Find weak ciphers RC4-SHA and RC4-MD5 in Solaris using script

Find weak ciphers (RC4-SHA and RC4-MD5) Solaris using script

APPLIES TO : Solaris 10 and 11

ISSUE : SSL/TLS use of weak RC4 cipherin port 3872

GOAL :  Find and disable SSL/TLS use of weak RC4 cipher

SOLUTION : Run the attached script in the affected server, Modify the IP address to the affected servers primary IP and the port which mentioned by scan report, Here the port is 3872, The required changes has to be applied by Oracle Databse team at the 13C Cloud Server. 

Port 3872 - Cloud Control Agent, Only the OMS will connect to this port.



SCRIPT :  Script Download
                     #!/usr/bin/env bash

                     # OpenSSL requires the port number.
                     SERVER=192.168.1.10:3872
                     DELAY=1
                     ciphers=$(openssl ciphers 'ALL:eNULL' | sed -e 's/:/ /g')
                     
                     echo Obtaining cipher list from $(openssl version).
                     
                     for cipher in ${ciphers[@]}
                     do
                           echo -n Testing $cipher...
                           result=$(echo -n | openssl s_client -cipher "$cipher" -connect $SERVER 2>&1)
                           if [[ "$result" =~ ":error:" ]] ; then
                                 error=$(echo -n $result | cut -d':' -f6)
                                 echo NO \($error\)
                           else
                                 if [[ "$result" =~ "Cipher is ${cipher}" || "$result" =~ "Cipher    :" ]] ; then
                                       echo YES
                                 else
                                       echo UNKNOWN RESPONSE
                                       echo $result
                                 fi
                           fi
                           sleep $DELAY

                     done


SCRIPT Output :  Here the weak ciphers RC4-SHA , RC4-MD5, DES-CBC3-SHA are open to port 3872 and its vulnerable.  The required changes has to be applied by Oracle Databse team at the 13C Cloud Server. 


JUDI-DEV-TEST01# ./ssl_test_script.sh|grep RC4
      Testing ECDHE-RSA-RC4-SHA...NO (sslv3 alert handshake failure)
      Testing ECDHE-ECDSA-RC4-SHA...NO (sslv3 alert handshake failure)
      Testing AECDH-RC4-SHA...NO (sslv3 alert handshake failure)
      Testing ADH-RC4-MD5...NO (sslv3 alert handshake failure)
      Testing ECDH-RSA-RC4-SHA...NO (sslv3 alert handshake failure)
      Testing ECDH-ECDSA-RC4-SHA...NO (sslv3 alert handshake failure)
      Testing RC4-SHA...YES
      Testing RC4-MD5...YES
      Testing DES-CBC3-SHA...YES
JUDI-DEV-TEST01#

~Judi~

How to create a cron job using script without editor

How to create a cron job using script without editor 

APPLIES TO : cron job modification

GOAL : This document explains how to add any cronjobs by using a script without open the corntab in editor. 


SOLUTION : Create a script with like below, modify the cron job as per your environment requirement, execute the script to perform the modification.

            #!/usr/bin/ksh
            #write out current crontab
            crontab -l > /tmp/mycron
            
            #echo new cron into cron file
            echo '* * * * * uname >> /tmp/cron.out' >> /tmp/mycron
            echo '* * * * * date >> /tmp/cron.out1' >> /tmp/mycron
            
            #install new cron file
            crontab /tmp/mycron

            rm /tmp/mycron


Cron line explanation :  

        1. The number of minutes after the hour (0 to 59) 

        2. The hour in military time (24 hour) format (0 to 23) 

        3. The day of the month (1 to 31) 

        4. The month (1 to 12) 

        5. The day of the week(0 or 7 is Sun, or use name) 

        6. The command to be executed. 

* * * * * "command to be executed"
- - - - -
| | | | |
| | | | ----- Day of week (0 - 7) (Sunday=0 or 7)
| | | ------- Month (1 - 12)
| | --------- Day of month (1 - 31)
| ----------- Hour (0 - 23)
------------- Minute (0 - 59)

~Judi~

File system utilization report in mail

File system utilization report in mail

Issue :
Very often file systems are filled with application logs and other data,This space filling makes the server to panic for the servers which do not have proper monitoring in place.

Goal :
Deploy a  script to monitor the file systems usage with a defined threshold and to notify the support team and application team to clear the space.

Solution :
A script has been created to monitor the File System usage with a threshold of 85%, This script will run in cron every 30 minutes and send a mail to mentioned mail ID's if any of the File System is more than 85%

#!/bin/ksh
#disk_usage.sh - Monitor the disk usage and alert the support/applicaiton team
################################
#       Begin               
#       Author : Roselin John
#       Version 0.1
# -
# -
# -
# -
# -
################################

HOST=`uname -n`
> /root/scripts/disk_log
> /root/scripts/disk_log.txt
df -k | sed '1d' | awk '{ if ($5> 85) {print "Filesystem", $6, "on Server '$HOST' is", $5, "used, Please clear space"}}' > /root/scripts/disk_log
if [ -s /root/root_scripts/disk_log ] ; then
unix2dos /root/root_scripts/disk_log /root/scripts/disk_log.txt
mailx -s "Disk Monitor Alert" judi@gmail.com < /root/scripts/disk_log.txt
fi


Update the below entry in cron
30 * * * * /root/scripts/disk_usage.sh 2>&1

File System Monitoring
File System Monitoring script
Monitor File system changes
filesystem usage

Script - Find cpu - model / type / count / core / thread / speed - Solaris Sparc

           

           -  Purpose of this script - Find the CPU count, Model, Type, Physical Count, Core, Thread, Speed and vCPU mapping with Physical CPU
          -  Use the script in Solaris Sparc servers
          -  The output as below
                    CPU Model is : UltraSPARC-T2
                    CPU Type is : sparcv9
                    Total number of physical processors: 1
                    Number of virtual processors: 64
                    Total number of cores: 8
                    Number of cores per physical processor: 8
                    Number of hardware threads (strands or vCPUs) per core: 8
                    Processor speed: 1165 MHz (1.16 GHz)

#!/bin/bash

/usr/bin/kstat -m cpu_info | egrep "chip_id|core_id|module: cpu_info|brand|cpu_type" > /var/tmp/cpu_info.log

nproc=`(grep chip_id /var/tmp/cpu_info.log | awk '{ print $2 }' | sort -u | wc -l | tr -d ' ')`
ncore=`(grep core_id /var/tmp/cpu_info.log | awk '{ print $2 }' | sort -u | wc -l | tr -d ' ')`
vproc=`(grep 'module: cpu_info' /var/tmp/cpu_info.log | awk '{ print $4 }' | sort -u | wc -l | tr -d ' ')`
cpumodel=`grep brand /var/tmp/cpu_info.log | uniq | awk '{print $2}'`
cputype=`grep "cpu_type" /var/tmp/cpu_info.log | uniq | awk '{print $2}'`

nstrandspercore=$(($vproc/$ncore))
ncoresperproc=$(($ncore/$nproc))

speedinmhz=`(/usr/bin/kstat -m cpu_info | grep clock_MHz | awk '{ print $2 }' | sort -u)`
speedinghz=`echo "scale=2; $speedinmhz/1000" | bc`

echo "" ; echo "" 
echo "CPU Model is : $cpumodel"
echo "CPU Type is : $cputype"
echo "Total number of physical processors: $nproc"
echo "Number of virtual processors: $vproc"
echo "Total number of cores: $ncore"
echo "Number of cores per physical processor: $ncoresperproc"
echo "Number of hardware threads (strands or vCPUs) per core: $nstrandspercore"
echo "Processor speed: $speedinmhz MHz ($speedinghz GHz)"
echo "" ; echo "" 
# now derive the vcpu-to-core mapping based on above information #

echo -e "\n** Socket-Core-vCPU mapping **"
let linenum=2

for ((i = 1; i <= ${nproc}; ++i ))
do
        chipid=`sed -n ${linenum}p /var/tmp/cpu_info.log | awk '{ print $2 }'`
        echo -e "\nPhysical Processor $i (chip id: $chipid):"

        for ((j = 1; j <= ${ncoresperproc}; ++j ))
        do
                let linenum=($linenum + 1)
                coreid=`sed -n ${linenum}p /var/tmp/cpu_info.log | awk '{ print $2 }'`
                echo -e "\tCore $j (core id: $coreid):"

                let linenum=($linenum - 2)
                vcpustart=`sed -n ${linenum}p /var/tmp/cpu_info.log | awk '{ print $4 }'`

                let linenum=(3 * $nstrandspercore + $linenum - 3)
                vcpuend=`sed -n ${linenum}p /var/tmp/cpu_info.log | awk '{ print $4 }'`

                echo -e "\t\tvCPU ids: $vcpustart - $vcpuend"
                let linenum=($linenum + 4)
        done
done

rm /var/tmp/cpu_info.log







~Judi~
script to find cpu information
script to find cpu count
script to find cpu core
script to find cpu thread
script to find cpu model and type
find cpu details in sparc server
find cpu details in Solaris server
processor details in solaris server
processor information in sparc server
solaris cpu count

Mail notification about oracle unix account expiry and lock out status

Mail notification about oracle unix account expiry and lock out status

          -  Purpose of this script - Notify DB admins about oracle account expiry and lock out status
          -  The list of user needs to be declared in the variable IDS section
          -  Start receiving a mail, from the 14th day prior to the password expiry
          -  Will receive mail if the account is locked out or any other error ( LK / NL / NP / UN / UP / )
          -  Modify as per your requirement IDS , MAILID , DAYS
          -  Schedule the script in cron to run daily by 00:00 AM
          -  The Result in mail will be any one of the following
               oracle   -  Password NON expiry has set - Against COMPANY password policy - Contact UNIX Support team by raising a WO OR
               oracle   -  Password expire in 3 days - Last change is 25-Nov-2016 - Change the password ASAP OR
               oracle   -  Password expired 2 days ago - Change the password ASAP OR
               oracle   -  Account is locked - Contact UNIX Support team by raising a WO



#!/bin/ksh
#########################
#########################

# About : Notify DATABASE team about oracle account expiry and lock status 
# Author : Roselin John (roselinjohn@gmail.com)
# Version : 1.2
# The user list needs to be defined in variable "IDS"


#########################
#########################

#### Variable clasification
# EPOCH - Find the epoch time since the user's password was last changed
# ASTATE - Account status
# CURRENT_EPOCH - Users password age from shadow file in epoch seconds
# AGE - Compute the age of the user's password
# MAX - Max password age per user
# EXPIRE - how many days remaining to expire

DATABASE_ACCOUNTS () {
TOLIST="oracledba@company.com"
CCLIST="unixadmin@company.com"

IDS='oracle oracledba'

OUTFILE=/var/tmp/oraValication
> $OUTFILE
> $OUTFILE.1

EPOCH=`/bin/perl -e 'print int(time/(60*60*24))'`

for USER in $IDS ; do
ASTATE=`passwd -s $USER | awk '{print $2}'`
TFIELD=`passwd -s $USER | awk '{ total = total + NF }; END { print total+0 }'`
CURRENT_EPOCH=`grep $USER /etc/shadow | cut -d: -f3`
if [ "$ASTATE" = "LK" ] ; then
echo "$USER \t - \tAccount is locked - Contcat UNIX Support team by raising a WO" >> $OUTFILE
elif [ "$ASTATE" = "NL" ] ; then
echo "$USER \t - \tThe account is a no  login  account - Contcat UNIX Support team by raising a WO" >> $OUTFILE
elif [ "$ASTATE" = "NP" ] ; then
echo "$USER \t - \tAccount has no password - Contcat UNIX Support team by raising a WO" >> $OUTFILE
elif [ "$ASTATE" = "UN" ] ; then
echo "$USER \t - \tThe data in the  password  field  is unknown - Contcat UNIX Support team by raising a WO" >> $OUTFILE
elif [ "$ASTATE" = "UP" ] ; then
echo "$USER \t - \tThis account  not activated - Contcat UNIX Support team by raising a WO" >> $OUTFILE
elif [ "$ASTATE" = "PS" ] ; then
if [ "$TFIELD" -eq 2 ] ; then
echo "$USER \t - \tPassword NON expiry has set - Against COMPANY passsord policy - Contcat UNIX Support team by raising a WO" >> $OUTFILE
else
FORCED=`passwd -s $USER | awk '{print $3}'`
if [ "$FORCED" = "00/00/00" ] ; then
echo "$USER \t - \tPassowrd change is in force at next login" >> $OUTFILE
else
# Compute the age of the user's password
AGE=`echo $EPOCH - $CURRENT_EPOCH | /bin/bc`
MAX=`grep $USER /etc/shadow | cut -d: -f5`
EXPIRE=`echo $MAX - $AGE | /bin/bc`
#CHANGE=`echo $CURRENT_EPOCH + 1 | /bin/bc`
CHANGE=`echo $CURRENT_EPOCH | /bin/bc`
LSTCNG="`perl -e 'print scalar localtime('$CHANGE' * 24 *3600);'`"
LSTCNGD=`echo $LSTCNG | awk '{print $3"-"$2"-"$5}'`
if [ "$EXPIRE" -le 0 ] ; then
echo "$USER \t - \tPassword expired `echo $EXPIRE| sed 's/\-//g'` days ago - Change the password ASAP" >> $OUTFILE
elif [ "$EXPIRE" -le 14 ] ; then
echo "$USER \t - \tPassword expire in $EXPIRE days - Last change is `echo $LSTCNGD` - Change the password ASAP" >> $OUTFILE
fi
fi
fi
fi
done


if [ -s "$OUTFILE" ] ; then

echo "Validated unix accounts in server `uname -n` are   :: $IDS

=========================================================


" >> $OUTFILE.1 ; cat $OUTFILE >> $OUTFILE.1
unix2dos "$OUTFILE.1" "$OUTFILE.ora.dosfile"
mailx -s "`uname -n` - Oracle - UNIX Account Status" -c $CCLIST $TOLIST, < $OUTFILE.ora.dosfile
#cat $OUTFILE.ora.dosfile
rm $OUTFILE.ora.dosfile
fi

rm $OUTFILE.1 $OUTFILE 
}

DATABASE_ACCOUNTS




The Result in mail will be any one of the below

oracle - Password NON expiry has set - Against COMPANY password policy - Contact UNIX Support team by raising a WO    OR
oracle - Password expire in 3 days - Last change is 25-Nov-2016 - Change the password ASAP    OR
oracle - Password expired 2 days ago - Change the password ASAP    OR
oracle - Account is locked - Contact UNIX Support team by raising a WO