API tools faq
paste
Advertisement
Guest User

EM12c R4 SSL Security Checkup Script v1.7

a guest
Aug 18th, 2015
243
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 29.83 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM12c R4 environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It also contains a patch
  6. # check currently comparing against the latest recommended patches
  7. # and flags the use of self-signed certificates.  Further checks include
  8. # EM12c Java JDK version.
  9. #
  10. # Added in v1.0:  Repository database patch check
  11. # Added in v1.1:  EM12c Java JDK version check
  12. # Change in v1.2: Removed patch 19948000 recommendation for OHS.
  13. # Change in v1.3: Update for 30 Apr 2015 patches, add EM-OH plugin home
  14. #                 restored GDFA/16420963 for WLS
  15. #                 added 20114054 for Agent - only applicable for Linux x86-64
  16. # Change in v1.4: Add datestamp/hostname to output header
  17. #         Update for 31 May 2015 patches, add EM-DB-DISC plugin home
  18. # Change in v1.5: Add repo DB check for SSL_VERSION and SSL_CIPHER_SUITES
  19. #                 Add VERBOSE_CHECKSEC variable:
  20. #                   Set to 0 for quiet run.
  21. #                   Set to 1 to see failed check summary after run.
  22. #                   Set to 2 for failed check summary and patch details.
  23. # Change in v1.6: Add PSU4 for EM12cR4, complete VERBOSE_CHECKSEC work
  24. #                 Add 14 July 2015 patches
  25. # Change in v1.7: Update for 31 Jul 2015 patches
  26. #
  27. # From: @BrianPardy on Twitter
  28. #
  29. # Known functional on Linux x86-64, Solaris, AIX.
  30. #
  31. # Run this script as the Oracle EM12c software owner, with your environment
  32. # fully up and running.
  33. #
  34. # Thanks to Dave Corsar, who tested on Solaris and let me know the
  35. # changes needed to make an earlier version work on Solaris.
  36. #
  37. # Thanks to opa tropa who confirmed AIX functionality and noted the
  38. # use of GNU extensions to grep, which I have since removed.
  39. #
  40. # Dedicated to our two Lhasa Apsos:
  41. #   Lucy (6/13/1998 - 3/13/2015)
  42. #   Ethel (6/13/1998 - 7/31/2015)
  43. #
  44.  
  45. SCRIPTNAME=`basename $0`
  46. PATCHDATE="31 Jul 2015"
  47. OMSHOST=`hostname -f`
  48. VERSION="1.7"
  49. FAIL_COUNT=0
  50. FAIL_TESTS=""
  51.  
  52. RUN_DB_CHECK=0
  53. VERBOSE_CHECKSEC=2
  54.  
  55. HOST_OS=`uname -s`
  56. HOST_ARCH=`uname -m`
  57.  
  58. ORAGCHOMELIST="/etc/oragchomelist"
  59. ORATAB="/etc/oratab"
  60.  
  61. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  62.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  63. fi
  64.  
  65. if [[ ! -r $ORATAB ]]; then                 # Solaris
  66.     ORATAB="/var/opt/oracle/oratab"
  67. fi
  68.  
  69. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  70.     GREP=/usr/sfw/bin/gegrep
  71. else
  72.     GREP=`which grep`
  73. fi
  74.  
  75. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  76.  
  77. OPATCH="$OMS_HOME/OPatch/opatch"
  78. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  79. OMSORAINST="$OMS_HOME/oraInst.loc"
  80. ORAINVENTORY=`head -n 1 $OMSORAINST | awk -F= '{print $2}'`
  81.  
  82. MW_HOME=`dirname $OMS_HOME`
  83. BIP_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"Oracle_BI" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  84. COMMON_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"common" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  85. WEBTIER_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"webtier" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  86. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent12c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  87. AGENT_DB_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.db.agent.plugin_12.1.0.7.0"
  88. AGENT_DB_PLUGIN_DISC_HOME="$AGENT_HOME/../../plugins/oracle.sysman.db.discovery.plugin_12.1.0.7.0"
  89. AGENT_FMW_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.agent.plugin_12.1.0.7.0"
  90. AGENT_FMW_PLUGIN_DISC_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.discovery.plugin_12.1.0.7.0"
  91. AGENT_BEACON_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.beacon.agent.plugin_12.1.0.4.0"
  92. AGENT_OH_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.oh.agent.plugin_12.1.0.4.0"
  93.  
  94. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  95. WL_HOME=`$GREP wlserver $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/samples.*$//' | sed -e 's/"//' | uniq`
  96.  
  97. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  98. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  99. OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  100. OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  101.  
  102. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  103. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  104. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  105. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  106. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  107. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  108. PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  109. PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  110. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  111.  
  112. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  113. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  114. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  115.  
  116. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  117.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  118.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  119.  
  120.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  121.         RUN_DB_CHECK=1
  122.     fi
  123.  
  124.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  125.         RUN_DB_CHECK=1
  126.     fi
  127.  
  128.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  129.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported by this script for now"
  130.     fi
  131. fi
  132.  
  133.  
  134. sslcheck () {
  135.     OPENSSL_CHECK_COMPONENT=$1
  136.     OPENSSL_CHECK_HOST=$2
  137.     OPENSSL_CHECK_PORT=$3
  138.     OPENSSL_CHECK_PROTO=$4
  139.  
  140.     OPENSSL_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  141.    
  142.    
  143.  
  144.     if [[ $OPENSSL_CHECK_PROTO == "tls1" ]]; then
  145.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO available for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  146.         if [[ $OPENSSL_RETURN -eq "0" ]]; then
  147.             echo OK
  148.         else
  149.             echo FAILED
  150.             FAIL_COUNT=$((FAIL_COUNT+1))
  151.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection failed"
  152.         fi
  153.     fi
  154.  
  155.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  156.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO disabled for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  157.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  158.             echo OK
  159.         else
  160.             echo FAILED
  161.             FAIL_COUNT=$((FAIL_COUNT+1))
  162.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection succeeded"
  163.         fi
  164.     fi
  165. }
  166.  
  167. opatchcheck () {
  168.     OPATCH_CHECK_COMPONENT=$1
  169.     OPATCH_CHECK_OH=$2
  170.     OPATCH_CHECK_PATCH=$3
  171.  
  172.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  173.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  174.     else
  175.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  176.     fi
  177.  
  178.     if [[ -z "$OPATCH_RET" ]]; then
  179.         echo FAILED
  180.         FAIL_COUNT=$((FAIL_COUNT+1))
  181.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCH_CHECK_COMPONENT @ ${OPATCH_CHECK_OH}:Patch $OPATCH_CHECK_PATCH not found"
  182.     else
  183.         echo OK
  184.     fi
  185.  
  186.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCH_RET
  187.  
  188. }
  189.  
  190. opatchautocheck () {
  191.     OPATCHAUTO_CHECK_COMPONENT=$1
  192.     OPATCHAUTO_CHECK_OH=$2
  193.     OPATCHAUTO_CHECK_PATCH=$3
  194.  
  195.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  196.  
  197.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  198.         echo FAILED
  199.         FAIL_COUNT=$((FAIL_COUNT+1))
  200.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCHAUTO_CHECK_COMPONENT @ ${OPATCHAUTO_CHECK_OH}:Patch $OPATCHAUTO_CHECK_PATCH not found"
  201.     else
  202.         echo OK
  203.     fi
  204.  
  205.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCHAUTO_RET
  206.  
  207. }
  208.  
  209. certcheck () {
  210.     CERTCHECK_CHECK_COMPONENT=$1
  211.     CERTCHECK_CHECK_HOST=$2
  212.     CERTCHECK_CHECK_PORT=$3
  213.  
  214.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT)... "
  215.  
  216.     OPENSSL_SELFSIGNED_COUNT=`echo Q | openssl s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT 2>&1 | $GREP -ci "self signed certificate"`
  217.  
  218.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  219.         echo OK
  220.     else
  221.         echo FAILED - Found self-signed certificate
  222.         FAIL_COUNT=$((FAIL_COUNT+1))
  223.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$CERTCHECK_CHECK_COMPONENT @ ${CERTCHECK_CHECK_HOST}:${CERTCHECK_CHECK_PORT} found self-signed certificate"
  224.     fi
  225. }
  226.  
  227.  
  228. ciphercheck () {
  229.     OPENSSL_CHECK_COMPONENT=$1
  230.     OPENSSL_CHECK_HOST=$2
  231.     OPENSSL_CHECK_PORT=$3
  232.  
  233.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  234.  
  235.     OPENSSL_LOW_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  236.  
  237.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  238.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  239.         FAIL_COUNT=$((FAIL_COUNT+1))
  240.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits LOW strength ciphers"
  241.     else
  242.         echo -e "\tOK"
  243.     fi
  244.  
  245.  
  246.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  247.  
  248.     OPENSSL_MEDIUM_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  249.  
  250.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  251.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  252.         FAIL_COUNT=$((FAIL_COUNT+1))
  253.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits MEDIUM strength ciphers"
  254.     else
  255.         echo -e "\tOK"
  256.     fi
  257.  
  258.  
  259.  
  260.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  261.  
  262.     OPENSSL_HIGH_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  263.  
  264.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  265.         echo -e "\tOK"
  266.     else
  267.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  268.         FAIL_COUNT=$((FAIL_COUNT+1))
  269.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Rejects HIGH strength ciphers"
  270.     fi
  271.     echo
  272. }
  273.  
  274. wlspatchcheck () {
  275.     WLSDIR=$1
  276.     WLSPATCH=$2
  277.  
  278.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $WLSPATCH`
  279.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  280.  
  281.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  282.         echo -e "\tOK"
  283.     else
  284.         echo -e "\tFAILED - PATCH NOT FOUND"
  285.         FAIL_COUNT=$((FAIL_COUNT+1))
  286.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WLSDIR:Patch $WLSPATCH not found"
  287.     fi
  288.  
  289.     test $VERBOSE_CHECKSEC -ge 2 && echo $WLSCHECK_RETURN
  290.    
  291. }
  292.  
  293. javacheck () {
  294.     WHICH_JAVA=$1
  295.     JAVA_DIR=$2
  296.  
  297.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  298.  
  299.     if [[ "$JAVACHECK_RETURN" == "1.6.0_95" ]]; then
  300.         echo -e "\tOK"
  301.     else
  302.         #echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  303.         echo -e "\tFAILED"
  304.         FAIL_COUNT=$((FAIL_COUNT+1))
  305.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_JAVA Java in ${JAVA_DIR}:Found incorrect version $JAVACHECK_RETURN"
  306.     fi
  307.     test $VERBOSE_CHECKSEC -ge 2 && echo $JAVACHECK_RETURN
  308. }
  309.  
  310. paramcheck () {
  311.     WHICH_PARAM=$1
  312.     WHICH_ORACLE_HOME=$2
  313.     WHICH_FILE=$3
  314.  
  315.     PARAMCHECK_RETURN=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | awk -F= '{print $2}' | sed -e 's/\s//g'`
  316.     if [[ "$WHICH_PARAM" == "SSL_VERSION" ]]; then
  317.         if [[ "$PARAMCHECK_RETURN" == "1.0" ]]; then
  318.             echo -e "OK"
  319.         else
  320.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  321.             FAIL_COUNT=$((FAIL_COUNT+1))
  322.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  323.         fi
  324.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  325.     fi
  326.  
  327.     if [[ "$WHICH_PARAM" == "SSL_CIPHER_SUITES" ]]; then
  328.         if [[ "$PARAMCHECK_RETURN" == "(SSL_RSA_WITH_AES128_CBC_SHA,SSL_RSA_WITH_AES256_CBC_SHA)" ]]; then
  329.             echo -e "OK"
  330.         else
  331.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  332.             FAIL_COUNT=$((FAIL_COUNT+1))
  333.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  334.         fi
  335.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  336.     fi
  337. }
  338.  
  339.  
  340. ### MAIN SCRIPT HERE
  341.  
  342.  
  343. echo -e "Performing EM12cR4 security checkup version $VERSION on $OMSHOST at `date`.\n"
  344.  
  345. echo "Using port definitions from configuration files "
  346. echo -e "\t/etc/oragchomelist"
  347. echo -e "\t$EMGC_PROPS"
  348. echo -e "\t$EMBIP_PROPS"
  349. echo -e "\t$OPMN_PROPS"
  350. echo -e "\t$OHS_ADMIN_CONF"
  351. echo
  352. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  353. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  354. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  355. echo -e "\tOHSadmin port found at $OMSHOST:$PORT_OHS_ADMIN"
  356. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  357. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  358. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  359. echo -e "\tOPMN port found at $OMSHOST:$PORT_OPMN"
  360. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  361. echo
  362. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  363.  
  364. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  365.     echo -e "\tRepository DB on OMS server, will check patches/parameters in $REPOS_DB_HOME"
  366. fi
  367.  
  368.  
  369. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  370.  
  371. echo -e "\n\t(1a) Forbid SSLv2 connections"
  372. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  373. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  374. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  375. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl2
  376. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  377. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  378. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  379. sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  380. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  381.  
  382. echo -e "\n\t(1b) Forbid SSLv3 connections"
  383. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  384. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  385. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  386. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl3
  387. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  388. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  389. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  390. sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  391. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  392.  
  393. echo -e "\n\t(1c) Permit TLSv1 connections"
  394. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  395. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  396. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  397. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN tls1
  398. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  399. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  400. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  401. sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  402. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  403.  
  404. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 1477287.1, 1905314.1, 1067411.1)"
  405. ciphercheck Agent $OMSHOST $PORT_AGENT
  406. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  407. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  408. ciphercheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  409. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  410. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  411. ciphercheck OMSupload $OMSHOST $PORT_UPL
  412. ciphercheck OPMN $OMSHOST $PORT_OPMN
  413. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  414.  
  415. echo -e "\n(3) Checking self-signed certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  416. certcheck Agent $OMSHOST $PORT_AGENT
  417. certcheck BIPublisher $OMSHOST $PORT_BIP
  418. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  419. certcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  420. certcheck OMSconsole $OMSHOST $PORT_OMS
  421. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  422. certcheck OMSupload $OMSHOST $PORT_UPL
  423. certcheck OPMN $OMSHOST $PORT_OPMN
  424. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  425.  
  426.  
  427. echo -e "\n(4) Checking EM12c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  428.  
  429. #echo -ne "\n\t(4a) OMS ($OMS_HOME) PSU2 Patch 19830994... "
  430. #opatchcheck OMS $OMS_HOME 19830994
  431.  
  432. #echo -ne "\n\t(4a) OMS ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM - OMS 12.1.0.4.3 PSU Patch (20392036)... "
  433. #opatchcheck OMS $OMS_HOME 20392036
  434.  
  435. echo -ne "\n\t(4a) OMS ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM - OMS 12.1.0.4.4 PSU Patch (20870437)... "
  436. opatchcheck OMS $OMS_HOME 20870437
  437.  
  438. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) CPUJAN2015 Patch (19822893)... "
  439. opatchcheck BIP $BIP_HOME 19822893
  440.  
  441. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) Merge Patch (20444447)... "
  442. opatchcheck BIP $BIP_HOME 20444447
  443.  
  444. #echo -ne "\n\t(4b) *NEW* BI Publisher ($BIP_HOME) ORACLE BI PUBLISHER PATCH BUG FOR PRIVATE EMCC PS3 MANDATORY INSTALL PATCH (17888172)... "
  445. #opatchcheck BIP $BIP_HOME 17888172
  446.  
  447. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) CVE-2015-0426 Oracle Help Patch (20075252)... "
  448. opatchcheck COMMON $COMMON_HOME 20075252
  449.  
  450. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) ADF MERGE REQUEST ON TOP OF 11.1.1.7.1 FOR BUGS 20465665 18820382 20645397 (20747356)... "
  451. opatchcheck COMMON $COMMON_HOME 20747356
  452.  
  453. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) WEBCENTER PORTAL BUNDLE PATCH 11.1.1.7.1 (16761779)... "
  454. opatchcheck COMMON $COMMON_HOME 16761779
  455.  
  456.  
  457. #echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.10 12UV Patch (19637463)... "
  458. #wlspatchcheck $WL_HOME 19637463
  459.  
  460. #echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.11 YUIS Patch (20181997)... "
  461. #wlspatchcheck $WL_HOME 20181997
  462.  
  463. echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.12 EJUW Patch (20780171)... "
  464. wlspatchcheck $WL_HOME 20780171
  465.  
  466. echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) SU Patch [GDFA]: WEBLOGIC.STORE.PERSISTENTSTOREEXCEPTION: [STORE:280040] OCCURS EASILEY (16420963)... "
  467. wlspatchcheck $WL_HOME 16420963
  468.  
  469. # Commented this patch out 4/17/2015, as Oracle no longer recommends it for EM12c installations.
  470. #echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CPUJAN2015 Patch (19948000)... "
  471. #opatchcheck WebTier $WEBTIER_HOME 19948000
  472.  
  473. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2014-4212 OPMN Patch (19345576)... "
  474. opatchcheck WebTier $WEBTIER_HOME 19345576
  475.  
  476. #echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2013-3836 PLACEHOLDER FOR SECURITY PATCH FOR WEBCACHE 11.1.1.7.0 WITH OCT2013 CPU (17306880)... "
  477. #opatchcheck WebTier $WEBTIER_HOME 17306880
  478.  
  479. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE 2015-2658 MERGE REQUEST ON TOP OF 11.1.1.7.0 FOR BUGS 16370190 20310323 20715657 (20807683)... "
  480. opatchcheck WebTier $WEBTIER_HOME 20807683
  481.  
  482. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2013-0169,CVE-2011-3389 OSS SECURITY PATCH UPDATE 11.1.1.7.0 CPUOCT2013 (17337741)... "
  483. opatchcheck WebTier $WEBTIER_HOME 17337741
  484.  
  485. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) WLSPLUGINS (OHS) SECURITY PATCH UPDATE 11.1.1.7.0 CPUJUL2014 (18423831)... "
  486. opatchcheck WebTier $WEBTIER_HOME 18423831
  487.  
  488. #echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 (20613714)... "
  489. #opatchautocheck OMS $OMS_HOME 20613714
  490.  
  491. #echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.3 (20804122)... "
  492. #opatchautocheck OMS $OMS_HOME 20804122
  493.  
  494. #echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.4 (20950048)... "
  495. #opatchautocheck OMS $OMS_HOME 20950048
  496.  
  497. #echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.5 (21167937)... "
  498. #opatchautocheck OMS $OMS_HOME 21167937
  499.  
  500. echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.6 (21324654)... "
  501. opatchautocheck OMS $OMS_HOME 21324654
  502.  
  503. #echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 (20613870)... "
  504. #opatchautocheck OMS $OMS_HOME 20613870
  505.  
  506. #echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.3 (20804213)... "
  507. #opatchautocheck OMS $OMS_HOME 20804213
  508.  
  509. #echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.4 (20950040)... "
  510. #opatchautocheck OMS $OMS_HOME 20950040
  511.  
  512. #echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.5 (21167980)... "
  513. #opatchautocheck OMS $OMS_HOME 21167980
  514.  
  515. echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.6 (21324861)... "
  516. opatchautocheck OMS $OMS_HOME 21324861
  517.  
  518.  
  519. #echo -ne "\n\t(4h) OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.4 (20613886)... "
  520. #opatchautocheck OMS $OMS_HOME 20613886
  521.  
  522. #echo -ne "\n\t(4h) OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.5 (20822914)... "
  523. #opatchautocheck OMS $OMS_HOME 20822914
  524.  
  525. echo -ne "\n\t(4h) *UPDATED* OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.6 (21167991)... "
  526. opatchautocheck OMS $OMS_HOME 21167991
  527.  
  528. #echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE 12.1.0.6.6 (20613853)... "
  529. #opatchautocheck OMS $OMS_HOME 20613853
  530.  
  531. #echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.7 (20822866)... "
  532. #opatchautocheck OMS $OMS_HOME 20822866
  533.  
  534. #echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.8 (20962507)... "
  535. #opatchautocheck OMS $OMS_HOME 20962507
  536.  
  537. echo -ne "\n\t(4i) OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.9 (21167953)... "
  538. opatchautocheck OMS $OMS_HOME 21167953
  539.  
  540. #echo -ne "\n\t(4j) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE 12.1.0.4.7 (20613931)... "
  541. #opatchcheck Agent $AGENT_HOME 20613931
  542.  
  543. #echo -ne "\n\t(4j) *NEW* OMS ($OMS_HOME) CFW PLUGIN BUNDLE PATCH 12.1.0.2.1 (20385040)... "
  544. #opatchautocheck OMS $OMS_HOME 20385040
  545.  
  546. echo -ne "\n\t(4j) OMS ($OMS_HOME) CFW PLUGIN BUNDLE PATCH 12.1.0.2.2 (21167573)... "
  547. opatchautocheck OMS $OMS_HOME 21167573
  548.  
  549. #echo -ne "\n\t(4k) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.9 (20950034)... "
  550. #opatchcheck Agent $AGENT_HOME 20950034
  551.  
  552. #echo -ne "\n\t(4k) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.10 (21168025)... "
  553. #opatchcheck Agent $AGENT_HOME 21168025
  554.  
  555. echo -ne "\n\t(4k) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.11 (21325110)... "
  556. opatchcheck Agent $AGENT_HOME 21325110
  557.  
  558. echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) Merge Patch (18502187)... "
  559. opatchcheck Agent $AGENT_HOME 18502187
  560.  
  561. echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) JDBC Security Patch (18721761)... "
  562. opatchcheck Agent $AGENT_HOME 18721761
  563.  
  564. if [[ "$HOST_OS" == "Linux" && "$HOST_ARCH" == "x86_64" ]]; then
  565.     echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) CVE 2012-3137 EM Agent only: Instant Client Security Patch (20114054)... "
  566.     opatchcheck Agent $AGENT_HOME 20114054
  567. fi
  568.  
  569. #echo -ne "\n\t(4k) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE 20676926... "
  570. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 20676926
  571.  
  572. #echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.4 AGENT-SIDE MONITORING (21065223)... "
  573. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 21065223
  574.  
  575. #echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.5 AGENT-SIDE MONITORING (21229731)... "
  576. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 21229731
  577.  
  578. echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.6 AGENT-SIDE MONITORING (21415075)... "
  579. opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 21415075
  580.  
  581. echo -ne "\n\t(4l) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_DISC_HOME) DB PLUGIN BUNDLE 12.1.0.7.4 AGENT-SIDE DISCOVERY (21065239)... "
  582. opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_DISC_HOME 21065239
  583.  
  584. #echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE MONITORING (20677020)... "
  585. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 20677020
  586.  
  587. #echo -ne "\n\t(4m) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.4 AGENT-SIDE MONITORING (21065760)... "
  588. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 21065760
  589.  
  590. #echo -ne "\n\t(4m) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.5 AGENT-SIDE MONITORING (21229821)... "
  591. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 21229821
  592.  
  593. echo -ne "\n\t(4m) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.6 AGENT-SIDE MONITORING (21415166)... "
  594. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 21415166
  595.  
  596. #echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_DISC_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE DISCOVERY (20677038)... "
  597. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_DISC_HOME 20677038
  598.  
  599. echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_DISC_HOME) FMW PLUGIN BUNDLE 12.1.0.7.5 AGENT-SIDE DISCOVERY (21229841)... "
  600. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_DISC_HOME 21229841
  601.  
  602. echo -ne "\n\t(4n) OMS CHAINED AGENT BEACON PLUGIN ($AGENT_BEACON_PLUGIN_HOME) EM-BEACON BUNDLE PATCH 12.1.0.4.1 (20466772)... "
  603. opatchcheck AgentBeaconPlugin $AGENT_BEACON_PLUGIN_HOME 20466772
  604.  
  605. echo -ne "\n\t(4o) OMS CHAINED AGENT EM-OH BUNDLE PATCH 12.1.0.4.1 (20855134)... "
  606. opatchcheck AgentOHPlugin $AGENT_OH_PLUGIN_HOME 20855134
  607.  
  608.  
  609. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  610.  
  611. #   if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  612. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.5 19769489... "
  613. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769489
  614. #
  615. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.2 DATABASE PSU (JAN2015) 19877440... "
  616. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877440
  617. #   fi
  618.  
  619.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  620.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.6 (APR2015) (20299013)... "
  621.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20299013
  622.  
  623.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.7 (JUL2015) (20760982)... "
  624.         opatchcheck ReposDBHome $REPOS_DB_HOME 20760982
  625.  
  626.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.3 DATABASE PSU (APR2015) (20406239)... "
  627.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20406239
  628.  
  629.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.4 DATABASE PSU (JUL2015) (21068539)... "
  630.         opatchcheck ReposDBHome $REPOS_DB_HOME 21068539
  631.     fi
  632.  
  633. #   if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  634. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch 20243268... "
  635. #       opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  636. #
  637. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.2 19769480... "
  638. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769480
  639. #
  640. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.2 ORACLE JAVAVM COMPONENT 12.1.0.2.2 DATABASE PSU (JAN2015) 19877336... "
  641. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877336
  642. #   fi
  643.  
  644.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  645.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch (20243268)... "
  646.         opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  647.  
  648.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.3 (APR2015) (20299023)... "
  649.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20299023
  650.  
  651.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.4 (JUL2015) (20831110)... "
  652.         opatchcheck ReposDBHome $REPOS_DB_HOME 20831110
  653.  
  654.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.3 DATABASE PSU (APR2015) (20415564)... "
  655.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20415564
  656.  
  657.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.4 DATABASE PSU (JUL2015) (21068507)... "
  658.         opatchcheck ReposDBHome $REPOS_DB_HOME 21068507
  659.     fi
  660.  
  661.     echo -ne "\n\t(4q) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_VERSION parameter (1545816.1)... "
  662.     paramcheck SSL_VERSION $REPOS_DB_HOME sqlnet.ora
  663.  
  664.     echo -ne "\n\t(4q) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  665.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME sqlnet.ora
  666.  
  667.     echo -ne "\n\t(4q) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_VERSION parameter (1545816.1)... "
  668.     paramcheck SSL_VERSION $REPOS_DB_HOME listener.ora
  669.  
  670.     echo -ne "\n\t(4q) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  671.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME listener.ora
  672. fi
  673.  
  674. echo
  675.  
  676. echo -e "\n(5) Checking EM12c Java versions against baseline (see notes 1506916.1, 1492980.1)"
  677.  
  678. echo -ne "\n\t(5a) *UPDATED* MW ($MW_HOME/jdk16/jdk) Java version 1.6.0_95 (9553040)... "
  679. javacheck MW $MW_HOME/jdk16/jdk 1.6.0_95
  680.  
  681. echo -ne "\n\t(5b) *UPDATED* WebTier ($WEBTIER_HOME/jdk) Java version 1.6.0_95 (9553040)... "
  682. javacheck WebTier $WEBTIER_HOME/jdk 1.6.0_95
  683.  
  684. echo
  685.  
  686. if [[ $FAIL_COUNT -gt "0" ]]; then
  687.     echo "Failed test count: $FAIL_COUNT - Review output"
  688.     test $VERBOSE_CHECKSEC -ge 1 && echo -e $FAIL_TESTS
  689. else
  690.     echo "All tests succeeded."
  691. fi
  692.  
  693. echo
  694. echo "Visit https://pardydba.wordpress.com/2015/03/09/em12c-r4-ssl-security-checkup-script/ for the latest version."
  695. echo
  696.  
  697. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!