Go to main content

Oracle® Advanced Support Gateway Security Guide

Exit Print View

Updated: March 2024
 
 

All Systems With An Agent Deployed

The following changes are made to every system on which an agent is deployed:

  • An entry is added to the /etc/hosts file for the Gateway.

  • A new group is created on the operating system (OS) of the monitored server. The default group name is orarom.

  • A new user is created on the ILOM of the monitored server (if applicable). The default username is orarom.

  • A new user is added on the operating system (OS) (orarom) of the monitored server.


    Note -  The password for the orarom account is typically set to expire after 90 days. You can manage the password on the Gateway. For further information about password management, see this MOS knowledge article.
  • The new OS user is added to the group that owns the Oracle Inventory.

  • A new user is added into the group that owns the database diag directories that are listed in the oratab file (required for monitoring databases and generating ADR packages).

  • The Oracle Inventory directory is updated for group read/write permissions.

  • The Database diag directories are updated for group read/write permissions.

  • A directory (/opt/OracleHomes) is created for the agent information based on the information provided in the System Install flow or discussion with your implementation engineer.

  • If permission to retain root privileges is given in the configuration worksheet, the sudoers or RBAC files are updated to allow the new OS user to execute commands as root.

  • For Linux systems, the group of the /var/log/messages file is changed to the new group (orarom) if the group owner is root.

    This allows the agent user to be part of a group that can read the file and the group read permission is granted. The agent user can then monitor the messages file. If the messages file is already owned by a different group, the new user is added to that group instead.

  • For Linux systems, the /etc/security/limits.conf file is updated to add the required settings for the new user (orarom) to meet the agent requirements.

  • Agents are pushed from the Gateway to the server using the new user. The storage requirement for the agent is initially around 5GB.

  • Once the agents have been installed, the root.sh script for the agent is executed.

    Root.sh creates or updates /etc/oragchomelist, creates /etc/init.d/gcstartup, creates /etc/init.d/lockgcstartup, and creates /etc/init.d/lockgcstartup.

  • For Solaris systems, the explorer tool may be scheduled to execute once per week at 11 PM on Sunday in root’s crontab.

  • For some Solaris systems, host-based fault telemetry is configured for ASR, either updating snmpd.confor using asradm, and starting the required services.

  • ILOMs are configured to send SNMP traps to the Gateway for all ILOM detected faults of level minor or above for ASR.


    Note -  For Exadata Nodes, the ILOM rules are configured on the operating system of the node using the Exadata CLIs (cellcli and dbmcli) rather than directly on the ILOM.

    Note -  For Exalogic Virtual Machines, a further file is copied from the physical host to /var/exalogic/info to define it as part of an Exalogic.
  • Install or upgrade the Oracle Autonomous Health Framework (AHF) to a minimum version of 22.3.1.

    The storage requirement for AHF is 2GB of space in /opt and a minimum of 6GB (with a recommendation of 10GB) on /u01.

  • Configure Oracle Autonomous Health Framework (AHF) to auto-update from the Gateway when a new version is available.

  • A monitoring sudoers profile is added to allow the monitoring of the system and a restart of the agents by the monitoring user:

    /usr/sbin/dmidecode, /sbin/ethtool, /usr/bin/ipmitool, /usr/sbin/imageinfo, /usr/local/bin/imageinfo, /opt/oracle/bda/bin/imageinfo, /usr/bin/systemctl stop oracle-oasgagent.service, /usr/bin/systemctl start oracle-oasgagent.service, /usr/bin/systemctl restart oracle-oasgagent.service, /usr/bin/systemctl status oracle-oasgagent.service, /sbin/service oasgagent start, /sbin/service oasgagent stop, /sbin/service oasgagent restart, /sbin/service oasgagent status