Creating Additional Users on a Linux Instance (OCI)

In general, all OCI Linux servers created with OPC user by default, which has super privileges and can be used by admin users only.  If you would like provision access to developers on Linux server, we need to create new users and will see the process below how to create and access them.

High level plan to create and new user:

1. Generate SSH key pairs for the users offline.
2. Add the new users.
3. Append a public key to the ~/.ssh/authorized_keys file for each new user.

Detailed steps:

The new users then can SSH to the instance using the appropriate private keys.

To create an additional SSH-enabled user:

1. Generate an SSH key pair for the new user.

2. Copy the public key value to a text file for use later in this procedure.

3. Log in to the instance.

4. Become the root user:
    

   sudo su

5. Create the new user:

    useradd <new_user>

6. Create a .ssh directory in the new user’s home directory:

    mkdir /home/<new_user>/.ssh

7. Copy the SSH public key that you saved to a text file into the /home/new_user/.ssh/authorized_keys file:

    echo <public_key> > /home/<new_user>/.ssh/authorized_keys

8. Change the owner and group of the /home/username/.ssh directory to the new user:

    chown -R <new_user>:<group> /home/<new_user>/.ssh

9. To enable sudo privileges for the new user, run the visudo command and edit the /etc/sudoers file as follows:

a. In /etc/sudoers, look for:

    %<username> ALL=(ALL) NOPASSWD: ALL

b. Add the following line immediately after the preceding line:

    %<group> ALL=(ALL) NOPASSWD: ALL

The new user can now sign in to the instance.

I was able to create new user and followed all above steps as is and tried to login with new user, and I got below error message.

"Server refused our key"

"No supported authentication methods available (server sent: publickey.gssapi-keyex.gassapi-with-mic)".

After couple of hours research, found 2 issues.

Issue-1:

/home/<new user>/.ssh folder doesn't have 700 permissions and it has 755, changed .ssh folder permissions to 700.

Issue-2:

/home/new_user/.ssh/authorized_keys file suppose to have 600 permissions, but it was 755, changed back to 600.

Now you were able to login the linux server with new user.

Source: https://docs.cloud.oracle.com/en-us/iaas/Content/Compute/Tasks/addingusers.htm

Permanently change the hostname of an Oracle Cloud Infrastructure (OCI) compute instance

For Oracle Linux 6:

1) Edit /etc/sysconfig/network
change the parameter value for "hostname"
example:
$ cat /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=instance-ol6 <--------- change here

2) In the file /etc/oci-hostname.conf change the value of PRESERVE_HOSTINFO to 2.
$cat /etc/oci-hostname.conf
PRESERVE_HOSTINFO=2

This change will be persistent across reboots.

For Oracle Linux 7:

1) Update the /etc/hostname file with below command.
    hostnamectl set-hostname <new name>

2) Edit the oci configuration file for hostnames as given below to update the needed value to 2 and save changes.
    $ vi /etc/oci-hostname.conf
    PRESERVE_HOSTINFO=2
  

3) Edit the FQDN from OCI console GUI, go to compute instances
--> select the instance
--> scroll down
--> at the left bottom corner select attached VNIC under resources
--> edit appropriate VNIC
--> change hostname to update FQDN
--> update VNIC

4) Reboot the instance

5) Check the hostname with hostname command.

Different Levels of SUDO Access.

As a root user, visudo and insert the following based on your requirement.

###############################################

# APPLMGRSU users can su to applmgr

User_Alias  APPLMGRSU = user1

APPLMGRSU ALL = NOPASSWD: /bin/su - applmgr

###############################################

# ORACLESU users can su to oracle

User_Alias  ORACLESU = user1

ORACLESU ALL = NOPASSWD: /bin/su - oracle

###############################################

# allow the user to issue commands as root without a password

user1 ALL=(root) NOPASSWD: ALL

###############################################

#Append the following entry to run ALL command without a password for a user named user1:

user1 ALL=(ALL) NOPASSWD:ALL

SUDO access to Developers to bounce some of services.

One of the scenario that I come across, some of developers wanted to bounce apache / opmn services after their development activity to see their changes got effected or not.  It is hard for DBAs every time to do such things.  To overcome that, we have granted sudoers access to some of key developers, so that they can bounce on their own on non-prod environments.  

As root, on application server:

visudo

Insert this into file:

###############################################

# DEVORACLE users can run the following commands as applmgr

User_Alias  DEVORACLE = user1, user2, user3

DEVORACLE ALL = (applmgr) NOPASSWD: /u01/scripts/stopopmn, /u01/scripts/startopmn, /u01/scripts/startapache, /u01/scripts/stopapache

As applmgr, on application server:

cp $ADMIN_SCRIPTS_HOME/adopmnctl.sh /u01/scripts/.

cp $ADMIN_SCRIPTS_HOME/adapcctl.sh /u01/scripts/.

Make easy commands to developers:

$ cd /u01/scripts

$ echo "/u01/scripts/adopmnctl.sh stopall" > stopopmn

$ echo "/u01/scripts/adopmnctl.sh startall" > startopmn

$ echo "/u01/scripts/adapcctl.sh stop" > stopapache

$ echo "/u01/scripts/adapcctl.sh start" > stopapache

Here are the files you see in /u01/scripts after all done:

adapcctl.sh

adopmnctl.sh

startapache

stopapache

startopmn

stopopmn

Change permissions to all files under /u01/scripts:

$ chmod 700 *

These are the commands that only the developers listed by name in the sudoers file (above) can run:

sudo -u applmgr /u01/scripts/stopopmn

sudo -u applmgr /u01/scripts/startopmn

sudo -u applmgr /u01/scripts/stopapache

sudo -u applmgr /u01/scripts/startapache

Delete Files Older Than X Days in Unix

In this example X is replaced with 7.

List all files older than X days:

find /path/to/files/ -type f -mtime -7 -exec ls -l {} \; 

Delete all files older than X days:

find /path/to/files/ -type f -mtime -7 -exec rm -f {} \;

Move all files with extension '.arc' older than X days:

find /path/to/files/ -type f -name '*.arc' -mtime +7 -exec mv {} /path/to/archive/ \;

X11-Forwarding (or) DISPLAY settings on Linux Servers

For Oracle installations, to launch GUI, we should have X11 to be enabled and set DISPLAY variables.

1) To enable X11 forwarding on Linux servers:

Install required packages as first step.

X11-forwarding  : ✔  (remote display is forwarded through SSH)

$ yum install xorg-x11-xauth xorg-x11-fonts-* xorg-x11-font-utils xorg-x11-fonts-Type1 xdpyinfo -y

Set below three parameters:

$ vi /etc/ssh/sshd_config 
    X11Forwarding yes
    X11DisplayOffset 10
    X11UseLocalhost no
 
$ systemctl restart sshd

$ systemctl status sshd.service

2) Set DISPLAY variable 

echo $DISPLAY, if not set then export DISPLAY=<hostname/IPADDRESS>:<port>

Ex: $ export DISPLAY=oracledemo:0.0
      $ echo $DISPLAY
   oracledemo:0.0

Disable Firewall on OCI Linux Servers

How to disable firewall on OCI Linux Servers / regular on-premise servers?

Below commands will work for OCI Linux OS Version 7, so please check your O.S Version before execute these commands.

Check OS Version:

For Oracle Linux:
 $ cat /etc/oracle-release (OR)  just type "hostnamectl" on the command line.

For Redhat Linux:
$ cat /etc/redhat-release

1) Check if firewall is running or not.

$ firewall-cmd --state

2) Stop firewall.

$ systemctl stop firewalld.service

Note: If you simply stop the firewall, once server rebooted, your firewall be started running again.  If you don't want to enable firewall rules after reboot permanently disable the firewall.

3) Disable firewall.

$ systemctl disable firewalld.service

4) Cross check if firewall is running or not.

$ firewall-cmd --state


If your OS Version is 6, to stop firewall you need to use iptables service.  Remember all commands needs to be run from root user, if not at least you should have sudo access to run these commands.

1) Status of firewalls

$ service iptables status

2) Stop firewalls.

$ service iptables stop

3) Disable firewalls.

$ chkconfig iptables off

Timezone Change on OCI Linux Hosts

How to change Timezone on Oracle Cloud Infrastructure (OCI) Linux Servers:

All our OCI servers by default they are in GMT timezone, but we wanted them to be in US CST time.
So we have changed timezone as shown below.

1) Login to the host as root user and change directory to /etc and do the following.

    cd /etc/

2) Check localtime file.

    $ls -ltr localtime    ## It is softlink and pointed to GMT time.
  lrwxrwxrwx. 1 root root 37 Jan  24  2020 localtime -> /usr/share/zoneinfo/GMT
   
3) Remove the softlink that pointed to GMT.

  unlink localtime

4) Create a new softlink pointing to US CST time.

    ln -s /usr/share/zoneinfo/America/Chicago localtime  

Tar / Untar

1) To compress an entire directory
tar -czvf <filename>.tar.gz /home/oracle/data/ 

2) To compress multiple directories and files, execute:
tar -czvf <filename>.tar.gz /home/oracle/data/ /home/oracle/pics/ /home/oracle/<some filename> 

3) To use bzip2 compression instead of gzip by passing the -j option to the tar command:
tar -cjvf <filename>.tar.bz2 /home/oracle/data/

4) To exclude certain files when creating a tarball. The syntax is:
tar -zcvf <filename>.tar.gz --exclude='dir1' --exclude='regex' dir1

 For example, exclude ~/Downloads/ directory:
 tar -czvf /share/backup.tar.gz --exclude="Downloads" /home/oracle/

5) To view files stored in an archive:
tar -ztvf <filename>.tar.gz
tar -jtvf <filename>.tar.bz2

6) To extracting an archive / tar:
tar -xzvf <filename>.tar.gz
tar -xjvf <filename>.tar.bz2

7) To extract the contents of the archive/tar into a specific directory such as /home/oracle/backups/? Try passing the -C DIR option:
tar -xzvf <filename>.tar.gz -C /home/oracle/backups/
tar -xjvf <filename>.tar.bz2 -C /tmp

8) Other Options:
tar cvf - 11.2.0.3    | gzip -c > 11.2.0.3.tar.gz  # To tar a directory
gunzip -c /ora/11.2.0.3.tar.gz   | tar xvf -  ## To untar a directory
tar -zxf /share/apps.tar.gz --directory /appl/   ## Extract to a directory 

Different ways to check no.of CPU cores in Linux

How to find no.of cpu cores in Linux:

Option-1
cat /proc/cpuinfo | grep -i processor | wc -l
(or)
grep -c ^processor /proc/cpuinfo

Option-2
nproc

Option-3
lscpu
(or)
lscpu | grep 'CPU(s):' | head -1 | awk '{print $2}'

Different ways to Empty or Delete a Large File Content in Linux

There are different ways to empty or delete a large file content.  Make sure, which file you are going to empty.

Option-1
> file_name

Option-2
cat /dev/null > file_name

Option-3
dd if=/dev/null of=file_name

Option-4
echo > file_name

Create User and Group in Unix

Group Add:

/usr/sbin/groupadd -g 503 dba
/usr/sbin/groupadd -g 510 dev

Oracle User creation:

/usr/sbin/groupadd -g 501 oracle
/usr/sbin/useradd -u 501 -g oracle -G oracle -c "Oracle Application or Database" oracle
/usr/bin/passwd oracle
/usr/sbin/usermod -U oracle
/usr/sbin/usermod -g dba -G dba,oracle oracle

Applmgr User creation:

/usr/sbin/groupadd -g 508 applmgr
/usr/sbin/useradd -u 508 -g applmgr -G applmgr -c "Oracle Applications Manager" applmgr
/usr/bin/passwd applmgr
/usr/sbin/usermod -U applmgr
/usr/sbin/usermod -g dba -G dba,applmgr applmgr

Crontab Entries

Crontab Add Timestamp to the logfile:

If you want append date to the crontab logfile use below format:

45 09 * * * "/u01/scripts/test_date.sh" >/u01/scripts/test_date.log\_`date +\%Y\%m\%d\%H\%M` 2>&1