Kernel Requirements
The following are the kernel requirements for Oracle Database 11g Release 2 (11.2):
JDBC or Oracle Universal Connection Pool's (UCP) Oracle RAC features like Fast Connection Failover (FCF) subscribe to notifications from the Oracle Notification Service (ONS) running on the Oracle RAC nodes. The connections between the ONS server in the database tier and the notification client in the mid-tier are usually not authenticated. It is possible to configure and use SSL certificates to setup the authentication but the steps are not clearly documented.
The workaround is as follows:
The following are the kernel requirements for Oracle Database 11g Release 2 (11.2):
For Linux x86
- On Oracle Linux 4 and Red Hat Enterprise Linux 4
2.6.9 or later - On Asianux Server 3, Oracle Linux 5, and Red Hat Enterprise Linux 5
2.6.18 or later - On Oracle Linux 6
2.6.32.100 or later - On Asianux Server 4 and Red Hat Enterprise Linux 6
2.6.32-71 or later - On SUSE Linux Enterprise Server 10
2.6.16.21 or later - On SUSE Linux Enterprise Server 11:
2.6.27.19 or later
For Linux x86-64
- On Oracle Linux 4 and Red Hat Enterprise Linux 4
2.6.9 or later - On Oracle Linux 5 Update 2 with Red Hat Compatible Kernel
2.6.18 or later - On Oracle Linux 5 Update 5 with Red Hat Compatible Kernel
2.6.18 or later - On Oracle Linux 5 Update 5 with Unbreakable Enterprise Kernel
2.6.32-100.0.19 or later - On Oracle Linux 6
2.6.32-100.28.5.el6.x86_64 or later - On Oracle Linux 6 with Red Hat Compatible Kernel
2.6.32-71.el6.x86_64 or later - On Oracle Linux 7
3.8.13-33.el7uek.x86_64 or later - On Oracle Linux 7 with Red Hat Compatible Kernel
3.10.0-54.0.1.el7.x86_64 or later - On Red Hat Enterprise Linux 5 Update 2
2.6.18 or later - On Red Hat Enterprise Linux 5 Update 5
2.6.18 or later - On Red Hat Enterprise Linux 6
2.6.32-71.el6.x86_64 or later - On Red Hat Enterprise Linux 7
3.10.0-54.0.1.el7.x86_64 or later - On Asianux Server 3
2.6.18 or later - On Asianux Server 4
2.6.32-71.el6.x86_64 or later - On SUSE Linux Enterprise Server 10
2.6.16.21 or later - On SUSE Linux Enterprise Server 11
2.6.27.19 or later
- Configure and Use SSL Certificates to Setup Authentication
Note:
This affects the security in the connection between the Oracle Clusterware and the mid-tier or JDBC client.The workaround is as follows:
- Create an Oracle Wallet to store the SSL certificate using the
orapki
interface:
cd $ORA_CRS_HOME/opmn/conf
mkdir sslwallet
orapki wallet create -wallet sslwallet -auto_login
When prompted, provideONS_Wallet
as the password.orapki wallet add -wallet sslwallet -dn "CN=ons_test,C=US" -keysize 1024 -self_signed -validity 9999 -pwd ONS_Wallet
orapki wallet export -wallet sslwallet -dn "CN=ons_test,C=US" -cert sslwallet/cert.txt -pwd ONS_Wallet
- Copy the wallet created in Step c to all other cluster nodes at the same location.
- Stop the ONS server on all nodes in the cluster:
srvctl stop nodeapps
- Update the ONS configuration file on all nodes in the database tier to specify the location of the wallet created in Step 1:
- Open the file
ORA_CRS_HOME
/opmn/conf/ons.config
- Add the
walletfile
parameter to theons.config
file:
walletfile=
ORA_CRS_HOME
/opmn/conf/sslwallet
- Restart the ONS servers with the
srvctl
:
srvctl start nodeapps
- Open the file
- If you are running a client-side ONS daemon on the mid-tier, there are two possible configurations:
- ONS started from OPMN (like in OracleAS 10.1.3.x) which uses
opmn.xml
for its configuration. - ONS started standalone (like using
onsctl
), which usesons.config
for its configuration.
opmn.xml
file to specify the wallet location.
For case (2), refer to the section titled Configuration of ONS in Appendix B of the Oracle Database JDBC Developer's Guide. The client-side ONS daemon can potentially run of different machines. Copy the wallet created in Step 1 to those client-side machines and specify the path on that client-side machine in theons.config
file or in theopmn.xml
file. - ONS started from OPMN (like in OracleAS 10.1.3.x) which uses
- If you are running remote ONS configuration without a client-side ONS daemon, refer to the "Remote ONS Subscription" subsection of the "Configuring ONS for Fast Connection Failover" subsection of the "Using Fast Connection Failover" section of the "Fast Connection Failover" chapter in the Oracle Database JDBC Developer's Guide. Copy the wallet created in Step 1 to those client-side machines and specify the path on that client-side machine in the
ons.config
file or in theopmn.xml
file.
Alternatively, you can specify the following string as thesetONSConfiguration
argument:
propertiesfile=location_of_a_Java_properties_file
The Java properties file should contain one or more of the ONS Java properties listed below, but at least theoracle.ons.nodes
property. The values for these Java properties would be similar to those specified in the "Remote ONS Subscription" subsection previously noted in this step:
oracle.ons.nodes oracle.ons.walletfile oracle.ons.walletpassword
No comments:
Post a Comment