API tools faq
paste
Advertisement
Guest User

EM12c R4 SSL Security Checkup Script v1.9

a guest
Sep 17th, 2015
106
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 32.64 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM12c R4 environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It also contains a patch
  6. # check currently comparing against the latest recommended patches
  7. # and flags the use of self-signed certificates.  Further checks include
  8. # EM12c Java JDK version.
  9. #
  10. # Added in v1.0:  Repository database patch check
  11. # Added in v1.1:  EM12c Java JDK version check
  12. # Change in v1.2: Removed patch 19948000 recommendation for OHS.
  13. # Change in v1.3: Update for 30 Apr 2015 patches, add EM-OH plugin home
  14. #                 restored GDFA/16420963 for WLS
  15. #                 added 20114054 for Agent - only applicable for Linux x86-64
  16. # Change in v1.4: Add datestamp/hostname to output header
  17. #         Update for 31 May 2015 patches, add EM-DB-DISC plugin home
  18. # Change in v1.5: Add repo DB check for SSL_VERSION and SSL_CIPHER_SUITES
  19. #                 Add VERBOSE_CHECKSEC variable:
  20. #                   Set to 0 for quiet run.
  21. #                   Set to 1 to see failed check summary after run.
  22. #                   Set to 2 for failed check summary and patch details.
  23. # Change in v1.6: Add PSU4 for EM12cR4, complete VERBOSE_CHECKSEC work
  24. #                 Add 14 July 2015 patches
  25. # Change in v1.7: Update for 31 Jul 2015 patches
  26. # Change in v1.8: Update for 31 Aug 2015 patches
  27. # Change in v1.9: Add 17714229 for OMS home
  28. #                 Add 21068288 CVE-2015-4742 for oracle_common home
  29. #                 Add check for usage of demonstration SSL certificates
  30. #
  31. # From: @BrianPardy on Twitter
  32. #
  33. # Known functional on Linux x86-64, Solaris, AIX.
  34. #
  35. # Run this script as the Oracle EM12c software owner, with your environment
  36. # fully up and running.
  37. #
  38. # Thanks to Dave Corsar, who tested on Solaris and let me know the
  39. # changes needed to make an earlier version work on Solaris.
  40. #
  41. # Thanks to opa tropa who confirmed AIX functionality and noted the
  42. # use of GNU extensions to grep, which I have since removed.
  43. #
  44. # Dedicated to our two Lhasa Apsos:
  45. #   Lucy (6/13/1998 - 3/13/2015)
  46. #   Ethel (6/13/1998 - 7/31/2015)
  47. #
  48. #
  49.  
  50. SCRIPTNAME=`basename $0`
  51. PATCHDATE="31 Aug 2015"
  52. OMSHOST=`hostname -f`
  53. VERSION="1.9"
  54. FAIL_COUNT=0
  55. FAIL_TESTS=""
  56.  
  57. RUN_DB_CHECK=0
  58. VERBOSE_CHECKSEC=2
  59.  
  60. HOST_OS=`uname -s`
  61. HOST_ARCH=`uname -m`
  62.  
  63. ORAGCHOMELIST="/etc/oragchomelist"
  64. ORATAB="/etc/oratab"
  65.  
  66. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  67.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  68. fi
  69.  
  70. if [[ ! -r $ORATAB ]]; then                 # Solaris
  71.     ORATAB="/var/opt/oracle/oratab"
  72. fi
  73.  
  74. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  75.     GREP=/usr/sfw/bin/gegrep
  76. else
  77.     GREP=`which grep`
  78. fi
  79.  
  80. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  81.  
  82. OPATCH="$OMS_HOME/OPatch/opatch"
  83. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  84. OMSORAINST="$OMS_HOME/oraInst.loc"
  85. ORAINVENTORY=`head -n 1 $OMSORAINST | awk -F= '{print $2}'`
  86.  
  87. MW_HOME=`dirname $OMS_HOME`
  88. BIP_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"Oracle_BI" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  89. COMMON_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"common" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  90. WEBTIER_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"webtier" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  91. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent12c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  92. AGENT_DB_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.db.agent.plugin_12.1.0.7.0"
  93. AGENT_DB_PLUGIN_DISC_HOME="$AGENT_HOME/../../plugins/oracle.sysman.db.discovery.plugin_12.1.0.7.0"
  94. AGENT_FMW_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.agent.plugin_12.1.0.7.0"
  95. AGENT_FMW_PLUGIN_DISC_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.discovery.plugin_12.1.0.7.0"
  96. AGENT_BEACON_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.beacon.agent.plugin_12.1.0.4.0"
  97. AGENT_OH_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.oh.agent.plugin_12.1.0.4.0"
  98.  
  99. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  100. WL_HOME=`$GREP wlserver $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/samples.*$//' | sed -e 's/"//' | uniq`
  101.  
  102. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  103. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  104. OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  105. OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  106.  
  107. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  108. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  109. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  110. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  111. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  112. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  113. PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  114. PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  115. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  116.  
  117. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  118. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  119. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  120.  
  121. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  122.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  123.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  124.  
  125.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  126.         RUN_DB_CHECK=1
  127.     fi
  128.  
  129.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  130.         RUN_DB_CHECK=1
  131.     fi
  132.  
  133.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  134.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported by this script for now"
  135.     fi
  136. fi
  137.  
  138.  
  139. sslcheck () {
  140.     OPENSSL_CHECK_COMPONENT=$1
  141.     OPENSSL_CHECK_HOST=$2
  142.     OPENSSL_CHECK_PORT=$3
  143.     OPENSSL_CHECK_PROTO=$4
  144.  
  145.     OPENSSL_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  146.    
  147.    
  148.  
  149.     if [[ $OPENSSL_CHECK_PROTO == "tls1" ]]; then
  150.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO available for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  151.         if [[ $OPENSSL_RETURN -eq "0" ]]; then
  152.             echo OK
  153.         else
  154.             echo FAILED
  155.             FAIL_COUNT=$((FAIL_COUNT+1))
  156.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection failed"
  157.         fi
  158.     fi
  159.  
  160.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  161.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO disabled for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  162.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  163.             echo OK
  164.         else
  165.             echo FAILED
  166.             FAIL_COUNT=$((FAIL_COUNT+1))
  167.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection succeeded"
  168.         fi
  169.     fi
  170. }
  171.  
  172. opatchcheck () {
  173.     OPATCH_CHECK_COMPONENT=$1
  174.     OPATCH_CHECK_OH=$2
  175.     OPATCH_CHECK_PATCH=$3
  176.  
  177.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  178.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  179.     else
  180.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  181.     fi
  182.  
  183.     if [[ -z "$OPATCH_RET" ]]; then
  184.         echo FAILED
  185.         FAIL_COUNT=$((FAIL_COUNT+1))
  186.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCH_CHECK_COMPONENT @ ${OPATCH_CHECK_OH}:Patch $OPATCH_CHECK_PATCH not found"
  187.     else
  188.         echo OK
  189.     fi
  190.  
  191.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCH_RET
  192.  
  193. }
  194.  
  195. opatchautocheck () {
  196.     OPATCHAUTO_CHECK_COMPONENT=$1
  197.     OPATCHAUTO_CHECK_OH=$2
  198.     OPATCHAUTO_CHECK_PATCH=$3
  199.  
  200.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  201.  
  202.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  203.         echo FAILED
  204.         FAIL_COUNT=$((FAIL_COUNT+1))
  205.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCHAUTO_CHECK_COMPONENT @ ${OPATCHAUTO_CHECK_OH}:Patch $OPATCHAUTO_CHECK_PATCH not found"
  206.     else
  207.         echo OK
  208.     fi
  209.  
  210.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCHAUTO_RET
  211.  
  212. }
  213.  
  214. certcheck () {
  215.     CERTCHECK_CHECK_COMPONENT=$1
  216.     CERTCHECK_CHECK_HOST=$2
  217.     CERTCHECK_CHECK_PORT=$3
  218.  
  219.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT)... "
  220.  
  221.     OPENSSL_SELFSIGNED_COUNT=`echo Q | openssl s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT 2>&1 | $GREP -ci "self signed certificate"`
  222.  
  223.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  224.         echo OK
  225.     else
  226.         echo FAILED - Found self-signed certificate
  227.         FAIL_COUNT=$((FAIL_COUNT+1))
  228.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$CERTCHECK_CHECK_COMPONENT @ ${CERTCHECK_CHECK_HOST}:${CERTCHECK_CHECK_PORT} found self-signed certificate"
  229.     fi
  230. }
  231.  
  232. democertcheck () {
  233.     DEMOCERTCHECK_CHECK_COMPONENT=$1
  234.     DEMOCERTCHECK_CHECK_HOST=$2
  235.     DEMOCERTCHECK_CHECK_PORT=$3
  236.  
  237.     echo -ne "\tChecking certificate at $DEMOCERTCHECK_CHECK_COMPONENT ($DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT)... "
  238.  
  239.     OPENSSL_DEMO_COUNT=`echo Q | openssl s_client -prexit -connect $DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT 2>&1 | $GREP -ci "issuer=/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN=CertGenCAB"`
  240.  
  241.     if [[ $OPENSSL_DEMO_COUNT -eq "0" ]]; then
  242.         echo OK
  243.     else
  244.         echo FAILED - Found demonstration certificate
  245.         FAIL_COUNT=$((FAIL_COUNT+1))
  246.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$DEMOCERTCHECK_CHECK_COMPONENT @ ${DEMOCERTCHECK_CHECK_HOST}:${DEMOCERTCHECK_CHECK_PORT} found demonstration certificate"
  247.     fi
  248. }
  249.  
  250.  
  251. ciphercheck () {
  252.     OPENSSL_CHECK_COMPONENT=$1
  253.     OPENSSL_CHECK_HOST=$2
  254.     OPENSSL_CHECK_PORT=$3
  255.  
  256.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  257.  
  258.     OPENSSL_LOW_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  259.  
  260.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  261.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  262.         FAIL_COUNT=$((FAIL_COUNT+1))
  263.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits LOW strength ciphers"
  264.     else
  265.         echo -e "\tOK"
  266.     fi
  267.  
  268.  
  269.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  270.  
  271.     OPENSSL_MEDIUM_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  272.  
  273.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  274.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  275.         FAIL_COUNT=$((FAIL_COUNT+1))
  276.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits MEDIUM strength ciphers"
  277.     else
  278.         echo -e "\tOK"
  279.     fi
  280.  
  281.  
  282.  
  283.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  284.  
  285.     OPENSSL_HIGH_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  286.  
  287.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  288.         echo -e "\tOK"
  289.     else
  290.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  291.         FAIL_COUNT=$((FAIL_COUNT+1))
  292.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Rejects HIGH strength ciphers"
  293.     fi
  294.     echo
  295. }
  296.  
  297. wlspatchcheck () {
  298.     WLSDIR=$1
  299.     WLSPATCH=$2
  300.  
  301.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $WLSPATCH`
  302.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  303.  
  304.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  305.         echo -e "\tOK"
  306.     else
  307.         echo -e "\tFAILED - PATCH NOT FOUND"
  308.         FAIL_COUNT=$((FAIL_COUNT+1))
  309.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WLSDIR:Patch $WLSPATCH not found"
  310.     fi
  311.  
  312.     test $VERBOSE_CHECKSEC -ge 2 && echo $WLSCHECK_RETURN
  313.    
  314. }
  315.  
  316. javacheck () {
  317.     WHICH_JAVA=$1
  318.     JAVA_DIR=$2
  319.  
  320.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  321.  
  322.     if [[ "$JAVACHECK_RETURN" == "1.6.0_95" ]]; then
  323.         echo -e "\tOK"
  324.     else
  325.         #echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  326.         echo -e "\tFAILED"
  327.         FAIL_COUNT=$((FAIL_COUNT+1))
  328.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_JAVA Java in ${JAVA_DIR}:Found incorrect version $JAVACHECK_RETURN"
  329.     fi
  330.     test $VERBOSE_CHECKSEC -ge 2 && echo $JAVACHECK_RETURN
  331. }
  332.  
  333. paramcheck () {
  334.     WHICH_PARAM=$1
  335.     WHICH_ORACLE_HOME=$2
  336.     WHICH_FILE=$3
  337.  
  338.     PARAMCHECK_RETURN=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | awk -F= '{print $2}' | sed -e 's/\s//g'`
  339.     if [[ "$WHICH_PARAM" == "SSL_VERSION" ]]; then
  340.         if [[ "$PARAMCHECK_RETURN" == "1.0" ]]; then
  341.             echo -e "OK"
  342.         else
  343.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  344.             FAIL_COUNT=$((FAIL_COUNT+1))
  345.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  346.         fi
  347.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  348.     fi
  349.  
  350.     if [[ "$WHICH_PARAM" == "SSL_CIPHER_SUITES" ]]; then
  351.         if [[ "$PARAMCHECK_RETURN" == "(SSL_RSA_WITH_AES128_CBC_SHA,SSL_RSA_WITH_AES256_CBC_SHA)" ]]; then
  352.             echo -e "OK"
  353.         else
  354.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  355.             FAIL_COUNT=$((FAIL_COUNT+1))
  356.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  357.         fi
  358.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  359.     fi
  360. }
  361.  
  362.  
  363. ### MAIN SCRIPT HERE
  364.  
  365.  
  366. echo -e "Performing EM12cR4 security checkup version $VERSION on $OMSHOST at `date`.\n"
  367.  
  368. echo "Using port definitions from configuration files "
  369. echo -e "\t/etc/oragchomelist"
  370. echo -e "\t$EMGC_PROPS"
  371. echo -e "\t$EMBIP_PROPS"
  372. echo -e "\t$OPMN_PROPS"
  373. echo -e "\t$OHS_ADMIN_CONF"
  374. echo
  375. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  376. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  377. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  378. echo -e "\tOHSadmin port found at $OMSHOST:$PORT_OHS_ADMIN"
  379. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  380. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  381. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  382. echo -e "\tOPMN port found at $OMSHOST:$PORT_OPMN"
  383. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  384. echo
  385. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  386.  
  387. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  388.     echo -e "\tRepository DB on OMS server, will check patches/parameters in $REPOS_DB_HOME"
  389. fi
  390.  
  391.  
  392. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  393.  
  394. echo -e "\n\t(1a) Forbid SSLv2 connections"
  395. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  396. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  397. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  398. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl2
  399. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  400. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  401. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  402. sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  403. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  404.  
  405. echo -e "\n\t(1b) Forbid SSLv3 connections"
  406. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  407. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  408. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  409. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl3
  410. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  411. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  412. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  413. sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  414. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  415.  
  416. echo -e "\n\t(1c) Permit TLSv1 connections"
  417. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  418. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  419. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  420. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN tls1
  421. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  422. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  423. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  424. sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  425. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  426.  
  427. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 1477287.1, 1905314.1, 1067411.1)"
  428. ciphercheck Agent $OMSHOST $PORT_AGENT
  429. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  430. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  431. ciphercheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  432. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  433. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  434. ciphercheck OMSupload $OMSHOST $PORT_UPL
  435. ciphercheck OPMN $OMSHOST $PORT_OPMN
  436. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  437.  
  438. echo -e "\n(3) Checking self-signed and demonstration certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  439. certcheck Agent $OMSHOST $PORT_AGENT
  440. democertcheck Agent $OMSHOST $PORT_AGENT
  441. certcheck BIPublisher $OMSHOST $PORT_BIP
  442. democertcheck BIPublisher $OMSHOST $PORT_BIP
  443. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  444. democertcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  445. certcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  446. democertcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  447. certcheck OMSconsole $OMSHOST $PORT_OMS
  448. democertcheck OMSconsole $OMSHOST $PORT_OMS
  449. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  450. democertcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  451. certcheck OMSupload $OMSHOST $PORT_UPL
  452. democertcheck OMSupload $OMSHOST $PORT_UPL
  453. certcheck OPMN $OMSHOST $PORT_OPMN
  454. democertcheck OPMN $OMSHOST $PORT_OPMN
  455. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  456. democertcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  457.  
  458.  
  459. echo -e "\n(4) Checking EM12c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  460.  
  461. #echo -ne "\n\t(4a) OMS ($OMS_HOME) PSU2 Patch 19830994... "
  462. #opatchcheck OMS $OMS_HOME 19830994
  463.  
  464. #echo -ne "\n\t(4a) OMS ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM - OMS 12.1.0.4.3 PSU Patch (20392036)... "
  465. #opatchcheck OMS $OMS_HOME 20392036
  466.  
  467. echo -ne "\n\t(4a) OMS ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM - OMS 12.1.0.4.4 PSU Patch (20870437)... "
  468. opatchcheck OMS $OMS_HOME 20870437
  469.  
  470. echo -ne "\n\t(4a) *NEW* OMS ($OMS_HOME) DO NOT CREATE INCIDENT WHEN A COMMAND IS OVER RUN IN JOB WORKER (17714229)... "
  471. opatchautocheck OMS $OMS_HOME 17714229
  472.  
  473. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) CPUJAN2015 Patch (19822893)... "
  474. opatchcheck BIP $BIP_HOME 19822893
  475.  
  476. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) Merge Patch (20444447)... "
  477. opatchcheck BIP $BIP_HOME 20444447
  478.  
  479. #echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) ORACLE BI PUBLISHER PATCH BUG FOR PRIVATE EMCC PS3 MANDATORY INSTALL PATCH (17888172)... "
  480. #opatchcheck BIP $BIP_HOME 17888172
  481.  
  482. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) CVE-2015-0426 Oracle Help Patch (20075252)... "
  483. opatchcheck COMMON $COMMON_HOME 20075252
  484.  
  485. #echo -ne "\n\t(4c) AS Common ($COMMON_HOME) ADF MERGE REQUEST ON TOP OF 11.1.1.7.1 FOR BUGS 20465665 18820382 20645397 (20747356)... "
  486. #opatchcheck COMMON $COMMON_HOME 20747356
  487.  
  488. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) WEBCENTER PORTAL BUNDLE PATCH 11.1.1.7.1 (16761779)... "
  489. opatchcheck COMMON $COMMON_HOME 16761779
  490.  
  491. # Replaced 20747356, commented out above
  492. echo -ne "\n\t(4c) *NEW* AS Common ($COMMON_HOME) CVE-2015-4742 MERGE REQUEST ON TOP OF 11.1.1.7.1 FOR BUGS 20747356 18274008 (21068288)... "
  493. opatchcheck COMMON $COMMON_HOME 21068288
  494.  
  495.  
  496. #echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.10 12UV Patch (19637463)... "
  497. #wlspatchcheck $WL_HOME 19637463
  498.  
  499. #echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.11 YUIS Patch (20181997)... "
  500. #wlspatchcheck $WL_HOME 20181997
  501.  
  502. echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.12 EJUW Patch (20780171)... "
  503. wlspatchcheck $WL_HOME 20780171
  504.  
  505. echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) SU Patch [GDFA]: WEBLOGIC.STORE.PERSISTENTSTOREEXCEPTION: [STORE:280040] OCCURS EASILEY (16420963)... "
  506. wlspatchcheck $WL_HOME 16420963
  507.  
  508. # Commented this patch out 4/17/2015, as Oracle no longer recommends it for EM12c installations.
  509. #echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CPUJAN2015 Patch (19948000)... "
  510. #opatchcheck WebTier $WEBTIER_HOME 19948000
  511.  
  512. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2014-4212 OPMN Patch (19345576)... "
  513. opatchcheck WebTier $WEBTIER_HOME 19345576
  514.  
  515. #echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2013-3836 PLACEHOLDER FOR SECURITY PATCH FOR WEBCACHE 11.1.1.7.0 WITH OCT2013 CPU (17306880)... "
  516. #opatchcheck WebTier $WEBTIER_HOME 17306880
  517.  
  518. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE 2015-2658 MERGE REQUEST ON TOP OF 11.1.1.7.0 FOR BUGS 16370190 20310323 20715657 (20807683)... "
  519. opatchcheck WebTier $WEBTIER_HOME 20807683
  520.  
  521. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2013-0169,CVE-2011-3389 OSS SECURITY PATCH UPDATE 11.1.1.7.0 CPUOCT2013 (17337741)... "
  522. opatchcheck WebTier $WEBTIER_HOME 17337741
  523.  
  524. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) WLSPLUGINS (OHS) SECURITY PATCH UPDATE 11.1.1.7.0 CPUJUL2014 (18423831)... "
  525. opatchcheck WebTier $WEBTIER_HOME 18423831
  526.  
  527. #echo -ne "\n\t(4f) OMS ($OMS_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 (20613714)... "
  528. #opatchautocheck OMS $OMS_HOME 20613714
  529.  
  530. #echo -ne "\n\t(4f) OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.3 (20804122)... "
  531. #opatchautocheck OMS $OMS_HOME 20804122
  532.  
  533. #echo -ne "\n\t(4f) OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.4 (20950048)... "
  534. #opatchautocheck OMS $OMS_HOME 20950048
  535.  
  536. #echo -ne "\n\t(4f) OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.5 (21167937)... "
  537. #opatchautocheck OMS $OMS_HOME 21167937
  538.  
  539. #echo -ne "\n\t(4f) OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.6 (21324654)... "
  540. #opatchautocheck OMS $OMS_HOME 21324654
  541.  
  542. echo -ne "\n\t(4f) OMS ($OMS_HOME) DB PLUGIN BUNDLE PATCH 12.1.0.7.7 (21506301)... "
  543. opatchautocheck OMS $OMS_HOME 21506301
  544.  
  545. #echo -ne "\n\t(4g) OMS ($OMS_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 (20613870)... "
  546. #opatchautocheck OMS $OMS_HOME 20613870
  547.  
  548. #echo -ne "\n\t(4g) OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.3 (20804213)... "
  549. #opatchautocheck OMS $OMS_HOME 20804213
  550.  
  551. #echo -ne "\n\t(4g) OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.4 (20950040)... "
  552. #opatchautocheck OMS $OMS_HOME 20950040
  553.  
  554. #echo -ne "\n\t(4g) OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.5 (21167980)... "
  555. #opatchautocheck OMS $OMS_HOME 21167980
  556.  
  557. #echo -ne "\n\t(4g) OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.6 (21324861)... "
  558. #opatchautocheck OMS $OMS_HOME 21324861
  559.  
  560. echo -ne "\n\t(4g) OMS ($OMS_HOME) FMW PLUGIN BUNDLE PATCH 12.1.0.7.7 (21506335)... "
  561. opatchautocheck OMS $OMS_HOME 21506335
  562.  
  563.  
  564. #echo -ne "\n\t(4h) OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.4 (20613886)... "
  565. #opatchautocheck OMS $OMS_HOME 20613886
  566.  
  567. #echo -ne "\n\t(4h) OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.5 (20822914)... "
  568. #opatchautocheck OMS $OMS_HOME 20822914
  569.  
  570. #echo -ne "\n\t(4h) OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.6 (21167991)... "
  571. #opatchautocheck OMS $OMS_HOME 21167991
  572.  
  573. echo -ne "\n\t(4h) OMS ($OMS_HOME) MOS PLUGIN BUNDLE PATCH 12.1.0.6.7 (21506428)... "
  574. opatchautocheck OMS $OMS_HOME 21506428
  575.  
  576. #echo -ne "\n\t(4i) OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE 12.1.0.6.6 (20613853)... "
  577. #opatchautocheck OMS $OMS_HOME 20613853
  578.  
  579. #echo -ne "\n\t(4i) OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.7 (20822866)... "
  580. #opatchautocheck OMS $OMS_HOME 20822866
  581.  
  582. #echo -ne "\n\t(4i) OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.8 (20962507)... "
  583. #opatchautocheck OMS $OMS_HOME 20962507
  584.  
  585. #echo -ne "\n\t(4i) OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.9 (21167953)... "
  586. #opatchautocheck OMS $OMS_HOME 21167953
  587.  
  588. echo -ne "\n\t(4i) OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE PATCH 12.1.0.6.10 (21324852)... "
  589. opatchautocheck OMS $OMS_HOME 21324852
  590.  
  591. #echo -ne "\n\t(4j) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE 12.1.0.4.7 (20613931)... "
  592. #opatchcheck Agent $AGENT_HOME 20613931
  593.  
  594. #echo -ne "\n\t(4j) OMS ($OMS_HOME) CFW PLUGIN BUNDLE PATCH 12.1.0.2.1 (20385040)... "
  595. #opatchautocheck OMS $OMS_HOME 20385040
  596.  
  597. echo -ne "\n\t(4j) OMS ($OMS_HOME) CFW PLUGIN BUNDLE PATCH 12.1.0.2.2 (21167573)... "
  598. opatchautocheck OMS $OMS_HOME 21167573
  599.  
  600. #echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.9 (20950034)... "
  601. #opatchcheck Agent $AGENT_HOME 20950034
  602.  
  603. #echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.10 (21168025)... "
  604. #opatchcheck Agent $AGENT_HOME 21168025
  605.  
  606. #echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.11 (21325110)... "
  607. #opatchcheck Agent $AGENT_HOME 21325110
  608.  
  609. echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 12.1.0.4.12 (21506284)... "
  610. opatchcheck Agent $AGENT_HOME 21506284
  611.  
  612. echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) Merge Patch (18502187)... "
  613. opatchcheck Agent $AGENT_HOME 18502187
  614.  
  615. echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) JDBC Security Patch (18721761)... "
  616. opatchcheck Agent $AGENT_HOME 18721761
  617.  
  618. if [[ "$HOST_OS" == "Linux" && "$HOST_ARCH" == "x86_64" ]]; then
  619.     echo -ne "\n\t(4k) OMS CHAINED AGENT HOME ($AGENT_HOME) CVE 2012-3137 EM Agent only: Instant Client Security Patch (20114054)... "
  620.     opatchcheck Agent $AGENT_HOME 20114054
  621. fi
  622.  
  623. #echo -ne "\n\t(4k) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE 20676926... "
  624. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 20676926
  625.  
  626. #echo -ne "\n\t(4l) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.4 AGENT-SIDE MONITORING (21065223)... "
  627. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 21065223
  628.  
  629. #echo -ne "\n\t(4l) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.5 AGENT-SIDE MONITORING (21229731)... "
  630. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 21229731
  631.  
  632. #echo -ne "\n\t(4l) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.6 AGENT-SIDE MONITORING (21415075)... "
  633. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 21415075
  634.  
  635. echo -ne "\n\t(4l) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.7 AGENT-SIDE MONITORING (21603371)... "
  636. opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 21603371
  637.  
  638. echo -ne "\n\t(4l) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_DISC_HOME) DB PLUGIN BUNDLE 12.1.0.7.4 AGENT-SIDE DISCOVERY (21065239)... "
  639. opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_DISC_HOME 21065239
  640.  
  641. #echo -ne "\n\t(4l) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE MONITORING (20677020)... "
  642. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 20677020
  643.  
  644. #echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.4 AGENT-SIDE MONITORING (21065760)... "
  645. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 21065760
  646.  
  647. #echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.5 AGENT-SIDE MONITORING (21229821)... "
  648. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 21229821
  649.  
  650. #echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.6 AGENT-SIDE MONITORING (21415166)... "
  651. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 21415166
  652.  
  653. echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.7 AGENT-SIDE MONITORING (21603497)... "
  654. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 21603497
  655.  
  656. #echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_DISC_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE DISCOVERY (20677038)... "
  657. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_DISC_HOME 20677038
  658.  
  659. #echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_DISC_HOME) FMW PLUGIN BUNDLE 12.1.0.7.5 AGENT-SIDE DISCOVERY (21229841)... "
  660. #opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_DISC_HOME 21229841
  661.  
  662. echo -ne "\n\t(4m) OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_DISC_HOME) FMW PLUGIN BUNDLE 12.1.0.7.7 AGENT-SIDE DISCOVERY (21611921)... "
  663. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_DISC_HOME 21611921
  664.  
  665. echo -ne "\n\t(4n) OMS CHAINED AGENT BEACON PLUGIN ($AGENT_BEACON_PLUGIN_HOME) EM-BEACON BUNDLE PATCH 12.1.0.4.1 (20466772)... "
  666. opatchcheck AgentBeaconPlugin $AGENT_BEACON_PLUGIN_HOME 20466772
  667.  
  668. echo -ne "\n\t(4o) OMS CHAINED AGENT EM-OH BUNDLE PATCH 12.1.0.4.1 (20855134)... "
  669. opatchcheck AgentOHPlugin $AGENT_OH_PLUGIN_HOME 20855134
  670.  
  671.  
  672. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  673.  
  674. #   if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  675. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.5 19769489... "
  676. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769489
  677. #
  678. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.2 DATABASE PSU (JAN2015) 19877440... "
  679. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877440
  680. #   fi
  681.  
  682.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  683.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.6 (APR2015) (20299013)... "
  684.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20299013
  685.  
  686.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.7 (JUL2015) (20760982)... "
  687.         opatchcheck ReposDBHome $REPOS_DB_HOME 20760982
  688.  
  689.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.3 DATABASE PSU (APR2015) (20406239)... "
  690.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20406239
  691.  
  692.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.4 DATABASE PSU (JUL2015) (21068539)... "
  693.         opatchcheck ReposDBHome $REPOS_DB_HOME 21068539
  694.     fi
  695.  
  696. #   if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  697. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch 20243268... "
  698. #       opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  699. #
  700. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.2 19769480... "
  701. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769480
  702. #
  703. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.2 ORACLE JAVAVM COMPONENT 12.1.0.2.2 DATABASE PSU (JAN2015) 19877336... "
  704. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877336
  705. #   fi
  706.  
  707.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  708.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch (20243268)... "
  709.         opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  710.  
  711.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.3 (APR2015) (20299023)... "
  712.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20299023
  713.  
  714.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.4 (JUL2015) (20831110)... "
  715.         opatchcheck ReposDBHome $REPOS_DB_HOME 20831110
  716.  
  717.         #echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.3 DATABASE PSU (APR2015) (20415564)... "
  718.         #opatchcheck ReposDBHome $REPOS_DB_HOME 20415564
  719.  
  720.         echo -ne "\n\t(4p) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.4 DATABASE PSU (JUL2015) (21068507)... "
  721.         opatchcheck ReposDBHome $REPOS_DB_HOME 21068507
  722.     fi
  723.  
  724.     echo -ne "\n\t(4q) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_VERSION parameter (1545816.1)... "
  725.     paramcheck SSL_VERSION $REPOS_DB_HOME sqlnet.ora
  726.  
  727.     echo -ne "\n\t(4q) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  728.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME sqlnet.ora
  729.  
  730.     echo -ne "\n\t(4q) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_VERSION parameter (1545816.1)... "
  731.     paramcheck SSL_VERSION $REPOS_DB_HOME listener.ora
  732.  
  733.     echo -ne "\n\t(4q) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  734.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME listener.ora
  735. fi
  736.  
  737. echo
  738.  
  739. echo -e "\n(5) Checking EM12c Java versions against baseline (see notes 1506916.1, 1492980.1)"
  740.  
  741. echo -ne "\n\t(5a) MW ($MW_HOME/jdk16/jdk) Java version 1.6.0_95 (9553040)... "
  742. javacheck MW $MW_HOME/jdk16/jdk 1.6.0_95
  743.  
  744. echo -ne "\n\t(5b) WebTier ($WEBTIER_HOME/jdk) Java version 1.6.0_95 (9553040)... "
  745. javacheck WebTier $WEBTIER_HOME/jdk 1.6.0_95
  746.  
  747. echo
  748.  
  749. if [[ $FAIL_COUNT -gt "0" ]]; then
  750.     echo "Failed test count: $FAIL_COUNT - Review output"
  751.     test $VERBOSE_CHECKSEC -ge 1 && echo -e $FAIL_TESTS
  752. else
  753.     echo "All tests succeeded."
  754. fi
  755.  
  756. echo
  757. echo "Visit https://pardydba.wordpress.com/2015/03/09/em12c-r4-ssl-security-checkup-script/ for the latest version."
  758. echo
  759.  
  760. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!