API tools faq
paste
Advertisement
Guest User

EM13c TLS Check Script v0.6

a guest
Jul 20th, 2016
119
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 23.44 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM13c environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It will also validate your
  6. # system comparing against the latest recommended patches and also flags
  7. # the use of demo or self-signed certificates.  Latest enhancement adds
  8. # checks for the EM13c WLS Java JDK version.
  9. #
  10. # Released  v0.1:  Initial beta release 5 Apr 2016
  11. # Changes   v0.2:  Updated for current patches
  12. # Changes   v0.3:  APR2016 patchset added
  13. # Changes   v0.4:  Plugin updates for 20160429
  14. # Changes   v0.5:  Plugin updates for 20160531
  15. # Changes   v0.6:  Plugin/OMS/DB updates for 20160719 CPU + Java check
  16. #
  17. # From: @BrianPardy on Twitter
  18. #
  19. # Known functional on Linux x86-64, may work on Solaris and AIX.
  20. #
  21. # Run this script as the Oracle EM13c software owner, with your environment
  22. # fully up and running.
  23. #
  24. # Thanks to Dave Corsar, who tested a previous version on Solaris and
  25. # let me know the changes needed to make the script work on Solaris.
  26. #
  27. # Thanks to opa tropa who confirmed AIX functionality on a previous
  28. # version and noted the use of GNU extensions to grep, which I have
  29. # since removed.
  30. #
  31. # Dedicated to our two Lhasa Apsos:
  32. #   Lucy (6/13/1998 - 3/13/2015)
  33. #   Ethel (6/13/1998 - 7/31/2015)
  34. #
  35. #
  36.  
  37. SCRIPTNAME=`basename $0`
  38. PATCHDATE="19 Jul 2016"
  39. OMSHOST=`hostname -f`
  40. VERSION="0.6"
  41. FAIL_COUNT=0
  42. FAIL_TESTS=""
  43.  
  44. RUN_DB_CHECK=0
  45. VERBOSE_CHECKSEC=2
  46.  
  47. HOST_OS=`uname -s`
  48. HOST_ARCH=`uname -m`
  49.  
  50. ORAGCHOMELIST="/etc/oragchomelist"
  51. ORATAB="/etc/oratab"
  52.  
  53. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  54.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  55. fi
  56.  
  57. if [[ ! -r $ORATAB ]]; then                 # Solaris
  58.     ORATAB="/var/opt/oracle/oratab"
  59. fi
  60.  
  61. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  62.     GREP=/usr/sfw/bin/gegrep
  63. else
  64.     GREP=`which grep`
  65. fi
  66.  
  67. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  68.  
  69. if [[ "$OMS_HOME" == "." ]]; then
  70.     OMS_HOME=`cat $ORAGCHOMELIST | head -n 1`
  71. fi
  72.  
  73.  
  74. OPATCH="$OMS_HOME/OPatch/opatch"
  75. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  76. OMSPATCHER="$OMS_HOME/OMSPatcher/omspatcher"
  77. OMSORAINST="$OMS_HOME/oraInst.loc"
  78. ORAINVENTORY=`$GREP inventory_loc $OMSORAINST | awk -F= '{print $2}'`
  79.  
  80. MW_HOME=$OMS_HOME
  81. COMMON_HOME="$MW_HOME/oracle_common"
  82.  
  83. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent13c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  84.  
  85.  
  86. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  87.  
  88. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  89. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  90. #OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  91. #OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  92.  
  93. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  94. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  95. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  96. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  97. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  98. PORT_BIP_OHS=`$GREP BIP_HTTPS_OHS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  99. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  100. #PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  101. #PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  102. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  103.  
  104. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  105. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  106. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  107.  
  108. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  109.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  110.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  111.  
  112.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  113.         RUN_DB_CHECK=1
  114.     fi
  115.  
  116.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  117.         RUN_DB_CHECK=1
  118.     fi
  119.  
  120.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  121.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported by this script for now"
  122.     fi
  123. fi
  124.  
  125.  
  126.  
  127. sslcheck () {
  128.     OPENSSL_CHECK_COMPONENT=$1
  129.     OPENSSL_CHECK_HOST=$2
  130.     OPENSSL_CHECK_PORT=$3
  131.     OPENSSL_CHECK_PROTO=$4
  132.  
  133.     OPENSSL_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  134.    
  135.    
  136.  
  137.     if [[ $OPENSSL_CHECK_PROTO == "tls1" ]]; then
  138.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO available for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  139.         if [[ $OPENSSL_RETURN -eq "0" ]]; then
  140.             echo OK
  141.         else
  142.             echo FAILED
  143.             FAIL_COUNT=$((FAIL_COUNT+1))
  144.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection failed"
  145.         fi
  146.     fi
  147.  
  148.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  149.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO disabled for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  150.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  151.             echo OK
  152.         else
  153.             echo FAILED
  154.             FAIL_COUNT=$((FAIL_COUNT+1))
  155.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection succeeded"
  156.         fi
  157.     fi
  158. }
  159.  
  160. opatchcheck () {
  161.     OPATCH_CHECK_COMPONENT=$1
  162.     OPATCH_CHECK_OH=$2
  163.     OPATCH_CHECK_PATCH=$3
  164.  
  165.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  166.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  167.     else
  168.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  169.     fi
  170.  
  171.     if [[ -z "$OPATCH_RET" ]]; then
  172.         echo FAILED
  173.         FAIL_COUNT=$((FAIL_COUNT+1))
  174.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCH_CHECK_COMPONENT @ ${OPATCH_CHECK_OH}:Patch $OPATCH_CHECK_PATCH not found"
  175.     else
  176.         echo OK
  177.     fi
  178.  
  179.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCH_RET
  180.  
  181. }
  182.  
  183. opatchautocheck () {
  184.     OPATCHAUTO_CHECK_COMPONENT=$1
  185.     OPATCHAUTO_CHECK_OH=$2
  186.     OPATCHAUTO_CHECK_PATCH=$3
  187.  
  188.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  189.  
  190.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  191.         echo FAILED
  192.         FAIL_COUNT=$((FAIL_COUNT+1))
  193.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCHAUTO_CHECK_COMPONENT @ ${OPATCHAUTO_CHECK_OH}:Patch $OPATCHAUTO_CHECK_PATCH not found"
  194.     else
  195.         echo OK
  196.     fi
  197.  
  198.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCHAUTO_RET
  199.  
  200. }
  201.  
  202. omspatchercheck () {
  203.     OMSPATCHER_CHECK_COMPONENT=$1
  204.     OMSPATCHER_CHECK_OH=$2
  205.     OMSPATCHER_CHECK_PATCH=$3
  206.  
  207.     OMSPATCHER_RET=`$OMSPATCHER lspatches -oh $OMSPATCHER_CHECK_OH | $GREP $OMSPATCHER_CHECK_PATCH`
  208.  
  209.     if [[ -z "$OMSPATCHER_RET" ]]; then
  210.         echo FAILED
  211.         FAIL_COUNT=$((FAIL_COUNT+1))
  212.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OMSPATCHER_CHECK_COMPONENT @ ${OMSPATCHER_CHECK_OH}:Patch $OMSPATCHER_CHECK_PATCH not found"
  213.     else
  214.         echo OK
  215.     fi
  216.  
  217.     test $VERBOSE_CHECKSEC -ge 2 && echo $OMSPATCHER_RET
  218.  
  219. }
  220.  
  221. certcheck () {
  222.     CERTCHECK_CHECK_COMPONENT=$1
  223.     CERTCHECK_CHECK_HOST=$2
  224.     CERTCHECK_CHECK_PORT=$3
  225.  
  226.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT)... "
  227.  
  228.     OPENSSL_SELFSIGNED_COUNT=`echo Q | openssl s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT -tls1 2>&1 | $GREP -ci "self signed certificate"`
  229.  
  230.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  231.         echo OK
  232.     else
  233.         echo FAILED - Found self-signed certificate
  234.         FAIL_COUNT=$((FAIL_COUNT+1))
  235.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$CERTCHECK_CHECK_COMPONENT @ ${CERTCHECK_CHECK_HOST}:${CERTCHECK_CHECK_PORT} found self-signed certificate"
  236.     fi
  237. }
  238.  
  239. democertcheck () {
  240.     DEMOCERTCHECK_CHECK_COMPONENT=$1
  241.     DEMOCERTCHECK_CHECK_HOST=$2
  242.     DEMOCERTCHECK_CHECK_PORT=$3
  243.  
  244.     echo -ne "\tChecking demo certificate at $DEMOCERTCHECK_CHECK_COMPONENT ($DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT)... "
  245.  
  246.     OPENSSL_DEMO_COUNT=`echo Q | openssl s_client -prexit -connect $DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT -tls1 2>&1 | $GREP -ci "issuer=/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN"`
  247.  
  248.     if [[ $OPENSSL_DEMO_COUNT -eq "0" ]]; then
  249.         echo OK
  250.     else
  251.         echo FAILED - Found demonstration certificate
  252.         FAIL_COUNT=$((FAIL_COUNT+1))
  253.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$DEMOCERTCHECK_CHECK_COMPONENT @ ${DEMOCERTCHECK_CHECK_HOST}:${DEMOCERTCHECK_CHECK_PORT} found demonstration certificate"
  254.     fi
  255. }
  256.  
  257.  
  258. ciphercheck () {
  259.     OPENSSL_CHECK_COMPONENT=$1
  260.     OPENSSL_CHECK_HOST=$2
  261.     OPENSSL_CHECK_PORT=$3
  262.  
  263.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  264.  
  265.     OPENSSL_LOW_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  266.  
  267.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  268.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  269.         FAIL_COUNT=$((FAIL_COUNT+1))
  270.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits LOW strength ciphers"
  271.     else
  272.         echo -e "\tOK"
  273.     fi
  274.  
  275.  
  276.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  277.  
  278.     OPENSSL_MEDIUM_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  279.  
  280.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  281.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  282.         FAIL_COUNT=$((FAIL_COUNT+1))
  283.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits MEDIUM strength ciphers"
  284.     else
  285.         echo -e "\tOK"
  286.     fi
  287.  
  288.  
  289.  
  290.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  291.  
  292.     OPENSSL_HIGH_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  293.  
  294.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  295.         echo -e "\tOK"
  296.     else
  297.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  298.         FAIL_COUNT=$((FAIL_COUNT+1))
  299.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Rejects HIGH strength ciphers"
  300.     fi
  301.     echo
  302. }
  303.  
  304. wlspatchcheck () {
  305.     WLSDIR=$1
  306.     WLSPATCH=$2
  307.  
  308.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $WLSPATCH`
  309.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  310.  
  311.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  312.         echo -e "\tOK"
  313.     else
  314.         echo -e "\tFAILED - PATCH NOT FOUND"
  315.         FAIL_COUNT=$((FAIL_COUNT+1))
  316.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WLSDIR:Patch $WLSPATCH not found"
  317.     fi
  318.  
  319.     test $VERBOSE_CHECKSEC -ge 2 && echo $WLSCHECK_RETURN
  320.    
  321. }
  322.  
  323. javacheck () {
  324.     WHICH_JAVA=$1
  325.     JAVA_DIR=$2
  326.  
  327.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  328.  
  329.     if [[ "$JAVACHECK_RETURN" == "1.7.0_111" ]]; then
  330.         echo -e "\tOK"
  331.     else
  332.         #echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  333.         echo -e "\tFAILED"
  334.         FAIL_COUNT=$((FAIL_COUNT+1))
  335.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_JAVA Java in ${JAVA_DIR}:Found incorrect version $JAVACHECK_RETURN"
  336.     fi
  337.     test $VERBOSE_CHECKSEC -ge 2 && echo $JAVACHECK_RETURN
  338. }
  339.  
  340. paramcheck () {
  341.     WHICH_PARAM=$1
  342.     WHICH_ORACLE_HOME=$2
  343.     WHICH_FILE=$3
  344.  
  345.     PARAMCHECK_RETURN=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | awk -F= '{print $2}' | sed -e 's/\s//g'`
  346.     if [[ "$WHICH_PARAM" == "SSL_VERSION" ]]; then
  347.         if [[ "$PARAMCHECK_RETURN" == "1.0" ]]; then
  348.             echo -e "OK"
  349.         else
  350.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  351.             FAIL_COUNT=$((FAIL_COUNT+1))
  352.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  353.         fi
  354.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  355.     fi
  356.  
  357.     if [[ "$WHICH_PARAM" == "SSL_CIPHER_SUITES" ]]; then
  358.         if [[ "$PARAMCHECK_RETURN" == "(SSL_RSA_WITH_AES128_CBC_SHA,SSL_RSA_WITH_AES256_CBC_SHA)" ]]; then
  359.             echo -e "OK"
  360.         else
  361.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  362.             FAIL_COUNT=$((FAIL_COUNT+1))
  363.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  364.         fi
  365.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  366.     fi
  367. }
  368.  
  369.  
  370. ### MAIN SCRIPT HERE
  371.  
  372.  
  373. echo -e "Performing EM13c security checkup version $VERSION on $OMSHOST at `date`.\n"
  374.  
  375. echo "Using port definitions from configuration files "
  376. echo -e "\t/etc/oragchomelist"
  377. echo -e "\t$EMGC_PROPS"
  378. echo -e "\t$EMBIP_PROPS"
  379. echo
  380. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  381. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  382. echo -e "\tBIPublisherOHS port found at $OMSHOST:$PORT_BIP_OHS"
  383. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  384. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  385. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  386. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  387. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  388. echo
  389. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  390.  
  391. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  392.     echo -e "\tRepository DB on OMS server, will check patches/parameters in $REPOS_DB_HOME"
  393. fi
  394.  
  395. #exit 0
  396.  
  397. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  398.  
  399. echo -e "\n\t(1a) Forbid SSLv2 connections"
  400. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  401. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  402. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  403. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl2
  404. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  405. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  406. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  407. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  408. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  409.  
  410. echo -e "\n\t(1b) Forbid SSLv3 connections"
  411. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  412. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  413. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  414. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl3
  415. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  416. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  417. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  418. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  419. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  420.  
  421. echo -e "\n\t(1c) Permit TLSv1 connections"
  422. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  423. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  424. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  425. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1
  426. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  427. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  428. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  429. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  430. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  431.  
  432. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 2138391.1, 1067411.1)"
  433. ciphercheck Agent $OMSHOST $PORT_AGENT
  434. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  435. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  436. ciphercheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  437. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  438. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  439. ciphercheck OMSupload $OMSHOST $PORT_UPL
  440. #ciphercheck OPMN $OMSHOST $PORT_OPMN
  441. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  442.  
  443. echo -e "\n(3) Checking self-signed and demonstration certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  444. certcheck Agent $OMSHOST $PORT_AGENT
  445. democertcheck Agent $OMSHOST $PORT_AGENT
  446. certcheck BIPublisher $OMSHOST $PORT_BIP
  447. democertcheck BIPublisher $OMSHOST $PORT_BIP
  448. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  449. democertcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  450. certcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  451. democertcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  452. certcheck OMSconsole $OMSHOST $PORT_OMS
  453. democertcheck OMSconsole $OMSHOST $PORT_OMS
  454. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  455. democertcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  456. certcheck OMSupload $OMSHOST $PORT_UPL
  457. democertcheck OMSupload $OMSHOST $PORT_UPL
  458. #certcheck OPMN $OMSHOST $PORT_OPMN
  459. #democertcheck OPMN $OMSHOST $PORT_OPMN
  460. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  461. democertcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  462.  
  463.  
  464. echo -e "\n(4) Checking EM13c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  465.  
  466. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  467.  
  468.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  469.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160119 (JAN2016) (21948354)... "
  470.         #opatchcheck ReposDBHome $REPOS_DB_HOME 21948354
  471.  
  472.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160419 (APR2016) (22291127)... "
  473.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22291127
  474.  
  475.         echo -ne "\n\t(4a) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160719 (JUL2016) (23054246)... "
  476.         opatchcheck ReposDBHome $REPOS_DB_HOME 23054246
  477.  
  478.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160119 DATABASE PSU (JAN2016) (22139226)... "
  479.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22139226
  480.  
  481.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160419 DATABASE PSU (APR2016) (22674709)... "
  482.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22674709
  483.  
  484.         echo -ne "\n\t(4a) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160719 DATABASE PSU (JUL2016) (23177536)... "
  485.         opatchcheck ReposDBHome $REPOS_DB_HOME 23177536
  486.     fi
  487.  
  488.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_VERSION parameter (1545816.1)... "
  489.     paramcheck SSL_VERSION $REPOS_DB_HOME sqlnet.ora
  490.  
  491.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  492.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME sqlnet.ora
  493.  
  494.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_VERSION parameter (1545816.1)... "
  495.     paramcheck SSL_VERSION $REPOS_DB_HOME listener.ora
  496.  
  497.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  498.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME listener.ora
  499. fi
  500.  
  501. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160331 (22823268)... "
  502. #opatchcheck Agent $AGENT_HOME 22823268
  503.  
  504. #echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160429 (23030165)... "
  505. #opatchcheck Agent $AGENT_HOME 23030165
  506.  
  507. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160531 (23208577)... "
  508. #opatchcheck Agent $AGENT_HOME 23208577
  509.  
  510. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160719 (23592254)... "
  511. opatchcheck Agent $AGENT_HOME 23592254
  512.  
  513. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22920712)... "
  514. #opatchcheck Agent $AGENT_HOME 22920712
  515.  
  516. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095221)... "
  517. #opatchcheck Agent $AGENT_HOME 23095221
  518.  
  519. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294830)... "
  520. #opatchcheck Agent $AGENT_HOME 23294830
  521.  
  522. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697777)... "
  523. opatchcheck Agent $AGENT_HOME 23697777
  524.  
  525. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294839)... "
  526. opatchcheck Agent $AGENT_HOME 23294839
  527.  
  528. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22936491)... "
  529. #opatchcheck Agent $AGENT_HOME 22936491
  530.  
  531. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095280)... "
  532. #opatchcheck Agent $AGENT_HOME 23095280
  533.  
  534. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294872)... "
  535. #opatchcheck Agent $AGENT_HOME 23294872
  536.  
  537. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697781)... "
  538. opatchcheck Agent $AGENT_HOME 23697781
  539.  
  540. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22823189)... "
  541. #opatchcheck Agent $AGENT_HOME 22823189
  542.  
  543. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23208587)... "
  544. #opatchcheck Agent $AGENT_HOME 23208587
  545.  
  546. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160719 MONITORING (23697783)... "
  547. opatchcheck Agent $AGENT_HOME 23697783
  548.  
  549. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294895)... "
  550. opatchcheck Agent $AGENT_HOME 23294895
  551.  
  552. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160331 (22920724)... "
  553. #omspatchercheck OMS $OMS_HOME 22920724
  554.  
  555. echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM OH PLUGIN BUNDLE PATCH 13.1.1.0.160429 (23135564)... "
  556. opatchcheck Agent $AGENT_HOME 23135564
  557.  
  558. #echo -ne "\n\t(4d) *UPDATED* OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160429 (23095307)... "
  559. #omspatchercheck OMS $OMS_HOME 23095307
  560.  
  561. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160531 (23294904)... "
  562. #omspatchercheck OMS $OMS_HOME 23294904
  563.  
  564. echo -ne "\n\t(4d) *UPDATED* OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160719 (23697785)... "
  565. omspatchercheck OMS $OMS_HOME 23697785
  566.  
  567. #echo -ne "\n\t(4e) ($MW_HOME) WLS PATCH SET UPDATE 12.1.3.0.160419 (22505404)... "
  568. #opatchcheck WLS $MW_HOME 22505404
  569.  
  570. echo -ne "\n\t(4e) *UPDATED* ($MW_HOME) WLS PATCH SET UPDATE 12.1.3.0.160719 (23094292)... "
  571. opatchcheck WLS $MW_HOME 23094292
  572.  
  573. echo -ne "\n\t(4f) *NEW* OMS HOME ($OMS_HOME) ENTERPRISE MANAGER BASE PLATFORM PATCH SET UPDATE 13.1.0.0.160719 (23134365)... "
  574. omspatchercheck OMS $MW_HOME 23134365
  575.  
  576. echo -e "\n(5) Checking EM13c Java patch levels against $PATCHDATE baseline (see notes 1492980.1, 1616397.1)"
  577.  
  578. echo -ne "\n\t(5a) *NEW* WLS ($MW_HOME/oracle_common/jdk) JAVA SE JDK VERSION 1.7.0-111 (13079846)... "
  579. javacheck WLSJAVA $MW_HOME/oracle_common/jdk
  580.  
  581. #echo -ne "\n\t(5a) *NEW* OMS CHAINED AGENT HOME ($AGENT_HOME/oracle_common/jdk) JAVA SE JDK VERSION 1.7.0-111 (13079846)... "
  582. #javacheck AGTJAVA $AGENT_HOME/oracle_common/jdk
  583.  
  584. echo
  585. echo
  586.  
  587. if [[ $FAIL_COUNT -gt "0" ]]; then
  588.     echo "Failed test count: $FAIL_COUNT - Review output"
  589.     test $VERBOSE_CHECKSEC -ge 1 && echo -e $FAIL_TESTS
  590. else
  591.     echo "All tests succeeded."
  592. fi
  593.  
  594. echo
  595. echo "Visit https://pardydba.wordpress.com/2016/04/05/securing-oracle-enterprise-manager-13c/ for the latest version."
  596. echo
  597.  
  598. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!