API tools faq
paste
Advertisement
Guest User

EM13c TLS Check Script v0.5

a guest
Jun 16th, 2016
77
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 21.49 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # This script should examine your EM13c environment, identify the ports
  4. # each component uses, and check for SSLv2/SSLv3 usage, as well as make
  5. # sure that weak cipher suites get rejected.  It will soon contain a patch
  6. # check currently comparing against the latest recommended patches
  7. # and also flags the use of demo or self-signed certificates.  Further
  8. # enhancements will include checks for the EM13c Java JDK version.
  9. #
  10. # Released  v0.1:  Initial beta release 5 Apr 2016
  11. # Changes   v0.2:  Updated for current patches
  12. # Changes   v0.3:  APR2016 patchset added
  13. # Changes   v0.4:  Plugin updates for 20160429
  14. # Changes   v0.5:  Plugin updates for 20160531
  15. #
  16. # From: @BrianPardy on Twitter
  17. #
  18. # Known functional on Linux x86-64, may work on Solaris and AIX.
  19. #
  20. # Run this script as the Oracle EM13c software owner, with your environment
  21. # fully up and running.
  22. #
  23. # Thanks to Dave Corsar, who tested a previous version on Solaris and
  24. # let me know the changes needed to make the script work on Solaris.
  25. #
  26. # Thanks to opa tropa who confirmed AIX functionality on a previous
  27. # version and noted the use of GNU extensions to grep, which I have
  28. # since removed.
  29. #
  30. # Dedicated to our two Lhasa Apsos:
  31. #   Lucy (6/13/1998 - 3/13/2015)
  32. #   Ethel (6/13/1998 - 7/31/2015)
  33. #
  34. #
  35.  
  36. SCRIPTNAME=`basename $0`
  37. PATCHDATE="31 May 2016"
  38. OMSHOST=`hostname -f`
  39. VERSION="0.5"
  40. FAIL_COUNT=0
  41. FAIL_TESTS=""
  42.  
  43. RUN_DB_CHECK=0
  44. VERBOSE_CHECKSEC=2
  45.  
  46. HOST_OS=`uname -s`
  47. HOST_ARCH=`uname -m`
  48.  
  49. ORAGCHOMELIST="/etc/oragchomelist"
  50. ORATAB="/etc/oratab"
  51.  
  52. if [[ ! -r $ORAGCHOMELIST ]]; then          # Solaris
  53.     ORAGCHOMELIST="/var/opt/oracle/oragchomelist"
  54. fi
  55.  
  56. if [[ ! -r $ORATAB ]]; then                 # Solaris
  57.     ORATAB="/var/opt/oracle/oratab"
  58. fi
  59.  
  60. if [[ -x "/usr/sfw/bin/gegrep" ]]; then
  61.     GREP=/usr/sfw/bin/gegrep
  62. else
  63.     GREP=`which grep`
  64. fi
  65.  
  66. OMS_HOME=`$GREP -i oms $ORAGCHOMELIST | xargs ls -d 2>/dev/null`
  67.  
  68. if [[ "$OMS_HOME" == "." ]]; then
  69.     OMS_HOME=`cat $ORAGCHOMELIST | head -n 1`
  70. fi
  71.  
  72.  
  73. OPATCH="$OMS_HOME/OPatch/opatch"
  74. OPATCHAUTO="$OMS_HOME/OPatch/opatchauto"
  75. OMSPATCHER="$OMS_HOME/OMSPatcher/omspatcher"
  76. OMSORAINST="$OMS_HOME/oraInst.loc"
  77. ORAINVENTORY=`$GREP inventory_loc $OMSORAINST | awk -F= '{print $2}'`
  78.  
  79. MW_HOME=$OMS_HOME
  80. COMMON_HOME="$MW_HOME/oracle_common"
  81.  
  82. AGENT_HOME=`$GREP -vi REMOVED $ORAINVENTORY/ContentsXML/inventory.xml | $GREP "HOME NAME=\"agent13c" | awk '{print $3}' | sed -e 's/LOC=\"//' | sed -e 's/"//'`
  83.  
  84.  
  85. EM_INSTANCE_BASE=`$GREP GCDomain $MW_HOME/domain-registry.xml | sed -e 's/.*=//' | sed -e 's/\/user_projects.*$//' | sed -e 's/"//'`
  86.  
  87. EMGC_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/emgc.properties"
  88. EMBIP_PROPS="$EM_INSTANCE_BASE/em/EMGC_OMS1/embip.properties"
  89. #OPMN_PROPS="$EM_INSTANCE_BASE/WebTierIH1/config/OPMN/opmn/ports.prop"
  90. #OHS_ADMIN_CONF="$EM_INSTANCE_BASE/WebTierIH1/config/OHS/ohs1/admin.conf"
  91.  
  92. PORT_UPL=`$GREP EM_UPLOAD_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  93. PORT_OMS=`$GREP EM_CONSOLE_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  94. PORT_OMS_JAVA=`$GREP MS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  95. PORT_NODEMANAGER=`$GREP EM_NODEMGR_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  96. PORT_BIP=`$GREP BIP_HTTPS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  97. PORT_BIP_OHS=`$GREP BIP_HTTPS_OHS_PORT $EMBIP_PROPS | awk -F= '{print $2}'`
  98. PORT_ADMINSERVER=`$GREP AS_HTTPS_PORT $EMGC_PROPS | awk -F= '{print $2}'`
  99. #PORT_OPMN=`$GREP '/opmn/remote_port' $OPMN_PROPS | awk -F= '{print $2}'`
  100. #PORT_OHS_ADMIN=`$GREP Listen $OHS_ADMIN_CONF | awk '{print $2}'`
  101. PORT_AGENT=`$AGENT_HOME/bin/emctl status agent | $GREP 'Agent URL' | sed -e 's/\/emd\/main\///' | sed -e 's/^.*://' | uniq`
  102.  
  103. REPOS_DB_CONNDESC=`$GREP EM_REPOS_CONNECTDESCRIPTOR $EMGC_PROPS | sed -e 's/EM_REPOS_CONNECTDESCRIPTOR=//' | sed -e 's/\\\\//g'`
  104. REPOS_DB_HOST=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*HOST=//' | sed -e 's/).*$//'`
  105. REPOS_DB_SID=`echo $REPOS_DB_CONNDESC | sed -e 's/^.*SID=//' | sed -e 's/).*$//'`
  106.  
  107. if [[ "$REPOS_DB_HOST" == "$OMSHOST" ]]; then
  108.     REPOS_DB_HOME=`$GREP "$REPOS_DB_SID:" $ORATAB | awk -F: '{print $2}'`
  109.     REPOS_DB_VERSION=`$REPOS_DB_HOME/OPatch/opatch lsinventory -oh $REPOS_DB_HOME | $GREP 'Oracle Database' | awk '{print $4}'`
  110.  
  111.     if [[ "$REPOS_DB_VERSION" == "11.2.0.4.0" ]]; then
  112.         RUN_DB_CHECK=1
  113.     fi
  114.  
  115.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  116.         RUN_DB_CHECK=1
  117.     fi
  118.  
  119.     if [[ "$RUN_DB_CHECK" -eq 0 ]]; then
  120.         echo -e "\tSkipping local repository DB patch check, only 11.2.0.4 or 12.1.0.2 supported by this script for now"
  121.     fi
  122. fi
  123.  
  124.  
  125.  
  126. sslcheck () {
  127.     OPENSSL_CHECK_COMPONENT=$1
  128.     OPENSSL_CHECK_HOST=$2
  129.     OPENSSL_CHECK_PORT=$3
  130.     OPENSSL_CHECK_PROTO=$4
  131.  
  132.     OPENSSL_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -$OPENSSL_CHECK_PROTO 2>&1 | $GREP Cipher | $GREP -c 0000`
  133.    
  134.    
  135.  
  136.     if [[ $OPENSSL_CHECK_PROTO == "tls1" ]]; then
  137.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO available for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  138.         if [[ $OPENSSL_RETURN -eq "0" ]]; then
  139.             echo OK
  140.         else
  141.             echo FAILED
  142.             FAIL_COUNT=$((FAIL_COUNT+1))
  143.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection failed"
  144.         fi
  145.     fi
  146.  
  147.     if [[ $OPENSSL_CHECK_PROTO == "ssl2" || $OPENSSL_CHECK_PROTO == "ssl3" ]]; then
  148.         echo -en "\tConfirming $OPENSSL_CHECK_PROTO disabled for $OPENSSL_CHECK_COMPONENT at $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT... "
  149.         if [[ $OPENSSL_RETURN -ne "0" ]]; then
  150.             echo OK
  151.         else
  152.             echo FAILED
  153.             FAIL_COUNT=$((FAIL_COUNT+1))
  154.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:$OPENSSL_CHECK_PROTO protocol connection succeeded"
  155.         fi
  156.     fi
  157. }
  158.  
  159. opatchcheck () {
  160.     OPATCH_CHECK_COMPONENT=$1
  161.     OPATCH_CHECK_OH=$2
  162.     OPATCH_CHECK_PATCH=$3
  163.  
  164.     if [[ "$OPATCH_CHECK_COMPONENT" == "ReposDBHome" ]]; then
  165.         OPATCH_RET=`$OPATCH_CHECK_OH/OPatch/opatch lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  166.     else
  167.         OPATCH_RET=`$OPATCH lsinv -oh $OPATCH_CHECK_OH | $GREP $OPATCH_CHECK_PATCH`
  168.     fi
  169.  
  170.     if [[ -z "$OPATCH_RET" ]]; then
  171.         echo FAILED
  172.         FAIL_COUNT=$((FAIL_COUNT+1))
  173.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCH_CHECK_COMPONENT @ ${OPATCH_CHECK_OH}:Patch $OPATCH_CHECK_PATCH not found"
  174.     else
  175.         echo OK
  176.     fi
  177.  
  178.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCH_RET
  179.  
  180. }
  181.  
  182. opatchautocheck () {
  183.     OPATCHAUTO_CHECK_COMPONENT=$1
  184.     OPATCHAUTO_CHECK_OH=$2
  185.     OPATCHAUTO_CHECK_PATCH=$3
  186.  
  187.     OPATCHAUTO_RET=`$OPATCHAUTO lspatches -oh $OPATCHAUTO_CHECK_OH | $GREP $OPATCHAUTO_CHECK_PATCH`
  188.  
  189.     if [[ -z "$OPATCHAUTO_RET" ]]; then
  190.         echo FAILED
  191.         FAIL_COUNT=$((FAIL_COUNT+1))
  192.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPATCHAUTO_CHECK_COMPONENT @ ${OPATCHAUTO_CHECK_OH}:Patch $OPATCHAUTO_CHECK_PATCH not found"
  193.     else
  194.         echo OK
  195.     fi
  196.  
  197.     test $VERBOSE_CHECKSEC -ge 2 && echo $OPATCHAUTO_RET
  198.  
  199. }
  200.  
  201. omspatchercheck () {
  202.     OMSPATCHER_CHECK_COMPONENT=$1
  203.     OMSPATCHER_CHECK_OH=$2
  204.     OMSPATCHER_CHECK_PATCH=$3
  205.  
  206.     OMSPATCHER_RET=`$OMSPATCHER lspatches -oh $OMSPATCHER_CHECK_OH | $GREP $OMSPATCHER_CHECK_PATCH`
  207.  
  208.     if [[ -z "$OMSPATCHER_RET" ]]; then
  209.         echo FAILED
  210.         FAIL_COUNT=$((FAIL_COUNT+1))
  211.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OMSPATCHER_CHECK_COMPONENT @ ${OMSPATCHER_CHECK_OH}:Patch $OMSPATCHER_CHECK_PATCH not found"
  212.     else
  213.         echo OK
  214.     fi
  215.  
  216.     test $VERBOSE_CHECKSEC -ge 2 && echo $OMSPATCHER_RET
  217.  
  218. }
  219.  
  220. certcheck () {
  221.     CERTCHECK_CHECK_COMPONENT=$1
  222.     CERTCHECK_CHECK_HOST=$2
  223.     CERTCHECK_CHECK_PORT=$3
  224.  
  225.     echo -ne "\tChecking certificate at $CERTCHECK_CHECK_COMPONENT ($CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT)... "
  226.  
  227.     OPENSSL_SELFSIGNED_COUNT=`echo Q | openssl s_client -prexit -connect $CERTCHECK_CHECK_HOST:$CERTCHECK_CHECK_PORT -tls1 2>&1 | $GREP -ci "self signed certificate"`
  228.  
  229.     if [[ $OPENSSL_SELFSIGNED_COUNT -eq "0" ]]; then
  230.         echo OK
  231.     else
  232.         echo FAILED - Found self-signed certificate
  233.         FAIL_COUNT=$((FAIL_COUNT+1))
  234.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$CERTCHECK_CHECK_COMPONENT @ ${CERTCHECK_CHECK_HOST}:${CERTCHECK_CHECK_PORT} found self-signed certificate"
  235.     fi
  236. }
  237.  
  238. democertcheck () {
  239.     DEMOCERTCHECK_CHECK_COMPONENT=$1
  240.     DEMOCERTCHECK_CHECK_HOST=$2
  241.     DEMOCERTCHECK_CHECK_PORT=$3
  242.  
  243.     echo -ne "\tChecking demo certificate at $DEMOCERTCHECK_CHECK_COMPONENT ($DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT)... "
  244.  
  245.     OPENSSL_DEMO_COUNT=`echo Q | openssl s_client -prexit -connect $DEMOCERTCHECK_CHECK_HOST:$DEMOCERTCHECK_CHECK_PORT -tls1 2>&1 | $GREP -ci "issuer=/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN"`
  246.  
  247.     if [[ $OPENSSL_DEMO_COUNT -eq "0" ]]; then
  248.         echo OK
  249.     else
  250.         echo FAILED - Found demonstration certificate
  251.         FAIL_COUNT=$((FAIL_COUNT+1))
  252.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$DEMOCERTCHECK_CHECK_COMPONENT @ ${DEMOCERTCHECK_CHECK_HOST}:${DEMOCERTCHECK_CHECK_PORT} found demonstration certificate"
  253.     fi
  254. }
  255.  
  256.  
  257. ciphercheck () {
  258.     OPENSSL_CHECK_COMPONENT=$1
  259.     OPENSSL_CHECK_HOST=$2
  260.     OPENSSL_CHECK_PORT=$3
  261.  
  262.     echo -ne "\tChecking LOW strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  263.  
  264.     OPENSSL_LOW_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher LOW 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  265.  
  266.     if [[ $OPENSSL_LOW_RETURN -eq "0" ]]; then
  267.         echo -e "\tFAILED - PERMITS LOW STRENGTH CIPHER CONNECTIONS"
  268.         FAIL_COUNT=$((FAIL_COUNT+1))
  269.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits LOW strength ciphers"
  270.     else
  271.         echo -e "\tOK"
  272.     fi
  273.  
  274.  
  275.     echo -ne "\tChecking MEDIUM strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  276.  
  277.     OPENSSL_MEDIUM_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher MEDIUM 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  278.  
  279.     if [[ $OPENSSL_MEDIUM_RETURN -eq "0" ]]; then
  280.         echo -e "\tFAILED - PERMITS MEDIUM STRENGTH CIPHER CONNECTIONS"
  281.         FAIL_COUNT=$((FAIL_COUNT+1))
  282.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Permits MEDIUM strength ciphers"
  283.     else
  284.         echo -e "\tOK"
  285.     fi
  286.  
  287.  
  288.  
  289.     echo -ne "\tChecking HIGH strength ciphers on $OPENSSL_CHECK_COMPONENT ($OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT)..."
  290.  
  291.     OPENSSL_HIGH_RETURN=`echo Q | openssl s_client -prexit -connect $OPENSSL_CHECK_HOST:$OPENSSL_CHECK_PORT -tls1 -cipher HIGH 2>&1 | $GREP Cipher | uniq | $GREP -c 0000`
  292.  
  293.     if [[ $OPENSSL_HIGH_RETURN -eq "0" ]]; then
  294.         echo -e "\tOK"
  295.     else
  296.         echo -e "\tFAILED - CANNOT CONNECT WITH HIGH STRENGTH CIPHER"
  297.         FAIL_COUNT=$((FAIL_COUNT+1))
  298.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$OPENSSL_CHECK_COMPONENT @ $OPENSSL_CHECK_HOST:${OPENSSL_CHECK_PORT}:Rejects HIGH strength ciphers"
  299.     fi
  300.     echo
  301. }
  302.  
  303. wlspatchcheck () {
  304.     WLSDIR=$1
  305.     WLSPATCH=$2
  306.  
  307.     WLSCHECK_RETURN=`( cd $MW_HOME/utils/bsu && $MW_HOME/utils/bsu/bsu.sh -report ) | $GREP $WLSPATCH`
  308.     WLSCHECK_COUNT=`echo $WLSCHECK_RETURN | wc -l`
  309.  
  310.     if [[ $WLSCHECK_COUNT -ge "1" ]]; then
  311.         echo -e "\tOK"
  312.     else
  313.         echo -e "\tFAILED - PATCH NOT FOUND"
  314.         FAIL_COUNT=$((FAIL_COUNT+1))
  315.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WLSDIR:Patch $WLSPATCH not found"
  316.     fi
  317.  
  318.     test $VERBOSE_CHECKSEC -ge 2 && echo $WLSCHECK_RETURN
  319.    
  320. }
  321.  
  322. javacheck () {
  323.     WHICH_JAVA=$1
  324.     JAVA_DIR=$2
  325.  
  326.     JAVACHECK_RETURN=`$JAVA_DIR/bin/java -version 2>&1 | $GREP version | awk '{print $3}' | sed -e 's/"//g'`
  327.  
  328.     if [[ "$JAVACHECK_RETURN" == "1.6.0_95" ]]; then
  329.         echo -e "\tOK"
  330.     else
  331.         #echo -e "\tFAILED - Found version $JAVACHECK_RETURN"
  332.         echo -e "\tFAILED"
  333.         FAIL_COUNT=$((FAIL_COUNT+1))
  334.         FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_JAVA Java in ${JAVA_DIR}:Found incorrect version $JAVACHECK_RETURN"
  335.     fi
  336.     test $VERBOSE_CHECKSEC -ge 2 && echo $JAVACHECK_RETURN
  337. }
  338.  
  339. paramcheck () {
  340.     WHICH_PARAM=$1
  341.     WHICH_ORACLE_HOME=$2
  342.     WHICH_FILE=$3
  343.  
  344.     PARAMCHECK_RETURN=`$GREP $WHICH_PARAM $WHICH_ORACLE_HOME/network/admin/$WHICH_FILE | awk -F= '{print $2}' | sed -e 's/\s//g'`
  345.     if [[ "$WHICH_PARAM" == "SSL_VERSION" ]]; then
  346.         if [[ "$PARAMCHECK_RETURN" == "1.0" ]]; then
  347.             echo -e "OK"
  348.         else
  349.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  350.             FAIL_COUNT=$((FAIL_COUNT+1))
  351.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  352.         fi
  353.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  354.     fi
  355.  
  356.     if [[ "$WHICH_PARAM" == "SSL_CIPHER_SUITES" ]]; then
  357.         if [[ "$PARAMCHECK_RETURN" == "(SSL_RSA_WITH_AES128_CBC_SHA,SSL_RSA_WITH_AES256_CBC_SHA)" ]]; then
  358.             echo -e "OK"
  359.         else
  360.             echo -e "FAILED - Found $WHICH_PARAM = $PARAMCHECK_RETURN"
  361.             FAIL_COUNT=$((FAIL_COUNT+1))
  362.             FAIL_TESTS="${FAIL_TESTS}\\n$FUNCNAME:$WHICH_PARAM in $WHICH_FILE for home ${WHICH_ORACLE_HOME}:incorrect parameter value"
  363.         fi
  364.         test $VERBOSE_CHECKSEC -ge 2 && echo $PARAMCHECK_RETURN
  365.     fi
  366. }
  367.  
  368.  
  369. ### MAIN SCRIPT HERE
  370.  
  371.  
  372. echo -e "Performing EM13c security checkup version $VERSION on $OMSHOST at `date`.\n"
  373.  
  374. echo "Using port definitions from configuration files "
  375. echo -e "\t/etc/oragchomelist"
  376. echo -e "\t$EMGC_PROPS"
  377. echo -e "\t$EMBIP_PROPS"
  378. echo
  379. echo -e "\tAgent port found at $OMSHOST:$PORT_AGENT"
  380. echo -e "\tBIPublisher port found at $OMSHOST:$PORT_BIP"
  381. echo -e "\tBIPublisherOHS port found at $OMSHOST:$PORT_BIP_OHS"
  382. echo -e "\tNodeManager port found at $OMSHOST:$PORT_NODEMANAGER"
  383. echo -e "\tOMSconsole port found at $OMSHOST:$PORT_OMS"
  384. echo -e "\tOMSproxy port found at $OMSHOST:$PORT_OMS_JAVA"
  385. echo -e "\tOMSupload port found at $OMSHOST:$PORT_UPL"
  386. echo -e "\tWLSadmin found at $OMSHOST:$PORT_ADMINSERVER"
  387. echo
  388. echo -e "\tRepository DB version=$REPOS_DB_VERSION SID=$REPOS_DB_SID host=$REPOS_DB_HOST"
  389.  
  390. if [[ $RUN_DB_CHECK -eq "1" ]]; then
  391.     echo -e "\tRepository DB on OMS server, will check patches/parameters in $REPOS_DB_HOME"
  392. fi
  393.  
  394. #exit 0
  395.  
  396. echo -e "\n(1) Checking SSL/TLS configuration (see notes 1602983.1, 1477287.1, 1905314.1)"
  397.  
  398. echo -e "\n\t(1a) Forbid SSLv2 connections"
  399. sslcheck Agent $OMSHOST $PORT_AGENT ssl2
  400. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl2
  401. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl2
  402. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl2
  403. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl2
  404. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl2
  405. sslcheck OMSupload $OMSHOST $PORT_UPL ssl2
  406. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl2
  407. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl2
  408.  
  409. echo -e "\n\t(1b) Forbid SSLv3 connections"
  410. sslcheck Agent $OMSHOST $PORT_AGENT ssl3
  411. sslcheck BIPublisher $OMSHOST $PORT_BIP ssl3
  412. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER ssl3
  413. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS ssl3
  414. sslcheck OMSconsole $OMSHOST $PORT_OMS ssl3
  415. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA ssl3
  416. sslcheck OMSupload $OMSHOST $PORT_UPL ssl3
  417. #sslcheck OPMN $OMSHOST $PORT_OPMN ssl3
  418. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER ssl3
  419.  
  420. echo -e "\n\t(1c) Permit TLSv1 connections"
  421. sslcheck Agent $OMSHOST $PORT_AGENT tls1
  422. sslcheck BIPublisher $OMSHOST $PORT_BIP tls1
  423. sslcheck NodeManager $OMSHOST $PORT_NODEMANAGER tls1
  424. sslcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS tls1
  425. sslcheck OMSconsole $OMSHOST $PORT_OMS tls1
  426. sslcheck OMSproxy $OMSHOST $PORT_OMS_JAVA tls1
  427. sslcheck OMSupload $OMSHOST $PORT_UPL tls1
  428. #sslcheck OPMN $OMSHOST $PORT_OPMN tls1
  429. sslcheck WLSadmin $OMSHOST $PORT_ADMINSERVER tls1
  430.  
  431. echo -e "\n(2) Checking supported ciphers at SSL/TLS endpoints (see notes 2138391.1, 1067411.1)"
  432. ciphercheck Agent $OMSHOST $PORT_AGENT
  433. ciphercheck BIPublisher $OMSHOST $PORT_BIP
  434. ciphercheck NodeManager $OMSHOST $PORT_NODEMANAGER
  435. ciphercheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  436. ciphercheck OMSconsole $OMSHOST $PORT_OMS
  437. ciphercheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  438. ciphercheck OMSupload $OMSHOST $PORT_UPL
  439. #ciphercheck OPMN $OMSHOST $PORT_OPMN
  440. ciphercheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  441.  
  442. echo -e "\n(3) Checking self-signed and demonstration certificates at SSL/TLS endpoints (see notes 1367988.1, 1399293.1, 1593183.1, 1527874.1, 123033.1, 1937457.1)"
  443. certcheck Agent $OMSHOST $PORT_AGENT
  444. democertcheck Agent $OMSHOST $PORT_AGENT
  445. certcheck BIPublisher $OMSHOST $PORT_BIP
  446. democertcheck BIPublisher $OMSHOST $PORT_BIP
  447. certcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  448. democertcheck NodeManager $OMSHOST $PORT_NODEMANAGER
  449. certcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  450. democertcheck BIPublisherOHS $OMSHOST $PORT_BIP_OHS
  451. certcheck OMSconsole $OMSHOST $PORT_OMS
  452. democertcheck OMSconsole $OMSHOST $PORT_OMS
  453. certcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  454. democertcheck OMSproxy $OMSHOST $PORT_OMS_JAVA
  455. certcheck OMSupload $OMSHOST $PORT_UPL
  456. democertcheck OMSupload $OMSHOST $PORT_UPL
  457. #certcheck OPMN $OMSHOST $PORT_OPMN
  458. #democertcheck OPMN $OMSHOST $PORT_OPMN
  459. certcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  460. democertcheck WLSadmin $OMSHOST $PORT_ADMINSERVER
  461.  
  462.  
  463. echo -e "\n(4) Checking EM13c Oracle home patch levels against $PATCHDATE baseline (see notes 1664074.1, 1900943.1, 822485.1, 1470197.1, 1967243.1)"
  464.  
  465. if [[ $RUN_DB_CHECK -eq 1 ]]; then
  466.  
  467.     if [[ "$REPOS_DB_VERSION" == "12.1.0.2.0" ]]; then
  468.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160119 (JAN2016) (21948354)... "
  469.         #opatchcheck ReposDBHome $REPOS_DB_HOME 21948354
  470.  
  471.         echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) PSU 12.1.0.2.160419 (APR2016) (22291127)... "
  472.         opatchcheck ReposDBHome $REPOS_DB_HOME 22291127
  473.  
  474.         #echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160119 DATABASE PSU (JAN2016) (22139226)... "
  475.         #opatchcheck ReposDBHome $REPOS_DB_HOME 22139226
  476.  
  477.         echo -ne "\n\t(4a) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) ORACLE JAVAVM COMPONENT 12.1.0.2.160419 DATABASE PSU (APR2016) (22674709)... "
  478.         opatchcheck ReposDBHome $REPOS_DB_HOME 22674709
  479.     fi
  480.  
  481.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_VERSION parameter (1545816.1)... "
  482.     paramcheck SSL_VERSION $REPOS_DB_HOME sqlnet.ora
  483.  
  484.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) sqlnet.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  485.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME sqlnet.ora
  486.  
  487.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_VERSION parameter (1545816.1)... "
  488.     paramcheck SSL_VERSION $REPOS_DB_HOME listener.ora
  489.  
  490.     echo -ne "\n\t(4b) OMS REPOSITORY DATABASE HOME ($REPOS_DB_HOME) listener.ora SSL_CIPHER_SUITES parameter (1545816.1)... "
  491.     paramcheck SSL_CIPHER_SUITES $REPOS_DB_HOME listener.ora
  492. fi
  493.  
  494. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160331 (22823268)... "
  495. #opatchcheck Agent $AGENT_HOME 22823268
  496.  
  497. #echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160429 (23030165)... "
  498. #opatchcheck Agent $AGENT_HOME 23030165
  499.  
  500. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM-AGENT BUNDLE PATCH 13.1.0.0.160531 (23208577)... "
  501. opatchcheck Agent $AGENT_HOME 23208577
  502.  
  503. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22920712)... "
  504. #opatchcheck Agent $AGENT_HOME 22920712
  505.  
  506. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095221)... "
  507. #opatchcheck Agent $AGENT_HOME 23095221
  508.  
  509. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294830)... "
  510. opatchcheck Agent $AGENT_HOME 23294830
  511.  
  512. echo -ne "\n\t(4c) *NEW* OMS CHAINED AGENT HOME ($AGENT_HOME) EM DB PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294839)... "
  513. opatchcheck Agent $AGENT_HOME 23294839
  514.  
  515. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22936491)... "
  516. #opatchcheck Agent $AGENT_HOME 22936491
  517.  
  518. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160429 MONITORING (23095280)... "
  519. #opatchcheck Agent $AGENT_HOME 23095280
  520.  
  521. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM FMW PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23294872)... "
  522. opatchcheck Agent $AGENT_HOME 23294872
  523.  
  524. #echo -ne "\n\t(4c) OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160331 MONITORING (22823189)... "
  525. #opatchcheck Agent $AGENT_HOME 22823189
  526.  
  527. echo -ne "\n\t(4c) *UPDATED* OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 MONITORING (23208587)... "
  528. opatchcheck Agent $AGENT_HOME 23208587
  529.  
  530. echo -ne "\n\t(4c) *NEW* OMS CHAINED AGENT HOME ($AGENT_HOME) EM SI PLUGIN BUNDLE PATCH 13.1.1.0.160531 DISCOVERY (23294895)... "
  531. opatchcheck Agent $AGENT_HOME 23294895
  532.  
  533. #echo -ne "\n\t(4d) OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160331 (22920724)... "
  534. #omspatchercheck OMS $OMS_HOME 22920724
  535.  
  536. echo -ne "\n\t(4c) *NEW* OMS CHAINED AGENT HOME ($AGENT_HOME) EM OH PLUGIN BUNDLE PATCH 13.1.1.0.160429 (23135564)... "
  537. opatchcheck Agent $AGENT_HOME 23135564
  538.  
  539. #echo -ne "\n\t(4d) *UPDATED* OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160429 (23095307)... "
  540. #omspatchercheck OMS $OMS_HOME 23095307
  541.  
  542. echo -ne "\n\t(4d) *UPDATED* OMS HOME ($OMS_HOME) ENTERPRISE MANAGER FOR OMS PLUGINS 13.1.1.0.160531 (23294904)... "
  543. omspatchercheck OMS $OMS_HOME 23294904
  544.  
  545. echo -ne "\n\t(4e) ($MW_HOME) WLS PATCH SET UPDATE 12.1.3.0.160419 (22505404)... "
  546. opatchcheck WLS $MW_HOME 22505404
  547.  
  548. echo
  549. echo
  550.  
  551. if [[ $FAIL_COUNT -gt "0" ]]; then
  552.     echo "Failed test count: $FAIL_COUNT - Review output"
  553.     test $VERBOSE_CHECKSEC -ge 1 && echo -e $FAIL_TESTS
  554. else
  555.     echo "All tests succeeded."
  556. fi
  557.  
  558. echo
  559. echo "Visit https://pardydba.wordpress.com/2016/04/05/securing-oracle-enterprise-manager-13c/ for the latest version."
  560. echo
  561.  
  562. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!