Security - Oracle Exadata Recipes: A Problem-Solution Approach - page 351

echo "${username}:${PASSWD}" | chpasswd
chown -R ${username}:oinstall /home/${username}
echo " " >> ${LC}
echo "$username soft core unlimited" >> $LC
echo "$username soft core unlimited" >> $LC
echo "$username soft nproc 131072" >> $LC
echo "$username hard nproc 131072" >> $LC
echo "$username soft nofile 131072" >> $LC
echo "$username hard nofile 131072" >> $LC
echo "$username soft memlock 55520682" >> $LC
echo "$username hard memlock 55520682" >> $LC
(( USER_ID+=1 ))
done
You will likely need to create these operating system groups and user accounts on each Exadata Compute Node,
so use dcli with the previous scripts to run the scripts in Listing 12-1 and 12-2 on each node. Following, we will show
an example dbs_group file containing the names of each compute node in an Exadata Quarter Rack and the dcli
command to execute the scripts on both compute nodes:
[root@cm01dbm01 source]# cat dbs_group
cm01dbm01
cm01dbm02
[root@cm01dbm01 source]# dcli -g ~/dbs_group -l root -x lst12-01-setup-osgroups.sh
+ groupadd dba_prod -g 1010
+ groupadd dba_test -g 1011
... Additional groupadd output omitted
[root@cm01dbm01 source]# dcli -g ~/dbs_group -l root -x lst12-02-setup-dbausers.sh
[root@cm01dbm01 source]# dcli -g ~/dbs_group -l root grep ora /etc/passwd
cm01dbm01: oracle:x:1001:1001::/home/oracle:/bin/bash
cm01dbm01: oraprod:x:1001:1001::/home/oracle:/bin/bash
cm01dbm01: oratest:x:1001:1001::/home/oracle:/bin/bash
... Additional lines from /etc/passwd omitted
At this point, if your business requirements demand it, you can also elect to create additional Linux groups and
user accounts for non-DBA access. Many organizations require named user logins to database servers and prevent
SSH access from privileged accounts, forcing named users to sudo to the Oracle database accounts. If this matches
your security requirement, you can create a named user account or accounts for each database. In the example in
Listing 12-3, we will create three additional accounts, userprod , usertest , and userdev . You would likely want to use
dcli to propagate these accounts to your other compute nodes, as demonstrated previously.
Listing 12-3. lst12-03-setup-osusers.sh
#!/bin/bash
# Name: lst12-03-setup-osusers.sh
export PASSWD=welcome1
export USER_LIST="userprod usertest userdev"
# Set USER_ID to the next available id from /etc/passwd or an unused value
export USER_ID=3004
#
for username in 'echo $USER_LIST'
do
useradd ${username} -u ${USER_ID} -d /home/${username}