RAC ssh 配置——官方文献

最新推荐文章于 2025-12-10 21:23:44 发布

转载最新推荐文章于 2025-12-10 21:23:44 发布 · 144 阅读

文章标签：

#运维 #数据库 #shell

本文介绍如何在集群的每个节点上配置SSH，包括创建RSA和DSA密钥、设置授权密钥文件，以及如何启用SSH用户等效性以实现无密码登录。适用于希望了解详细SSH配置步骤的读者。

2.3.7.1 Configuring SSH on Cluster Member Nodes

To configure SSH, you must first create RSA and DSA keys on each cluster node, and then copy the keys from all cluster node members into an authorized keys file on each node. To do this task, complete the following steps:

Create RSA and DSA keys on each node: Complete the following steps on each node:

Log in as the oracle user.
If necessary, create the .ssh directory in the oracle user's home directory and set the correct permissions on it:
```
$ mkdir ~/.ssh
$ chmod 700 ~/.ssh
$ chmod 700 
```
Enter the following commands to generate an RSA key for version 2 of the SSH protocol:
```
$ /usr/bin/ssh-keygen -t rsa
```
At the prompts:
- Accept the default location for the key file.
- Enter and confirm a pass phrase that is different from the oracle user's password.
This command writes the public key to the ~/.ssh/id_rsa.pub file and the private key to the ~/.ssh/id_rsa file. Never distribute the private key to anyone.
Enter the following commands to generate a DSA key for version 2 of the SSH protocol:
```
$ /usr/bin/ssh-keygen -t dsa
```
At the prompts:
- Accept the default location for the key file
- Enter and confirm a pass phrase that is different from the oracle user's password
This command writes the public key to the ~/.ssh/id_dsa.pub file and the private key to the ~/.ssh/id_dsa file. Never distribute the private key to anyone.

Add keys to an authorized key file: Complete the following steps:

On the local node, determine if you have an authorized key file (~/.ssh/authorized_keys). If the authorized key file already exists, then proceed to step 2. Otherwise, enter the following commands:
```
$ touch ~/.ssh/authorized_keys
$ cd ~/.ssh
$ ls
```
You should see the id_dsa.pub and id_rsa.pub keys that you have created.

Using SSH, copy the contents of the ~/.ssh/id_rsa.pub and ~/.ssh/id_dsa.pub files to the file ~/.ssh/authorized_keys, and provide the Oracle user password as prompted. This process is illustrated in the following syntax example with a two-node cluster, with nodes node1 and node2, where the Oracle user path is /home/oracle:

[oracle@node1 .ssh]$ ssh node1 cat /home/oracle/.ssh/id_rsa.pub >> authorized_keys
oracle@node1's password:
[oracle@node1 .ssh]$ ssh node1 cat /home/oracle/.ssh/id_dsa.pub >> authorized_keys
[oracle@node1 .ssh$ ssh node2 cat /home/oracle/.ssh/id_rsa.pub >> authorized_keys
oracle@node2's password:
[oracle@node1 .ssh$ ssh node2 cat /home/oracle/.ssh/id_dsa.pub >>authorized_keys
oracle@node2's password:

Note:

Repeat this process for each node in the cluster.

Use SCP (Secure Copy) or SFTP (Secure FTP) to copy the authorized_keys file to the Oracle user .ssh directory on a remote node. The following example is with SCP, on a node called node2, where the Oracle user path is /home/oracle:
```
[oracle@node1 .ssh]scp authorized_keys node2:/home/oracle/.ssh/
```
Repeat step 2 and 3 for each cluster node member. When you have added keys from each cluster node member to the authorized_keys file on the last node you want to have as a cluster node member, then use SCP to copy the complete authorized_keys file back to each cluster node member

Note:
The Oracle user's /.ssh/authorized_keys file on every node must contain the contents from all of the /.ssh/id_rsa.pub and /.ssh/id_dsa.pub files that you generated on all cluster nodes.
Change the permissions on the Oracle user's /.ssh/authorized_keys file on all cluster nodes:
```
$ chmod 600 ~/.ssh/authorized_keys
```
At this point, if you use ssh to log in to or run a command on another node, you are prompted for the pass phrase that you specified when you created the DSA key.

2.3.7.2 Enabling SSH User Equivalency on Cluster Member Nodes

To enable Oracle Universal Installer to use the ssh and scp commands without being prompted for a pass phrase, follow these steps:

On the system where you want to run Oracle Universal Installer, log in as the oracle user.

Enter the following commands:

$ exec /usr/bin/ssh-agent $SHELL
$ /usr/bin/ssh-add

At the prompts, enter the pass phrase for each key that you generated.
If you have configured SSH correctly, then you can now use the ssh or scp commands without being prompted for a password or a pass phrase.
If you are on a remote terminal, and the local node has only one visual (which is typical), then use the following syntax to set the DISPLAY environment variable:
Bourne, Korn, and Bash shells
```
$ export DISPLAY=hostname:0
```
C shell:
```
$ setenv DISPLAY 0
```
For example, if you are using the Bash shell, and if your hostname is node1, then enter the following command:
```
$ export DISPLAY=node1:0
```
To test the SSH configuration, enter the following commands from the same terminal session, testing the configuration of each cluster node, where nodename1, nodename2, and so on, are the names of nodes in the cluster:
```
$ ssh nodename1 date
$ ssh nodename2 date
    .
    .
    .
```