API tools faq
paste
Advertisement
Guest User

EM13c TLS Check Script v0.7

a guest
Aug 19th, 2016
93
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 26.78 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM13c environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It will also validate your
  6. # system comparing against the latest recommended patches and also flags
  7. # the use of demo or self-signed certificates.  Latest enhancement adds
  8. # checks for the EM13c WLS Java JDK version.
  9. #
  10. # Released  v0.1:  Initial beta release 5 Apr 2016
  11. # Changes   v0.2:  Updated for current patches
  12. # Changes   v0.3:  APR2016 patchset added
  13. # Changes   v0.4:  Plugin updates for 20160429
  14. # Changes   v0.5:  Plugin updates for 20160531
  15. # Changes   v0.6:  Plugin/OMS/DB updates for 20160719 CPU + Java check
  16. # Changes   v0.7:  Plugin/OMS updates for 20160816 bundles
  17. #                  Support for SLES11 OpenSSL 1 parallel package
  18. #                  Add checks for TLSv1.1, TLSv1.2
  19. #                  Permit only TLSv1.2 where supported by OpenSSL
  20. #
  21. # From: @BrianPardy on Twitter
  22. #
  23. # Known functional on Linux x86-64, may work on Solaris and AIX.
  24. #
  25. # Run this script as the Oracle EM13c software owner, with your environment
  26. # fully up and running.
  27. #
  28. # Thanks to Dave Corsar, who tested a previous version on Solaris and
  29. # let me know the changes needed to make the script work on Solaris.
  30. #
  31. # Thanks to opa tropa who confirmed AIX functionality on a previous
  32. # version and noted the use of GNU extensions to grep, which I have
  33. # since removed.
  34. #
  35. # Dedicated to our two Lhasa Apsos:
  36. #   Lucy (6/13/1998 - 3/13/2015)
  37. #   Ethel (6/13/1998 - 7/31/2015)
  38. #
  39. #
  40.  
  41. SCRIPTNAME=`basename $0`
  42. PATCHDATE="16 Aug 2016"
  43. OMSHOST=`hostname -f`
  44. VERSION="0.7"
  45. FAIL_COUNT=0
  46. FAIL_TESTS=""
  47.  
  48. RUN_DB_CHECK=0
  49. VERBOSE_CHECKSEC=2
  50.  
  51. HOST_OS=`uname -s`
  52. HOST_ARCH=`uname -m`
  53.  
  54. ORAGCHOMELIST="/etc/oragchomelist"
  55. ORATAB="/etc/oratab"
  56. OPENSSL=`which openssl`
  57.  
  58. if [[ -x "/usr/bin/openssl1" && -f "/etc/SuSE-release" ]]; then
  59.     OPENSSL=`which openssl1`
  60. fi
  61.  
  62. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  63.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  64. fi
  65.  
  66. if [[ ! -r $ORATAB ]]; then                 # Solaris
  67.     ORATAB="/var/opt/oracle/oratab"
  68. fi
  69.  
  70. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  71.     GREP=/usr/sfw/bin/gegrep
  72. else
  73.     GREP=`which grep`
  74. fi
  75.  
  76. OPENSSL_HAS_TLS1_1=`$OPENSSL s_client help 2>&1 | $GREP -c tls1_1`
  77. OPENSSL_HAS_TLS1_2=`$OPENSSL s_client help 2>&1 | $GREP -c tls1_2`
  78. OPENSSL_ALLOW_TLS1_2_ONLY=$OPENSSL_HAS_TLS1_2
  79.  
  80. OPENSSL_PERMIT_FORBID_NON_TLS1_2="Permit"
  81.  
  82. if [[ $OPENSSL_ALLOW_TLS1_2_ONLY -gt 0 ]]; then
  83.     OPENSSL_PERMIT_FORBID_NON_TLS1_2="Forbid"
  84. fi
  85.  
  86.  
  87.  
  88. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  89.  
  90. if [[ "$OMS_HOME" == "." ]]; then
  91.     OMS_HOME=`cat $ORAGCHOMELIST | head -n 1`
  92. fi
  93.  
  94.  
  95. OPATCH="$OMS_HOME/OPatch/opatch"
  96. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  97. OMSPATCHER="$OMS_HOME/OMSPatcher/omspatcher"
  98. OMSORAINST="$OMS_HOME/oraInst.loc"
  99. ORAINVENTORY=`$GREP inventory_loc $OMSORAINST | awk -F= '{print $2}'`
  100.  
  101. MW_HOME=$OMS_HOME
  102. COMMON_HOME="$MW_HOME/oracle_common"
  103.  
  104. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent13c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  105.  
  106.  
  107. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  108.  
  109. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  110. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  111. #OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  112. #OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  113.  
  114. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  115. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  116. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  117. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  118. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  119. PORT_BIP_OHS=`$GREP BIP_HTTPS_OHS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  120. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  121. #PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  122. #PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  123. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  124.  
  125. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  126. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  127. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  128.  
  129. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  130.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  131.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  132.  
  133.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  134.         RUN_DB_CHECK=1
  135.     fi
  136.  
  137.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  138.         RUN_DB_CHECK=1
  139.     fi
  140.  
  141.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  142.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported by this script for now"
  143.     fi
  144. fi
  145.  
  146.  
  147.  
  148. sslcheck () {
  149.     OPENSSL_CHECK_COMPONENT=$1
  150.     OPENSSL_CHECK_HOST=$2
  151.     OPENSSL_CHECK_PORT=$3
  152.     OPENSSL_CHECK_PROTO=$4
  153.     OPENSSL_AVAILABLE_OR_DISABLED="disabled"
  154.  
  155.     if [[ $OPENSSL_CHECK_PROTO == "tls1_1" && $OPENSSL_HAS_TLS1_1 == 0 ]]; then
  156.         echo -en "\tYour OpenSSL ($OPENSSL) does not support $OPENSSL_CHECK_PROTO. Skipping $OPENSSL_CHECK_COMPONENT\n"
  157.         return
  158.     fi
  159.  
  160.     if [[ $OPENSSL_CHECK_PROTO == "tls1_2" && $OPENSSL_HAS_TLS1_2 == 0 ]]; then
  161.         echo -en "\tYour OpenSSL ($OPENSSL) does not support $OPENSSL_CHECK_PROTO. Skipping $OPENSSL_CHECK_COMPONENT\n"
  162.         return
  163.     fi
  164.  
  165.  
  166.     OPENSSL_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  167.    
  168.  
  169.     if [[ $OPENSSL_CHECK_PROTO == "tls1" || $OPENSSL_CHECK_PROTO == "tls1_1" || $OPENSSL_CHECK_PROTO == "tls1_2" ]]; then
  170.  
  171.         if [[ $OPENSSL_ALLOW_TLS1_2_ONLY > 0 ]]; then
  172.             if [[ $OPENSSL_CHECK_PROTO == "tls1_2" ]]; then
  173.                 OPENSSL_AVAILABLE_OR_DISABLED="available"
  174.             fi
  175.         fi
  176.  
  177.         if [[ $OPENSSL_ALLOW_TLS1_2_ONLY == 0 ]]; then
  178.             OPENSSL_AVAILABLE_OR_DISABLED="available"
  179.         fi
  180.  
  181.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO $OPENSSL_AVAILABLE_OR_DISABLED for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  182.  
  183.         if [[ $OPENSSL_AVAILABLE_OR_DISABLED == "available" ]]; then
  184.             if [[ $OPENSSL_RETURN -eq "0" ]]; then
  185.                 echo OK
  186.             else
  187.                 echo FAILED
  188.                 FAIL_COUNT=$((FAIL_COUNT+1))
  189.                 FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection failed"
  190.             fi
  191.         fi
  192.  
  193.         if [[ $OPENSSL_AVAILABLE_OR_DISABLED == "disabled" ]]; then
  194.             if [[ $OPENSSL_RETURN -ne "0" ]]; then
  195.                 echo OK
  196.             else
  197.                 echo FAILED
  198.                 FAIL_COUNT=$((FAIL_COUNT+1))
  199.                 FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection allowed"
  200.             fi
  201.         fi
  202.  
  203.  
  204.     fi
  205.  
  206.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  207.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO $OPENSSL_AVAILABLE_OR_DISABLED for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  208.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  209.             echo OK
  210.         else
  211.             echo FAILED
  212.             FAIL_COUNT=$((FAIL_COUNT+1))
  213.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection succeeded"
  214.         fi
  215.     fi
  216. }
  217.  
  218. opatchcheck () {
  219.     OPATCH_CHECK_COMPONENT=$1
  220.     OPATCH_CHECK_OH=$2
  221.     OPATCH_CHECK_PATCH=$3
  222.  
  223.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  224.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  225.     else
  226.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  227.     fi
  228.  
  229.     if [[ -z "$OPATCH_RET" ]]; then
  230.         echo FAILED
  231.         FAIL_COUNT=$((FAIL_COUNT+1))
  232.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCH_CHECK_COMPONENT @ ${OPATCH_CHECK_OH}:Patch $OPATCH_CHECK_PATCH not found"
  233.     else
  234.         echo OK
  235.     fi
  236.  
  237.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCH_RET
  238.  
  239. }
  240.  
  241. opatchautocheck () {
  242.     OPATCHAUTO_CHECK_COMPONENT=$1
  243.     OPATCHAUTO_CHECK_OH=$2
  244.     OPATCHAUTO_CHECK_PATCH=$3
  245.  
  246.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  247.  
  248.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  249.         echo FAILED
  250.         FAIL_COUNT=$((FAIL_COUNT+1))
  251.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCHAUTO_CHECK_COMPONENT @ ${OPATCHAUTO_CHECK_OH}:Patch $OPATCHAUTO_CHECK_PATCH not found"
  252.     else
  253.         echo OK
  254.     fi
  255.  
  256.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCHAUTO_RET
  257.  
  258. }
  259.  
  260. omspatchercheck () {
  261.     OMSPATCHER_CHECK_COMPONENT=$1
  262.     OMSPATCHER_CHECK_OH=$2
  263.     OMSPATCHER_CHECK_PATCH=$3
  264.  
  265.     OMSPATCHER_RET=`$OMSPATCHER lspatches -oh $OMSPATCHER_CHECK_OH | $GREP $OMSPATCHER_CHECK_PATCH`
  266.  
  267.     if [[ -z "$OMSPATCHER_RET" ]]; then
  268.         echo FAILED
  269.         FAIL_COUNT=$((FAIL_COUNT+1))
  270.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OMSPATCHER_CHECK_COMPONENT @ ${OMSPATCHER_CHECK_OH}:Patch $OMSPATCHER_CHECK_PATCH not found"
  271.     else
  272.         echo OK
  273.     fi
  274.  
  275.     test $VERBOSE_CHECKSEC -ge 2 && echo $OMSPATCHER_RET
  276.  
  277. }
  278.  
  279. certcheck () {
  280.     CERTCHECK_CHECK_COMPONENT=$1
  281.     CERTCHECK_CHECK_HOST=$2
  282.     CERTCHECK_CHECK_PORT=$3
  283.  
  284.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT)... "
  285.  
  286.     OPENSSL_SELFSIGNED_COUNT=`echo Q | $OPENSSL s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT -tls1 2>&1 | $GREP -ci "self signed certificate"`
  287.  
  288.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  289.         echo OK
  290.     else
  291.         echo FAILED - Found self-signed certificate
  292.         FAIL_COUNT=$((FAIL_COUNT+1))
  293.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$CERTCHECK_CHECK_COMPONENT @ ${CERTCHECK_CHECK_HOST}:${CERTCHECK_CHECK_PORT} found self-signed certificate"
  294.     fi
  295. }
  296.  
  297. democertcheck () {
  298.     DEMOCERTCHECK_CHECK_COMPONENT=$1
  299.     DEMOCERTCHECK_CHECK_HOST=$2
  300.     DEMOCERTCHECK_CHECK_PORT=$3
  301.  
  302.     echo -ne "\tChecking demo certificate at $DEMOCERTCHECK_CHECK_COMPONENT ($DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT)... "
  303.  
  304.     OPENSSL_DEMO_COUNT=`echo Q | $OPENSSL s_client -prexit -connect $DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT -tls1 2>&1 | $GREP -ci "issuer=/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN"`
  305.  
  306.     if [[ $OPENSSL_DEMO_COUNT -eq "0" ]]; then
  307.         echo OK
  308.     else
  309.         echo FAILED - Found demonstration certificate
  310.         FAIL_COUNT=$((FAIL_COUNT+1))
  311.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$DEMOCERTCHECK_CHECK_COMPONENT @ ${DEMOCERTCHECK_CHECK_HOST}:${DEMOCERTCHECK_CHECK_PORT} found demonstration certificate"
  312.     fi
  313. }
  314.  
  315.  
  316. ciphercheck () {
  317.     OPENSSL_CHECK_COMPONENT=$1
  318.     OPENSSL_CHECK_HOST=$2
  319.     OPENSSL_CHECK_PORT=$3
  320.  
  321.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  322.  
  323.     OPENSSL_LOW_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  324.  
  325.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  326.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  327.         FAIL_COUNT=$((FAIL_COUNT+1))
  328.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits LOW strength ciphers"
  329.     else
  330.         echo -e "\tOK"
  331.     fi
  332.  
  333.  
  334.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  335.  
  336.     OPENSSL_MEDIUM_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  337.  
  338.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  339.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  340.         FAIL_COUNT=$((FAIL_COUNT+1))
  341.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits MEDIUM strength ciphers"
  342.     else
  343.         echo -e "\tOK"
  344.     fi
  345.  
  346.  
  347.  
  348.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  349.  
  350.     OPENSSL_HIGH_RETURN=`echo Q | $OPENSSL s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  351.  
  352.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  353.         echo -e "\tOK"
  354.     else
  355.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  356.         FAIL_COUNT=$((FAIL_COUNT+1))
  357.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Rejects HIGH strength ciphers"
  358.     fi
  359.     echo
  360. }
  361.  
  362. wlspatchcheck () {
  363.     WLSDIR=$1
  364.     WLSPATCH=$2
  365.  
  366.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $WLSPATCH`
  367.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  368.  
  369.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  370.         echo -e "\tOK"
  371.     else
  372.         echo -e "\tFAILED - PATCH NOT FOUND"
  373.         FAIL_COUNT=$((FAIL_COUNT+1))
  374.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WLSDIR:Patch $WLSPATCH not found"
  375.     fi
  376.  
  377.     test $VERBOSE_CHECKSEC -ge 2 && echo $WLSCHECK_RETURN
  378.    
  379. }
  380.  
  381. javacheck () {
  382.     WHICH_JAVA=$1
  383.     JAVA_DIR=$2
  384.  
  385.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  386.  
  387.     if [[ "$JAVACHECK_RETURN" == "1.7.0_111" ]]; then
  388.         echo -e "\tOK"
  389.     else
  390.         #echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  391.         echo -e "\tFAILED"
  392.         FAIL_COUNT=$((FAIL_COUNT+1))
  393.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_JAVA Java in ${JAVA_DIR}:Found incorrect version $JAVACHECK_RETURN"
  394.     fi
  395.     test $VERBOSE_CHECKSEC -ge 2 && echo $JAVACHECK_RETURN
  396. }
  397.  
  398. paramcheck () {
  399.     WHICH_PARAM=$1
  400.     WHICH_ORACLE_HOME=$2
  401.     WHICH_FILE=$3
  402.  
  403.     PARAMCHECK_RETURN=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | awk -F= '{print $2}' | sed -e 's/\s//g'`
  404.     if [[ "$WHICH_PARAM" == "SSL_VERSION" ]]; then
  405.         if [[ "$PARAMCHECK_RETURN" == "1.0" ]]; then
  406.             echo -e "OK"
  407.         else
  408.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  409.             FAIL_COUNT=$((FAIL_COUNT+1))
  410.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  411.         fi
  412.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  413.     fi
  414.  
  415.     if [[ "$WHICH_PARAM" == "SSL_CIPHER_SUITES" ]]; then
  416.         if [[ "$PARAMCHECK_RETURN" == "(SSL_RSA_WITH_AES128_CBC_SHA,SSL_RSA_WITH_AES256_CBC_SHA)" ]]; then
  417.             echo -e "OK"
  418.         else
  419.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  420.             FAIL_COUNT=$((FAIL_COUNT+1))
  421.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  422.         fi
  423.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  424.     fi
  425. }
  426.  
  427.  
  428. ### MAIN SCRIPT HERE
  429.  
  430.  
  431. echo -e "Performing EM13c security checkup version $VERSION on $OMSHOST at `date`.\n"
  432.  
  433. echo "Using port definitions from configuration files "
  434. echo -e "\t/etc/oragchomelist"
  435. echo -e "\t$EMGC_PROPS"
  436. echo -e "\t$EMBIP_PROPS"
  437. echo
  438. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  439. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  440. echo -e "\tBIPublisherOHS port found at $OMSHOST:$PORT_BIP_OHS"
  441. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  442. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  443. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  444. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  445. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  446. echo
  447. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  448.  
  449. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  450.     echo -e "\tRepository DB on OMS server, will check patches/parameters in $REPOS_DB_HOME"
  451. fi
  452.  
  453. #exit 0
  454.  
  455. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  456.  
  457. echo -e "\n\t(1a) Forbid SSLv2 connections"
  458. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  459. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  460. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  461. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl2
  462. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  463. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  464. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  465. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  466. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  467.  
  468. echo -e "\n\t(1b) Forbid SSLv3 connections"
  469. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  470. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  471. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  472. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl3
  473. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  474. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  475. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  476. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  477. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  478.  
  479. echo -e "\n\t(1c) $OPENSSL_PERMIT_FORBID_NON_TLS1_2 TLSv1 connections"
  480. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  481. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  482. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  483. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1
  484. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  485. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  486. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  487. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  488. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  489.  
  490. echo -e "\n\t(1c) $OPENSSL_PERMIT_FORBID_NON_TLS1_2 TLSv1.1 connections"
  491. sslcheck Agent $OMSHOST $PORT_AGENT tls1_1
  492. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1_1
  493. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1_1
  494. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1_1
  495. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1_1
  496. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1_1
  497. sslcheck OMSupload $OMSHOST $PORT_UPL tls1_1
  498. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  499. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1_1
  500.  
  501. echo -e "\n\t(1c) Permit TLSv1.2 connections"
  502. sslcheck Agent $OMSHOST $PORT_AGENT tls1_2
  503. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1_2
  504. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1_2
  505. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1_2
  506. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1_2
  507. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1_2
  508. sslcheck OMSupload $OMSHOST $PORT_UPL tls1_2
  509. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  510. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1_2
  511.  
  512. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 2138391.1, 1067411.1)"
  513. ciphercheck Agent $OMSHOST $PORT_AGENT
  514. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  515. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  516. ciphercheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  517. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  518. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  519. ciphercheck OMSupload $OMSHOST $PORT_UPL
  520. #ciphercheck OPMN $OMSHOST $PORT_OPMN
  521. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  522.  
  523. echo -e "\n(3) Checking self-signed and demonstration certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  524. certcheck Agent $OMSHOST $PORT_AGENT
  525. democertcheck Agent $OMSHOST $PORT_AGENT
  526. certcheck BIPublisher $OMSHOST $PORT_BIP
  527. democertcheck BIPublisher $OMSHOST $PORT_BIP
  528. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  529. democertcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  530. certcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  531. democertcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  532. certcheck OMSconsole $OMSHOST $PORT_OMS
  533. democertcheck OMSconsole $OMSHOST $PORT_OMS
  534. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  535. democertcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  536. certcheck OMSupload $OMSHOST $PORT_UPL
  537. democertcheck OMSupload $OMSHOST $PORT_UPL
  538. #certcheck OPMN $OMSHOST $PORT_OPMN
  539. #democertcheck OPMN $OMSHOST $PORT_OPMN
  540. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  541. democertcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  542.  
  543.  
  544. echo -e "\n(4) Checking EM13c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  545.  
  546. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  547.  
  548.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  549.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160119 (JAN2016) (21948354)... "
  550.         #opatchcheck ReposDBHome $REPOS_DB_HOME 21948354
  551.  
  552.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160419 (APR2016) (22291127)... "
  553.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22291127
  554.  
  555.         echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160719 (JUL2016) (23054246)... "
  556.         opatchcheck ReposDBHome $REPOS_DB_HOME 23054246
  557.  
  558.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160119 DATABASE PSU (JAN2016) (22139226)... "
  559.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22139226
  560.  
  561.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160419 DATABASE PSU (APR2016) (22674709)... "
  562.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22674709
  563.  
  564.         echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160719 DATABASE PSU (JUL2016) (23177536)... "
  565.         opatchcheck ReposDBHome $REPOS_DB_HOME 23177536
  566.     fi
  567.  
  568.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_VERSION parameter (1545816.1)... "
  569.     paramcheck SSL_VERSION $REPOS_DB_HOME sqlnet.ora
  570.  
  571.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  572.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME sqlnet.ora
  573.  
  574.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_VERSION parameter (1545816.1)... "
  575.     paramcheck SSL_VERSION $REPOS_DB_HOME listener.ora
  576.  
  577.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  578.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME listener.ora
  579. fi
  580.  
  581. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160331 (22823268)... "
  582. #opatchcheck Agent $AGENT_HOME 22823268
  583.  
  584. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160429 (23030165)... "
  585. #opatchcheck Agent $AGENT_HOME 23030165
  586.  
  587. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160531 (23208577)... "
  588. #opatchcheck Agent $AGENT_HOME 23208577
  589.  
  590. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160719 (23592254)... "
  591. #opatchcheck Agent $AGENT_HOME 23592254
  592.  
  593. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160816 (24308442)... "
  594. opatchcheck Agent $AGENT_HOME 24308442
  595.  
  596. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22920712)... "
  597. #opatchcheck Agent $AGENT_HOME 22920712
  598.  
  599. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095221)... "
  600. #opatchcheck Agent $AGENT_HOME 23095221
  601.  
  602. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294830)... "
  603. #opatchcheck Agent $AGENT_HOME 23294830
  604.  
  605. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697777)... "
  606. #opatchcheck Agent $AGENT_HOME 23697777
  607.  
  608. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160816 MONITORING (24364560)... "
  609. opatchcheck Agent $AGENT_HOME 24364560
  610.  
  611. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294839)... "
  612. opatchcheck Agent $AGENT_HOME 23294839
  613.  
  614. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22936491)... "
  615. #opatchcheck Agent $AGENT_HOME 22936491
  616.  
  617. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095280)... "
  618. #opatchcheck Agent $AGENT_HOME 23095280
  619.  
  620. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294872)... "
  621. #opatchcheck Agent $AGENT_HOME 23294872
  622.  
  623. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697781)... "
  624. opatchcheck Agent $AGENT_HOME 23697781
  625.  
  626. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22823189)... "
  627. #opatchcheck Agent $AGENT_HOME 22823189
  628.  
  629. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23208587)... "
  630. #opatchcheck Agent $AGENT_HOME 23208587
  631.  
  632. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697783)... "
  633. opatchcheck Agent $AGENT_HOME 23697783
  634.  
  635. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294895)... "
  636. opatchcheck Agent $AGENT_HOME 23294895
  637.  
  638. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160331 (22920724)... "
  639. #omspatchercheck OMS $OMS_HOME 22920724
  640.  
  641. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM OH PLUGIN BUNDLE PATCH 13.1.1.0.160429 (23135564)... "
  642. opatchcheck Agent $AGENT_HOME 23135564
  643.  
  644. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160429 (23095307)... "
  645. #omspatchercheck OMS $OMS_HOME 23095307
  646.  
  647. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160531 (23294904)... "
  648. #omspatchercheck OMS $OMS_HOME 23294904
  649.  
  650. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160719 (23697785)... "
  651. #omspatchercheck OMS $OMS_HOME 23697785
  652.  
  653. echo -ne "\n\t(4d) *UPDATED* OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160816 (24364619)... "
  654. omspatchercheck OMS $OMS_HOME 24364619
  655.  
  656. #echo -ne "\n\t(4e) ($MW_HOME) WLS PATCH SET UPDATE 12.1.3.0.160419 (22505404)... "
  657. #opatchcheck WLS $MW_HOME 22505404
  658.  
  659. echo -ne "\n\t(4e) ($MW_HOME) WLS PATCH SET UPDATE 12.1.3.0.160719 (23094292)... "
  660. opatchcheck WLS $MW_HOME 23094292
  661.  
  662. echo -ne "\n\t(4f) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM PATCH SET UPDATE 13.1.0.0.160719 (23134365)... "
  663. omspatchercheck OMS $MW_HOME 23134365
  664.  
  665. echo -e "\n(5) Checking EM13c Java patch levels against $PATCHDATE baseline (see notes 1492980.1, 1616397.1)"
  666.  
  667. echo -ne "\n\t(5a) WLS ($MW_HOME/oracle_common/jdk) JAVA SE JDK VERSION 1.7.0-111 (13079846)... "
  668. javacheck WLSJAVA $MW_HOME/oracle_common/jdk
  669.  
  670. #echo -ne "\n\t(5a) *NEW* OMS CHAINED AGENT HOME ($AGENT_HOME/oracle_common/jdk) JAVA SE JDK VERSION 1.7.0-111 (13079846)... "
  671. #javacheck AGTJAVA $AGENT_HOME/oracle_common/jdk
  672.  
  673. echo
  674. echo
  675.  
  676. if [[ $FAIL_COUNT -gt "0" ]]; then
  677.     echo "Failed test count: $FAIL_COUNT - Review output"
  678.     test $VERBOSE_CHECKSEC -ge 1 && echo -e $FAIL_TESTS
  679. else
  680.     echo "All tests succeeded."
  681. fi
  682.  
  683. echo
  684. echo "Visit https://pardydba.wordpress.com/2016/04/05/securing-oracle-enterprise-manager-13c/ for the latest version."
  685. echo
  686.  
  687. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!