Mounting an Oracle Cloud Object Storage Bucket as a File
System on Linux
Prerequisites: Ensure that bucket you’re trying to mount is in the compartment listed for S3 compatibility; by default, it’s a root compartment of the tenancy.
If you need to change that, settings are located under Administration->Tenancy Details->Edit Object Storage Setting. Create an Object Storage Bucket from the OCI Console.
Click in Object Storage
Enter a name for the bucket and click on Create Bucket.
Install s3fs-fuse You can install s3fs-fuse by using a prebuilt package from the Oracle Linux EPEL repository. In this post, I’m using the binary RPM.
Configure Credentials In the Oracle Cloud Infrastructure Console, click the Profile icon in the top-right corner, and select User Settings. Click Customer Secret Keys, and then click Generate Secret Key. Give the key a meaningful name (for example, bk_orap2g), and then click Generate Secret Key. Copy and save the secret key because it won’t be shown again. The S3 credentials are created by using an access key and the secret key. The access key is displayed in the Customer Secret Keys area of the Console.
Create the directory and assign ownership # mkdir /home/oracle/bkp_db # chown oracle:oinstall /home/oracle/bkp_db
Mount the File System $ s3fs bucket2fs /home/oracle/bkp_db -o passwd_file==${HOME}/.password-bk -o url=https://mynamespace.compat.objectstorage..oraclecloud.com/ -o nomultipart -o use_path_request_style
Add an entry in the /etc/fstab file. #s3fs bk_orap2g /home/oracle/bkp_db fuse.s3fs _netdev,allow_other,nomultipart,use_path_request_style,passwd_file=/home/oracle/.passwd-bk,url=https://mynamespace.bej2.objectstorage.eu-frankfurt-1.oraclecloud.com/ 0 0
or add an entry to crontab to mount bucket on reboot.
Navigate to Compute > Instances > then select your instance
On the bottom left select Console Connections
From a terminal run “cat ~/.ssh/id_rsa.pub” and copy it. If you have another public key you want to use, feel free to use it.
Click on Create Console Connection
Select the PASTE SSH KEYS option
Paste the ssh public key into the field
Click on the Create Console Connection button.
Once it is Active select the three dots menu on the right and select Connect with SSH, alternately you could use Connect with VNC.
Choose LINUX/MAC OS or WINDOWS and copy the command.
In a text editor to make it easier and for insurance modify the command and add “-i ~/.ssh/id_rsa” in a couple places; replace id_rsa with your private key if it is different. For example the changes in red:
From the previous steps paste the command that was copied and modified into a new terminal window and press enter.
Press enter again and you should now see a prompt to login — DO NOT LOGIN.
While watching your terminal with the login prompt, in the OCI console click on the Reboot button of your instance > choose confirm OK.
You should see commands running across the terminal and once you see the OS options immediately use your up and down arrows to change the option. If you wait to long it will default to an option and continue to start. If that happens you will have to reboot again.
For Linux select the Unbreakable Enterprise Kernel option and press “e” to edit.
This is the tricky part. Scroll down using your keyboard down arrow to the very bottom. You should see the cursor in a lighter color; it can be hard to see, but trust me it is there.
Move the cursor until it is between the loglevel=4 and the last line ending in “initrdefi /boot/xxxxx.x86_64.img”.
Insert “rw init=/bin/bash”, be sure there is a space between the two other lines (see below).
Now press CTRL-X and it will reboot to a bash shell as root --- *** BE CAREFUL NOW ***.
Reset the OPC SSH key –
From the same terminal from the previous steps run the following:
Execute "/usr/sbin/load_policy -i” - to preserve the SELinux policies for the files you will modify.
Execute "/bin/mount -o remount,rw /“ - to remount the root partition with read/write permissions.
Execute "cd ~opc/.ssh” - to change to the opc SSH key directory. If you run a ls command you should see one file authorized_keys. If you run “cat authorized_keys” it may be empty or the wrong key; mine was empty.
Execute “mv authorized_keys authorized_keys.orig” - as a safety precaution to back up the original file.
Execute “vi authorized_keys” - to create a new authorized_keys file.
Press “i” to insert some text.
Paste in your ssh public key used from the previous step when you created the console connection.
Press ESC, enter “:wq”, and press Enter to write and quit the file to save it.
Execute “chown opc:opc authorized_keys” to make sure the owner of the file is opc otherwise it will be owned by root.
Execute “chmod 600 authorized_keys” to set the proper permissions.
Execute "mount -o remount,ro /” to force the OS to flush the filesystem cache. It also guarantees that the filesystem is marked as "cleanly unmounted" when the machine comes back up from a reboot.
Execute “/usr/sbin/reboot -f” to reboot the running instance.
Next when you see the same OS options let the server start using the default OS option.
After the instance has rebooted open a new terminal and try to ssh in using “ssh opc@myinstance”; change myinstance to your hostname. Another alternative is to provide the location to your private key like “ssh -i ~/.ssh/my_private_key opc@myinstance”.
If successful you will get a login prompt; yeah!
Important, I recommend closing the terminal window with the serial connection and then deleting the Console Connection immediately using the OCI console. If you don't delete the serial console it will terminate your session automatically after 24 hours and you will have to re-authenticate, but the serial console will still be there. The risk is low since for someone to use this serial console they would need your private key, but as a precautionary measure it is best to delete the serial console as soon as you are finished using it.
OEM 12c has a very useful Perl script which allows removing an installed OEM agent in the host. The process is quite straightforward just by invoking the AgentDeinstall.pl script located under:
$AGENT_HOME/sysman/install/AgentDeinstall.pl
[oracle@DB1 ~]$/u01/app/oracle/product/agent12c/core/12.1.0.3.0/perl/bin/perl /u01/app/oracle/product/agent12c/core/12.1.0.3.0/sysman/install/AgentDeinstall.pl -agentHome /u01/app/oracle/product/agent12c/core/12.1.0.3.0 Agent Oracle Home: /u01/app/oracle/product/agent12c/core/12.1.0.3.0 NOTE: The agent base directory: /u01/app/oracle/product/agent12c will be removed after successful deinstallation of agent home. DetachHome Command executed:/u01/app/oracle/product/agent12c/core/12.1.0.3.0/oui/bin/runInstaller -detachHome -force -depHomesOnly -silent ORACLE_HOME=/u01/app/oracle/product/agent12c/core/12.1.0.3.0 -waitForCompletion -invPtrLoc /u01/app/oracle/product/agent12c/core/12.1.0.3.0/oraInst.loc Starting Oracle Universal Installer... Checking swap space: must be greater than 500 MB. Actual 5978 MB Passed The inventory pointer is located at /u01/app/oracle/product/agent12c/core/12.1.0.3.0/oraInst.loc 'DetachHome' was successful. Starting Oracle Universal Installer... Checking swap space: must be greater than 500 MB. Actual 5978 MB Passed The inventory pointer is located at /u01/app/oracle/product/agent12c/core/12.1.0.3.0/oraInst.loc The Oracle home '/u01/app/oracle/product/agent12c/sbin' could not be updated as it does not exist. Deinstall Command executed:/u01/app/oracle/product/agent12c/core/12.1.0.3.0/oui/bin/runInstaller -deinstall -silent "REMOVE_HOMES={/u01/app/oracle/product/agent12c/core/12.1.0.3.0}" -waitForCompletion -removeAllFiles -invPtrLoc /u01/app/oracle/product/agent12c/core/12.1.0.3.0/oraInst.loc Starting Oracle Universal Installer... Checking swap space: must be greater than 500 MB. Actual 5978 MB Passed Preparing to launch Oracle Universal Installer from /tmp/OraInstall2018-04-17_12-45-35PM. Please wait ...Oracle Universal Installer, Version 11.1.0.11.0 Production Copyright (C) 1999, 2013, Oracle. All rights reserved. Starting deinstall Deinstall in progress (Tuesday, April 17, 2018 12:45:40 PM CST) Configuration assistant "Agent Deinstall Assistant" succeeded ............................................................... 100% Done. Deinstall successful End of install phases.(Tuesday, April 17, 2018 12:46:15 PM CST) End of deinstallations Please check '/u01/app/oraInventory/logs/silentInstall2018-04-17_12-45-35PM.log' for more details. Do you want us to delete the old oracle home [yes/no] :yes NOTE: The targets monitored by this Management Agent will not be deleted in the Enterprise Manager Repository by this deinstall script. Make sure to delete the targets manually from the Cloud Control Console for a successful deinstallation.
Under some circumstances, such as when installing additional software in a virtual machine domain, you might need to download and import the GPG key to use with yum. To obtain and import a GPG key from the public yum repository:
Download the GPG key, for example with the the wget command.
7.2.4 Error During Oracle Database Installation on Oracle Linux 7
When installing Oracle Database 11g Release 2 (11.2.0.4) on Oracle Linux 7 and Red Hat Enterprise Linux 7, Oracle Universal Installer shows the following error message:
Error in invoking target 'agent nmhs' of makefile
When creating the database, the following error occurs:
Error securing Database Control
Apply patch 19692824 to the Database home:
https://updates.oracle.com/download/19692824.html
For additional information about how to apply the patch and when to apply the patch, refer to Note 1951613.1
This issue is tracked with Oracle bug 19692824.
You can create one by issuing the following command in a Linux Bash terminal on most distributions:
1
$ gpg --gen-key
Note: On Arch Linux Install GPG first with: sudo pacman -S gpg
The initial prompt will appear and looks like this:
123456
Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only)Your selection?
Choose 1 which will enable both encryption and signing.
The next prompt asks for the keysize:
12
RSA keys may be between 1024 and 4096 bits long.What keysize do you want? (2048)
Enter 2048 for the keysize.
Then read the next set of output:
1234567
Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n yearsKey is valid for? (0)
Most people make their keys valid until infinity, which is the default option. If you do this don’t forget to revoke the key when you no longer use it.
Enter 0 for infinity, or however long you wish.
123
You need a user ID to identify your key; the software constructs the user IDfrom the Real Name, Comment and E-mail Address in this form:"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
Your next input from here should be your real name:
1
Real name:
Followed by your email address you wish to associate the key with (you can add more later!) :
1
E-mail address:
Here you can give the key a description that fits its purpose:
1
Comment:
This part is important and is the passphrase that you’ll use to open/decrypt your key that is generated. You can make it memorable but it’s essential that this follows a few precepts to make it strong and considered “secure”.
For Example: Contains symbols, contains upper & lower case characters, some numbers, no dictionary words, etc.
123
You need a Passphrase to protect your secret key.Enter passphrase:
As the next prompt says type on the keyboard, move the mouse, and perform some actions that read/write to the machine’s hard drives.
1234
We need to generate a lot of random bytes. It is a good idea to performsome other action (type on the keyboard, move the mouse, use thedisks) during the prime generation; this gives the random numbergenerator a better chance to gain enough entropy.
If this is not enough or does not seem to update and complete after sometime, open up a new shell session and carry out these commands:
A revocation certificate must be generated to revoke your public key if your private key becomes compromised in any way.
It is recommended to create a revocation certificate when you create your key.
Note: Keep your revocation certificate on a medium that you can safely secure, like a thumb drive in a locked box. The revocation key may be printed and/or stored as a file. Take care to safeguard your revocation key.
To create a revocation certificate for your key carry out these two commands.
This first statement will create an environment variable in Bash containing the GPG key value you just created. Note that if you have other keys previously generated the value extracted with this command may be of a different key, this filters on the first key listed by the gpg program:
Now we create the revocation certificate by passing the $GPGKEY variable we defined:
1
$ gpg --output revoke.asc --gen-revoke $GPGKEY
Enter 0 for this multiple choice list.
12345678
Create a revocation certificate for this key? (y/N) yPlease select the reason for the revocation: 0 = No reason specified 1 = Key has been compromised 2 = Key is superseded 3 = Key is no longer used Q = Cancel(Probably you want to select 1 here)
Enter something along the lines of - “Will be used if/when this key is ever compromised.”
This also needs ending with a new line.
123
Enter an optional description; end it with an empty line:>>
Now enter your key’s passphrase
12
You need a passphrase to unlock the secret key foruser:
The resultant message seen here means you successfully created your revocation certificate.
12345678
ASCII armoured output forced.Revocation certificate created.Please move it to a medium which you can hide away; if Mallory getsaccess to this certificate he can use it to make your key unusable.It is smart to print this certificate and store it away, just incaseyour media become unreadable. But have some caution: The print system ofyour machine might store the data and make it available to others!
Note: Mallory being a malicious attacker (less commonly called Trudy, an intruder.); unlike the passive Eve, this one is the active man-in-the-middle attacker who can modify messages, substitute his/her own messages, replay old messages, and so on. – Source
As indicated backup somewhere safe the revoke.asc file, in case you should ever need it in the future to invalidate your private key.
It can be found in your current working directory where you executed the initial gpg --output command.
Step 3 – Installing Pass
Arch Linux
1
$ sudo pacman -S pass
Debian / Ubuntu
1
$ sudo apt-get install pass
Step 4 – Initialising Pass
After installing Pass you need to initialise it with your GPG key from the previous steps.
In the same shell session as earlier use the environment variable $GPGKEY and supply it to Pass via the init parameter:
1
$ pass init $GPGKEY
This message will follow:
12
mkdir: created directory ‘/home/scarlz/.password-store’Password store initialized for <KEYVALUE>.
Step 5 – Adding Password Entries
To add a new password entry to Pass, follow this next code snippet’s syntax:
This example was for an entry of an email address account in a descriptive hierarchy.
The prompt generated asks for the password that is to be associated and stored with this entry
1234
mkdir: created directory ‘/home/scarlz/.password-store/email’mkdir: created directory ‘/home/scarlz/.password-store/email/gmail’Enter password for email/proton-mail/count.elmsley@protonmail.com:Retype password for email/proton-mail/count.elmsley@protonmail.com:
The password is then read encrypted, and placed in ~/.password-store .
As the data stored in the encrypted files are plain text you can add any other details that go with an entry using the -mparameter. This creates the password with a multi-line entry where the first field is usually the password and the rest of the lines are the extra details such as usernames, emails addresses, etc.
Press CTRL + D to quit and confirm the entry when in multi-line mode.
To use Pass to generate a password for an entry on your behalf, use the generate option:
1
$ pass generate archlinux.org/wiki/username <n>
The <n> represents the number of characters you want the password to be in total. Replace it with a value like 16 to make the password lengthy enough.
There are some other options you can toggle like -n to exclude symbols from the password, and -c to send the password straight to the clipboard, and not print it to standard out once it’s created.
If you want to single out certain categories or sections of the tree use:
1
$ pass ls Email/
Which shows only:
123
├── Email│ ├── user@gmail.com│ └── zx2c4.com
To actually decrypt and retrieve a password, call the program and provide the path to the password:
1
$ pass Email/user@gmail.com
You will now have to enter or unlock your GPG key to see and display the password.
Instead of displaying the password in the terminal you can copy it to the clipboard for 45 seconds via -c :
1
$ pass -c Email/user@gmail.com
Which gives the message below and let’s you paste the password into any websites, forms, etc:
1
Copied Email/user@gmail.com to clipboard. Will clear in 45 seconds.
Step 7 – Removing & Editing Password Entries
You many need to remove passwords in the manager from time to time. This is done with the familiarly named rm and the path to the password file you want to remove.
Pass has support for Git tracking which would be ideal for private Git repositories but also in theory “safe” to put on a public service like Github, as the files are of course encrypted with GPG. Depending upon the strength of your passphrase too.
Make sure you have git installed on your system for this next section:
You can now add, edit, remove, and make changes then push them to your remote repository with:
1
$ pass git push
Step 9 – Shell Environment Variables
Here are three variables I found that seem potentially the most useful, should you ever need to fiddle with their functionality (there are others though).
PASSWORD_STORE_DIR
Overrides the default password storage directory.
$PASSWORD_STORE_GIT
Overrides the default root of the git repository, which is helpful if PASSWORD_STORE_DIR is temporarily set to a sub-directory of the default password store.
$PASSWORD_STORE_CLIP_TIME
Specifies the number of seconds to wait before restoring the clipboard, by default 45 seconds.
Step 10 – Exporting & Importing Keys
To transfer and move around a pass GPG key to other systems, follow these steps for a rudimentary solution.
Public Key
To see the current public GPG keys you have setup and active use:
1
$ gpg --list-keys
One of these will show the ID and details of your Pass key, use the key ID value to export the public key into a file with:
1
$ gpg -ao pass_public.key --export <key ID value>
Then transfer the generated pass_public.key onto your new system, and use the --import option to add it to GPG.
This is done with the command:
1
$ gpg --import pass_public.key
Private Key
To see the current private GPG keys you have setup and active use:
1
$ gpg --list-secret-keys
Like in the public key section, export the private key into a file with:
1
$ gpg -ao pass_private.key --export-secret-keys
Then transfer the generated pass_private.key onto your new system, and use the --import option to add it to GPG.
This is done with the command:
1
$ gpg --import pass_private.key
Trust Error
Sometimes after importing the key onto a new system you may get an error message similiar to:
1
gpg: There is no assurance this key belongs to the named user
Which appers when trying to encrypt a new file or edit an existing Pass entry.
If so use GPG to edit the key.
1
$ gpg --edit-key <Key Value>
At the prompt type:
1
> trust
Then from the numerical choices displayed enter a suitable value. The highest option 5 is fine if you know that this key is definetly your own and not a potentially unsafe key.
1234567891011
Please decide how far you trust this user to correctly verify other users' keys(by looking at passports, checking fingerprints from different sources, etc.)1 = I don't know or won't say2 = I do NOT trust3 = I trust marginally4 = I trust fully5 = I trust ultimatelym = back to the main menuYour decision?
The operation you were trying to perform with Pass should now work as they key is trusted. Enter quit to leave the gpg prompt.
Click in Object Storage
Enter a name for the bucket and click on Create Bucket.
Install s3fs-fuse
Configure Credentials
