Linux Prerequisites

Learn about prerequisites for installing Oracle Communications Unified Assurance on Linux environments.

Operating System Install Type

Unified Assurance requires various components that are installed as part of the base operating system, and a "minimal" installation has been shown to be missing one or more important applications. Oracle Communications recommends using either a Base or Cloud installation type, depending on the operating system.

The following command can be used to update to a Base installation, as well as verify that all needed base packages have been installed:

yum groupinstall "Base"

FIPS 140-2 Compliance in Oracle Linux 8

Unified Assurance installed on Oracle Linux 8 supports FIPS 140-2 compliance. Customers installing Unified Assurance 6.0.4 must use Oracle Linux 8 and can optionally configure FIPs mode for Linux as described in "FIPS 140-2 Compliance in Oracle Linux 8" in Oracle Linux 8 Enhancing System Security.

Customers updating or upgrading to 6.0.4 can optionally remain on Linux 7, where FIPS compliance is not supported.

SELinux

The Unified Assurance installer uses the useradd tool to create the user assure1. By default, SELinux does not allow this user to have a home directory outside of /home. The following steps show you how to configure SELinux to allow /opt to be treated as a valid parent directory for home directories.

  1. Install RPM containing the semanage tool:

    yum install policycoreutils-python

  2. Edit the semanage.conf file:

    nano /etc/selinux/semanage.conf

    Change the usepasswd setting from false to true:

    usepasswd=true

    Save the file.

  3. Set /opt label to be the same as /home:

    semanage fcontext -a -e /home /opt

  4. Update the labels for /opt:

    restorecon -R /opt

  5. OPTIONAL: the following are needed on servers that will be running Docker:

    yum install container-selinux selinux-policy-targeted

NTP

The Network Time Protocol (NTP) should be installed and configured on all servers that will be part of an environment. It is essential that all servers have the time synchronized to ensure proper functionality. Consult with your operating system documentation to determine the best NTP strategy for your organization.

DNS Entries

Before installing Unified Assurance, all servers must be able to communicate with one another using the Host FQDN entries and Web FQDN entry (or entries) from each server to each server.

This can be tested by doing the following:

WARNING:

Environments should not be configured using /etc/hosts entries or other manually configured local services. DNS is required for all functionality to work properly across all servers in an installation.

Ports

Unified Assurance uses several network ports for communication between components. These need to be opened bidirectionally through your local operating system firewall, network firewalls, and network access control lists (ACLs).

Open the following ports in firewalls:

The following is an example of creating a Unified Assurance firewalld service:

  1. Create the firewalld service file:

    cat <<'EOM' >/etc/firewalld/services/ocua.xml
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>OCUA</short>
  <description>Ports needed for OCUA</description>
  <port protocol="tcp" port="80"/>
  <port protocol="udp" port="161"/>
  <port protocol="udp" port="162"/>
  <port protocol="tcp" port="179"/>
  <port protocol="tcp" port="443"/>
  <port protocol="udp" port="514"/>
  <port protocol="tcp" port="2181"/>  
  <port protocol="tcp" port="2379"/>
  <port protocol="tcp" port="2380"/>
  <port protocol="tcp" port="2424"/>
  <port protocol="tcp" port="2425"/>
  <port protocol="tcp" port="2426"/>
  <port protocol="tcp" port="2427"/>
  <port protocol="tcp" port="2428"/>
  <port protocol="tcp" port="2429"/>
  <port protocol="tcp" port="2430"/>
  <port protocol="tcp" port="2434"/>
  <port protocol="tcp" port="2486"/>
  <port protocol="tcp" port="2487"/>
  <port protocol="tcp" port="2488"/>
  <port protocol="tcp" port="2489"/>
  <port protocol="tcp" port="2490"/>
  <port protocol="tcp" port="3181"/>
  <port protocol="tcp" port="3306"/>
  <port protocol="tcp" port="4369"/>
  <port protocol="tcp" port="5601"/>
  <port protocol="tcp" port="5671"/>
  <port protocol="tcp" port="6443"/>
  <port protocol="tcp" port="6550"/>
  <port protocol="tcp" port="6551"/>      
  <port protocol="tcp" port="7473"/>
  <port protocol="tcp" port="7687"/>
  <port protocol="tcp" port="8055"/>
  <port protocol="tcp" port="8056"/>
  <port protocol="tcp" port="8080"/>   
  <port protocol="tcp" port="8086"/>
  <port protocol="tcp" port="8443"/>
  <port protocol="udp" port="8472"/>      
  <port protocol="tcp" port="8873"/>
  <port protocol="tcp" port="9093"/>
  <port protocol="tcp" port="9200"/>
  <port protocol="tcp" port="10080"/>
  <port protocol="tcp" port="10250"/>
  <port protocol="tcp" port="10251"/>
  <port protocol="tcp" port="10252"/>
  <port protocol="tcp" port="10255"/>      
  <port protocol="tcp" port="25671"/>
  <port protocol="tcp" port="30000-30127"/>   
</service>
EOM

  2. Enable the OCUA firewalld service:

    firewall-cmd --zone=public --permanent --add-service=ocua

  3. Reload firewalld:

    firewall-cmd --reload

Proxy

Set the following environment variables:

https_proxy=PROXYSTRING
no_proxy=NOPROXYSTRING

These can be set in any of the following ways: