jul 20th, 2015
246
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 28.87 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM12c R4 environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It also contains a patch
  6. # check currently comparing against the latest recommended patches
  7. # and flags the use of self-signed certificates.  Further checks include
  8. # EM12c Java JDK version.
  9. #
  10. # Added in v1.0:  Repository database patch check
  11. # Added in v1.1:  EM12c Java JDK version check
  12. # Change in v1.2: Removed patch 19948000 recommendation for OHS.
  13. # Change in v1.3: Update for 30 Apr 2015 patches, add EM-OH plugin home
  14. #                 restored GDFA/16420963 for WLS
  15. #                 added 20114054 for Agent - only applicable for Linux x86-64
  16. # Change in v1.4: Add datestamp/hostname to output header
  17. #         Update for 31 May 2015 patches, add EM-DB-DISC plugin home
  18. # Change in v1.5: Add repo DB check for SSL_VERSION and SSL_CIPHER_SUITES
  19. #                 Add VERBOSE_CHECKSEC variable:
  20. #                   Set to 0 for quiet run.
  21. #                   Set to 1 to see failed check summary after run.
  22. #                   Set to 2 for failed check summary and patch details.
  23. # Change in v1.6: Add PSU4 for EM12cR4, complete VERBOSE_CHECKSEC work
  24. #                 Add 14 July 2015 patches
  25. #
  26. # From: @BrianPardy on Twitter
  27. #
  28. # Known functional on Linux x86-64, Solaris, AIX.
  29. #
  30. # Run this script as the Oracle EM12c software owner, with your environment
  31. # fully up and running.
  32. #
  33. # Thanks to Dave Corsar, who tested on Solaris and let me know the
  34. # changes needed to make an earlier version work on Solaris.
  35. #
  36. # Thanks to opa tropa who confirmed AIX functionality and noted the
  37. # use of GNU extensions to grep, which I have since removed.
  38. #
  39. # Dedicated to our two Lhasa Apsos, Lucy (6/13/1998 - 3/13/2015) and Ethel.
  40. #
  41.  
  42. SCRIPTNAME=`basename $0`
  43. PATCHDATE="14 Jul 2015"
  44. OMSHOST=`hostname -f`
  45. VERSION="1.6"
  46. FAIL_COUNT=0
  47. FAIL_TESTS=""
  48.  
  49. RUN_DB_CHECK=0
  50. VERBOSE_CHECKSEC=2
  51.  
  52. HOST_OS=`uname -s`
  53. HOST_ARCH=`uname -m`
  54.  
  55. ORAGCHOMELIST="/etc/oragchomelist"
  56. ORATAB="/etc/oratab"
  57.  
  58. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  59.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  60. fi
  61.  
  62. if [[ ! -r $ORATAB ]]; then                 # Solaris
  63.     ORATAB="/var/opt/oracle/oratab"
  64. fi
  65.  
  66. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  67.     GREP=/usr/sfw/bin/gegrep
  68. else
  69.     GREP=`which grep`
  70. fi
  71.  
  72. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  73.  
  74. OPATCH="$OMS_HOME/OPatch/opatch"
  75. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  76. OMSORAINST="$OMS_HOME/oraInst.loc"
  77. ORAINVENTORY=`head -n 1 $OMSORAINST | awk -F= '{print $2}'`
  78.  
  79. MW_HOME=`dirname $OMS_HOME`
  80. BIP_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"Oracle_BI" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  81. COMMON_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"common" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  82. WEBTIER_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"webtier" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  83. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent12c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  84. AGENT_DB_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.db.agent.plugin_12.1.0.7.0"
  85. AGENT_DB_PLUGIN_DISC_HOME="$AGENT_HOME/../../plugins/oracle.sysman.db.discovery.plugin_12.1.0.7.0"
  86. AGENT_FMW_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.agent.plugin_12.1.0.7.0"
  87. AGENT_FMW_PLUGIN_DISC_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.discovery.plugin_12.1.0.7.0"
  88. AGENT_BEACON_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.beacon.agent.plugin_12.1.0.4.0"
  89. AGENT_OH_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.oh.agent.plugin_12.1.0.4.0"
  90.  
  91. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  92. WL_HOME=`$GREP wlserver $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/samples.*$//' | sed -e 's/"//' | uniq`
  93.  
  94. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  95. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  96. OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  97. OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  98.  
  99. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  100. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  101. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  102. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  103. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  104. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  105. PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  106. PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  107. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  108.  
  109. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  110. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  111. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  112.  
  113. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  114.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  115.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  116.  
  117.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  118.         RUN_DB_CHECK=1
  119.     fi
  120.  
  121.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  122.         RUN_DB_CHECK=1
  123.     fi
  124.  
  125.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  126.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported by this script for now"
  127.     fi
  128. fi
  129.  
  130.  
  131. sslcheck () {
  132.     OPENSSL_CHECK_COMPONENT=$1
  133.     OPENSSL_CHECK_HOST=$2
  134.     OPENSSL_CHECK_PORT=$3
  135.     OPENSSL_CHECK_PROTO=$4
  136.  
  137.     OPENSSL_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  138.    
  139.    
  140.  
  141.     if [[ $OPENSSL_CHECK_PROTO == "tls1" ]]; then
  142.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO available for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  143.         if [[ $OPENSSL_RETURN -eq "0" ]]; then
  144.             echo OK
  145.         else
  146.             echo FAILED
  147.             FAIL_COUNT=$((FAIL_COUNT+1))
  148.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection failed"
  149.         fi
  150.     fi
  151.  
  152.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  153.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO disabled for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  154.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  155.             echo OK
  156.         else
  157.             echo FAILED
  158.             FAIL_COUNT=$((FAIL_COUNT+1))
  159.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection succeeded"
  160.         fi
  161.     fi
  162. }
  163.  
  164. opatchcheck () {
  165.     OPATCH_CHECK_COMPONENT=$1
  166.     OPATCH_CHECK_OH=$2
  167.     OPATCH_CHECK_PATCH=$3
  168.  
  169.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  170.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  171.     else
  172.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  173.     fi
  174.  
  175.     if [[ -z "$OPATCH_RET" ]]; then
  176.         echo FAILED
  177.         FAIL_COUNT=$((FAIL_COUNT+1))
  178.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCH_CHECK_COMPONENT @ ${OPATCH_CHECK_OH}:Patch $OPATCH_CHECK_PATCH not found"
  179.     else
  180.         echo OK
  181.     fi
  182.  
  183.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCH_RET
  184.  
  185. }
  186.  
  187. opatchautocheck () {
  188.     OPATCHAUTO_CHECK_COMPONENT=$1
  189.     OPATCHAUTO_CHECK_OH=$2
  190.     OPATCHAUTO_CHECK_PATCH=$3
  191.  
  192.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  193.  
  194.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  195.         echo FAILED
  196.         FAIL_COUNT=$((FAIL_COUNT+1))
  197.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCHAUTO_CHECK_COMPONENT @ ${OPATCHAUTO_CHECK_OH}:Patch $OPATCHAUTO_CHECK_PATCH not found"
  198.     else
  199.         echo OK
  200.     fi
  201.  
  202.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCHAUTO_RET
  203.  
  204. }
  205.  
  206. certcheck () {
  207.     CERTCHECK_CHECK_COMPONENT=$1
  208.     CERTCHECK_CHECK_HOST=$2
  209.     CERTCHECK_CHECK_PORT=$3
  210.  
  211.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT)... "
  212.  
  213.     OPENSSL_SELFSIGNED_COUNT=`echo Q | openssl s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT 2>&1 | $GREP -ci "self signed certificate"`
  214.  
  215.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  216.         echo OK
  217.     else
  218.         echo FAILED - Found self-signed certificate
  219.         FAIL_COUNT=$((FAIL_COUNT+1))
  220.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$CERTCHECK_CHECK_COMPONENT @ ${CERTCHECK_CHECK_HOST}:${CERTCHECK_CHECK_PORT} found self-signed certificate"
  221.     fi
  222. }
  223.  
  224.  
  225. ciphercheck () {
  226.     OPENSSL_CHECK_COMPONENT=$1
  227.     OPENSSL_CHECK_HOST=$2
  228.     OPENSSL_CHECK_PORT=$3
  229.  
  230.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  231.  
  232.     OPENSSL_LOW_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  233.  
  234.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  235.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  236.         FAIL_COUNT=$((FAIL_COUNT+1))
  237.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits LOW strength ciphers"
  238.     else
  239.         echo -e "\tOK"
  240.     fi
  241.  
  242.  
  243.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  244.  
  245.     OPENSSL_MEDIUM_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  246.  
  247.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  248.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  249.         FAIL_COUNT=$((FAIL_COUNT+1))
  250.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits MEDIUM strength ciphers"
  251.     else
  252.         echo -e "\tOK"
  253.     fi
  254.  
  255.  
  256.  
  257.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  258.  
  259.     OPENSSL_HIGH_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  260.  
  261.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  262.         echo -e "\tOK"
  263.     else
  264.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  265.         FAIL_COUNT=$((FAIL_COUNT+1))
  266.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Rejects HIGH strength ciphers"
  267.     fi
  268.     echo
  269. }
  270.  
  271. wlspatchcheck () {
  272.     WLSDIR=$1
  273.     WLSPATCH=$2
  274.  
  275.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $WLSPATCH`
  276.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  277.  
  278.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  279.         echo -e "\tOK"
  280.     else
  281.         echo -e "\tFAILED - PATCH NOT FOUND"
  282.         FAIL_COUNT=$((FAIL_COUNT+1))
  283.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WLSDIR:Patch $WLSPATCH not found"
  284.     fi
  285.  
  286.     test $VERBOSE_CHECKSEC -ge 2 && echo $WLSCHECK_RETURN
  287.    
  288. }
  289.  
  290. javacheck () {
  291.     WHICH_JAVA=$1
  292.     JAVA_DIR=$2
  293.  
  294.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  295.  
  296.     if [[ "$JAVACHECK_RETURN" == "1.6.0_95" ]]; then
  297.         echo -e "\tOK"
  298.     else
  299.         #echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  300.         echo -e "\tFAILED"
  301.         FAIL_COUNT=$((FAIL_COUNT+1))
  302.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_JAVA Java in ${JAVA_DIR}:Found incorrect version $JAVACHECK_RETURN"
  303.     fi
  304.     test $VERBOSE_CHECKSEC -ge 2 && echo $JAVACHECK_RETURN
  305. }
  306.  
  307. paramcheck () {
  308.     WHICH_PARAM=$1
  309.     WHICH_ORACLE_HOME=$2
  310.     WHICH_FILE=$3
  311.  
  312.     PARAMCHECK_RETURN=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | awk -F= '{print $2}' | sed -e 's/\s//g'`
  313.     if [[ "$WHICH_PARAM" == "SSL_VERSION" ]]; then
  314.         if [[ "$PARAMCHECK_RETURN" == "1.0" ]]; then
  315.             echo -e "OK"
  316.         else
  317.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  318.             FAIL_COUNT=$((FAIL_COUNT+1))
  319.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  320.         fi
  321.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  322.     fi
  323.  
  324.     if [[ "$WHICH_PARAM" == "SSL_CIPHER_SUITES" ]]; then
  325.         if [[ "$PARAMCHECK_RETURN" == "(SSL_RSA_WITH_AES128_CBC_SHA,SSL_RSA_WITH_AES256_CBC_SHA)" ]]; then
  326.             echo -e "OK"
  327.         else
  328.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  329.             FAIL_COUNT=$((FAIL_COUNT+1))
  330.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  331.         fi
  332.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  333.     fi
  334. }
  335.  
  336.  
  337. ### MAIN SCRIPT HERE
  338.  
  339.  
  340. echo -e "Performing EM12cR4 security checkup version $VERSION on $OMSHOST at `date`.\n"
  341.  
  342. echo "Using port definitions from configuration files "
  343. echo -e "\t/etc/oragchomelist"
  344. echo -e "\t$EMGC_PROPS"
  345. echo -e "\t$EMBIP_PROPS"
  346. echo -e "\t$OPMN_PROPS"
  347. echo -e "\t$OHS_ADMIN_CONF"
  348. echo
  349. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  350. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  351. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  352. echo -e "\tOHSadmin port found at $OMSHOST:$PORT_OHS_ADMIN"
  353. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  354. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  355. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  356. echo -e "\tOPMN port found at $OMSHOST:$PORT_OPMN"
  357. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  358. echo
  359. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  360.  
  361. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  362.     echo -e "\tRepository DB on OMS server, will check patches/parameters in $REPOS_DB_HOME"
  363. fi
  364.  
  365.  
  366. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  367.  
  368. echo -e "\n\t(1a) Forbid SSLv2 connections"
  369. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  370. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  371. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  372. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl2
  373. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  374. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  375. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  376. sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  377. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  378.  
  379. echo -e "\n\t(1b) Forbid SSLv3 connections"
  380. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  381. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  382. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  383. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl3
  384. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  385. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  386. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  387. sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  388. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  389.  
  390. echo -e "\n\t(1c) Permit TLSv1 connections"
  391. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  392. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  393. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  394. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN tls1
  395. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  396. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  397. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  398. sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  399. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  400.  
  401. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 1477287.1, 1905314.1, 1067411.1)"
  402. ciphercheck Agent $OMSHOST $PORT_AGENT
  403. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  404. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  405. ciphercheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  406. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  407. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  408. ciphercheck OMSupload $OMSHOST $PORT_UPL
  409. ciphercheck OPMN $OMSHOST $PORT_OPMN
  410. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  411.  
  412. echo -e "\n(3) Checking self-signed certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  413. certcheck Agent $OMSHOST $PORT_AGENT
  414. certcheck BIPublisher $OMSHOST $PORT_BIP
  415. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  416. certcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  417. certcheck OMSconsole $OMSHOST $PORT_OMS
  418. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  419. certcheck OMSupload $OMSHOST $PORT_UPL
  420. certcheck OPMN $OMSHOST $PORT_OPMN
  421. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  422.  
  423.  
  424. echo -e "\n(4) Checking EM12c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  425.  
  426. #echo -ne "\n\t(4a) OMS ($OMS_HOME) PSU2 Patch 19830994... "
  427. #opatchcheck OMS $OMS_HOME 19830994
  428.  
  429. #echo -ne "\n\t(4a) OMS ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM - OMS 12.1.0.4.3 PSU Patch (20392036)... "
  430. #opatchcheck OMS $OMS_HOME 20392036
  431.  
  432. echo -ne "\n\t(4a) *UPDATED* OMS ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM - OMS 12.1.0.4.4 PSU Patch (20870437)... "
  433. opatchcheck OMS $OMS_HOME 20870437
  434.  
  435. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) CPUJAN2015 Patch (19822893)... "
  436. opatchcheck BIP $BIP_HOME 19822893
  437.  
  438. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) Merge Patch (20444447)... "
  439. opatchcheck BIP $BIP_HOME 20444447
  440.  
  441. #echo -ne "\n\t(4b) *NEW* BI Publisher ($BIP_HOME) ORACLE BI PUBLISHER PATCH BUG FOR PRIVATE EMCC PS3 MANDATORY INSTALL PATCH (17888172)... "
  442. #opatchcheck BIP $BIP_HOME 17888172
  443.  
  444. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) CVE-2015-0426 Oracle Help Patch (20075252)... "
  445. opatchcheck COMMON $COMMON_HOME 20075252
  446.  
  447. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) ADF MERGE REQUEST ON TOP OF 11.1.1.7.1 FOR BUGS 20465665 18820382 20645397 (20747356)... "
  448. opatchcheck COMMON $COMMON_HOME 20747356
  449.  
  450. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) WEBCENTER PORTAL BUNDLE PATCH 11.1.1.7.1 (16761779)... "
  451. opatchcheck COMMON $COMMON_HOME 16761779
  452.  
  453. #echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.10 12UV Patch (19637463)... "
  454. #wlspatchcheck $WL_HOME 19637463
  455.  
  456. #echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.11 YUIS Patch (20181997)... "
  457. #wlspatchcheck $WL_HOME 20181997
  458.  
  459. echo -ne "\n\t(4d) *UPDATED* WebLogic Server ($WL_HOME) 10.3.6.0.12 EJUW Patch (20780171)... "
  460. wlspatchcheck $WL_HOME 20780171
  461.  
  462. echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) SU Patch [GDFA]: WEBLOGIC.STORE.PERSISTENTSTOREEXCEPTION: [STORE:280040] OCCURS EASILEY (16420963)... "
  463. wlspatchcheck $WL_HOME 16420963
  464.  
  465. # Commented this patch out 4/17/2015, as Oracle no longer recommends it for EM12c installations.
  466. #echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CPUJAN2015 Patch (19948000)... "
  467. #opatchcheck WebTier $WEBTIER_HOME 19948000
  468.  
  469. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2014-4212 OPMN Patch (19345576)... "
  470. opatchcheck WebTier $WEBTIER_HOME 19345576
  471.  
  472. #echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2013-3836 PLACEHOLDER FOR SECURITY PATCH FOR WEBCACHE 11.1.1.7.0 WITH OCT2013 CPU (17306880)... "
  473. #opatchcheck WebTier $WEBTIER_HOME 17306880
  474.  
  475. echo -ne "\n\t(4e) *UPDATED* WebTier ($WEBTIER_HOME) CVE 2015-2658 MERGE REQUEST ON TOP OF 11.1.1.7.0 FOR BUGS 16370190 20310323 20715657 (20807683)... "
  476. opatchcheck WebTier $WEBTIER_HOME 20807683
  477.  
  478. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2013-0169,CVE-2011-3389 OSS SECURITY PATCH UPDATE 11.1.1.7.0 CPUOCT2013 (17337741)... "
  479. opatchcheck WebTier $WEBTIER_HOME 17337741
  480.  
  481. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) WLSPLUGINS (OHS) SECURITY PATCH UPDATE 11.1.1.7.0 CPUJUL2014 (18423831)... "
  482. opatchcheck WebTier $WEBTIER_HOME 18423831
  483.  
  484. #echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 (20613714)... "
  485. #opatchautocheck OMS $OMS_HOME 20613714
  486.  
  487. #echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.3 (20804122)... "
  488. #opatchautocheck OMS $OMS_HOME 20804122
  489.  
  490. #echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.4 (20950048)... "
  491. #opatchautocheck OMS $OMS_HOME 20950048
  492.  
  493. echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.5 (21167937)... "
  494. opatchautocheck OMS $OMS_HOME 21167937
  495.  
  496. #echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 (20613870)... "
  497. #opatchautocheck OMS $OMS_HOME 20613870
  498.  
  499. #echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.3 (20804213)... "
  500. #opatchautocheck OMS $OMS_HOME 20804213
  501.  
  502. #echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.4 (20950040)... "
  503. #opatchautocheck OMS $OMS_HOME 20950040
  504.  
  505. echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.5 (21167980)... "
  506. opatchautocheck OMS $OMS_HOME 21167980
  507.  
  508.  
  509. #echo -ne "\n\t(4h) OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.4 (20613886)... "
  510. #opatchautocheck OMS $OMS_HOME 20613886
  511.  
  512. echo -ne "\n\t(4h) OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.5 (20822914)... "
  513. opatchautocheck OMS $OMS_HOME 20822914
  514.  
  515. #echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE 12.1.0.6.6 (20613853)... "
  516. #opatchautocheck OMS $OMS_HOME 20613853
  517.  
  518. #echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.7 (20822866)... "
  519. #opatchautocheck OMS $OMS_HOME 20822866
  520.  
  521. #echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.8 (20962507)... "
  522. #opatchautocheck OMS $OMS_HOME 20962507
  523.  
  524. echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.9 (21167953)... "
  525. opatchautocheck OMS $OMS_HOME 21167953
  526.  
  527. #echo -ne "\n\t(4j) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE 12.1.0.4.7 (20613931)... "
  528. #opatchcheck Agent $AGENT_HOME 20613931
  529.  
  530. #echo -ne "\n\t(4j) *NEW* OMS ($OMS_HOME) CFW PLUGIN BUNDLE PATCH 12.1.0.2.1 (20385040)... "
  531. #opatchautocheck OMS $OMS_HOME 20385040
  532.  
  533. echo -ne "\n\t(4j) *UPDATED* OMS ($OMS_HOME) CFW PLUGIN BUNDLE PATCH 12.1.0.2.2 (21167573)... "
  534. opatchautocheck OMS $OMS_HOME 21167573
  535.  
  536. #echo -ne "\n\t(4k) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.9 (20950034)... "
  537. #opatchcheck Agent $AGENT_HOME 20950034
  538.  
  539. echo -ne "\n\t(4k) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.10 (21168025)... "
  540. opatchcheck Agent $AGENT_HOME 21168025
  541.  
  542. echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) Merge Patch (18502187)... "
  543. opatchcheck Agent $AGENT_HOME 18502187
  544.  
  545. echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) JDBC Security Patch (18721761)... "
  546. opatchcheck Agent $AGENT_HOME 18721761
  547.  
  548. if [[ "$HOST_OS" == "Linux" && "$HOST_ARCH" == "x86_64" ]]; then
  549.     echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) CVE 2012-3137 EM Agent only: Instant Client Security Patch (20114054)... "
  550.     opatchcheck Agent $AGENT_HOME 20114054
  551. fi
  552.  
  553. #echo -ne "\n\t(4k) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE 20676926... "
  554. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 20676926
  555.  
  556. #echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.4 AGENT-SIDE MONITORING (21065223)... "
  557. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 21065223
  558.  
  559. echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.5 AGENT-SIDE MONITORING (21229731)... "
  560. opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 21229731
  561.  
  562. echo -ne "\n\t(4l) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_DISC_HOME) DB PLUGIN BUNDLE 12.1.0.7.4 AGENT-SIDE DISCOVERY (21065239)... "
  563. opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_DISC_HOME 21065239
  564.  
  565. #echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE MONITORING (20677020)... "
  566. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 20677020
  567.  
  568. #echo -ne "\n\t(4m) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.4 AGENT-SIDE MONITORING (21065760)... "
  569. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 21065760
  570.  
  571. echo -ne "\n\t(4m) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.5 AGENT-SIDE MONITORING (21229821)... "
  572. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 21229821
  573.  
  574. #echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_DISC_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE DISCOVERY (20677038)... "
  575. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_DISC_HOME 20677038
  576.  
  577. echo -ne "\n\t(4m) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_DISC_HOME) FMW PLUGIN BUNDLE 12.1.0.7.5 AGENT-SIDE DISCOVERY (21229841)... "
  578. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_DISC_HOME 21229841
  579.  
  580. echo -ne "\n\t(4n) OMS CHAINED AGENT BEACON PLUGIN ($AGENT_BEACON_PLUGIN_HOME) EM-BEACON BUNDLE PATCH 12.1.0.4.1 (20466772)... "
  581. opatchcheck AgentBeaconPlugin $AGENT_BEACON_PLUGIN_HOME 20466772
  582.  
  583. echo -ne "\n\t(4o) OMS CHAINED AGENT EM-OH BUNDLE PATCH 12.1.0.4.1 (20855134)... "
  584. opatchcheck AgentOHPlugin $AGENT_OH_PLUGIN_HOME 20855134
  585.  
  586.  
  587. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  588.  
  589. #   if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  590. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.5 19769489... "
  591. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769489
  592. #
  593. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.2 DATABASE PSU (JAN2015) 19877440... "
  594. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877440
  595. #   fi
  596.  
  597.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  598.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.6 (APR2015) (20299013)... "
  599.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20299013
  600.  
  601.         echo -ne "\n\t(4p) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.7 (JUL2015) (20760982)... "
  602.         opatchcheck ReposDBHome $REPOS_DB_HOME 20760982
  603.  
  604.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.3 DATABASE PSU (APR2015) (20406239)... "
  605.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20406239
  606.  
  607.         echo -ne "\n\t(4p) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.4 DATABASE PSU (JUL2015) (21068539)... "
  608.         opatchcheck ReposDBHome $REPOS_DB_HOME 21068539
  609.     fi
  610.  
  611. #   if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  612. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch 20243268... "
  613. #       opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  614. #
  615. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.2 19769480... "
  616. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769480
  617. #
  618. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.2 ORACLE JAVAVM COMPONENT 12.1.0.2.2 DATABASE PSU (JAN2015) 19877336... "
  619. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877336
  620. #   fi
  621.  
  622.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  623.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch (20243268)... "
  624.         opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  625.  
  626.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.3 (APR2015) (20299023)... "
  627.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20299023
  628.  
  629.         echo -ne "\n\t(4p) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.4 (JUL2015) (20831110)... "
  630.         opatchcheck ReposDBHome $REPOS_DB_HOME 20831110
  631.  
  632.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.3 DATABASE PSU (APR2015) (20415564)... "
  633.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20415564
  634.  
  635.         echo -ne "\n\t(4p) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.4 DATABASE PSU (JUL2015) (21068507)... "
  636.         opatchcheck ReposDBHome $REPOS_DB_HOME 21068507
  637.     fi
  638.  
  639.     echo -ne "\n\t(4q) *NEW* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_VERSION parameter (1545816.1)... "
  640.     paramcheck SSL_VERSION $REPOS_DB_HOME sqlnet.ora
  641.  
  642.     echo -ne "\n\t(4q) *NEW* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  643.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME sqlnet.ora
  644.  
  645.     echo -ne "\n\t(4q) *NEW* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_VERSION parameter (1545816.1)... "
  646.     paramcheck SSL_VERSION $REPOS_DB_HOME listener.ora
  647.  
  648.     echo -ne "\n\t(4q) *NEW* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  649.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME listener.ora
  650. fi
  651.  
  652. echo
  653.  
  654. echo -e "\n(5) Checking EM12c Java versions against baseline (see notes 1506916.1, 1492980.1)"
  655.  
  656. echo -ne "\n\t(5a) MW ($MW_HOME/jdk16/jdk) Java version 1.6.0_95 (9553040)... "
  657. javacheck MW $MW_HOME/jdk16/jdk 1.6.0_95
  658.  
  659. echo -ne "\n\t(5b) WebTier ($WEBTIER_HOME/jdk) Java version 1.6.0_95 (9553040)... "
  660. javacheck WebTier $WEBTIER_HOME/jdk 1.6.0_95
  661.  
  662. echo
  663.  
  664. if [[ $FAIL_COUNT -gt "0" ]]; then
  665.     echo "Failed test count: $FAIL_COUNT - Review output"
  666.     test $VERBOSE_CHECKSEC -ge 1 && echo -e $FAIL_TESTS
  667. else
  668.     echo "All tests succeeded."
  669. fi
  670.  
  671. echo
  672. echo "Visit https://pardydba.wordpress.com/2015/03/09/em12c-r4-ssl-security-checkup-script/ for the latest version."
  673. echo
  674.  
  675. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!