API tools faq
paste
Advertisement
Guest User

EM12c R4 SSL Security Checkup Script v1.3

a guest
May 1st, 2015
334
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 21.42 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM12c R4 environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It also contains a patch
  6. # check currently comparing against the latest recommended patches
  7. # and flags the use of self-signed certificates.  Further checks include
  8. # EM12c Java JDK version.
  9. #
  10. # Added in v1.0:  Repository database patch check
  11. # Added in v1.1:  EM12c Java JDK version check
  12. # Change in v1.2: Removed patch 19948000 recommendation for OHS.
  13. # Change in v1.3: Update for 30 Apr 2015 patches, add EM-OH plugin home
  14. #                 restored GDFA/16420963 for WLS
  15. #                 added 20114054 for Agent - only applicable for Linux x86-64
  16. #
  17. # From: @BrianPardy on Twitter
  18. #
  19. # Known functional on Linux x86-64, Solaris, AIX.
  20. #
  21. # Run this script as the Oracle EM12c software owner, with your environment
  22. # fully up and running.
  23. #
  24. # Thanks to Dave Corsar, who tested on Solaris and let me know the
  25. # changes needed to make an earlier version work on Solaris.
  26. #
  27. # Thanks to opa tropa who confirmed AIX functionality and noted the
  28. # use of GNU extensions to grep, which I have since removed.
  29. #
  30. # Dedicated to our two Lhasa Apsos, Lucy (RIP 3/13/2015) and Ethel.
  31. #
  32.  
  33. SCRIPTNAME=`basename $0`
  34. PATCHDATE="30 April 2015"
  35. OMSHOST=`hostname -f`
  36. VERSION="1.3"
  37. FAIL_COUNT=0
  38.  
  39. RUN_DB_CHECK=0
  40.  
  41. HOST_OS=`uname -s`
  42. HOST_ARCH=`uname -m`
  43.  
  44. ORAGCHOMELIST="/etc/oragchomelist"
  45. ORATAB="/etc/oratab"
  46.  
  47. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  48.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  49. fi
  50.  
  51. if [[ ! -r $ORATAB ]]; then                 # Solaris
  52.     ORATAB="/var/opt/oracle/oratab"
  53. fi
  54.  
  55. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  56.     GREP=/usr/sfw/bin/gegrep
  57. else
  58.     GREP=`which grep`
  59. fi
  60.  
  61. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  62.  
  63. OPATCH="$OMS_HOME/OPatch/opatch"
  64. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  65. OMSORAINST="$OMS_HOME/oraInst.loc"
  66. ORAINVENTORY=`head -n 1 $OMSORAINST | awk -F= '{print $2}'`
  67.  
  68. MW_HOME=`dirname $OMS_HOME`
  69. BIP_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"Oracle_BI" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  70. COMMON_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"common" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  71. WEBTIER_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"webtier" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  72. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent12c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  73. AGENT_DB_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.db.agent.plugin_12.1.0.7.0"
  74. AGENT_FMW_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.agent.plugin_12.1.0.7.0"
  75. AGENT_FMW_PLUGIN_DISC_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.discovery.plugin_12.1.0.7.0"
  76. AGENT_BEACON_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.beacon.agent.plugin_12.1.0.4.0"
  77. AGENT_OH_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.oh.agent.plugin_12.1.0.4.0"
  78.  
  79. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  80. WL_HOME=`$GREP wlserver $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/samples.*$//' | sed -e 's/"//' | uniq`
  81.  
  82. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  83. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  84. OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  85. OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  86.  
  87. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  88. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  89. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  90. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  91. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  92. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  93. PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  94. PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  95. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  96.  
  97. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  98. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  99. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  100.  
  101. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  102.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  103.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  104.  
  105.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  106.         RUN_DB_CHECK=1
  107.     fi
  108.  
  109.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  110.         RUN_DB_CHECK=1
  111.     fi
  112.  
  113.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  114.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported by this script for now"
  115.     fi
  116. fi
  117.  
  118.  
  119.  
  120.  
  121. sslcheck () {
  122.     OPENSSL_CHECK_COMPONENT=$1
  123.     OPENSSL_CHECK_HOST=$2
  124.     OPENSSL_CHECK_PORT=$3
  125.     OPENSSL_CHECK_PROTO=$4
  126.  
  127.     OPENSSL_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  128.    
  129.    
  130.  
  131.     if [[ $OPENSSL_CHECK_PROTO == "tls1" ]]; then
  132.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO available for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  133.         if [[ $OPENSSL_RETURN -eq "0" ]]; then
  134.             echo OK
  135.         else
  136.             echo FAILED
  137.             FAIL_COUNT=$((FAIL_COUNT+1))
  138.         fi
  139.     fi
  140.  
  141.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  142.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO disabled for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  143.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  144.             echo OK
  145.         else
  146.             echo FAILED
  147.             FAIL_COUNT=$((FAIL_COUNT+1))
  148.         fi
  149.     fi
  150. }
  151.  
  152. opatchcheck () {
  153.     OPATCH_CHECK_COMPONENT=$1
  154.     OPATCH_CHECK_OH=$2
  155.     OPATCH_CHECK_PATCH=$3
  156.  
  157.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  158.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  159.     else
  160.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  161.     fi
  162.  
  163.     if [[ -z "$OPATCH_RET" ]]; then
  164.         echo FAILED
  165.         FAIL_COUNT=$((FAIL_COUNT+1))
  166.     else
  167.         echo OK
  168.     fi
  169.  
  170.     echo $OPATCH_RET
  171.  
  172. }
  173.  
  174. opatchautocheck () {
  175.     OPATCHAUTO_CHECK_COMPONENT=$1
  176.     OPATCHAUTO_CHECK_OH=$2
  177.     OPATCHAUTO_CHECK_PATCH=$3
  178.  
  179.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  180.  
  181.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  182.         echo FAILED
  183.         FAIL_COUNT=$((FAIL_COUNT+1))
  184.     else
  185.         echo OK
  186.     fi
  187.  
  188.     echo $OPATCHAUTO_RET
  189.  
  190. }
  191.  
  192. certcheck () {
  193.     CERTCHECK_CHECK_COMPONENT=$1
  194.     CERTCHECK_CHECK_HOST=$2
  195.     CERTCHECK_CHECK_PORT=$3
  196.  
  197.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT)... "
  198.  
  199.     OPENSSL_SELFSIGNED_COUNT=`echo Q | openssl s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT 2>&1 | $GREP -ci "self signed certificate"`
  200.  
  201.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  202.         echo OK
  203.     else
  204.         echo FAILED - Found self-signed certificate
  205.         FAIL_COUNT=$((FAIL_COUNT+1))
  206.     fi
  207. }
  208.  
  209.  
  210. ciphercheck () {
  211.     OPENSSL_CHECK_COMPONENT=$1
  212.     OPENSSL_CHECK_HOST=$2
  213.     OPENSSL_CHECK_PORT=$3
  214.  
  215.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  216.  
  217.     OPENSSL_LOW_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  218.  
  219.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  220.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  221.         FAIL_COUNT=$((FAIL_COUNT+1))
  222.     else
  223.         echo -e "\tOK"
  224.     fi
  225.  
  226.  
  227.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  228.  
  229.     OPENSSL_MEDIUM_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  230.  
  231.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  232.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  233.         FAIL_COUNT=$((FAIL_COUNT+1))
  234.     else
  235.         echo -e "\tOK"
  236.     fi
  237.  
  238.  
  239.  
  240.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  241.  
  242.     OPENSSL_HIGH_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  243.  
  244.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  245.         echo -e "\tOK"
  246.     else
  247.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  248.         FAIL_COUNT=$((FAIL_COUNT+1))
  249.     fi
  250.     echo
  251. }
  252.  
  253. wlspatchcheck () {
  254.     WLSDIR=$1
  255.     PATCH=$2
  256.  
  257.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $PATCH`
  258.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  259.  
  260.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  261.         echo -e "\tOK"
  262.     else
  263.         echo -e "\tFAILED - PATCH NOT FOUND"
  264.         FAIL_COUNT=$((FAIL_COUNT+1))
  265.     fi
  266.  
  267.     echo $WLSCHECK_RETURN
  268.    
  269. }
  270.  
  271. javacheck () {
  272.     WHICH_JAVA=$1
  273.     JAVA_DIR=$2
  274.  
  275.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  276.  
  277.     if [[ "$JAVACHECK_RETURN" == "1.6.0_95" ]]; then
  278.         echo -e "\tOK"
  279.     else
  280.         echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  281.         FAIL_COUNT=$((FAIL_COUNT+1))
  282.     fi
  283. }
  284.  
  285.  
  286. ### MAIN SCRIPT HERE
  287.  
  288.  
  289. echo -e "Performing EM12cR4 security checkup version $VERSION.\n"
  290.  
  291. echo "Using port definitions from configuration files "
  292. echo -e "\t/etc/oragchomelist"
  293. echo -e "\t$EMGC_PROPS"
  294. echo -e "\t$EMBIP_PROPS"
  295. echo -e "\t$OPMN_PROPS"
  296. echo -e "\t$OHS_ADMIN_CONF"
  297. echo
  298. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  299. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  300. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  301. echo -e "\tOHSadmin port found at $OMSHOST:$PORT_OHS_ADMIN"
  302. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  303. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  304. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  305. echo -e "\tOPMN port found at $OMSHOST:$PORT_OPMN"
  306. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  307. echo
  308. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  309.  
  310. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  311.     echo -e "\tRepository DB on OMS server, will check patches in $REPOS_DB_HOME"
  312.  
  313. fi
  314.  
  315. #echo -e "\tRepository DB connect descriptor $REPOS_DB_CONNDESC"
  316. #echo -e "\tRepository DB host $REPOS_DB_HOST"
  317. #echo -e "\tRepository DB SID $REPOS_DB_SID"
  318. #echo -e "\tRepository DB ORACLE_HOME $REPOS_DB_HOME"
  319.  
  320.  
  321.  
  322. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  323.  
  324. echo -e "\n\t(1a) Forbid SSLv2 connections"
  325. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  326. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  327. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  328. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl2
  329. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  330. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  331. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  332. sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  333. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  334.  
  335. echo -e "\n\t(1b) Forbid SSLv3 connections"
  336. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  337. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  338. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  339. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl3
  340. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  341. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  342. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  343. sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  344. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  345.  
  346. echo -e "\n\t(1c) Permit TLSv1 connections"
  347. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  348. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  349. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  350. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN tls1
  351. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  352. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  353. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  354. sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  355. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  356.  
  357. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 1477287.1, 1905314.1, 1067411.1)"
  358. ciphercheck Agent $OMSHOST $PORT_AGENT
  359. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  360. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  361. ciphercheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  362. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  363. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  364. ciphercheck OMSupload $OMSHOST $PORT_UPL
  365. ciphercheck OPMN $OMSHOST $PORT_OPMN
  366. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  367.  
  368. echo -e "\n(3) Checking self-signed certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  369. certcheck Agent $OMSHOST $PORT_AGENT
  370. certcheck BIPublisher $OMSHOST $PORT_BIP
  371. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  372. certcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  373. certcheck OMSconsole $OMSHOST $PORT_OMS
  374. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  375. certcheck OMSupload $OMSHOST $PORT_UPL
  376. certcheck OPMN $OMSHOST $PORT_OPMN
  377. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  378.  
  379.  
  380.  
  381. echo -e "\n(4) Checking EM12c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  382.  
  383. #echo -ne "\n\t(4a) OMS ($OMS_HOME) PSU2 Patch 19830994... "
  384. #opatchcheck OMS $OMS_HOME 19830994
  385.  
  386. echo -ne "\n\t(4a) OMS ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM - OMS 12.1.0.4.3 PSU Patch (20392036)... "
  387. opatchcheck OMS $OMS_HOME 20392036
  388.  
  389. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) CPUJAN2015 Patch (19822893)... "
  390. opatchcheck BIP $BIP_HOME 19822893
  391.  
  392. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) Merge Patch (20444447)... "
  393. opatchcheck BIP $BIP_HOME 20444447
  394.  
  395. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) CVE-2015-0426 Oracle Help Patch (20075252)... "
  396. opatchcheck COMMON $COMMON_HOME 20075252
  397.  
  398. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) ADF MERGE REQUEST ON TOP OF 11.1.1.7.1 FOR BUGS 20465665 18820382 20645397 (20747356)... "
  399. opatchcheck COMMON $COMMON_HOME 20747356
  400.  
  401. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) WEBCENTER PORTAL BUNDLE PATCH 11.1.1.7.1 (16761779)... "
  402. opatchcheck COMMON $COMMON_HOME 16761779
  403.  
  404. #echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.10 12UV Patch (19637463)... "
  405. #wlspatchcheck $WL_HOME 19637463
  406.  
  407. echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.11 YUIS Patch (20181997)... "
  408. wlspatchcheck $WL_HOME 20181997
  409.  
  410. echo -ne "\n\t(4d) *NEW* WebLogic Server ($WL_HOME) SU Patch [GDFA]: WEBLOGIC.STORE.PERSISTENTSTOREEXCEPTION: [STORE:280040] OCCURS EASILEY (16420963)... "
  411. wlspatchcheck $WL_HOME 16420963
  412.  
  413. # Commented this patch out 4/17/2015, as Oracle no longer recommends it for EM12c installations.
  414. #echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CPUJAN2015 Patch (19948000)... "
  415. #opatchcheck WebTier $WEBTIER_HOME 19948000
  416.  
  417. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2014-4212 OPMN Patch (19345576)... "
  418. opatchcheck WebTier $WEBTIER_HOME 19345576
  419.  
  420. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2013-3836 PLACEHOLDER FOR SECURITY PATCH FOR WEBCACHE 11.1.1.7.0 WITH OCT2013 CPU (17306880)... "
  421. opatchcheck WebTier $WEBTIER_HOME 17306880
  422.  
  423. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2013-0169,CVE-2011-3389 OSS SECURITY PATCH UPDATE 11.1.1.7.0 CPUOCT2013 (17337741)... "
  424. opatchcheck WebTier $WEBTIER_HOME 17337741
  425.  
  426. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) WLSPLUGINS (OHS) SECURITY PATCH UPDATE 11.1.1.7.0 CPUJUL2014 (18423831)... "
  427. opatchcheck WebTier $WEBTIER_HOME 18423831
  428.  
  429. #echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 (20613714)... "
  430. #opatchautocheck OMS $OMS_HOME 20613714
  431.  
  432. echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.3 (20804122)... "
  433. opatchautocheck OMS $OMS_HOME 20804122
  434.  
  435. #echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 (20613870)... "
  436. #opatchautocheck OMS $OMS_HOME 20613870
  437.  
  438. echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.3 (20804213)... "
  439. opatchautocheck OMS $OMS_HOME 20804213
  440.  
  441.  
  442. echo -ne "\n\t(4h) OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.4 (20613886)... "
  443. opatchautocheck OMS $OMS_HOME 20613886
  444.  
  445. #echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE 12.1.0.6.6 (20613853)... "
  446. #opatchautocheck OMS $OMS_HOME 20613853
  447.  
  448. echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.7 (20822866)... "
  449. opatchautocheck OMS $OMS_HOME 20822866
  450.  
  451. #echo -ne "\n\t(4j) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE 12.1.0.4.7 (20613931)... "
  452. #opatchcheck Agent $AGENT_HOME 20613931
  453.  
  454. echo -ne "\n\t(4j) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.8 (20822942)... "
  455. opatchcheck Agent $AGENT_HOME 20822942
  456.  
  457. echo -ne "\n\t(4j) OMS CHAINED AGENT HOME ($AGENT_HOME) Merge Patch (18502187)... "
  458. opatchcheck Agent $AGENT_HOME 18502187
  459.  
  460. echo -ne "\n\t(4j) OMS CHAINED AGENT HOME ($AGENT_HOME) JDBC Security Patch (18721761)... "
  461. opatchcheck Agent $AGENT_HOME 18721761
  462.  
  463. if [[ "$HOST_OS" == "Linux" && "$HOST_ARCH" == "x86_64" ]]; then
  464.     echo -ne "\n\t(4j) *NEW* OMS CHAINED AGENT HOME ($AGENT_HOME) CVE 2012-3137 EM Agent only: Instant Client Security Patch (20114054)... "
  465.     opatchcheck Agent $AGENT_HOME 20114054
  466. fi
  467.  
  468. #echo -ne "\n\t(4k) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE 20676926... "
  469. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 20676926
  470.  
  471. echo -ne "\n\t(4k) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.3 AGENT-SIDE (20844888)... "
  472. opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 20844888
  473.  
  474. #echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE MONITORING (20677020)... "
  475. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 20677020
  476.  
  477. echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.3 AGENT-SIDE MONITORING (20844953)... "
  478. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 20844953
  479.  
  480. echo -ne "\n\t(4l) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_DISC_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE DISCOVERY (20677038)... "
  481. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_DISC_HOME 20677038
  482.  
  483. echo -ne "\n\t(4m) OMS CHAINED AGENT BEACON PLUGIN ($AGENT_BEACON_PLUGIN_HOME) EM-BEACON BUNDLE PATCH 12.1.0.4.1 (20466772)... "
  484. opatchcheck AgentBeaconPlugin $AGENT_BEACON_PLUGIN_HOME 20466772
  485.  
  486. echo -ne "\n\t(4n) *NEW* OMS CHAINED AGENT EM-OH BUNDLE PATCH 12.1.0.4.1 (20855134)... "
  487. opatchcheck AgentOHPlugin $AGENT_OH_PLUGIN_HOME 20855134
  488.  
  489.  
  490.  
  491. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  492.  
  493. #   if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  494. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.5 19769489... "
  495. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769489
  496. #
  497. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.2 DATABASE PSU (JAN2015) 19877440... "
  498. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877440
  499. #   fi
  500.  
  501.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  502.         echo -ne "\n\t(4o) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.6 (APR2015) (20299013)... "
  503.         opatchcheck ReposDBHome $REPOS_DB_HOME 20299013
  504.  
  505.         echo -ne "\n\t(4o) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.3 DATABASE PSU (APR2015) (20406239)... "
  506.         opatchcheck ReposDBHome $REPOS_DB_HOME 20406239
  507.     fi
  508.  
  509. #   if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  510. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch 20243268... "
  511. #       opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  512. #
  513. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.2 19769480... "
  514. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769480
  515. #
  516. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.2 ORACLE JAVAVM COMPONENT 12.1.0.2.2 DATABASE PSU (JAN2015) 19877336... "
  517. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877336
  518. #   fi
  519.  
  520.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  521.         echo -ne "\n\t(4o) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch (20243268)... "
  522.         opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  523.  
  524.         echo -ne "\n\t(4o) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.3 (APR2015) (20299023)... "
  525.         opatchcheck ReposDBHome $REPOS_DB_HOME 20299023
  526.  
  527.         echo -ne "\n\t(4o) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.3 DATABASE PSU (APR2015) (20415564)... "
  528.         opatchcheck ReposDBHome $REPOS_DB_HOME 20415564
  529.     fi
  530. fi
  531.  
  532. echo
  533.  
  534. echo -e "\n(5) Checking EM12c Java versions against baseline (see notes 1506916.1, 1492980.1)"
  535.  
  536. echo -ne "\n\t(5a) *NEW* MW ($MW_HOME/jdk16/jdk) Java version 1.6.0_95 (9553040)... "
  537. javacheck MW $MW_HOME/jdk16/jdk 1.6.0_95
  538.  
  539. echo -ne "\n\t(5b) *NEW* WebTier ($WEBTIER_HOME/jdk) Java version 1.6.0_95 (9553040)... "
  540. javacheck WebTier $WEBTIER_HOME/jdk 1.6.0_95
  541.  
  542. echo
  543.  
  544. if [[ $FAIL_COUNT -gt "0" ]]; then
  545.     echo "Failed test count: $FAIL_COUNT - Review output"
  546. else
  547.     echo "All tests succeeded."
  548. fi
  549.  
  550. echo "Visit https://pardydba.wordpress.com/2015/03/09/em12c-r4-ssl-security-checkup-script/ for the latest version."
  551.  
  552. echo
  553.  
  554. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!