When attempting to configure 19c grid infrastructure by running <gridSetup.sh>, the following error occurs in SSH connectivity step:
Monday, 24 August 2020
INS-06006 GI RunInstaller Fails If OpenSSH Is Upgraded to 8.x
WUT-121: The file transfer has been forbidden by the Administrator
Problem: Users were not able to download files.
Solution: Edit these files and add below parameters:
$DOMAIN_HOME/config/fmwconfig/components/FORMS/forms1/server/webutil.cfg
$DOMAIN_HOME/config/fmwconfig/components/FORMS/instances/forms1/server/webutil.cfg
transfer.database.enabled=TRUE
transfer.appsrv.enabled=TRUE
transfer.appsrv.workAreadRoot=TRUE
transfer.appsrv.accessControl=TRUE
#List transfer.appsrv.read.<n> directories
transfer.appsrv.read.1=/temp
#transfer.appsrv.read2.=<locatation>
#List transfer.appsrv.write.<n> directories
transfer.appsrv.write.1=/temp
Database Open Access Vulnerability
Vulnerability Title: Database Open Access
Service Port: Database Listener Port
Service Name: Oracle TNS Listener
Service Protocol: tcp
Vulnerability Description:
The database allows any remote system the ability to connect to it. It is recommended to limit direct access to trusted systems because databases may contain sensitive data, and new vulnerabilities and exploits are discovered routinely for them. For this reason, it is a violation of PCI DSS section 1.3.6 to have databases listening on ports accessible from the Internet, even when protected with secure authentication mechanisms.
Solution:
Configure the database server to only allow access to trusted systems. For example, the PCI DSS standard requires you to place the database in an internal network zone, segregated from the DMZ
Add VALIDNODE_CHECKING in sqlnet.ora file and add IPs to restrict database access and then reload the listener and check:
$ORACLE_HOME/network/admin/sqlnet.ora
tcp.validnode_checking = yes
tcp.invited_nodes =(*.*.*.*)
Self-signed TLS/SSL certificate Vulnerability - Weblogic 12.2.1.4
Vulnerability Title: Self-signed TLS/SSL certificate
Service Port:4443
Service Name: HTTPS
Service Protocol: tcp
Vulnerability Description:
The server's TLS/SSL certificate is self-signed. Self-signed certificates cannot be trusted by default, especially because TLS/SSL man-in-the-middle attacks typically use self-signed certificates to eavesdrop on TLS/SSL connections.
Solution:
Obtain a new TLS/SSL server certificate that is NOT self-signed and install it on the server or remove the demo certificates.
remove these demo.cert and DemoTrust.jks certificates and check:
$MWH/wlserver/server/lib/DemoTrust.jks
$MWH/wlserver/server/lib/demo.cert
Click Jacking Vulnerability - Weblogic 12.2.1.4
Vulnerability Title: Click Jacking
Service Port:4443
Service Name: HTTPS
Service Protocol: tcp
Vulnerability Description:
Clickjacking, also known as a UI redress attack, is a method in which an attacker uses multiple transparent or opaque layers to trick a user into clicking a button or link on a page other than the one they believe they are clicking. Thus, the attacker is "hijacking" clicks meant for one page and routing the user to an illegitimate page.
Vulnerability Solution:Use HTTP X-Frame-Options. Send the HTTP response headers with X-Frame-Options that instruct the browser to restrict framing where it is not allowed.
1. Apply the Patch 30418565
Patch 30418565 FORMS LISTENER SERVLET NOT GENERATING X-FRAME-OPTIONS HTTP HEADER
Add SAMEORIGIN option with X-Frame-Options optin in Run-time and Staging httpd.conf
-- X-Frame-Options is available at line 1033
Header always append X-Frame-Options SAMEORIGIN
2.Run-time directory:
$DOMAIN_HOME/config/fmwconfig/components/OHS/instances/<componentName>/httpd.conf
3.Staging directory:
$DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf
Sunday, 23 August 2020
Browsable Web Directory Vulnerability - Weblogic 12.2.1.4
Vulnerability Title:Browsable web directory
Service Port:4443
Service Name:HTTPS
Service Protocol:tcp
Vulnerability Description: A web directory was found to be browsable, which means that anyone can see the contents of the directory. These directories can be found:
* via page spidering (following hyperlinks), or
* as part of a parent path (checking each directory along the path and searching for ""Directory Listing"" or similar strings), or
* by brute forcing a list of common directories.
Browsable directories could allow an attacker to perform a directory traversal attack by viewing ""hidden"" files in the web root, including CGI scripts, data files, or backup pages."
Vulnerability Proof: https://<*.*,*.*>:4443/OracleHTTPServer12c_files/
Solution:
Remove the "Indexs" option from Run-time & Staging httpd.conf
--check @ line # 241
From: Options Indexes FollowSymLinks
To: Options FollowSymLinks
1.Run-time directory:
$DOMAIN_HOME/config/fmwconfig/components/OHS/instances/<componentName>/httpd.conf
2.Staging directory:
$DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf
You should add the following value in [default] section of the formsweb.cfg
3.$DOMAIN_HOME/config/fmwconfig/servers/WLS_FORMS/applications/formsapp_12.2.1/config/formsweb.cfg
#
#X-Frame-Options to Resolve Click-Jacking
#
Set_X_Frame_Options=true
If you are not planing for https then comment out these lines in both Run-time and Staging httpd.conf files:
# Include the SSL definitions and Virtual Host container
include "ssl.conf"------------------------------->Comment out this.
....
IncludeOptional "moduleconf/*.conf" ------------------------------->Comment out this.
Restart the services and then test.
Weblogic 12.2.1.4 Admin Server Default Port Change
Please make the below changes to update the port in FMW 12.2.1.4:
Step 1: Take the backup of the below files:
$DOMAIN_HOME/config/fmwconfig/servers/AdminServer/applications/em/META-INF/emoms.properties
$DOMAIN_HOME/sysman/state/targets.xml
$DOMAIN_HOME/bin/stopManagedWebLogic.sh
$DOMAIN_HOME/bin/startManagedWebLogic.sh
$DOMAIN_HOME/bin/stopWebLogic.sh
Step 2: Navigate to the Weblogic Admin Console > Environments > Servers > AdminServer > Configuration Tab > General Sub Tab > now change the listen port from 7001 to 7010 and save the changes
Step3: Update the Admin Port(7001 to 7010) in the below files:
$DOMAIN_HOME/config/fmwconfig/servers/AdminServer/applications/em/META-INF/emoms.properties
$DOMAIN_HOME/sysman/state/targets.xml
$DOMAIN_HOME/bin/stopManagedWebLogic.sh
$DOMAIN_HOME/bin/startManagedWebLogic.sh
$DOMAIN_HOME/bin/stopWebLogic.sh
Step 4: Run $DOMAIN_HOME/bin/setDomainEnv.sh
Step 5: Restart your Admin Server and test the Weblogic Console URL and EM Console URL.
Admin Server Failure To Start With Error BEA-000362 Server failed
There are 1 nested errors:
weblogic.management.DeploymentException: java.io.IOException: Error from fcntl() for file locking, Resource temporarily unavailable, errno=11
Saturday, 20 June 2020
Rolling Upgrade Error in Script
Reports Server Component Status in REPORTS 12C
Friday, 19 June 2020
AVDF Console and Listener Port Change
ORA-28041: Authentication protocol internal error
Expired user accounts can't change password and connect from 11.1.0.7 client to 12.2.0.1 DB+April2018PSU, failing with error
ORA-28041: Authentication protocol internal error.
There is no issue with open user accounts connecting from 11.1.0.7 client to 12.2.0.1 DB+April2018PSU.
Also the expired user account connections from 11.1.0.7 client to 12.2.0.1DB+Jan2018PSU works fine. The issue started only after applying April 2018 PSU patch on DB server.
From Forms 11.1.2.2 and the SQLPLUS 11.1.0.7 that comes with Forms 11.1.2.2, expired user connections fail with below message:
ERROR:
ORA-28041: Authentication protocol internal error
In 12.2.0.1 databases, 11.1 client support has been removed. The following table shows which client and which database version are supported.
Thursday, 11 June 2020
Cluster verification failed with PRVG-4574
select group_number, name,compatibility from v$asm_diskgroup;
GROUP_NUMBER NAME COMPATIBILITY
------------ ------------------------------ ----------------
1 OCR_DG 11.2.0.2.0
Thursday, 4 June 2020
ORA-19571: archived log RECID '***' STAMP '***' not found in control file
It seems that the Controlfile records are over-written.
1. check control_file_record_keep_time
NAME TYPE VALUE
———————————— ———– ——————————
control_file_record_keep_time integer 7
The value is very low. So please increase.
alter system set control_file_record_keep_time=20 scope=both;
System altered.
SQL> show parameter control
NAME TYPE VALUE
———————————— ———– ——————————
control_file_record_keep_time integer 20
2) Next you need to catalog the archivelogs to make the backup run without errors
RMAN> catalog start with '/u01/archive';
3. Now start the backup
Monday, 1 June 2020
Password same as Login Name
select
name as [LoginName]
,'Password is same as Login Name' [Description]
from sys.syslogins
WHERE PWDCOMPARE (name,password) = 1
Password same as Username
Monitoring Long Running Operations
set lines 1000
set pages 1000
COLUMN OP_NAME FORMAT a40
select * from (
SELECT
SID,
OPNAME OP_Name,
TO_CHAR(start_time,'DD-MON-YYYY HH:MI:SS') START_TIME,
TO_CHAR(start_time + (round(TIME_REMAINING/60)/1440 +round(ELAPSED_SECONDS/60)/1440),'DD-MON-YYYY HH:MI:SS') "Expected_End_Time",
round(TIME_REMAINING/60) "Remaining_Minuts",
round(ELAPSED_SECONDS/60) "Elapsed_Minuts",
round(((TIME_REMAINING/(TIME_REMAINING+ELAPSED_SECONDS))*100),2) "% Remaining",
round(((ELAPSED_SECONDS/(TIME_REMAINING+ELAPSED_SECONDS))*100),2) "% Completed"
FROM
V$SESSION_LONGOPS
WHERE
TIME_REMAINING>0) order by 4 desc;
Toad Error - Error downloading resources XML file
….//community-dowloads.quest.com/toadsoft/ORA…
Solution:
1. Launch Toad
2. Go to the menu View
| Toad Options
3. Go to Startup.
Under Automatic Updates, uncheck this option and select "Don't
automatically check for updates".
4. Go to General.
Under Toad Improvement Program, uncheck the option "Participate in the
Toad Improvement program".
5. Go to Network
Utilities. Under Hosts, uncheck the option "Override Proxy for Toad
sites".
6. Hit Apply and OK,
and then restart Toad.