Operating Systems

13C OMS and TLSv1.2

by

A while ago I deployed OEM 13c to manage and monitor our databases. We have a lot of different systems on different architectures and operating systems. For the most part the move from OEM12c to OEM 13c was pretty smooth. As part of this process we were instructed to lock everything down to TLSv1.2, which is a huge pain inside of OEM. All the internal connections from the different components and nothing was listed in the documentation together. It took a lot of trial and error, but once it was setup, the deployment of the agents went just fine.

At least until I got to our AIX hosts. This is one of the longest open tickets I have ever had with oracle. Bug:23708579. After 9 months Oracle finally got me a patch that resolved the problem this week.

 

$ ./emctl start agent 
Oracle Enterprise Manager Cloud Control 13c Release 2 
Copyright (c) 1996, 2016 Oracle Corporation. All rights reserved. 
Starting agent ................ failed. 
SSL Configuration failed at Startup 
Consult emctl.log and emagent.nohup in: /u01/app/oracle/product/agent13c/agent_inst/sysman/log

From the log files

27656382 :: 2017-04-11 11:49:08,943::AgentLifeCycle.pm: Processing setproperty agent 
27656382 :: 2017-04-11 11:49:08,943::AgentStatus.pm:Processing setproperty agent 
27656382 :: 2017-04-11 11:49:12,411::AgentStatus.pm:/u01/app/oracle/product/agent13c/agent_13.2.0.0.0/bin/emdctl setproperty agent -name SSLCipherSuites -value TLS_RSA_WITH_AES_128_CBC_SHA returned 0 
27656382 :: 2017-04-11 11:49:12,412::Cleaning up agent command lock 
27656382 :: 2017-04-11 11:49:12,412::AgentCommandLock:closed file handle of emctl lockfile 
25624672 :: 2017-04-11 11:49:23,995::Initializing the agent command locking system 
25624672 :: 2017-04-11 11:49:24,039::AgentLifeCycle.pm: Processing stop agent 
25624672 :: 2017-04-11 11:49:24,039::AgentLifeCycle.pm: ParentProcess id=9175258 
25624672 :: 2017-04-11 11:49:26,815::AgentStatus.pm:emdctl status agent returned 1 
25624672 :: 2017-04-11 11:49:26,815::Status Output:Status agent Failure:Unable to connect to the agent at https://myoemserver:3872/emd/lifecycle/main/ [Connection refused]

There was a lot of confusion over this issue and originally they told me it was a bug in AIX that we would need to get IBM to fix. It turns out the patch that was needed was an agent patch

After applying patch: 25237184 the agent can now be locked to TLSv1.2 by adding the following to emd.properties

_frameworkTlsProtocols=TLSv1.2 
_frameworkSSLContextProtocol=TLSv1.2

and then by re-securing the agent with the “-protocol tlsv1.2” flag

./emctl secure agent "myPassword" -protocol tlsv1.2

After this the agent was able to start up and start communicating with the OMS.

 

Windows 10 – When You Can’t Be Trusted

by

Unfortunately some things require windows. Old interfaces that ensure you are running IE6, old proprietary administration software, and other things I don’t use on a daily basis. Windows 10 is one of the most frustrating versions of windows I have ever run. It pretty much assumes you are too stupid to have any idea what you are doing. I just spend an hour fighting with it to let me download a file that builds boot disks. It decided it wasn’t safe. I don’t know what that means since I have been using this product for years! In fact Edge assumes you are so stupid, I can’t get on most websites because it doesn’t assume they are safe! It also doesn’t think it is safe for me to install chrome! How anyone could use the pile of crap for day to day work baffles me. I am glad my work laptop is still Windows 7, where I can get a virus if I am stupid, but doesn’t try to baby proof everything!

ESXi Web UI

by

I run mainly on Macs, which means OS X. Unfortunately that means I don’t have access to the GUI of vmware. As of 6.0 U2, vmware has a very slick web UI built into it. Just look at the following article, all I had to do was ssh to my ESXi server and run:

esxcli software vib install -v http://download3.vmware.com/software/vmw-tools/esxui/esxui_signed.vib

 

https://calvin.me/web-interface-for-esxi-without-vcenter/

Xlib: No protocol specified

by

While trying to connect to an AIX box, and start dbca, I got the following error

Xlib: connection to "192.168.0.100:0.0" refused by server
Xlib: No protocol specified

This is an issue with Xming security. I changed the shortcut on my windows desktop to:

"C:\Program Files (x86)\Xming\Xming.exe" :2 -clipboard -multiwindow -ac

I was immediately able to fire up dbca.

the -ac option disable access control restrictions, so you should never do this over a public network, it could open up a massive hole in your computer and allow anyone to connect.