API tools faq
paste
Advertisement
Guest User

EM12c R4 SSL Security Checkup Script v1.2

a guest
Apr 17th, 2015
208
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 19.77 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM12c R4 environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It also contains a patch
  6. # check currently comparing against the latest recommended patches
  7. # and flags the use of self-signed certificates.  Further checks include
  8. # EM12c Java JDK version.
  9. #
  10. # Added in v1.0: Repository database patch check
  11. # Added in v1.1: EM12c Java JDK version check
  12. # Change in v1.2: Removed patch 19948000 recommendation for OHS.
  13. #
  14. # From: @BrianPardy on Twitter
  15. #
  16. # Known functional on Linux x86-64, Solaris, AIX.
  17. #
  18. # Run this script as the Oracle EM12c software owner, with your environment
  19. # fully up and running.
  20. #
  21. # Thanks to Dave Corsar, who tested on Solaris and let me know the
  22. # changes needed to make an earlier version work on Solaris.
  23. #
  24. # Thanks to opa tropa who confirmed AIX functionality and noted the
  25. # use of GNU extensions to grep, which I have since removed.
  26. #
  27. # Dedicated to our two Lhasa Apsos, Lucy (RIP 3/13/2015) and Ethel.
  28. #
  29.  
  30. SCRIPTNAME=`basename $0`
  31. PATCHDATE="15 April 2015"
  32. OMSHOST=`hostname -f`
  33. VERSION="1.2"
  34. FAIL_COUNT=0
  35.  
  36. RUN_DB_CHECK=0
  37.  
  38. ORAGCHOMELIST="/etc/oragchomelist"
  39. ORATAB="/etc/oratab"
  40.  
  41. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  42.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  43. fi
  44.  
  45. if [[ ! -r $ORATAB ]]; then                 # Solaris
  46.     ORATAB="/var/opt/oracle/oratab"
  47. fi
  48.  
  49. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  50.     GREP=/usr/sfw/bin/gegrep
  51. else
  52.     GREP=`which grep`
  53. fi
  54.  
  55. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  56.  
  57. OPATCH="$OMS_HOME/OPatch/opatch"
  58. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  59. OMSORAINST="$OMS_HOME/oraInst.loc"
  60. ORAINVENTORY=`head -n 1 $OMSORAINST | awk -F= '{print $2}'`
  61.  
  62. MW_HOME=`dirname $OMS_HOME`
  63. BIP_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"Oracle_BI" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  64. COMMON_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"common" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  65. WEBTIER_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"webtier" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  66. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent12c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  67. AGENT_DB_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.db.agent.plugin_12.1.0.7.0"
  68. AGENT_FMW_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.agent.plugin_12.1.0.7.0"
  69. AGENT_FMW_PLUGIN_DISC_HOME="$AGENT_HOME/../../plugins/oracle.sysman.emas.discovery.plugin_12.1.0.7.0"
  70. AGENT_BEACON_PLUGIN_HOME="$AGENT_HOME/../../plugins/oracle.sysman.beacon.agent.plugin_12.1.0.4.0"
  71.  
  72. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  73. WL_HOME=`$GREP wlserver $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/samples.*$//' | sed -e 's/"//' | uniq`
  74.  
  75. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  76. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  77. OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  78. OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  79.  
  80. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  81. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  82. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  83. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  84. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  85. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  86. PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  87. PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  88. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  89.  
  90. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  91. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  92. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  93.  
  94. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  95.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  96.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  97.  
  98.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  99.         RUN_DB_CHECK=1
  100.     fi
  101.  
  102.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  103.         RUN_DB_CHECK=1
  104.     fi
  105.  
  106.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  107.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported for now"
  108.     fi
  109. fi
  110.  
  111.  
  112.  
  113.  
  114. sslcheck () {
  115.     OPENSSL_CHECK_COMPONENT=$1
  116.     OPENSSL_CHECK_HOST=$2
  117.     OPENSSL_CHECK_PORT=$3
  118.     OPENSSL_CHECK_PROTO=$4
  119.  
  120.     OPENSSL_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  121.    
  122.    
  123.  
  124.     if [[ $OPENSSL_CHECK_PROTO == "tls1" ]]; then
  125.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO available for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  126.         if [[ $OPENSSL_RETURN -eq "0" ]]; then
  127.             echo OK
  128.         else
  129.             echo FAILED
  130.             FAIL_COUNT=$((FAIL_COUNT+1))
  131.         fi
  132.     fi
  133.  
  134.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  135.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO disabled for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  136.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  137.             echo OK
  138.         else
  139.             echo FAILED
  140.             FAIL_COUNT=$((FAIL_COUNT+1))
  141.         fi
  142.     fi
  143. }
  144.  
  145. opatchcheck () {
  146.     OPATCH_CHECK_COMPONENT=$1
  147.     OPATCH_CHECK_OH=$2
  148.     OPATCH_CHECK_PATCH=$3
  149.  
  150.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  151.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  152.     else
  153.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  154.     fi
  155.  
  156.     if [[ -z "$OPATCH_RET" ]]; then
  157.         echo FAILED
  158.         FAIL_COUNT=$((FAIL_COUNT+1))
  159.     else
  160.         echo OK
  161.     fi
  162.  
  163.     echo $OPATCH_RET
  164.  
  165. }
  166.  
  167. opatchautocheck () {
  168.     OPATCHAUTO_CHECK_COMPONENT=$1
  169.     OPATCHAUTO_CHECK_OH=$2
  170.     OPATCHAUTO_CHECK_PATCH=$3
  171.  
  172.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  173.  
  174.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  175.         echo FAILED
  176.         FAIL_COUNT=$((FAIL_COUNT+1))
  177.     else
  178.         echo OK
  179.     fi
  180.  
  181.     echo $OPATCHAUTO_RET
  182.  
  183. }
  184.  
  185. certcheck () {
  186.     CERTCHECK_CHECK_COMPONENT=$1
  187.     CERTCHECK_CHECK_HOST=$2
  188.     CERTCHECK_CHECK_PORT=$3
  189.  
  190.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT)... "
  191.  
  192.     OPENSSL_SELFSIGNED_COUNT=`echo Q | openssl s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT 2>&1 | $GREP -ci "self signed certificate"`
  193.  
  194.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  195.         echo OK
  196.     else
  197.         echo FAILED - Found self-signed certificate
  198.         FAIL_COUNT=$((FAIL_COUNT+1))
  199.     fi
  200. }
  201.  
  202.  
  203. ciphercheck () {
  204.     OPENSSL_CHECK_COMPONENT=$1
  205.     OPENSSL_CHECK_HOST=$2
  206.     OPENSSL_CHECK_PORT=$3
  207.  
  208.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  209.  
  210.     OPENSSL_LOW_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  211.  
  212.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  213.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  214.         FAIL_COUNT=$((FAIL_COUNT+1))
  215.     else
  216.         echo -e "\tOK"
  217.     fi
  218.  
  219.  
  220.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  221.  
  222.     OPENSSL_MEDIUM_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  223.  
  224.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  225.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  226.         FAIL_COUNT=$((FAIL_COUNT+1))
  227.     else
  228.         echo -e "\tOK"
  229.     fi
  230.  
  231.  
  232.  
  233.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  234.  
  235.     OPENSSL_HIGH_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  236.  
  237.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  238.         echo -e "\tOK"
  239.     else
  240.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  241.         FAIL_COUNT=$((FAIL_COUNT+1))
  242.     fi
  243.     echo
  244. }
  245.  
  246. wlspatchcheck () {
  247.     WLSDIR=$1
  248.     PATCH=$2
  249.  
  250.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $PATCH`
  251.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  252.  
  253.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  254.         echo -e "\tOK"
  255.     else
  256.         echo -e "\tFAILED - PATCH NOT FOUND"
  257.         FAIL_COUNT=$((FAIL_COUNT+1))
  258.     fi
  259.  
  260.     echo $WLSCHECK_RETURN
  261.    
  262. }
  263.  
  264. javacheck () {
  265.     WHICH_JAVA=$1
  266.     JAVA_DIR=$2
  267.  
  268.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  269.  
  270.     if [[ "$JAVACHECK_RETURN" == "1.6.0_95" ]]; then
  271.         echo -e "\tOK"
  272.     else
  273.         echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  274.         FAIL_COUNT=$((FAIL_COUNT+1))
  275.     fi
  276. }
  277.  
  278.  
  279. ### MAIN SCRIPT HERE
  280.  
  281.  
  282. echo -e "Performing EM12cR4 security checkup version $VERSION.\n"
  283.  
  284. echo "Using port definitions from configuration files "
  285. echo -e "\t/etc/oragchomelist"
  286. echo -e "\t$EMGC_PROPS"
  287. echo -e "\t$EMBIP_PROPS"
  288. echo -e "\t$OPMN_PROPS"
  289. echo -e "\t$OHS_ADMIN_CONF"
  290. echo
  291. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  292. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  293. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  294. echo -e "\tOHSadmin port found at $OMSHOST:$PORT_OHS_ADMIN"
  295. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  296. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  297. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  298. echo -e "\tOPMN port found at $OMSHOST:$PORT_OPMN"
  299. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  300. echo
  301. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  302.  
  303. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  304.     echo -e "\tRepository DB on OMS server, will check patches in $REPOS_DB_HOME"
  305.  
  306. fi
  307.  
  308. #echo -e "\tRepository DB connect descriptor $REPOS_DB_CONNDESC"
  309. #echo -e "\tRepository DB host $REPOS_DB_HOST"
  310. #echo -e "\tRepository DB SID $REPOS_DB_SID"
  311. #echo -e "\tRepository DB ORACLE_HOME $REPOS_DB_HOME"
  312.  
  313.  
  314.  
  315. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  316.  
  317. echo -e "\n\t(1a) Forbid SSLv2 connections"
  318. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  319. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  320. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  321. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl2
  322. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  323. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  324. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  325. sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  326. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  327.  
  328. echo -e "\n\t(1b) Forbid SSLv3 connections"
  329. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  330. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  331. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  332. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN ssl3
  333. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  334. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  335. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  336. sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  337. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  338.  
  339. echo -e "\n\t(1c) Permit TLSv1 connections"
  340. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  341. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  342. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  343. sslcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN tls1
  344. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  345. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  346. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  347. sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  348. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  349.  
  350. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 1477287.1, 1905314.1, 1067411.1)"
  351. ciphercheck Agent $OMSHOST $PORT_AGENT
  352. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  353. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  354. ciphercheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  355. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  356. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  357. ciphercheck OMSupload $OMSHOST $PORT_UPL
  358. ciphercheck OPMN $OMSHOST $PORT_OPMN
  359. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  360.  
  361. echo -e "\n(3) Checking self-signed certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  362. certcheck Agent $OMSHOST $PORT_AGENT
  363. certcheck BIPublisher $OMSHOST $PORT_BIP
  364. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  365. certcheck OHSadmin $OMSHOST $PORT_OHS_ADMIN
  366. certcheck OMSconsole $OMSHOST $PORT_OMS
  367. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  368. certcheck OMSupload $OMSHOST $PORT_UPL
  369. certcheck OPMN $OMSHOST $PORT_OPMN
  370. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  371.  
  372.  
  373. echo -e "\n(4) Checking EM12c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  374.  
  375. #echo -ne "\n\t(4a) OMS ($OMS_HOME) PSU2 Patch 19830994... "
  376. #opatchcheck OMS $OMS_HOME 19830994
  377.  
  378. echo -ne "\n\t(4a) *UPDATED* OMS ($OMS_HOME) PSU3 Patch (20392036)... "
  379. opatchcheck OMS $OMS_HOME 20392036
  380.  
  381. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) CPUJAN2015 Patch (19822893)... "
  382. opatchcheck BIP $BIP_HOME 19822893
  383.  
  384. echo -ne "\n\t(4b) BI Publisher ($BIP_HOME) Merge Patch (20444447)... "
  385. opatchcheck BIP $BIP_HOME 20444447
  386.  
  387. echo -ne "\n\t(4c) AS Common ($COMMON_HOME) CVE-2015-0426 Oracle Help Patch (20075252)... "
  388. opatchcheck COMMON $COMMON_HOME 20075252
  389.  
  390. echo -ne "\n\t(4c) *NEW* AS Common ($COMMON_HOME) ADF MERGE REQUEST ON TOP OF 11.1.1.7.1 FOR BUGS 20465665 18820382 20645397 (20747356)... "
  391. opatchcheck COMMON $COMMON_HOME 20747356
  392.  
  393. echo -ne "\n\t(4c) *NEW* AS Common ($COMMON_HOME) WEBCENTER PORTAL BUNDLE PATCH 11.1.1.7.1 (16761779)... "
  394. opatchcheck COMMON $COMMON_HOME 16761779
  395.  
  396. #echo -ne "\n\t(4d) WebLogic Server ($WL_HOME) 10.3.6.0.10 12UV Patch (19637463)... "
  397. #wlspatchcheck $WL_HOME 19637463
  398.  
  399. echo -ne "\n\t(4d) *UPDATED* WebLogic Server ($WL_HOME) 10.3.6.0.11 YUIS Patch (20181997)... "
  400. wlspatchcheck $WL_HOME 20181997
  401.  
  402. # Commented this patch out 4/17/2015, as Oracle no longer recommends it for EM12c installations.
  403. #echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CPUJAN2015 Patch (19948000)... "
  404. #opatchcheck WebTier $WEBTIER_HOME 19948000
  405.  
  406. echo -ne "\n\t(4e) WebTier ($WEBTIER_HOME) CVE-2014-4212 OPMN Patch (19345576)... "
  407. opatchcheck WebTier $WEBTIER_HOME 19345576
  408.  
  409. echo -ne "\n\t(4e) *NEW* WebTier ($WEBTIER_HOME) CVE-2013-3836 PLACEHOLDER FOR SECURITY PATCH FOR WEBCACHE 11.1.1.7.0 WITH OCT2013 CPU (17306880)... "
  410. opatchcheck WebTier $WEBTIER_HOME 17306880
  411.  
  412. echo -ne "\n\t(4e) *NEW* WebTier ($WEBTIER_HOME) CVE-2013-0169,CVE-2011-3389 OSS SECURITY PATCH UPDATE 11.1.1.7.0 CPUOCT2013 (17337741)... "
  413. opatchcheck WebTier $WEBTIER_HOME 17337741
  414.  
  415. echo -ne "\n\t(4e) *NEW* WebTier ($WEBTIER_HOME) WLSPLUGINS (OHS) SECURITY PATCH UPDATE 11.1.1.7.0 CPUJUL2014 (18423831)... "
  416. opatchcheck WebTier $WEBTIER_HOME 18423831
  417.  
  418. echo -ne "\n\t(4f) *UPDATED* OMS ($OMS_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 (20613714)... "
  419. opatchautocheck OMS $OMS_HOME 20613714
  420.  
  421. echo -ne "\n\t(4g) *UPDATED* OMS ($OMS_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 (20613870)... "
  422. opatchautocheck OMS $OMS_HOME 20613870
  423.  
  424. echo -ne "\n\t(4h) *UPDATED* OMS ($OMS_HOME) MOS PLUGIN BUNDLE 12.1.0.6.4 (20613886)... "
  425. opatchautocheck OMS $OMS_HOME 20613886
  426.  
  427. echo -ne "\n\t(4i) *UPDATED* OMS ($OMS_HOME) EXADATA PLUGIN BUNDLE 12.1.0.6.6 (20613853)... "
  428. opatchautocheck OMS $OMS_HOME 20613853
  429.  
  430. echo -ne "\n\t(4j) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE 12.1.0.4.7 (20613931)... "
  431. opatchcheck Agent $AGENT_HOME 20613931
  432.  
  433. echo -ne "\n\t(4j) OMS CHAINED AGENT HOME ($AGENT_HOME) Merge Patch (18502187)... "
  434. opatchcheck Agent $AGENT_HOME 18502187
  435.  
  436. echo -ne "\n\t(4j) OMS CHAINED AGENT HOME ($AGENT_HOME) JDBC Security Patch (18721761)... "
  437. opatchcheck Agent $AGENT_HOME 18721761
  438.  
  439. #echo -ne "\n\t(4k) OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE 20676926... "
  440. #opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 20676926
  441.  
  442. echo -ne "\n\t(4k) *UPDATED* OMS CHAINED AGENT DB PLUGIN ($AGENT_DB_PLUGIN_HOME) DB PLUGIN BUNDLE 12.1.0.7.3 AGENT-SIDE (20844888)... "
  443. opatchcheck AgentDBPlugin $AGENT_DB_PLUGIN_HOME 20844888
  444.  
  445. echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE MONITORING (20677020)... "
  446. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_HOME 20677020
  447.  
  448. echo -ne "\n\t(4l) *UPDATED* OMS CHAINED AGENT FMW PLUGIN ($AGENT_FMW_PLUGIN_DISC_HOME) FMW PLUGIN BUNDLE 12.1.0.7.2 AGENT-SIDE DISCOVERY (20677038)... "
  449. opatchcheck AgentFMWPlugin $AGENT_FMW_PLUGIN_DISC_HOME 20677038
  450.  
  451. echo -ne "\n\t(4m) *NEW* OMS CHAINED AGENT BEACON PLUGIN ($AGENT_BEACON_PLUGIN_HOME) EM-BEACON BUNDLE PATCH 12.1.0.4.1 (20466772)... "
  452. opatchcheck AgentBeaconPlugin $AGENT_BEACON_PLUGIN_HOME 20466772
  453.  
  454. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  455.  
  456. #   if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  457. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.5 19769489... "
  458. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769489
  459. #
  460. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.2 DATABASE PSU (JAN2015) 19877440... "
  461. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877440
  462. #   fi
  463.  
  464.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  465.         echo -ne "\n\t(4n) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 11.2.0.4.6 (APR2015) (20299013)... "
  466.         opatchcheck ReposDBHome $REPOS_DB_HOME 20299013
  467.  
  468.         echo -ne "\n\t(4n) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 11.2.0.4.3 DATABASE PSU (APR2015) (20406239)... "
  469.         opatchcheck ReposDBHome $REPOS_DB_HOME 20406239
  470.     fi
  471.  
  472. #   if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  473. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch 20243268... "
  474. #       opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  475. #
  476. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.2 19769480... "
  477. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19769480
  478. #
  479. #       echo -ne "\n\t(4m) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.2 ORACLE JAVAVM COMPONENT 12.1.0.2.2 DATABASE PSU (JAN2015) 19877336... "
  480. #       opatchcheck ReposDBHome $REPOS_DB_HOME 19877336
  481. #   fi
  482.  
  483.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  484.         echo -ne "\n\t(4n) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) Required Patch (20243268)... "
  485.         opatchcheck ReposDBHome $REPOS_DB_HOME 20243268
  486.  
  487.         echo -ne "\n\t(4n) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.3 (APR2015) (20299023)... "
  488.         opatchcheck ReposDBHome $REPOS_DB_HOME 20299023
  489.  
  490.         echo -ne "\n\t(4n) *UPDATED* OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.3 DATABASE PSU (APR2015) (20415564)... "
  491.         opatchcheck ReposDBHome $REPOS_DB_HOME 20415564
  492.     fi
  493. fi
  494.  
  495. echo
  496.  
  497. echo -e "\n(5) Checking EM12c Java versions against baseline (see notes 1506916.1, 1492980.1)"
  498.  
  499. echo -ne "\n\t(5a) *NEW* MW ($MW_HOME/jdk16/jdk) Java version 1.6.0_95 (9553040)... "
  500. javacheck MW $MW_HOME/jdk16/jdk 1.6.0_95
  501.  
  502. echo -ne "\n\t(5b) *NEW* WebTier ($WEBTIER_HOME/jdk) Java version 1.6.0_95 (9553040)... "
  503. javacheck WebTier $WEBTIER_HOME/jdk 1.6.0_95
  504.  
  505. echo
  506.  
  507. if [[ $FAIL_COUNT -gt "0" ]]; then
  508.     echo "Failed test count: $FAIL_COUNT - Review output"
  509. else
  510.     echo "All tests succeeded."
  511. fi
  512.  
  513. echo "Visit https://pardydba.wordpress.com/2015/03/09/em12c-r4-ssl-security-checkup-script/ for the latest version."
  514.  
  515. echo
  516.  
  517. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!