本文详细介绍了如何为Oracle用户配置SSH对等性，包括创建RSA和DSA密钥、添加密钥到authorized_keys文件、使用SCP或SFTP进行文件复制以及修改权限的过程。通过示例操作，确保了节点间安全的SSH连接。
六、配置oracle用户ssh对等性
2.4.7.1 Configuring SSH on Cluster Member Nodes
To configure SSH, you must first create RSA and DSA keys on each cluster node, and then copy the keys from all cluster node members into an authorized keys file on each node. Note that the SSH files must be readable only by root and by the oracle user. SSH ignores a private key file if it is accessible by others
To configure SSH, complete the following steps:
Create RSA and DSA keys on each node: Complete the following steps on each node:
-
Log in as the
oracleuser. -
If necessary, create the
.sshdirectory in theoracleuser's home directory and set the correct permissions on it:$ mkdir ~/.ssh$ chmod 700 ~/.ssh$ chmod 700 -
Enter the following commands to generate an RSA key for version 2 of the SSH protocol:
$ /usr/bin/ssh-keygen -t rsaAt the prompts:
-
Accept the default location for the key file.
-
Enter and confirm a pass phrase that is different from the
oracleuser's password.
This command writes the public key to the
~/.ssh/id_rsa.pubfile and the private key to the~/.ssh/id_rsafile. Never distribute the private key to anyone. -
-
Enter the following commands to generate a DSA key for version 2 of the SSH protocol:
$ /usr/bin/ssh-keygen -t dsaAt the prompts:
-
Accept the default location for the key file
-
Enter and confirm a pass phrase that is different from the
oracleuser's password
This command writes the public key to the
~/.ssh/id_dsa.pubfile and the private key to the~/.ssh/id_dsafile. Never distribute the private key to anyone. -
Add keys to an authorized key file: Complete the following steps:
-
On the local node, determine if you have an authorized key file (
~/.ssh/authorized_keys). If the authorized key file already exists, then proceed to step 2. Otherwise, enter the following commands:$ touch ~/.ssh/authorized_keys$ cd ~/.ssh$ lsYou should see the
id_dsa.pubandid_rsa.pubkeys that you have created. -
Using SSH, copy the contents of the
~/.ssh/id_rsa.puband~/.ssh/id_dsa.pubfiles to the file~/.ssh/authorized_keys, and provide theoracleuser password as prompted. This process is illustrated in the following syntax example with a two-node cluster, with nodesnode1andnode2, where theoracleuser path is/home/oracle:[oracle@node1 .ssh]$ ssh node1 cat /home/oracle/.ssh/id_rsa.pub >> authorized_keysoracle@node1's password:[oracle@node1 .ssh]$ ssh node1 cat /home/oracle/.ssh/id_dsa.pub >> authorized_keys[oracle@node1 .ssh$ ssh node2 cat /home/oracle/.ssh/id_rsa.pub >> authorized_keysoracle@node2's password:[oracle@node1 .ssh$ ssh node2 cat /home/oracle/.ssh/id_dsa.pub >>authorized_keysoracle@node2's password:Note:
Repeat this process for each node in the cluster. -
Use SCP (Secure Copy) or SFTP (Secure FTP) to copy the
authorized_keysfile to theoracleuser .ssh directory on a remote node. The following example is with SCP, on a node called node2, where theoracleuser path is/home/oracle:[oracle@node1 .ssh]scp authorized_keys node2:/home/oracle/.ssh/ -
Repeat step 2 and 3 for each cluster node member. When you have added keys from each cluster node member to the authorized_keys file on the last node you want to have as a cluster node member, then use SCP to copy the complete authorized_keys file back to each cluster node member
Note:
theoracleuser's/.ssh/authorized_keysfile on every node must contain the contents from all of the/.ssh/id_rsa.puband/.ssh/id_dsa.pubfiles that you generated on all cluster nodes. -
Change the permissions on the
oracleuser's/.ssh/authorized_keysfile on all cluster nodes:$ chmod 600 ~/.ssh/authorized_keysAt this point, if you use
sshto log in to or run a command on another node, you are prompted for the pass phrase that you specified when you created the DSA key.
扫一扫
5847
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
