1. Oracle Autonomous Health Framework User's Guide
  2. ahf security

ahf security

Use the ahf security command to manage AHF users.

AHF 26.8

Customer-Provided CA-Signed Certificates for AHF

Oracle Autonomous Health Framework (AHF) supports customer-provided Certificate Authority (CA)-signed certificates. Use the ahf security add-certificates command to configure the certificates on each node in a cluster.

AHF requires two certificates:

  • Root certificate: Used for connections dedicated to the privileged root user. The root certificate must be unique and cannot be shared.
  • Non-root certificate: Used for non-root connections.

TFA uses certificate pinning to enforce certificate usage based on the connection type. For connections dedicated to the privileged root user, TFA accepts only the designated root certificate.

Certificate Requirements

When creating CA-signed certificates for AHF, ensure that they meet the following requirements:

  • The same intermediate CA and root CA must sign the certificates on every node in the cluster. Using the same CAs across the cluster enables certificate synchronization when a new node is added.
  • The same intermediate CA and root CA must sign both the root and non-root certificates.
  • A certificate is used on both sides of the connection, as the client and server certificate. Therefore, certificates don't need to be restricted to client-only or server-only usage.
  • Private keys must not be password protected.
  • The CA certificate bundle must contain the intermediate CA and root CA public certificates required to establish the certificate chain of trust.

Configure CA-Signed Certificates

After creating the required CA-signed certificates, run the following command as the root user on each cluster node:

ahf security add-certificates --root-key  --root-cert  --non-root-key  --non-root-cert  --ca-cert

Manage Certificates for Upload Servers Using Self-Signed Certificates

Oracle Autonomous Health Framework (AHF) validates TLS connections to upload servers that use self-signed certificates by using customer-provided public certificates.

When you configure an upload endpoint, such as by using ahf configuration set --type upload, AHF must be able to verify the identity of the target server. If the upload server uses a self-signed certificate, import its public certificate into AHF before configuring the upload endpoint.

AHF stores imported certificates in a PKCS12 trust store and exports the trusted certificate entries to upload-cert.pem. AHF distributes the certificate material across the cluster nodes and uses the PEM bundle or PKCS12 trust store as the CA bundle when establishing connections to the upload server.

The trusted certificates are used to validate connections during operations such as:

  • Registration
  • Health checks
  • Deregistration
  • Data uploads

This certificate validation provides a managed trust mechanism for upload endpoints that use self-signed certificates.

Import an Upload Server Certificate

Before registering or configuring an upload server that uses a self-signed certificate, import its public certificate:

ahf security add-certificates --import-cert  --scope upload --alias

Where:

  • --import-cert specifies the public certificate file to import.
  • --scope upload identifies the certificate as being used for upload operations.
  • --alias specifies a unique alias for the certificate.

You can import certificates for multiple upload servers by using a different alias for each certificate.

After importing the required certificate, configure the upload endpoint by using ahf configuration set --type upload.

Examples:

  • List Upload Server Certificates

    To list the certificates configured for upload operations, run:

    ahf security list-certificates --scope upload

  • Update an Upload Server Certificate

    To update an upload server certificate, run the import command again with the updated certificate file and the appropriate alias:

    ahf security add-certificates --import-cert  --scope upload --alias

  • Remove an Upload Server Certificate

    To remove a certificate from the upload trust store, specify its alias:

    ahf security remove-certificates --scope upload --alias

AHF 25.1

Secure SSH Key Storage

SSH Keys are often required for secure access to resources automatically. However, storing these keys on systems can pose potential security risks.

AHF can now generate and securely store SSH keys for remote components used by Oracle Orachk and Oracle Exachk. These keys are encrypted and stored within the AHF wallet, ensuring they are protected from unauthorized access. AHF automatically detects the configured SSH keys for a remote system and uses them to login.

  • To create and add SSH key with password:

    ahf security add-credentials --node NODE --user-name USER --type ssh-key --generate-ssh-key --password

  • To add SSH key from a file path with password:

    ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file  --password

  • To add an already added SSH key with password:

    ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file  --password
    ahf security add-credentials --node NODE --user-name USER --type ssh-key --generate-ssh-key --password

  • To create and add SSH key for passwordless setup:

    ahf security add-credentials --node NODE --user-name USER --type ssh-key --generate-ssh-key

  • To add SSH key from a file path for passwordless setup:

    ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file

  • To add SSH key from a file path where the key is already added to remote host:

    ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file

  • To remove SSH key:

    ahf security remove-credentials --node NODE --user-name USER --type ssh-key

  • To check SSH key:

    ahf security check-credentials --node NODE --user-name USER --type ssh-key

  • To get stored SSH key:

    ahf security get-credentials --node NODE --user-name USER --type ssh-key

Credential Management

This release introduces improvements to the ahf security command category, streamlining the management of credentials used to log in to remote machines or nodes.

  • To add and store password for a node or a list of nodes:

    ahf security add-credentials --type password [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]

  • To remove the stored password for a node or a list of nodes:

    ahf security remove-credentials --type password [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]

  • To get the stored password for a node or a list of nodes:

    ahf security get-credentials --type password [--node NODE] [--nodes NODES-LIST][--user-name USER] [--exacli]

  • To check if a password is set for a node or a list of nodes:

    ahf security check-credentials --type password [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]
  • To add PDB credentials: 
    ahf security add-credentials --type password --databases orcl --cdb-user-name c##oradb --pdbs orclpdb,asd --pdb-user-name oradb --pdb-connect-strings example.connect.string,another.connect.string
    ahf security add-credentials --type password --databases orcl,other --cdb-user-name c##oradb --pdbs orclpdb,otherpdb --pdb-user-name oradb --pdb-connect-strings example.connect.string,another.connect.string

    The PDB credentials are saved in wallet as < pdb >.< database >.< pdb-user-name >.password=" the password ". Also saves the CDB credentials if not already saved.

  • To add CDB credentials: 
    ahf security add-credentials --type password --databases orcl,asdf --cdb-user-name c##oradb

    If ORACLE_HOME and ORACLE_SID are already set, you don't need to specify them explicitly in the command. You can also connect to the CDB using a connect string.

    The CDB credentials are saved in wallet as < database >.< cdb-user-name >.password=" the password ".

  • To AHF Common user credentials:

    ahf security add-credentials --type password --database ORCL --user-name c##ahfuser --oracle-home /u01/app/oracle/product/19c/dbhome_1 --oracle-sid ORCL1

Syntax: ahf security

ahf security action [options]
Action: add-user,remove-user,promote-user,demote-user,grant-role,revoke-role,list-users,reset-users,block-user,unblock-user, add-credentials, remove-credentials, get-credentials, check-credentials
ahf security add-certificates --root-key ROOT_KEY --root-cert ROOT_CERT --non-root-key NON_ROOT_KEY --non-root-cert NON_ROOT_CERT --ca-cert CA_CERT_BUNDLE
  • add-user
    Adds a user to the AHF access list.

    Usage: ahf security add-user --user USER_NAME

  • remove-user
    Removes a user from the AHF access list.

    Usage: ahf security remove-user [--user USER_NAME|--all]

  • promote-user
    Promotes a user to have admin access to AHF.

    Usage: ahf security promote-user --user USER_NAME

  • demote-user
    Demotes a user from having admin access to AHF.

    Usage: ahf security demote-user --user USER_NAME

  • grant-role
    Grants a role to a non-root user.

    Usage: ahf security grant-role --user USER_NAME--roleROLE

  • revoke-role
    Revokes the role granted to a non-root user.

    Usage: ahf security revoke-role --user USER_NAME--roleROLE

  • list-users
    Prints the list of users.

    Usage: ahf security list-users

  • reset-users
    Resets the AHF access list to the default AHF users.

    Usage: ahf security reset-users

  • block-user
    Blocks the specified user's access to AHF.

    Usage: ahf security block-user --user USER_NAME

  • unblock-user
    Unblocks the specified user's access to AHF.

    Usage: ahf security unblock-user --user USER_NAME

  • add-credentials
    Adds and stores the password or SSH key for a specified node or list of nodes.

    Note: You cannot run the ahf security add-credentials command as the root user. The root user is not permitted to store database user credentials. Run the command as the database owner user.

    Usage: ahf security add-credentials --type password|ssh-key [--generate-ssh-key] [--ssh-key-file PATH] [--node NODE] [--nodes NODES_LIST] [--database DB] [--databases LIST_OF_DBS] [--user-name USER] [--exacli] [--pdb PDB] [--pdbs LIST_OF_PDBS] [--cdb-user-name CDB_USERNAME] [--pdb-user-name PDB_USERNAME] [--oracle-home ORACLE_HOME] [--oracle-sid ORACLE_SID] [--cdb-connect-string CDB_CONNECT_STRING] [--pdb-connect-string PDB_CONNECT_STRING] [--oracle-homes ORACLE_HOMES_LIST] [--oracle-sids ORACLE_SIDS_LIST] [--cdb-connect-strings CDB_CONNECT_STRING_LIST] [--pdb-connect-strings PDB_CONNECT_STRING_LIST]

  • remove-credentials
    Removes the stored password or SSH key for a specified node or list of nodes.

    Usage: ahf security remove-credentials --type password|ssh-key [--node NODE] [--nodes NODES_LIST] [--database DB] [--databases LIST_OF_DBS] [--user-name USER] [--exacli] [--pdb PDB] [--pdbs LIST_OF_PDBS] [--cdb-user-name CDB_USERNAME] [--pdb-user-name PDB_USERNAME]

  • get-credentials
    Gets the stored password or SSH key for a specified node or list of nodes.

    Usage: ahf security get-credentials --type password|ssh-key [--node NODE] [--nodes NODES_LIST] [--database DB] [--databases LIST_OF_DBS] [--user-name USER] [--exacli] [--pdb PDB] [--pdbs LIST_OF_PDBS] [--all-nodes] [--all-databases] [--cdb-user-name CDB_USERNAME] [--pdb-user-name PDB_USERNAME]

  • check-credentials
    Checks the password or SSH key for a specified node or list of nodes.

    Usage: ahf security check-credentials --type password|ssh-key [--node NODE] [--nodes NODES_LIST] [--database DB] [--databases LIST_OF_DBS] [--user-name USER] [--exacli] [--pdb PDB] [--pdbs LIST_OF_PDBS] [--cdb-user-name CDB_USERNAME] [--pdb-user-name PDB_USERNAME] [--oracle-home ORACLE_HOME] [--oracle-sid ORACLE_SID] [--cdb-connect-string CDB_CONNECT_STRING] [--pdb-connect-string PDB_CONNECT_STRING] [--oracle-homes ORACLE_HOMES_LIST] [--oracle-sids ORACLE_SIDS_LIST] [--cdb-connect-strings CDB_CONNECT_STRING_LIST] [--pdb-connect-strings PDB_CONNECT_STRING_LIST]

ahf security add-user

  • --to-json Prints the output in JSON format.
  • --user USER_NAME Specifies the user to add.

ahf security remove-user

  • --to-json Prints the output in JSON format.
  • --user USER_NAME Specifies the user to remove.
  • --all Specifies to remove all users.

ahf security promote-user

  • --to-json Prints the output in JSON format.
  • --user USER_NAME Specifies the user to promote.

ahf security demote-user

  • --to-json Prints the output in JSON format.
  • --user USER_NAME Specifies the user to demote.

ahf security grant-role

  • --to-json Prints the output in JSON format.
  • --user USER_NAME Specifies the user required to run this command.

  • --role ROLE Specifies the role to grant to the user.
    Valid values:

    • platinum
    • privileged-compliance-checks

ahf security revoke-role

  • --to-json Prints the output in JSON format.
  • --user USER_NAME Specifies the user required to run this command.
  • --role ROLE Specifies the role to revoke from the user.

ahf security list-users

--to-json Prints the output in JSON format.

ahf security reset-users

--to-json Prints the output in JSON format.
The default users are the DB/CRS owner and the installer user.

ahf security block-user

  • --to-json Prints the output in JSON format.
  • --user USER_NAME Specifies the user to block.

ahf security unblock-user

  • --to-json Prints the output in JSON format.
  • --user USER_NAME Specifies the user to unblock.

ahf security add-credentials

  • --to-json
    Prints the output in JSON format.

  • --type TYPE
    Specifies the type of security. Valid values are password and ssh-key.

    Options for --type password:

    • --node NODE
    • --nodes NODES_LIST
    • --exacli
    • --database DB
    • --databases LIST_OF_DBS
    • --pdb PDB
    • --pdbs LIST_OF_PDBS
    • --cdb-user-name CDB_USER
    • --pdb-user-name PDB_USER
    • --user-name USER
    • --asm ASM
    • --asms LIST_OF_ASM_INSTANCE_NAMES
    • --oracle-home ORACLE_HOME
    • --oracle-sid ORACLE_SID
    • --cdb-connect-string CONNECT_STRING
    • --pdb-connect-string CONNECT_STRING
    • --oracle-homes LIST_OF_ORACLE_HOMES
    • --oracle-sids LIST_OF_ORACLE_SIDS
    • --cdb-connect-strings LIST_OF_CDB_CONNECT_STRINGS
    • --pdb-connect-strings LIST_OF_PDB_CONNECT_STRINGS

    Options for --type ssh-key:

    • --node NODE
    • --nodes NODES_LIST
    • --user-name USER
    • --generate-ssh-key
    • --ssh-key-file PATH
    • --password
  • --node NODE
    Specifies the node.
  • --nodes NODES_LIST
    Specifies a comma-delimited list of nodes.
  • --user-name USER
    Specifies the user for whom you want to set the password.
  • --exacli
    Specifies to set the password for the exacli user of a cell.
  • --generate-ssh-key
    Specifies to generate an SSH key pair.
  • --ssh-key-file PATH
    Specifies the path to an existing SSH key file.
  • --password
    Prompts for the password to log in to the remote system.

ahf security remove-credentials

  • --to-json
    Prints the output in JSON format.

  • --type TYPE
    Specifies the type of security. Valid values are password and ssh-key.

    Options for --type password:

    • --node NODE
    • --nodes NODES_LIST
    • --exacli
    • --database DB
    • --databases LIST_OF_DBS
    • --pdb PDB
    • --pdbs LIST_OF_PDBS
    • --cdb-user-name CDB_USER
    • --pdb-user-name PDB_USER
    • --user-name USER
    • --asm ASM
    • --asms LIST_OF_ASM_INSTANCE_NAMES

    Options for --type ssh-key:

    • --node NODE
    • --nodes NODES_LIST
    • --user-name USER
    • --generate-ssh-key
    • --ssh-key-file PATH
    • --password
  • --node NODE
    Specifies the node.
  • --nodes NODES_LIST
    Specifies a comma-delimited list of nodes.
  • --user-name USER
    Specifies the user for whom you want to remove the password.
  • --exacli
    Specifies to remove the password for the exacli user of a cell.
  • --generate-ssh-key
    Specifies to generate an SSH key pair.
  • --ssh-key-file PATH
    Specifies the path to an existing SSH key file.
  • --password
    Prompts for the password to log in to the remote system.

ahf security get-credentials

  • --to-json
    Prints the output in JSON format.

  • --type TYPE
    Specifies the type of security. Valid values are password and ssh-key.

    Options for --type password:

    • --node NODE
    • --nodes NODES_LIST
    • --exacli
    • --database DB
    • --databases LIST_OF_DBS
    • --pdb PDB
    • --pdbs LIST_OF_PDBS
    • --cdb-user-name CDB_USER
    • --pdb-user-name PDB_USER
    • --user-name USER
    • --asm ASM
    • --asms LIST_OF_ASM_INSTANCE_NAMES

    Options for --type ssh-key:

    • --node NODE
    • --nodes NODES_LIST
    • --user-name USER
    • --generate-ssh-key
    • --ssh-key-file PATH
    • --password
  • --node NODE
    Specifies the node.
  • --nodes NODES_LIST
    Specifies a comma-delimited list of nodes.
  • --user-name USER
    Specifies the user for whom you want to fetch the password.
  • --exacli
    Specifies to fetch the password for the exacli user of a cell.
  • --generate-ssh-key
    Specifies to generate an SSH key pair.
  • --ssh-key-file PATH
    Specifies the path to an existing SSH key file.
  • --password
    Prompts for the password to log in to the remote system.

ahf security check-credentials

  • --to-json
    Prints the output in JSON format.

  • --type TYPE
    Specifies the type of security. Valid values are password and ssh-key.

    Options for --type password:

    • --node NODE
    • --nodes NODES_LIST
    • --exacli
    • --database DB
    • --databases LIST_OF_DBS
    • --pdb PDB
    • --pdbs LIST_OF_PDBS
    • --cdb-user-name CDB_USER
    • --pdb-user-name PDB_USER
    • --user-name USER
    • --asm ASM
    • --asms LIST_OF_ASM_INSTANCE_NAMES
    • --oracle-home ORACLE_HOME
    • --oracle-sid ORACLE_SID
    • --cdb-connect-string CONNECT_STRING
    • --pdb-connect-string CONNECT_STRING
    • --oracle-homes LIST_OF_ORACLE_HOMES
    • --oracle-sids LIST_OF_ORACLE_SIDS
    • --cdb-connect-strings LIST_OF_CDB_CONNECT_STRINGS
    • --pdb-connect-strings LIST_OF_PDB_CONNECT_STRINGS

    Options for --type ssh-key:

    • --node NODE
    • --nodes NODES_LIST
    • --user-name USER
    • --generate-ssh-key
    • --ssh-key-file PATH
    • --password
  • --node NODE
    Specifies the node.
  • --nodes NODES_LIST
    Specifies a comma-delimited list of nodes.
  • --user-name USER
    Specifies the user for whom you want to check whether a password is set.
  • --exacli
    Specifies to check whether a password is set for the exacli user of a cell.
  • --generate-ssh-key
    Specifies to generate an SSH key pair.
  • --ssh-key-file PATH
    Specifies the path to an existing SSH key file.
  • --password
    Prompts for the password to log in to the remote system.

ahf security add-certificates

  • --to-json
    Prints the output in JSON format.
  • --root-key ROOT_KEY
    Specifies the path to the root key PEM file.
  • --root-cert ROOT_CERT
    Specifies the path to the root certificate PEM file.
  • --non-root-key NON_ROOT_KEY
    Specifies the path to the non-root key PEM file.
  • --non-root-cert NON_ROOT_CERT
    Specifies the path to the non-root certificate PEM file.
  • --ca-cert CA_CERT_BUNDLE
    Specifies the path to the CA certificate bundle PEM file.