9.5.7 ahf security

Use the ahf security command to manage AHF users.

AHF 26.8

Customer-Provided CA-Signed Certificates for AHF

Oracle Autonomous Health Framework (AHF) supports customer-provided Certificate Authority (CA)-signed certificates. Use the ahf security add-certificates command to configure the certificates on each node in a cluster.

AHF requires two certificates:

  • Root certificate: Used for connections dedicated to the privileged root user. The root certificate must be unique and cannot be shared.
  • Non-root certificate: Used for non-root connections.

TFA uses certificate pinning to enforce certificate usage based on the connection type. For connections dedicated to the privileged root user, TFA accepts only the designated root certificate.

Certificate Requirements

When creating CA-signed certificates for AHF, ensure that they meet the following requirements:

  • The same intermediate CA and root CA must sign the certificates on every node in the cluster. Using the same CAs across the cluster enables certificate synchronization when a new node is added.
  • The same intermediate CA and root CA must sign both the root and non-root certificates.
  • A certificate is used on both sides of the connection, as the client and server certificate. Therefore, certificates don't need to be restricted to client-only or server-only usage.
  • Private keys must not be password protected.
  • The CA certificate bundle must contain the intermediate CA and root CA public certificates required to establish the certificate chain of trust.

Configure CA-Signed Certificates

After creating the required CA-signed certificates, run the following command as the root user on each cluster node:

ahf security add-certificates --root-key <root-key.pem> --root-cert <root-cert.pem> --non-root-key <non-root-key.pem> --non-root-cert <non-root-cert.pem> --ca-cert <ca-bundle.pem>

Manage Certificates for Upload Servers Using Self-Signed Certificates

Oracle Autonomous Health Framework (AHF) validates TLS connections to upload servers that use self-signed certificates by using customer-provided public certificates.

When you configure an upload endpoint, such as by using ahf configuration set --type upload, AHF must be able to verify the identity of the target server. If the upload server uses a self-signed certificate, import its public certificate into AHF before configuring the upload endpoint.

AHF stores imported certificates in a PKCS12 trust store and exports the trusted certificate entries to upload-cert.pem. AHF distributes the certificate material across the cluster nodes and uses the PEM bundle or PKCS12 trust store as the CA bundle when establishing connections to the upload server.

The trusted certificates are used to validate connections during operations such as:

  • Registration
  • Health checks
  • Deregistration
  • Data uploads

This certificate validation provides a managed trust mechanism for upload endpoints that use self-signed certificates.

Import an Upload Server Certificate

Before registering or configuring an upload server that uses a self-signed certificate, import its public certificate:

ahf security add-certificates --import-cert <file> --scope upload --alias <alias>

Where:

  • --import-cert <file> specifies the public certificate file to import.
  • --scope upload identifies the certificate as being used for upload operations.
  • --alias <alias> specifies a unique alias for the certificate.

You can import certificates for multiple upload servers by using a different alias for each certificate.

After importing the required certificate, configure the upload endpoint by using ahf configuration set --type upload.

Examples:

  • List Upload Server Certificates

    To list the certificates configured for upload operations, run:

    ahf security list-certificates --scope upload
  • Update an Upload Server Certificate

    To update an upload server certificate, run the import command again with the updated certificate file and the appropriate alias:

    ahf security add-certificates --import-cert <file> --scope upload --alias <alias>
  • Remove an Upload Server Certificate

    To remove a certificate from the upload trust store, specify its alias:

    ahf security remove-certificates --scope upload --alias <alias>

AHF 25.1

Secure SSH Key Storage

SSH Keys are often required for secure access to resources automatically. However, storing these keys on systems can pose potential security risks.

AHF can now generate and securely store SSH keys for remote components used by Oracle Orachk and Oracle Exachk. These keys are encrypted and stored within the AHF wallet, ensuring they are protected from unauthorized access. AHF automatically detects the configured SSH keys for a remote system and uses them to login.

  • To create and add SSH key with password: 
    ahf security add-credentials --node NODE --user-name USER --type ssh-key --generate-ssh-key --password
  • To add SSH key from a file path with password: 
    ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file <FILEPATH> --password
  • To add an already added SSH key with password: 
    ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file <FILEPATH> --password
    ahf security add-credentials --node NODE --user-name USER --type ssh-key --generate-ssh-key --password
  • To create and add SSH key for passwordless setup: 
    ahf security add-credentials --node NODE --user-name USER --type ssh-key --generate-ssh-key
  • To add SSH key from a file path for passwordless setup: 
    ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file <FILEPATH>
  • To add SSH key from a file path where the key is already added to remote host: 
    ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file <FILEPATH>
  • To remove SSH key: 
    ahf security remove-credentials --node NODE --user-name USER --type ssh-key
  • To check SSH key: 
    ahf security check-credentials --node NODE --user-name USER --type ssh-key
  • To get stored SSH key: 
    ahf security get-credentials --node NODE --user-name USER --type ssh-key

Credential Management

This release introduces improvements to the ahf security command category, streamlining the management of credentials used to log in to remote machines or nodes.

  • To add and store password for a node or a list of nodes:
    ahf security add-credentials --type password [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]
  • To remove the stored password for a node or a list of nodes:
    ahf security remove-credentials --type password [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]
  • To get the stored password for a node or a list of nodes:
    ahf security get-credentials --type password [--node NODE] [--nodes NODES-LIST][--user-name USER] [--exacli]
  • To check if a password is set for a node or a list of nodes:
    ahf security check-credentials --type password [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]
  • To add PDB credentials:
    ahf security add-credentials --type password --databases orcl --cdb-user-name c##oradb --pdbs orclpdb,asd --pdb-user-name oradb --pdb-connect-strings example.connect.string,another.connect.string
    ahf security add-credentials --type password --databases orcl,other --cdb-user-name c##oradb --pdbs orclpdb,otherpdb --pdb-user-name oradb --pdb-connect-strings example.connect.string,another.connect.string

    The PDB credentials are saved in wallet as <pdb>.<database>.<pdb-user-name>.password="the password". Also saves the CDB credentials if not already saved.

  • To add CDB credentials:
    ahf security add-credentials --type password --databases orcl,asdf --cdb-user-name c##oradb

    If ORACLE_HOME and ORACLE_SID are already set, you don’t need to specify them explicitly in the command. You can also connect to the CDB using a connect string.

    The CDB credentials are saved in wallet as <database>.<cdb-user-name>.password="the password".

  • To AHF Common user credentials:
    ahf security add-credentials --type password --database ORCL --user-name c##ahfuser --oracle-home /u01/app/oracle/product/19c/dbhome_1 --oracle-sid ORCL1

Syntax: ahf security

ahf security action [options]
Action: add-user,remove-user,promote-user,demote-user,grant-role,revoke-role,list-users,reset-users,block-user,unblock-user, add-credentials, remove-credentials, get-credentials, check-credentials
ahf security add-certificates --root-key ROOT_KEY --root-cert ROOT_CERT --non-root-key NON_ROOT_KEY --non-root-cert NON_ROOT_CERT --ca-cert CA_CERT_BUNDLE
Action Description

add-user

Adds a user to the AHF access list.

Usage: ahf security add-user --user USER_NAME

remove-user

Removes a user from the AHF access list.

Usage: ahf security remove-user [--user USER_NAME|--all]

promote-user

Promotes a user to have admin access to AHF.

Usage: ahf security promote-user --user USER_NAME

demote-user

Demotes a user from having admin access to AHF.

Usage: ahf security demote-user --user USER_NAME

grant-role

Grants a role to a non-root user.

Usage: ahf security grant-role --user USER_NAME --role ROLE

revoke-role

Revokes the role granted to a non-root user.

Usage: ahf security revoke-role --user USER_NAME --role ROLE

list-users

Prints the list of users.

Usage: ahf security list-users

reset-users

Resets the AHF access list to default AHF users.

Usage: ahf security reset-users

block-user

Blocks the specified user's access to AHF.

Usage: ahf security block-user --user USER_NAME

unblock-user

Unblocks the specified blocked user's access to AHF.

Usage: ahf security unblock-user --user USER_NAME

add-credentials

Adds and stores the password or SSH key for a specified node or a list of nodes.

Note:

You cannot run the ahf security add-credentials command as the root user. The root user is not permitted to store database user credentials. Run the ahf security add-credentials command as the database owner user.

Usage: ahf security add-credentials --type password|ssh-key [--generate-ssh-key] [--ssh-key-file PATH] [--node NODE] [--nodes NODES-LIST] [--database DB] [--databases LIST-OF-DBS] [--user-name USER] [--exacli] [--pdb PDB] [--pdbs LIST-OF-PDBS] [--cdb-user-name CDB_USERNAME] [--pdb-user-name PDB_USERNAME] [--oracle-home ORACLE_HOME] [--oracle-sid ORACLE_SID] [--cdb-connect-string CDB_CONNECT_STRING] [--pdb-connect-string PDB_CONNECT_STRING] [--oracle-homes ORACLE_HOMES_LIST] [--oracle-sids ORACLE_SIDS_LIST] [--cdb-connect-strings CDB_CONNECT_STRING_LIST] [--pdb-connect-strings PDB_CONNECT_STRING_LIST]

remove-credentials

Removes the stored password or SSH key for a specified node or a list of nodes.

Usage: ahf security remove-credentials --type password|ssh-key [--node NODE] [--nodes NODES-LIST] [--database DB] [--databases LIST-OF-DBS] [--user-name USER] [--exacli] [--pdb PDB] [--pdbs LIST-OF-PDBS] [--cdb-user-name CDB_USERNAME] [--pdb-user-name PDB_USERNAME]

get-credentials

Gets the stored password or SSH key for a specified node or a list of nodes.

Usage: ahf security get-credentials --type password|ssh-key [--node NODE] [--nodes NODES-LIST] [--database DB] [--databases LIST-OF-DBS] [--user-name USER] [--exacli] [--pdb PDB] [--pdbs LIST-OF-PDBS] [--all-nodes] [--all-databases] [--cdb-user-name CDB_USERNAME] [--pdb-user-name PDB_USERNAME]

check-credentials

Checks the password or SSH key for a specified node or a list of nodes.

Usage: ahf security check-credentials --type password|ssh-key [--node NODE] [--nodes NODES-LIST] [--database DB] [--databases LIST-OF-DBS] [--user-name USER] [--exacli] [--pdb PDB] [--pdbs LIST-OF-PDBS] [--cdb-user-name CDB_USERNAME] [--pdb-user-name PDB_USERNAME] [--oracle-home ORACLE_HOME] [--oracle-sid ORACLE_SID] [--cdb-connect-string CDB_CONNECT_STRING] [--pdb-connect-string PDB_CONNECT_STRING] [--oracle-homes ORACLE_HOMES_LIST] [--oracle-sids ORACLE_SIDS_LIST] [--cdb-connect-strings CDB_CONNECT_STRING_LIST] [--pdb-connect-strings PDB_CONNECT_STRING_LIST]

Table 9-130 ahf security add-user

Option Description

--to-json

Prints the output in JSON format.

--user USER_NAME

Specifies the user to add.

Table 9-131 ahf security remove-user

Option Description

--to-json

Prints the output in JSON format.

--user USER_NAME

Specifies the user to remove.

--all

Specifies to remove all users.

Table 9-132 ahf security promote-user

Option Description

--to-json

Prints the output in JSON format.

--user USER_NAME

Specifies the user to promote.

Table 9-133 ahf security demote-user

Option Description

--to-json

Prints the output in JSON format.

--user USER_NAME

Specifies the user to demote.

Table 9-134 ahf security grant-role

Option Description

--to-json

Prints the output in JSON format.

--user USER_NAME

Specifies the user required to run this command.

--role ROLE

Specifies the role to grant to the user.

Valid values:

  • platinum
  • privileged-compliance-checks

Table 9-135 ahf security revoke-role

Option Description

--to-json

Prints the output in JSON format.

--user USER_NAME

Specifies the user required to run this command.

--role ROLE

Specifies the role to revoke from the user.

Table 9-136 ahf security list-users

Option Description

--to-json

Prints the output in JSON format.

Table 9-137 ahf security reset-users

Option Description

--to-json

Prints the output in JSON format.

The default users are the DB/CRS owner and the installer user.

Table 9-138 ahf security block-user

Option Description

--to-json

Prints the output in JSON format.

--user USER_NAME

Specifies the user to block.

Table 9-139 ahf security unblock-user

Option Description

--to-json

Prints the output in JSON format.

--user USER_NAME

Specifies the user to unblock.

Table 9-140 ahf security add-credentials

Option Description

--to-json

Prints the output in JSON format.

--type TYPE

Specifies the type of security: password | ssh-key.

Options for --type password:
  • --node
  • --nodes NODES-LIST
  • --exacli
  • --database DB
  • --databases LIST-OF-DBS
  • --pdb PDB
  • --pdbs LIST-OF-PDBS
  • --cdb-user-name CDB-USER
  • --pdb-user-name PDB-USER
  • --user-name USER
  • --asm ASM
  • --asms LIST-OF-ASM-INSTANCE-NAMES
  • --oracle-home ORACLE_HOME
  • --oracle-sid ORACLE_SID
  • --cdb-connect-string CONNECT_STRING
  • --pdb-connect-string CONNECT_STRING
  • --oracle-homes LIST_OF_ORACLE_HOMES
  • --oracle-sids LIST-OF-ORACLE-SIDs
  • --cdb-connect-strings LIST-OF-CDB-CONNECT-STRINGS
  • --pdb-connect-strings LIST-OF-PDB-CONNECT-STRINGS
Options for --type ssh-key:
  • --node NODE
  • --nodes NODES-LIST
  • --user-name USER
  • --generate-ssh-key
  • --ssh-key-file PATH
  • --password

--node NODE

Specifies the node.

--nodes NODES-LIST

Specifies the comma-delimited list of nodes

--user-name USER

Specifies the user for whom you want to set password.

--exacli

Specifies to set password for exacli user of a cell.

--generate-ssh-key

Specifies to generate the SSH key pair.

--ssh-key-file PATH

Specifies the path to the existing SSH key file.

--password

Prompts for password to log in to the remote system.

Table 9-141 ahf security remove-credentials

Option Description

--to-json

Prints the output in JSON format.

--type TYPE

Specifies the type of security: password | ssh-key.

Options for --type password:
  • --node
  • --nodes NODES-LIST
  • --exacli
  • --database DB
  • --databases LIST-OF-DBS
  • --pdb PDB
  • --pdbs LIST-OF-PDBS
  • --cdb-user-name CDB-USER
  • --pdb-user-name PDB-USER
  • --user-name USER
  • --asm ASM
  • --asms LIST-OF-ASM-INSTANCE-NAMES
Options for --type ssh-key:
  • --node NODE
  • --nodes NODES-LIST
  • --user-name USER
  • --generate-ssh-key
  • --ssh-key-file PATH
  • --password

--node NODE

Specifies the node.

--nodes NODES-LIST

Specifies the comma-delimited list of nodes

--user-name USER

Specifies the user for whom you want to remove password.

--exacli

Specifies to remove password for exacli user of a cell.

--generate-ssh-key

Specifies to generate the SSH key pair.

--ssh-key-file PATH

Specifies the path to the existing SSH key file.

--password

Prompts for password to log in to the remote system.

Table 9-142 ahf security get-credentials

Option Description

--to-json

Prints the output in JSON format.

--type TYPE

Specifies the type of security: password | ssh-key.

Options for --type password:
  • --node
  • --nodes NODES-LIST
  • --exacli
  • --database DB
  • --databases LIST-OF-DBS
  • --pdb PDB
  • --pdbs LIST-OF-PDBS
  • --cdb-user-name CDB-USER
  • --pdb-user-name PDB-USER
  • --user-name USER
  • --asm ASM
  • --asms LIST-OF-ASM-INSTANCE-NAMES
Options for --type ssh-key:
  • --node NODE
  • --nodes NODES-LIST
  • --user-name USER
  • --generate-ssh-key
  • --ssh-key-file PATH
  • --password

--node NODE

Specifies the node.

--nodes NODES-LIST

Specifies the comma-delimited list of nodes

--user-name USER

Specifies the user for whom you want to fetch password.

--exacli

Specifies to fetch password for exacli user of a cell.

--generate-ssh-key

Specifies to generate the SSH key pair.

--ssh-key-file PATH

Specifies the path to the existing SSH key file.

--password

Prompts for password to log in to the remote system.

Table 9-143 ahf security check-credentials

Option Description

--to-json

Prints the output in JSON format.

--type TYPE

Specifies the type of security: password | ssh-key.

Options for --type password:
  • --node
  • --nodes NODES-LIST
  • --exacli
  • --database DB
  • --databases LIST-OF-DBS
  • --pdb PDB
  • --pdbs LIST-OF-PDBS
  • --cdb-user-name CDB-USER
  • --pdb-user-name PDB-USER
  • --user-name USER
  • --asm ASM
  • --asms LIST-OF-ASM-INSTANCE-NAMES
  • --oracle-home ORACLE_HOME
  • --oracle-sid ORACLE_SID
  • --cdb-connect-string CONNECT_STRING
  • --pdb-connect-string CONNECT_STRING
  • --oracle-homes LIST_OF_ORACLE_HOMES
  • --oracle-sids LIST-OF-ORACLE-SIDs
  • --cdb-connect-strings LIST-OF-CDB-CONNECT-STRINGS
  • --pdb-connect-strings LIST-OF-PDB-CONNECT-STRINGS
Options for --type ssh-key:
  • --node NODE
  • --nodes NODES-LIST
  • --user-name USER
  • --generate-ssh-key
  • --ssh-key-file PATH
  • --password

--node NODE

Specifies the node.

--nodes NODES-LIST

Specifies the comma-delimited list of nodes

--user-name USER

Specifies to check if password is set for the specified.

--exacli

Specifies to check if password is set for exacli user of a cell.

--generate-ssh-key

Specifies to generate the SSH key pair.

--ssh-key-file PATH

Specifies the path to the existing SSH key file.

--password

Prompts for password to log in to the remote system.

Table 9-144 ahf security add-certificates

Option Description

--to-json

Prints the output in JSON format.

--root-key ROOT_KEY

Specifies the path to the root key PEM file.

--root-cert ROOT_CERT

Specifies the path to the root cert PEM file.

--non-root-key NON_ROOT_KEY

Specifies the path to the non-root key PEM file.

--non-root-cert NON_ROOT_CERT

Specifies the path to the non-root cert PEM file.

--ca-cert CA_CERT_BUNDLE

Specifies the path to the CA cert bundle PEM file.

Parent topic: Running Unified AHF CLI Administration Commands