Upgrade Oracle Cluster failed

[Mahani]

Hi anyone,

we plan for upgrade Oracle from Oracle Release 1 to release 2. and it running on RAC. However, the process to upgrade the cluster was failed.

asking the technical person said, it is caused by:
1. ping - the suid was removed. So suspect the
suid was removed for the whole directory.

2. ssh - suspect Oracle was initially setup using telnet and not ssh. Subsequently some of the telnet related services in /etc/inetd.conf was disabled when ssh was implemented before going live. SSH trusted signon is being turned on. The telnet services disabled.

Dont understand the connection of these two with oracle cluster upgrade. Can somebody explain?

platform: HP-UX 11.23 running on RAC
Oracle10g Release 1


Thanks

Nonie

[Hein van den Heuvel]

>> process to upgrade the cluster was failed.

Please qualify!

What setp failed?
Waht worked?
Any particular, specific, error messages?
Anything from an Error log you can cut an d paste into an attachment here?
Typically to oracle OUI will point upi to a log of commands rexecuted and sutff.

Cheers,
Hein

[Mahani]

Dear Hein,

Sorry i dun have any error message to paste here. but just to understand why cluster upgrade failed because of this 2 reasons.

Would like to know if SUID should be removed for security purpose. what is the impact if let this SUID made avaiable in the server ? does Oracle need this tool?

and what is the relation between installing cluster with server runnign on trusted mode?

Thanks

Regards
Nonie

[Wim Rombauts]

Until now, I have seen no security warning about the SUID bit on /usr/sbin/ping, but of course, I don't really know for sure.

I also know that Oracle expects ssh and scp to be in /usr/local/bin. It is hardcoded in their software. I created links from taht directory to /opt/ssh/bin, and since then, my clusterware installation detects the presence of ssh and works fine. Before that link, it only worked with rsh and rcp.

[Mahani]

Hi there,

i got the log from DBA, it goes like this:

./runcluvfy is run using Oracle, it failed at user equivalence check now.

Performing post-checks for cluster services setup

Checking node reachability...

Check: Node reachability from node "camrac01"
Destination Node Reachable?
------------------------------------ ------------------------
camrac01 yes
camrac02 yes
Result: Node reachability check passed from node "camrac01".


Checking user equivalence...

Check: User equivalence for user "oracle"
Node Name Comment
------------------------------------ ------------------------
camrac02 passed
camrac01 failed
Result: User equivalence check failed for user "oracle".

WARNING:
User equivalence is not set for nodes:
camrac01
Verification will proceed with nodes:
camrac02

Checking Cluster manager integrity...


Checking CSS daemon...
Node Name Status
------------------------------------ ------------------------
camrac02 running
Result: Daemon status check passed for "CSS daemon".

Cluster manager integrity check passed.

Checking cluster integrity...

Node Name
------------------------------------
camrac01
camrac02

Cluster integrity check passed


Checking OCR integrity...

Checking the absence of a non-clustered configuration...
All nodes free of non-clustered, local-only configurations.


Checking the version of OCR...
OCR of correct Version "2" exists.

Checking data integrity of OCR...
Data integrity check for OCR passed.

OCR integrity check passed.

Checking CRS integrity...

Checking daemon liveness...

Check: Liveness for "CRS daemon"
Node Name Running
------------------------------------ ------------------------
camrac02 yes
Result: Liveness check passed for "CRS daemon".

Checking daemon liveness...

Check: Liveness for "CSS daemon"
Node Name Running
------------------------------------ ------------------------
camrac02 yes
Result: Liveness check passed for "CSS daemon".

Checking daemon liveness...

Check: Liveness for "EVM daemon"
Node Name Running
------------------------------------ ------------------------
camrac02 yes
Result: Liveness check passed for "EVM daemon".

Liveness of all the daemons
Node Name CRS daemon CSS daemon EVM daemon
------------ ------------------------ ------------------------ ----------
camrac02 yes yes yes

Checking CRS health...

Check: Health of CRS
Node Name CRS OK?
------------------------------------ ------------------------
camrac02 yes
Result: CRS health check passed.

CRS integrity check passed.

Post-check for cluster services setup was unsuccessful.
Checks did not pass for the following node(s):
camrac01


What does the equivalence check means? Any idea how to deal with this?

Thanks

-Nonie

[kevin_m]

Oracle needs the ability to SSH from one server to the other without a password. This is so the RAC nodes can communicate seamlessly. One aspect of the user equivalence check verifies if your database account has this capability. So essentially you need to configure encryption keys for the user 'oracle' so the SSH or SCP commands work properly. See Chapter 2 in the document http://download.oracle.com/docs/cd/B19306_01/install.102/b14202.pdf and specifically the SSH configuration starting on page 2-11. A good test is to 'su - oracle' on each server and run the command 'ssh date'. If you've setup the keys already and are still prompted for a password, try changing the permissions on oracle's home directory to 755.

- Kevin