API tools faq
paste
Advertisement
Guest User

EM13c TLS Check Script v0.9

a guest
Oct 4th, 2016
119
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 35.80 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM13c environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It will also validate your
  6. # system comparing against the latest recommended patches and also flags
  7. # the use of demo or self-signed certificates.  Latest enhancement adds
  8. # checks for the EM13c WLS Java JDK version.
  9. #
  10. # Released  v0.1:  Initial beta release 5 Apr 2016
  11. # Changes   v0.2:  Updated for current patches
  12. # Changes   v0.3:  APR2016 patchset added
  13. # Changes   v0.4:  Plugin updates for 20160429
  14. # Changes   v0.5:  Plugin updates for 20160531
  15. # Changes   v0.6:  Plugin/OMS/DB updates for 20160719 CPU + Java check
  16. # Changes   v0.7:  Plugin/OMS updates for 20160816 bundles
  17. #                  Support for SLES11 OpenSSL 1 parallel package
  18. #                  Add checks for TLSv1.1, TLSv1.2
  19. #                  Permit only TLSv1.2 where supported by OpenSSL
  20. # Changes   v0.8:  Fix broken check for SSL_CIPHER_SUITES
  21. #                  Add checks for ENCRYPTION_SERVER, ENCRYPTION_CLIENT,
  22. #                  CRYPTO_CHECKSUM_SERVER, CRYPTO_CHECKSUM_CLIENT,
  23. #                  ENCRYPTION_TYPES_SERVER, ENCRYPTION_TYPES_CLIENT,
  24. #                  CRYPTO_CHECKSUM_TYPES_SERVER, CRYPTO_CHECKSUM_TYPES_CLIENT
  25. # Changes   v0.9:  Plugin updates for 20160920
  26. #                  Support TLSv1.2 when available in certcheck,
  27. #                  democertcheck, and ciphercheck
  28. #
  29. # From: @BrianPardy on Twitter
  30. #
  31. # Known functional on Linux x86-64, may work on Solaris and AIX.
  32. #
  33. # Run this script as the Oracle EM13c software owner, with your environment
  34. # fully up and running.
  35. #
  36. # Thanks to Dave Corsar, who tested a previous version on Solaris and
  37. # let me know the changes needed to make the script work on Solaris.
  38. #
  39. # Thanks to opa tropa who confirmed AIX functionality on a previous
  40. # version and noted the use of GNU extensions to grep, which I have
  41. # since removed.
  42. #
  43. # Thanks to Bob Schuppin who noted the use of TLS1 when using
  44. # openssl to check ciphers/certificates/demo-certs, which I have
  45. # now fixed.
  46. #
  47. # Thanks to Paige, who informed me of a broken check for the
  48. # SSL_CIPHER_SUITES parameter that led me to add the additional checks
  49. # for SQL*Net encryption
  50. #
  51. # In order to check selections for ENCRYPTION_TYPES and CRYPTO_CHECKSUM_TYPES
  52. # I have to make some judgement calls. Due to MD5's known issues, I consider
  53. # it unacceptable for CRYPTO_CHECKSUM_TYPES. Unfortunately SHA256, the
  54. # best choice available, can cause problems with target promotion in OEM
  55. # (see MOS note 2167682.1) so this check will simply make sure you do not
  56. # permit MD5, but will not enforce SHA256. This same issue also requires
  57. # allowing 3DES168 as an encryption algorithm to promote targets, though
  58. # I would generally not allow 3DES168 for security reasons. This check
  59. # will simply make sure you do not permit DES, DES40, 3DES112, or any
  60. # of the RC4_* algorithms.
  61. #
  62. #
  63. # Dedicated to our two Lhasa Apsos:
  64. #   Lucy (6/13/1998 - 3/13/2015)
  65. #   Ethel (6/13/1998 - 7/31/2015)
  66. #
  67.  
  68. SCRIPTNAME=`basename $0`
  69. PATCHDATE="20 Sep 2016"
  70. OMSHOST=`hostname -f`
  71. VERSION="0.9"
  72. FAIL_COUNT=0
  73. FAIL_TESTS=""
  74.  
  75. RUN_DB_CHECK=0
  76. VERBOSE_CHECKSEC=2
  77.  
  78. HOST_OS=`uname -s`
  79. HOST_ARCH=`uname -m`
  80.  
  81. ORAGCHOMELIST="/etc/oragchomelist"
  82. ORATAB="/etc/oratab"
  83. OPENSSL=`which openssl`
  84.  
  85. if [[ -x "/usr/bin/openssl1" && -f "/etc/SuSE-release" ]]; then
  86.     OPENSSL=`which openssl1`
  87. fi
  88.  
  89. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  90.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  91. fi
  92.  
  93. if [[ ! -r $ORATAB ]]; then                 # Solaris
  94.     ORATAB="/var/opt/oracle/oratab"
  95. fi
  96.  
  97. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  98.     GREP=/usr/sfw/bin/gegrep
  99. else
  100.     GREP=`which grep`
  101. fi
  102.  
  103. OPENSSL_HAS_TLS1_1=`$OPENSSL s_client help 2>&1 | $GREP -c tls1_1`
  104. OPENSSL_HAS_TLS1_2=`$OPENSSL s_client help 2>&1 | $GREP -c tls1_2`
  105. OPENSSL_ALLOW_TLS1_2_ONLY=$OPENSSL_HAS_TLS1_2
  106.  
  107. OPENSSL_PERMIT_FORBID_NON_TLS1_2="Permit"
  108.  
  109. if [[ $OPENSSL_ALLOW_TLS1_2_ONLY -gt 0 ]]; then
  110.     OPENSSL_PERMIT_FORBID_NON_TLS1_2="Forbid"
  111. fi
  112.  
  113. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  114.  
  115. if [[ "$OMS_HOME" == "." ]]; then
  116.     OMS_HOME=`cat $ORAGCHOMELIST | head -n 1`
  117. fi
  118.  
  119.  
  120. OPATCH="$OMS_HOME/OPatch/opatch"
  121. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  122. OMSPATCHER="$OMS_HOME/OMSPatcher/omspatcher"
  123. OMSORAINST="$OMS_HOME/oraInst.loc"
  124. ORAINVENTORY=`$GREP inventory_loc $OMSORAINST | awk -F= '{print $2}'`
  125.  
  126. MW_HOME=$OMS_HOME
  127. COMMON_HOME="$MW_HOME/oracle_common"
  128.  
  129. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent13c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  130.  
  131.  
  132. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  133.  
  134. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  135. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  136. #OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  137. #OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  138.  
  139. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  140. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  141. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  142. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  143. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  144. PORT_BIP_OHS=`$GREP BIP_HTTPS_OHS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  145. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  146. #PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  147. #PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  148. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  149.  
  150. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  151. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  152. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  153.  
  154. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  155.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  156.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  157.  
  158.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  159.         RUN_DB_CHECK=1
  160.     fi
  161.  
  162.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  163.         RUN_DB_CHECK=1
  164.     fi
  165.  
  166.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  167.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported by this script for now"
  168.     fi
  169. fi
  170.  
  171.  
  172.  
  173. sslcheck () {
  174.     OPENSSL_CHECK_COMPONENT=$1
  175.     OPENSSL_CHECK_HOST=$2
  176.     OPENSSL_CHECK_PORT=$3
  177.     OPENSSL_CHECK_PROTO=$4
  178.     OPENSSL_AVAILABLE_OR_DISABLED="disabled"
  179.  
  180.     if [[ $OPENSSL_CHECK_PROTO == "tls1_1" && $OPENSSL_HAS_TLS1_1 == 0 ]]; then
  181.         echo -en "\tYour OpenSSL ($OPENSSL) does not support $OPENSSL_CHECK_PROTO. Skipping $OPENSSL_CHECK_COMPONENT\n"
  182.         return
  183.     fi
  184.  
  185.     if [[ $OPENSSL_CHECK_PROTO == "tls1_2" && $OPENSSL_HAS_TLS1_2 == 0 ]]; then
  186.         echo -en "\tYour OpenSSL ($OPENSSL) does not support $OPENSSL_CHECK_PROTO. Skipping $OPENSSL_CHECK_COMPONENT\n"
  187.         return
  188.     fi
  189.  
  190.  
  191.     OPENSSL_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  192.    
  193.  
  194.     if [[ $OPENSSL_CHECK_PROTO == "tls1" || $OPENSSL_CHECK_PROTO == "tls1_1" || $OPENSSL_CHECK_PROTO == "tls1_2" ]]; then
  195.  
  196.         if [[ $OPENSSL_ALLOW_TLS1_2_ONLY > 0 ]]; then
  197.             if [[ $OPENSSL_CHECK_PROTO == "tls1_2" ]]; then
  198.                 OPENSSL_AVAILABLE_OR_DISABLED="available"
  199.             fi
  200.         fi
  201.  
  202.         if [[ $OPENSSL_ALLOW_TLS1_2_ONLY == 0 ]]; then
  203.             OPENSSL_AVAILABLE_OR_DISABLED="available"
  204.         fi
  205.  
  206.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO $OPENSSL_AVAILABLE_OR_DISABLED for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  207.  
  208.         if [[ $OPENSSL_AVAILABLE_OR_DISABLED == "available" ]]; then
  209.             if [[ $OPENSSL_RETURN -eq "0" ]]; then
  210.                 echo OK
  211.             else
  212.                 echo FAILED
  213.                 FAIL_COUNT=$((FAIL_COUNT+1))
  214.                 FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection failed"
  215.             fi
  216.         fi
  217.  
  218.         if [[ $OPENSSL_AVAILABLE_OR_DISABLED == "disabled" ]]; then
  219.             if [[ $OPENSSL_RETURN -ne "0" ]]; then
  220.                 echo OK
  221.             else
  222.                 echo FAILED
  223.                 FAIL_COUNT=$((FAIL_COUNT+1))
  224.                 FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection allowed"
  225.             fi
  226.         fi
  227.  
  228.  
  229.     fi
  230.  
  231.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  232.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO $OPENSSL_AVAILABLE_OR_DISABLED for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  233.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  234.             echo OK
  235.         else
  236.             echo FAILED
  237.             FAIL_COUNT=$((FAIL_COUNT+1))
  238.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection succeeded"
  239.         fi
  240.     fi
  241. }
  242.  
  243. opatchcheck () {
  244.     OPATCH_CHECK_COMPONENT=$1
  245.     OPATCH_CHECK_OH=$2
  246.     OPATCH_CHECK_PATCH=$3
  247.  
  248.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  249.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  250.     else
  251.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  252.     fi
  253.  
  254.     if [[ -z "$OPATCH_RET" ]]; then
  255.         echo FAILED
  256.         FAIL_COUNT=$((FAIL_COUNT+1))
  257.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCH_CHECK_COMPONENT @ ${OPATCH_CHECK_OH}:Patch $OPATCH_CHECK_PATCH not found"
  258.     else
  259.         echo OK
  260.     fi
  261.  
  262.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCH_RET
  263.  
  264. }
  265.  
  266. opatchautocheck () {
  267.     OPATCHAUTO_CHECK_COMPONENT=$1
  268.     OPATCHAUTO_CHECK_OH=$2
  269.     OPATCHAUTO_CHECK_PATCH=$3
  270.  
  271.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  272.  
  273.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  274.         echo FAILED
  275.         FAIL_COUNT=$((FAIL_COUNT+1))
  276.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCHAUTO_CHECK_COMPONENT @ ${OPATCHAUTO_CHECK_OH}:Patch $OPATCHAUTO_CHECK_PATCH not found"
  277.     else
  278.         echo OK
  279.     fi
  280.  
  281.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCHAUTO_RET
  282.  
  283. }
  284.  
  285. omspatchercheck () {
  286.     OMSPATCHER_CHECK_COMPONENT=$1
  287.     OMSPATCHER_CHECK_OH=$2
  288.     OMSPATCHER_CHECK_PATCH=$3
  289.  
  290.     OMSPATCHER_RET=`$OMSPATCHER lspatches -oh $OMSPATCHER_CHECK_OH | $GREP $OMSPATCHER_CHECK_PATCH`
  291.  
  292.     if [[ -z "$OMSPATCHER_RET" ]]; then
  293.         echo FAILED
  294.         FAIL_COUNT=$((FAIL_COUNT+1))
  295.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OMSPATCHER_CHECK_COMPONENT @ ${OMSPATCHER_CHECK_OH}:Patch $OMSPATCHER_CHECK_PATCH not found"
  296.     else
  297.         echo OK
  298.     fi
  299.  
  300.     test $VERBOSE_CHECKSEC -ge 2 && echo $OMSPATCHER_RET
  301.  
  302. }
  303.  
  304. certcheck () {
  305.     CERTCHECK_CHECK_COMPONENT=$1
  306.     CERTCHECK_CHECK_HOST=$2
  307.     CERTCHECK_CHECK_PORT=$3
  308.  
  309.     CERTCHECK_PROTOCOL="tls1"
  310.     if [[ $OPENSSL_ALLOW_TLS1_2_ONLY > 0 ]]; then
  311.         CERTCHECK_PROTOCOL=tls1_2
  312.     fi
  313.  
  314.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT, protocol $CERTCHECK_PROTOCOL)... "
  315.  
  316.  
  317.     OPENSSL_SELFSIGNED_COUNT=`echo Q | $OPENSSL s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT -$CERTCHECK_PROTOCOL 2>&1 | $GREP -ci "self signed certificate"`
  318.  
  319.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  320.         echo OK
  321.     else
  322.         echo FAILED - Found self-signed certificate
  323.         FAIL_COUNT=$((FAIL_COUNT+1))
  324.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$CERTCHECK_CHECK_COMPONENT @ ${CERTCHECK_CHECK_HOST}:${CERTCHECK_CHECK_PORT} found self-signed certificate"
  325.     fi
  326. }
  327.  
  328. democertcheck () {
  329.     DEMOCERTCHECK_CHECK_COMPONENT=$1
  330.     DEMOCERTCHECK_CHECK_HOST=$2
  331.     DEMOCERTCHECK_CHECK_PORT=$3
  332.  
  333.     DEMOCERTCHECK_PROTOCOL="tls1"
  334.     if [[ $OPENSSL_ALLOW_TLS1_2_ONLY > 0 ]]; then
  335.         DEMOCERTCHECK_PROTOCOL=tls1_2
  336.     fi
  337.  
  338.     echo -ne "\tChecking demo certificate at $DEMOCERTCHECK_CHECK_COMPONENT ($DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT, protocol $DEMOCERTCHECK_PROTOCOL)... "
  339.  
  340.     OPENSSL_DEMO_COUNT=`echo Q | $OPENSSL s_client -prexit -connect $DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT -$CERTCHECK_PROTOCOL 2>&1 | $GREP -ci "issuer=/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN"`
  341.  
  342.     if [[ $OPENSSL_DEMO_COUNT -eq "0" ]]; then
  343.         echo OK
  344.     else
  345.         echo FAILED - Found demonstration certificate
  346.         FAIL_COUNT=$((FAIL_COUNT+1))
  347.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$DEMOCERTCHECK_CHECK_COMPONENT @ ${DEMOCERTCHECK_CHECK_HOST}:${DEMOCERTCHECK_CHECK_PORT} found demonstration certificate"
  348.     fi
  349. }
  350.  
  351.  
  352. ciphercheck () {
  353.     OPENSSL_CHECK_COMPONENT=$1
  354.     OPENSSL_CHECK_HOST=$2
  355.     OPENSSL_CHECK_PORT=$3
  356.  
  357.     CIPHERCHECK_PROTOCOL="tls1"
  358.     if [[ $OPENSSL_ALLOW_TLS1_2_ONLY > 0 ]]; then
  359.         CIPHERCHECK_PROTOCOL=tls1_2
  360.     fi
  361.  
  362.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT, protocol $CIPHERCHECK_PROTOCOL)..."
  363.  
  364.     OPENSSL_LOW_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$CIPHERCHECK_PROTOCOL -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  365.  
  366.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  367.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  368.         FAIL_COUNT=$((FAIL_COUNT+1))
  369.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits LOW strength ciphers"
  370.     else
  371.         echo -e "\tOK"
  372.     fi
  373.  
  374.  
  375.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  376.  
  377.     OPENSSL_MEDIUM_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$CIPHERCHECK_PROTOCOL -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  378.  
  379.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  380.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  381.         FAIL_COUNT=$((FAIL_COUNT+1))
  382.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits MEDIUM strength ciphers"
  383.     else
  384.         echo -e "\tOK"
  385.     fi
  386.  
  387.  
  388.  
  389.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  390.  
  391.     OPENSSL_HIGH_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$CIPHERCHECK_PROTOCOL -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  392.  
  393.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  394.         echo -e "\tOK"
  395.     else
  396.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  397.         FAIL_COUNT=$((FAIL_COUNT+1))
  398.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Rejects HIGH strength ciphers"
  399.     fi
  400.     echo
  401. }
  402.  
  403. wlspatchcheck () {
  404.     WLSDIR=$1
  405.     WLSPATCH=$2
  406.  
  407.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $WLSPATCH`
  408.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  409.  
  410.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  411.         echo -e "\tOK"
  412.     else
  413.         echo -e "\tFAILED - PATCH NOT FOUND"
  414.         FAIL_COUNT=$((FAIL_COUNT+1))
  415.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WLSDIR:Patch $WLSPATCH not found"
  416.     fi
  417.  
  418.     test $VERBOSE_CHECKSEC -ge 2 && echo $WLSCHECK_RETURN
  419.    
  420. }
  421.  
  422. javacheck () {
  423.     WHICH_JAVA=$1
  424.     JAVA_DIR=$2
  425.  
  426.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  427.  
  428.     if [[ "$JAVACHECK_RETURN" == "1.7.0_111" ]]; then
  429.         echo -e "\tOK"
  430.     else
  431.         #echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  432.         echo -e "\tFAILED"
  433.         FAIL_COUNT=$((FAIL_COUNT+1))
  434.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_JAVA Java in ${JAVA_DIR}:Found incorrect version $JAVACHECK_RETURN"
  435.     fi
  436.     test $VERBOSE_CHECKSEC -ge 2 && echo $JAVACHECK_RETURN
  437. }
  438.  
  439. paramcheck () {
  440.     WHICH_PARAM=$1
  441.     WHICH_ORACLE_HOME=$2
  442.     WHICH_FILE=$3
  443.  
  444.     PARAMCHECK_PARAM_FOUND=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | $GREP -v '^#' | wc -l`
  445.  
  446.     if [[ $PARAMCHECK_PARAM_FOUND == "0" ]]; then
  447.         FAIL_COUNT=$((FAIL_COUNT+1))
  448.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:parameter not found"
  449.         return
  450.     fi
  451.  
  452.     PARAMCHECK_RETURN=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | $GREP -v '^#'  | awk -F= '{print $2}' | sed -e 's/\s//g'`
  453.     if [[ "$WHICH_PARAM" == "SSL_VERSION" ]]; then
  454.         if [[ "$PARAMCHECK_RETURN" == "1.0" ]]; then
  455.             echo -e "OK"
  456.         else
  457.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  458.             FAIL_COUNT=$((FAIL_COUNT+1))
  459.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  460.         fi
  461.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  462.     fi
  463.  
  464.     if [[ "$WHICH_PARAM" == "SSL_CIPHER_SUITES" ]]; then
  465.         if [[ "$PARAMCHECK_RETURN" == "(SSL_RSA_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_AES_256_CBC_SHA)" ]]; then
  466.             echo -e "OK"
  467.         else
  468.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  469.             FAIL_COUNT=$((FAIL_COUNT+1))
  470.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  471.         fi
  472.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  473.     fi
  474.  
  475.     if [[ "$WHICH_PARAM" == "SQLNET.ENCRYPTION_SERVER" ]]; then
  476.         echo $PARAMCHECK_RETURN | $GREP -iE '(requested|required)' >& /dev/null
  477.         PARAM_STATE=$?
  478.  
  479.         if [[ $PARAM_STATE == "0" ]]; then
  480.             echo -e "OK"
  481.         else
  482.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  483.             FAIL_COUNT=$((FAIL_COUNT+1))
  484.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  485.         fi
  486.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  487.     fi
  488.  
  489.     if [[ "$WHICH_PARAM" == "SQLNET.ENCRYPTION_CLIENT" ]]; then
  490.         echo $PARAMCHECK_RETURN | $GREP -iE '(requested|required)' >& /dev/null
  491.         PARAM_STATE=$?
  492.  
  493.         if [[ $PARAM_STATE == "0" ]]; then
  494.             echo -e "OK"
  495.         else
  496.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  497.             FAIL_COUNT=$((FAIL_COUNT+1))
  498.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  499.         fi
  500.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  501.     fi
  502.  
  503.     if [[ "$WHICH_PARAM" == "SQLNET.CRYPTO_CHECKSUM_SERVER" ]]; then
  504.         echo $PARAMCHECK_RETURN | $GREP -iE '(requested|required)' >& /dev/null
  505.         PARAM_STATE=$?
  506.  
  507.         if [[ $PARAM_STATE == "0" ]]; then
  508.             echo -e "OK"
  509.         else
  510.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  511.             FAIL_COUNT=$((FAIL_COUNT+1))
  512.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  513.         fi
  514.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  515.     fi
  516.  
  517.     if [[ "$WHICH_PARAM" == "SQLNET.CRYPTO_CHECKSUM_CLIENT" ]]; then
  518.         echo $PARAMCHECK_RETURN | $GREP -iE '(requested|required)' >& /dev/null
  519.         PARAM_STATE=$?
  520.  
  521.         if [[ $PARAM_STATE == "0" ]]; then
  522.             echo -e "OK"
  523.         else
  524.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  525.             FAIL_COUNT=$((FAIL_COUNT+1))
  526.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  527.         fi
  528.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  529.     fi
  530.  
  531.     if [[ "$WHICH_PARAM" == "SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER" ]]; then
  532.         echo $PARAMCHECK_RETURN | $GREP -iE 'MD5' >& /dev/null
  533.         PARAM_STATE=$?
  534.  
  535.         if [[ $PARAM_STATE == "1" ]]; then
  536.             echo -e "OK"
  537.         else
  538.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  539.             FAIL_COUNT=$((FAIL_COUNT+1))
  540.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value (do not use MD5, only use SHA1 and/or SHA256)"
  541.         fi
  542.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  543.     fi
  544.  
  545.     if [[ "$WHICH_PARAM" == "SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT" ]]; then
  546.         echo $PARAMCHECK_RETURN | $GREP -iE 'MD5' >& /dev/null
  547.         PARAM_STATE=$?
  548.  
  549.         if [[ $PARAM_STATE == "1" ]]; then
  550.             echo -e "OK"
  551.         else
  552.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  553.             FAIL_COUNT=$((FAIL_COUNT+1))
  554.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value (do not use MD5, only use SHA1 and/or SHA256)"
  555.         fi
  556.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  557.     fi
  558.  
  559.     if [[ "$WHICH_PARAM" == "SQLNET.ENCRYPTION_TYPES_SERVER" ]]; then
  560.         echo $PARAMCHECK_RETURN | $GREP -iE '([(,]des[),]|3des112|rc4|des40)' >& /dev/null
  561.         PARAM_STATE=$?
  562.  
  563.         if [[ $PARAM_STATE == "1" ]]; then
  564.             echo -e "OK"
  565.         else
  566.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  567.             FAIL_COUNT=$((FAIL_COUNT+1))
  568.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value (do not use DES, DES40, RC4_40, RC4_56, RC4_128, RC4_256, or 3DES112)"
  569.         fi
  570.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  571.     fi
  572.  
  573.     if [[ "$WHICH_PARAM" == "SQLNET.ENCRYPTION_TYPES_CLIENT" ]]; then
  574.         echo $PARAMCHECK_RETURN | $GREP -iE '([(,]des[),]|3des112|rc4|des40)' >& /dev/null
  575.         PARAM_STATE=$?
  576.  
  577.         if [[ $PARAM_STATE == "1" ]]; then
  578.             echo -e "OK"
  579.         else
  580.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  581.             FAIL_COUNT=$((FAIL_COUNT+1))
  582.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value (do not use DES, DES40, RC4_40, RC4_56, RC4_128, RC4_256, or 3DES112)"
  583.         fi
  584.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  585.     fi
  586. }
  587.  
  588.  
  589. ### MAIN SCRIPT HERE
  590.  
  591.  
  592. echo -e "Performing EM13c security checkup version $VERSION on $OMSHOST at `date`.\n"
  593.  
  594. echo "Using port definitions from configuration files "
  595. echo -e "\t/etc/oragchomelist"
  596. echo -e "\t$EMGC_PROPS"
  597. echo -e "\t$EMBIP_PROPS"
  598. echo
  599. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  600. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  601. echo -e "\tBIPublisherOHS port found at $OMSHOST:$PORT_BIP_OHS"
  602. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  603. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  604. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  605. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  606. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  607. echo
  608. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  609. echo
  610. echo -e "\tUsing OPENSSL=$OPENSSL (has TLS1_2=$OPENSSL_HAS_TLS1_2)"
  611.  
  612. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  613.     echo -e "\tRepository DB on OMS server, will check patches/parameters in $REPOS_DB_HOME"
  614. fi
  615.  
  616. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  617.  
  618. echo -e "\n\t(1a) Forbid SSLv2 connections"
  619. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  620. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  621. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  622. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl2
  623. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  624. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  625. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  626. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  627. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  628.  
  629. echo -e "\n\t(1b) Forbid SSLv3 connections"
  630. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  631. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  632. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  633. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl3
  634. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  635. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  636. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  637. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  638. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  639.  
  640. echo -e "\n\t(1c) $OPENSSL_PERMIT_FORBID_NON_TLS1_2 TLSv1 connections"
  641. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  642. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  643. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  644. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1
  645. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  646. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  647. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  648. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  649. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  650.  
  651. echo -e "\n\t(1c) $OPENSSL_PERMIT_FORBID_NON_TLS1_2 TLSv1.1 connections"
  652. sslcheck Agent $OMSHOST $PORT_AGENT tls1_1
  653. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1_1
  654. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1_1
  655. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1_1
  656. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1_1
  657. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1_1
  658. sslcheck OMSupload $OMSHOST $PORT_UPL tls1_1
  659. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  660. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1_1
  661.  
  662. echo -e "\n\t(1c) Permit TLSv1.2 connections"
  663. sslcheck Agent $OMSHOST $PORT_AGENT tls1_2
  664. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1_2
  665. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1_2
  666. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1_2
  667. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1_2
  668. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1_2
  669. sslcheck OMSupload $OMSHOST $PORT_UPL tls1_2
  670. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  671. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1_2
  672.  
  673. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 2138391.1, 1067411.1)"
  674. ciphercheck Agent $OMSHOST $PORT_AGENT
  675. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  676. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  677. ciphercheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  678. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  679. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  680. ciphercheck OMSupload $OMSHOST $PORT_UPL
  681. #ciphercheck OPMN $OMSHOST $PORT_OPMN
  682. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  683.  
  684. echo -e "\n(3) Checking self-signed and demonstration certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  685. certcheck Agent $OMSHOST $PORT_AGENT
  686. democertcheck Agent $OMSHOST $PORT_AGENT
  687. certcheck BIPublisher $OMSHOST $PORT_BIP
  688. democertcheck BIPublisher $OMSHOST $PORT_BIP
  689. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  690. democertcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  691. certcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  692. democertcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  693. certcheck OMSconsole $OMSHOST $PORT_OMS
  694. democertcheck OMSconsole $OMSHOST $PORT_OMS
  695. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  696. democertcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  697. certcheck OMSupload $OMSHOST $PORT_UPL
  698. democertcheck OMSupload $OMSHOST $PORT_UPL
  699. #certcheck OPMN $OMSHOST $PORT_OPMN
  700. #democertcheck OPMN $OMSHOST $PORT_OPMN
  701. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  702. democertcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  703.  
  704.  
  705. echo -e "\n(4) Checking EM13c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  706.  
  707. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  708.  
  709.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  710.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160119 (JAN2016) (21948354)... "
  711.         #opatchcheck ReposDBHome $REPOS_DB_HOME 21948354
  712.  
  713.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160419 (APR2016) (22291127)... "
  714.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22291127
  715.  
  716.         echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160719 (JUL2016) (23054246)... "
  717.         opatchcheck ReposDBHome $REPOS_DB_HOME 23054246
  718.  
  719.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160119 DATABASE PSU (JAN2016) (22139226)... "
  720.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22139226
  721.  
  722.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160419 DATABASE PSU (APR2016) (22674709)... "
  723.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22674709
  724.  
  725.         echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160719 DATABASE PSU (JUL2016) (23177536)... "
  726.         opatchcheck ReposDBHome $REPOS_DB_HOME 23177536
  727.     fi
  728.  
  729.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.ENCRYPTION_TYPES_SERVER parameter (76629.1, 2167682.1)... "
  730.     paramcheck SQLNET.ENCRYPTION_TYPES_SERVER $REPOS_DB_HOME sqlnet.ora
  731.  
  732.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.ENCRYPTION_SERVER parameter (76629.1, 2167682.1)... "
  733.     paramcheck SQLNET.ENCRYPTION_SERVER $REPOS_DB_HOME sqlnet.ora
  734.  
  735.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.ENCRYPTION_TYPES_CLIENT parameter (76629.1, 2167682.1)... "
  736.     paramcheck SQLNET.ENCRYPTION_TYPES_CLIENT $REPOS_DB_HOME sqlnet.ora
  737.  
  738.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.ENCRYPTION_CLIENT parameter (76629.1, 2167682.1)... "
  739.     paramcheck SQLNET.ENCRYPTION_CLIENT $REPOS_DB_HOME sqlnet.ora
  740.  
  741.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER parameter (76629.1, 2167682.1)... "
  742.     paramcheck SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER $REPOS_DB_HOME sqlnet.ora
  743.  
  744.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.CRYPTO_CHECKSUM_SERVER parameter (76629.1, 2167682.1)... "
  745.     paramcheck SQLNET.CRYPTO_CHECKSUM_SERVER $REPOS_DB_HOME sqlnet.ora
  746.  
  747.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT parameter (76629.1, 2167682.1)... "
  748.     paramcheck SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT $REPOS_DB_HOME sqlnet.ora
  749.  
  750.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SQLNET.CRYPTO_CHECKSUM_CLIENT parameter (76629.1, 2167682.1)... "
  751.     paramcheck SQLNET.CRYPTO_CHECKSUM_CLIENT $REPOS_DB_HOME sqlnet.ora
  752.  
  753.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_VERSION parameter (1545816.1)... "
  754.     paramcheck SSL_VERSION $REPOS_DB_HOME sqlnet.ora
  755.  
  756.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  757.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME sqlnet.ora
  758.  
  759.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_VERSION parameter (1545816.1)... "
  760.     paramcheck SSL_VERSION $REPOS_DB_HOME listener.ora
  761.  
  762.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  763.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME listener.ora
  764. fi
  765.  
  766. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160331 (22823268)... "
  767. #opatchcheck Agent $AGENT_HOME 22823268
  768.  
  769. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160429 (23030165)... "
  770. #opatchcheck Agent $AGENT_HOME 23030165
  771.  
  772. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160531 (23208577)... "
  773. #opatchcheck Agent $AGENT_HOME 23208577
  774.  
  775. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160719 (23592254)... "
  776. #opatchcheck Agent $AGENT_HOME 23592254
  777.  
  778. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160816 (24308442)... "
  779. #opatchcheck Agent $AGENT_HOME 24308442
  780.  
  781. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160920 (24437699)... "
  782. opatchcheck Agent $AGENT_HOME 24437699
  783.  
  784. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22920712)... "
  785. #opatchcheck Agent $AGENT_HOME 22920712
  786.  
  787. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095221)... "
  788. #opatchcheck Agent $AGENT_HOME 23095221
  789.  
  790. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294830)... "
  791. #opatchcheck Agent $AGENT_HOME 23294830
  792.  
  793. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697777)... "
  794. #opatchcheck Agent $AGENT_HOME 23697777
  795.  
  796. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160816 MONITORING (24364560)... "
  797. #opatchcheck Agent $AGENT_HOME 24364560
  798.  
  799. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160920 MONITORING (24545984)... "
  800. opatchcheck Agent $AGENT_HOME 24545984
  801.  
  802. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294839)... "
  803. #opatchcheck Agent $AGENT_HOME 23294839
  804.  
  805. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160920 DISCOVERY (24545989)... "
  806. opatchcheck Agent $AGENT_HOME 24545989
  807.  
  808. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22936491)... "
  809. #opatchcheck Agent $AGENT_HOME 22936491
  810.  
  811. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095280)... "
  812. #opatchcheck Agent $AGENT_HOME 23095280
  813.  
  814. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294872)... "
  815. #opatchcheck Agent $AGENT_HOME 23294872
  816.  
  817. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697781)... "
  818. #opatchcheck Agent $AGENT_HOME 23697781
  819.  
  820. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160920 MONITORING (24658006)... "
  821. opatchcheck Agent $AGENT_HOME 24658006
  822.  
  823. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22823189)... "
  824. #opatchcheck Agent $AGENT_HOME 22823189
  825.  
  826. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23208587)... "
  827. #opatchcheck Agent $AGENT_HOME 23208587
  828.  
  829. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697783)... "
  830. opatchcheck Agent $AGENT_HOME 23697783
  831.  
  832. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294895)... "
  833. opatchcheck Agent $AGENT_HOME 23294895
  834.  
  835. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160331 (22920724)... "
  836. #omspatchercheck OMS $OMS_HOME 22920724
  837.  
  838. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM OH PLUGIN BUNDLE PATCH 13.1.1.0.160429 (23135564)... "
  839. opatchcheck Agent $AGENT_HOME 23135564
  840.  
  841. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160429 (23095307)... "
  842. #omspatchercheck OMS $OMS_HOME 23095307
  843.  
  844. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160531 (23294904)... "
  845. #omspatchercheck OMS $OMS_HOME 23294904
  846.  
  847. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160719 (23697785)... "
  848. #omspatchercheck OMS $OMS_HOME 23697785
  849.  
  850. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160816 (24364619)... "
  851. #omspatchercheck OMS $OMS_HOME 24364619
  852.  
  853. echo -ne "\n\t(4d) *UPDATED* OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160920 (24546113)... "
  854. omspatchercheck OMS $OMS_HOME 24546113
  855.  
  856. #echo -ne "\n\t(4e) ($MW_HOME) WLS PATCH SET UPDATE 12.1.3.0.160419 (22505404)... "
  857. #opatchcheck WLS $MW_HOME 22505404
  858.  
  859. echo -ne "\n\t(4d) ($MW_HOME) WLS PATCH SET UPDATE 12.1.3.0.160719 (23094292)... "
  860. opatchcheck WLS $MW_HOME 23094292
  861.  
  862. echo -ne "\n\t(4f) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM PATCH SET UPDATE 13.1.0.0.160719 (23134365)... "
  863. omspatchercheck OMS $MW_HOME 23134365
  864.  
  865. echo -e "\n(5) Checking EM13c Java patch levels against $PATCHDATE baseline (see notes 1492980.1, 1616397.1)"
  866.  
  867. echo -ne "\n\t(5a) WLS ($MW_HOME/oracle_common/jdk) JAVA SE JDK VERSION 1.7.0-111 (13079846)... "
  868. javacheck WLSJAVA $MW_HOME/oracle_common/jdk
  869.  
  870.  
  871. echo
  872. echo
  873.  
  874. if [[ $FAIL_COUNT -gt "0" ]]; then
  875.     echo "Failed test count: $FAIL_COUNT - Review output"
  876.     test $VERBOSE_CHECKSEC -ge 1 && echo -e $FAIL_TESTS
  877. else
  878.     echo "All tests succeeded."
  879. fi
  880.  
  881. echo
  882. echo "Visit https://pardydba.wordpress.com/2016/04/05/securing-oracle-enterprise-manager-13c/ for the latest version."
  883. echo
  884.  
  885. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!