What is Network Path Analyzer?

Network Path Analyzer is a network reachability analysis tool based on real-time network configuration. Its primary data input is the network routing and security configuration in a customer tenancy, augmented with key network runtime state data, such as the status of a load balancer backend set or the state of a FastConnect virtual circuit.

Network Path Analyzer answers the following questions that are essential for the cloud network operations team to obtain an accurate and deep understanding of endpoint reachability in their cloud networks:

• If they can’t, why? What is missing?
• If they can, how? Over which routing paths, using which security policies?

Finding the answers to these questions in a complex network can be labor-intensive and time-consuming. It involves analyzing the virtual network topologies, carefully walking through multiple route tables, and scrutinizing different network security groups (NSGs) or security lists along the multi-hop network paths. If done manually, it can be error-prone.

Network Path Analyzer is a great network troubleshooting tool. Additionally, since it doesn’t use or need any traffic along the network paths because it operates solely on the configuration and runtime state data, it is also an effective tool for proactive configuration validation.

Benefits of Network Path Analyzer

Armed with Network Path Analyzer, you can realize the following benefits:

• Troubleshoot reachability issues caused by misconfiguration much faster, significantly reducing the Mean Time to Resolution (MTTR) for this type of outage
• Proactively verify and validate the network routing and security policy configuration for your reachability intents before even starting to send application traffic.
• A tool to perform on-demand validation of the logical network paths to match your intent

How to use Network Path Analyzer

Network Path Analyzer is directly available under Networking on the Oracle Cloud Console. You only need to create a path analysis and run it. An API is available to programmatically create, manage, and run your path analyses.

When creating a path analysis, specify the source and destination endpoints, the network protocol, and the source and the destination ports. For endpoints, you can select an IP address or an OCI resource. The viable OCI resource options include an IP address from a VCN subnet, a compute instance virtual network interface card (VNIC), an application load balancer, or a network load balancer.

In my simulation, I am checking bi-directional communication between 2 compute instances.

Select the “Network Path Analyzer” option in the Network Command Center

Click “Create Path Analysis”

Now fill in the Source and Destination information.

In my case I am testing communication between 2 compute instances (VM) via port 22 (SSH).

After filling in the information, perform the analysis.

After a few minutes, a communication report will be displayed where you can identify if it is working or if there is some type of problem.

Network Path Analyzer can assist with your troubleshooting process for the following reachability-related scenarios:

• Virtual machines (VMs) in your multi-VCN applications can’t communicate with each other. You want to check the configured path.
• Your frontend web server in a multitier application can’t reach the load balancer VIP of the application tier.
• Your load balancer can’t reach some of the backends.
• An on-premises endpoint in your hybrid cloud application can’t reach an OCI instance.
• Your on-premises site can’t access a cloud application hosted by your Oracle instances.

Network Path Analyzer is a tool to assist in troubleshooting reachability issues by quickly identifying misconfiguration and reducing the MTTR caused by configuration issues. It’s also an effective tool for customers to proactively verify their network configuration against their reachability intents so that they can proactively catch and correct misconfiguration and reduce outages.

I hope this article can help you

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

Object Storage is a regional cloud service. Buckets are logical containers created in a tenancy inside a region in which customer data is stored as objects.

You can store a copy of all objects from one bucket in another bucket located inside a different region for redundancy. This copy can help you recover from a disaster that could affect an entire cloud region. Cross-region object replication provides protection from a regional outage.

Configure the IAM policies

1. Log in to the OCI console and click Identity, and then click Policies.
2. Create a new policy and add the following statements:

Allow group 'OracleIdentityCloudService'/'OCI_Administrators' to manage buckets in tenancy	
Allow group 'OracleIdentityCloudService'/'OCI_Administrators' to manage objects in tenancy	
Allow service objectstorage-us-ashburn-1 to manage object-family in tenancy	
Allow service objectstorage-us-chicago-1 to manage object-family in tenancy

Configure Object Storage cross-region replication

1. Go to the source bucket and click Create Policy as shown in the following image.

Note: The destination bucket “Replication_Blog” has to be created in the destination region us-chicago before setting up replication. Setup replication policy on source bucket by selecting the destination region and bucket to replicate to and then click Create.

Select the Destination Region and Destination Bucket for replicating objects and click Create.

In the Bucket Information tab, the Replication field displays Enabled for the source bucket in US East (Ashburn) region.

In the US Midwest (Chicago) region, go to the Bucket Information tab and verify if the Replication is Enabled on the destination bucket as well :

Navigate to the destination region and bucket and confirm that the objects uploaded to the source bucket have been replicated in the destination bucket in US Midwest (Chicago) region. 

I hope this article can help you

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

The Oracle Database Security Assessment Tool (DBSAT), currently in version 3.1.0 (January 2024), is a command-line tool focused on detecting potential security vulnerabilities. Its greatest scope occurs within the database but it also inspects operating system and network components (listener) in search of failures.

The tool provides insight into the current status of users, roles, permissions, and security control policies to promote successful approaches to mitigating potential security risks.

What’s new in DBSAT 3.0 ?

New checks added in DBSAT 3.0 include the newly introduced Oracle Database 23c SQL Firewall, auditing-related issues, sensitive data and transparent sensitive data protection, and a wealth of other checks necessary for any security-conscious organization. Remarks and recommendations are updated to make them clearer and actionable.

Desupport notices list database features and parameters that are reaching or have reached their end-of-life so you can take proactive measures to phase out their usage. DBSAT Discoverer also added support for India’s permanent account number (PAN) and the unique identification (Aadhaar) number.

From its beginning, DBSAT offered a distillation of decades of security experience, checking configuration issues that might introduce unnecessary risk. Until now, DBSAT clearly identified checks that were related to security frameworks like the DISA STIGs, Center for Internet Security (CIS) benchmarks, or data privacy regulations like GDPR. However, no checks clearly indicated that they were Oracle best practices. DBSAT 3.0 fixes that issue: Findings that are Oracle best practices are now clearly identified.

When is DBSAT not enough?

DBSAT is a simple standalone tool that helps assess the security configuration of a single Oracle Database. What if you want to automate assessments across your fleet, track deviations from approved baselines, get alerts, keep history, and compare all in one interface? Use Oracle Data Safe or Oracle Audit Vault and Database Firewall to go the extra mile in assessments.

The DBSAT is made up of two components:

DBSAT Collector: Responsible for executing SQL queries and operating system commands that collect the data to be evaluated. The data is stored in a file that is later used by DBSAT Reporter in the analysis phase.

DBSAT Reporter: Responsible for analyzing the collected data and generating reports of findings and recommendations in files of multiple formats such as HTML, Excel and Text.

Reference: https://docs.oracle.com/en/database/oracle/security-assessment-tool/3.0.0/satug/index.html#GUID-999F5696-F368-4E54-86DB-DEFC593B2042

The main benefits of using DBSAT are:

• Quick identification of database security configuration errors;
• Recommendations based on best security practices;
• Reduction of the amplitude of an attack and exposure to risk.

DBSTAT works on Oracle database 11.2.0.4 and later versions including multitenant and cloud environments. The supported platforms are:

Oracle DBSAT runs on:

• Solaris x64 and Solaris SPARC64
• Linux x86-64 and Linux 64-bit Arm
• Windows x64
• HP-UX IA (64-bit)
• IBM AIX (64-bit) and Linux on zSeries (64-bit)

Its use is very simple and consists of downloading the MOS file (My Oracle Support – Doc ID 2138254.1), unzipping it, and running the script to collect and report security vulnerabilities. DBSAT is a lightweight utility that does not hamper system performance while running.

Running DBSAT Collector:

For DBSTAT to collect all the data and perform a complete validation, it must be executed from the database server, as some operating system commands are executed to collect data that cannot be obtained from the database. DBSTAT must also be run with an operating system user that has read permission on ORACLE_HOME files and directories for data to be collected and processed properly.

Collections in the database are carried out mainly on data dictionary views, so the user that will be provided in the connection string to the database must have sufficient permissions to select data from these views.

Collector Prerequisites

To gather all necessary data, run the Oracle DBSAT Collector on the database server. The collector uses operating system commands to gather process and file system information that the database alone cannot provide. Besides, the Oracle DBSAT Collector must be run as an OS user with read permissions on files and directories under ORACLE_HOME using SQL*Plus (through Oracle Database or Instant Client) to collect and process file system data using OS commands.

The Oracle DBSAT Collector collects most of its data by querying database views. It must connect to the database as a user with sufficient privileges to select from these views. Grant the DBSAT user the following privileges:

• CREATE SESSION
• READ or SELECT on SYS.REGISTRY$HISTORY
• Role SELECT_CATALOG_ROLE
• Role DV_SECANALYST (if Database Vault is enabled or if Database Vault Operations Control is enabled)
• Role AUDIT_VIEWER (12c and later)
• Role CAPTURE_ADMIN (12c and later)
• READ or SELECT on SYS.DBA_USERS_WITH_DEFPWD
• READ on SYS.DBA_AUDIT_MGMT_CONFIG_PARAMS
• READ on SYS.DBA_CREDENTIALS
• EXECUTE on SYS.DBMS_SQL

Syntax for running the DBSAT Collector:

$ dbsat collect <database_connect_string> <output_file>

[oracle@oracle-db-lab dbsat]$  ./dbsat collect "c##test1/test#123" /home/oracle/dbsat/collect/output_ORCL

Database Security Assessment Tool version 3.1 (Jan 2024)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Connecting to the target Oracle database...


SQL*Plus: Release 19.0.0.0.0 - Production on Fri Jan 19 23:52:20 2024
Version 19.19.0.0.0

Copyright (c) 1982, 2023, Oracle.  All rights reserved.


Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.19.0.0.0

Setup complete.
SQL queries complete.
OS commands complete.
Disconnected from Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.19.0.0.0
DBSAT Collector completed successfully.

Calling /u01/app/oracle/product/19.0.0/dbhome_1/bin/zip to encrypt output_ORCL.json...

Enter password:
Verify password:
  adding: output_ORCL.json (deflated 86%)
zip completed successfully.
[oracle@oracle-db-lab dbsat]

By default, the file will be generated and compressed with a password. However, we can omit the need to enter a password by adding the -n parameter in the best collect call. However, considering information security, this is not recommended.

Running DBSAT Reporter:

The prerequisite for DBSAT Reporter is that Python 2.6 or higher is installed on the server where the report will be generated. By default it is already installed in most UNIX environments.

To confirm the existence and version of Python run:

python -V 

Syntax for running the DBSAT Report:

dbsat report [-a] [-n] [-x <section>] <input_file>

The Reporter supports the following command-line options:

• -a

Runs the reports for all the database accounts.

• -n

Specifies no encryption for output.

• -g

Shows all grants including common grants in a pluggable database.

• -x

Excludes a section from the report.

Valid sections are:

• USER : User Accounts
• PRIV : Privileges and Roles
• AUTH : Authorization Control
• CRYPT : Encryption
• ACCESS :Fine-Grained Access Control
• AUDIT : Auditing
• CONF : Database Configuration
• NET : Network Configuration
• OS : Operating System

To exclude multiple sections use a comma-separated list, for example:

-x USER,PRIV

Or:

-x USER -x PRIV

Omitting this option will include all sections of the report.

The same path name is used to generate the report files produced by the Reporter in HTML, Excel, JSON, and Text formats with the appropriate file extensions.

Run the Reporter.

[oracle@oracle-lab dbsat]$ export JAVA_HOME=/u01/app/oracle/product/21.0.0/dbhome_1/jdk
[oracle@oracle-lab dbsat]$ export PATH=$JAVA_HOME/bin:$PATH
[oracle@oracle-lab dbsat]$ ./dbsat report -n output_ORCL

Database Security Assessment Tool version 3.1 (Jan 2024)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

DBSAT Reporter ran successfully.

[oracle@oracle-lab dbsat]$

DBSAT Reports:

DBSAT produces output in various formats for various audiences and purposes. An HTML report, for example, provides detailed results in an easy-to-navigate format using links while a Spreadsheet report provides a high-level summary of each finding, as well as allowing you to manipulate columns by adding new ones for your purposes and prioritization.

Example of a DBSAT summary in HTML:

1. Rule title and unique ID:

The ID has two parts: the prefix identifies the report section and the suffix identifies the specific rule.

2. Status:

Status can be used to define the prioritization of indicators, where a high-risk finding requires immediate action while a low-risk finding can be scheduled and adjusted with less priority.

• Pass: No errors or risks identified;
• Evaluate: It is necessary to carry out a manual analysis to identify the degree of risk;
• Some Risk: Low risk;
• Significant Risk: Medium rich;
• Severe Risk: High security risk;
• Opportunity: Additional opportunities to improve security using additional technologies.

3. Summary:

Discovery summary.

4. Details:

Provides detailed information to explain the discovery.

5. Remarks:

Explains the standard used to evaluate the results found. It can also explain recommended actions for remediation if a risk is reported.

6. References:

Lists the discovery based on the CIS Oracle Database Benchmark, DISA STIGs, Oracle Best Practices.

I hope this article helps you.  

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

First, you need access to an OCI environment. When you have an environment, ensure your user has been assigned to a group with permission to manage the email-family resources.

It would be best if you had a DNS domain to publish your domain keys identified mail (DKIM) and sender policy framework (SPF) records.

1. Generate SMTP credentials

SMTP credentials are necessary to send email through Email Delivery.  Remember that each user is limited to a maximum of two SMTP credentials.

Log into the Oracle Cloud Console and navigate to Identity >> Domains >> OracleIdentityCloudService domain >> Users.

Click on SMTP Credentials and click on Generate credentials.

Fill out the description and Click on “Generate Credentials.”

Copy the username and password. You can’t retrieve the password after closing the dialog box for security reasons.

2. Create your email domain.

An email domain lets you set up essential authentication measures for sending emails. Under Developer Services, select Application Integration and Email Delivery.

Click Email Domains and create a domain. If setting up DKIM and SPF, choose a DNS domain that you own or control and plan to use for the sending email address.

Click on “Create Email Domain.”

3. Set up DKIM

DKIM is an email authentication technique that allows the receiver to verify the owner of an email domain. It gives the email a digital signature and a header field containing all the signature and key-fetching data. So, implementing DKIM improves email deliverability and can protect your domain against malicious emails sent on behalf of your domain.

Click on “Add DKIM”

Fill out the DKIM Selector after clicking on Generate DKIM Record and click on “Create DKIM.”

We now need to configure our DNS domain. Go to your zone and create the CNAME record with the value it gives you.

If done correctly, your DKIM signing status changes to Active. Depending on the update type, updates to your DNS records can take up to 24 hours to propagate globally.

After DNS propagation, active DKIM will appear.

Tip: Rotate your DKIM keys at least every six months. This reduces the risk of active keys being compromised, either by attackers cracking or stealing them.

4. Create an approved sender

You need an approved sender for all “From” addresses sending mail through OCI. Otherwise, mail is rejected. Every sender’s email address must be registered to use it for Email Delivery.

Important note the following details about approved senders:

• An approved sender is associated with a compartment and only exists in the region where it was configured. If you create an approved sender in the US West (Phoenix) region, you can’t send email through the US East (Ashburn) region with that sender.
• Using multiple addresses in the email “From:” header is discouraged because it increases the possibility that your mail is placed in a spam folder or discarded.
• Approved senders are unique to tenancies. The service returns a 409 Conflict error if you create a duplicate sender.

Under DKIM, you can see Approved Senders. Create one.

Click on “Create Approved Sender”

Fill out the email address that you will use as the Approved sender. After that, click on “Create Approved Sender.”

5. Configure SPF on your approved sender domain

The SPF allows you to state which email servers are permitted to send email on behalf of your domain. Email receivers use SPF to detect email spoofing.  Without SPF, a spam or phishing email can be spoofed to appear to be from a legitimate domain.

Navigate to your approved sender. Under the three-dot menu, select View SPF.

Choose your sending location and create a DNS TXT record with the corresponding value. I’m using All commercial regions.

It can take some time, but your domain now shows DKIM Signing and SPF working.

6. Configure the SMTP connection

Navigate to Configuration to access SMTP sending information to configure the connection in your system.

The following information is displayed:

• Public endpoint: The public endpoint used to send email to this region
• SMTP ports: The SMTP ports used to accept email. Email Delivery supports TLS on port 25 or 587 (recommended).
• Security: Indicates if TLS is being used. Customers must encrypt email while in transit to Email Delivery.

7. Send mail

Now that our email domain is set up and secured, we can begin sending mail! You can use your own SMTP library or product, such as Postfix. I’m using Postfix to integrate with Email Delivery.

Install Postfix

 Run the command: yum install postfix -y

[root@vm-blog ~]# yum install postfix -y
Last metadata expiration check: 2:30:40 ago on Tue 09 Jan 2024 08:31:43 PM GMT.
Package postfix-2:3.5.8-7.el8.aarch64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[root@vm-blog ~]#

Start Postfix and make it running upon reboot.

Run the command:  service postfix start

[root@vm-blog ~]# service postfix start
Redirecting to /bin/systemctl start postfix.service
[root@vm-blog ~]#


chkconfig postfix on

[root@vm-blog ~]# chkconfig postfix on
Note: Forwarding request to 'systemctl enable postfix.service'.
[root@vm-blog ~]#

Edit the main.cf and add the endpoint in the end of the file

[root@vm-blog ~]# vi /etc/postfix/main.cf

### SMTP - RELAY
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
relayhost = smtp.email.us-ashburn-1.oci.oraclecloud.com:587

Create the sasl_passwd file in the same directory of main.cf.

vi /etc/postfix/sasl_passwd

The file contains this format:

smtp.email.us-ashburn-1.oci.oraclecloud.com:587 user:password*

*The user and password will be the SMTP credentials been generated in the first step.

Change the owner and permission of the sasl_passwd

[root@vm-blog ~]# chown root:root /etc/postfix/sasl_passwd
[root@vm-blog ~]# chmod 600 /etc/postfix/sasl_passwd

Generate the password hash and reload the postfix

[root@vm-blog ~]# postmap hash:/etc/postfix/sasl_passwd
[root@vm-blog ~]# postfix reload
postfix/postfix-script: refreshing the Postfix mail system
[root@vm-blog ~]#

Send the test email.  This require installing mailx package to validate.

Run the command:  yum install mailx -y

[root@vm-blog ~]# yum install mailx -y
Last metadata expiration check: 2:49:02 ago on Tue 09 Jan 2024 08:31:43 PM GMT.
Dependencies resolved.
======================================================================================================================================================================================================
 Package                                   Architecture                                Version                                            Repository                                             Size
======================================================================================================================================================================================================
Installing:
 mailx                                     aarch64                                     12.5-29.el8                                        ol8_baseos_latest                                     246 k

Transaction Summary
======================================================================================================================================================================================================
Install  1 Package

Total download size: 246 k
Installed size: 493 k
Downloading Packages:
mailx-12.5-29.el8.aarch64.rpm                                                                                                                                         6.0 MB/s | 246 kB     00:00
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                                 5.6 MB/s | 246 kB     00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                                                                              1/1
  Installing       : mailx-12.5-29.el8.aarch64                                                                                                                                                    1/1
  Running scriptlet: mailx-12.5-29.el8.aarch64                                                                                                                                                    1/1
  Verifying        : mailx-12.5-29.el8.aarch64                                                                                                                                                    1/1

Installed:
  mailx-12.5-29.el8.aarch64

Complete!
[root@vm-blog ~]#

Now, send the email to validate.

Run this command:

echo "This a test message from DBADUTRA BLOG" | mail -s "Validation DKIM, SPF, Email Delivery - OCI" -r <approved sender email address> <recipient email address>

Validate that you received the email

Check on Dashboard

Remember the first 3.100 emails sent are free. After this, you pay $0.085 per 1000 emails Sent.

I hope this article can help you; it is a reliable, robust, low-cost solution for high-volume email sending. Remember that all the resources used for this article are always free.

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

Começamos criando uma compute instance no OCI em uma sub-rede Virtual Cloud Network (VCN) onde temos acesso SSH, seja via Internet Gateway ou um canal privado. Esta VCN deve ter um Gateway de Serviço que permitirá acesso privado à Oracle Services Network para fins de acesso ao Object Storage. Estou usando o Oracle Linux 8 em ARM de baixo custo para minha implantação. Você pode alterar o formato dependendo das necessidades desejadas.

Ja fiz um artigo sobre isso “Criando um Compute Instance”

Crie o bucket que vamos usar para armazenar nossos dados. Deve ser do tipo Armazenamento padrão. Certifique-se de que esteja definido como privado, a menos que você queira armazenar também os dados de outras pessoas.

Precismos usar Grupos Dinâmicos para atribuir à nossa instância um Instance Principal e, em seguida, escrever políticas para permitir que ela funcione com nosso novo bucket.

Criando um Dynamic Group

Criamos um grupo dinâmico para vincular políticas à nossa instância. Neste exemplo, estamos usando apenas uma instância, portanto identificamos essa instância pelo OCID.

A seguir, vamos vincular nosso Dynamic Group a um conjunto de permissões usando uma Política.

Criando uma Politica para acesso ao Object Storage.

É aqui que atribuímos permissões aos membros do Dynamic Group que acabamos de criar. Criaremos uma política com uma instrução que permite que a instância que executa o backup interaja com o bucket específico que queremos montar.

Temos tudo setado para que possamos fazer a instalação no Linux e configurar a ferramenta rclone para que possamos ter acesso ao Object Storage.

Instalando pacotes e arquivo de configuração.

Faremos SSH em nossa instância usando o usuário opc com acesso sudo. A partir daí, instalaremos o rclone e o fuse:

[opc@vm-blog var]$ sudo yum-config-manager --enable ol8_developer && sudo yum install -y rclone fuse fuse3
Oracle Linux 8 Development Packages (aarch64)                                                                                                                         134 MB/s | 108 MB     00:00
Last metadata expiration check: 0:00:31 ago on Wed 13 Dec 2023 09:18:37 PM GMT.
Package fuse3-3.3.0-17.0.1.el8.aarch64 is already installed.
Dependencies resolved.
======================================================================================================================================================================================================
 Package                                   Architecture                               Version                                              Repository                                            Size
======================================================================================================================================================================================================
Installing:
 fuse                                      aarch64                                    2.9.7-17.0.1.el8                                     ol8_baseos_latest                                     81 k
 rclone                                    aarch64                                    1.65.0-1.0.1.el8                                     ol8_developer                                         19 M

Transaction Summary
======================================================================================================================================================================================================
Install  2 Packages

Total download size: 19 M
Installed size: 76 M
Downloading Packages:
(1/2): fuse-2.9.7-17.0.1.el8.aarch64.rpm                                                                                                                              2.3 MB/s |  81 kB     00:00
(2/2): rclone-1.65.0-1.0.1.el8.aarch64.rpm                                                                                                                             95 MB/s |  19 MB     00:00
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                                  94 MB/s |  19 MB     00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                                                                              1/1
  Installing       : rclone-1.65.0-1.0.1.el8.aarch64                                                                                                                                              1/2
  Installing       : fuse-2.9.7-17.0.1.el8.aarch64                                                                                                                                                2/2
  Running scriptlet: fuse-2.9.7-17.0.1.el8.aarch64                                                                                                                                                2/2
  Verifying        : fuse-2.9.7-17.0.1.el8.aarch64                                                                                                                                                1/2
  Verifying        : rclone-1.65.0-1.0.1.el8.aarch64                                                                                                                                              2/2

Installed:
  fuse-2.9.7-17.0.1.el8.aarch64                                                                    rclone-1.65.0-1.0.1.el8.aarch64

Complete!
[opc@vm-blog var]$

A seguir, criaremos um link simbolico para o diretorio /usr/bin directory:

[opc@vm-blog var]$ sudo ln -s /usr/bin/rclone /sbin/mount.rclone
[opc@vm-blog var]$

Crie um diretório para rclone em /etc/rclone e use o editor de sua preferência para criar um /etc/rclone/rclone.conf

Teste da instalação

A execução dos seguintes comandos montará o sistema de arquivos remoto (Object Storage):

sudo mkdir -p /backup

Depois que nosso local de montagem for criado:

[root@vm-blog rclone]# sudo rclone mount \
>     backup:blog_backup /backup\
>     --allow-other \
>     --cache-dir /tmp/rclone/cache \
>     --config /etc/rclone/rclone.conf \
>     --dir-perms 0770 \
>     --file-perms 0660 \
>     --log-file /var/log/rclone.log \
>     --log-level ERROR \
>     --tpslimit 50  \
>     --umask 0117 \
>     --vfs-cache-mode writes \
>     --vfs-fast-fingerprint &
[1] 73993

A seguir, vamos montar o storage editando nosso /etc/fstab (ponto de monagem deve ser um diretório existente):

backup:blog_backup /backup rclone rw,umask=0117,nofail,_netdev,args2env,config=/etc/rclone/rclone.conf,uid=1000,gid=1000,file_perms=0760,dir_perms=0770,allow_other,vfs_cache_mode=writes,cache_dir=/tmp/rclone/cache 0 0

Depois que seu fstab for editado:

[root@vm-blog /]# sudo mount -av
/                        : ignored
/boot                    : already mounted
/boot/efi                : already mounted
/var/oled                : already mounted
/dev/shm                 : already mounted
none                     : ignored
/backup                  : already mounted
[root@vm-blog /]#

Para este teste configurei o diretório de backup padrão para banco de dados e servidor Web no Object Storage.

Podemos ver aqui que os backups foram gerados no /backup.

Aqui podemos confirmar que os objetos estão no bucket e sincronizados com o arquivos que foram gerados no servidor pelo backup.

Espero que este artigo possa te auxiliar em uma solução simples e sincronizada para seus backups, lembrando que todos os recursos utilizados para este artigos são Always Free.

Te vejo em um próximo artigo.

Até a próxima.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

Recebi esta mensagem na console:

Me fez lembrar do ORA-0600, mas vamos lá do que se trata este erro.

A VM ou Compute Instance, envia uma solicitação de protocolo de resolução de endereço (ARP) para a placa de interface de rede virtual (VNIC) da instância. Se o ARP falhar, a máquina virtual (VM) será marcada como sem resposta e a mensagem de erro aparecerá.

Diante disso qual seria as possiveis soluções para analisar e arrumar isso:

Verifique as métricas de integridade da infraestrutura para determinar se há um problema contínuo de infraestrutura. Se houver um problema contínuo de infraestrutura, aguarde até que os engenheiros da OCI resolvam o problema e verifique novamente a métrica instance_accessibility_status.

Se não houver um problema contínuo de infraestrutura, provavelmente há um problema de software ou configuração incorreta de rede que você mesmo deve resolver. Confirme se o sistema operacional e a rede estão configurados corretamente. Consulte as documentações sobre Troubleshooting Compute Instance e Network.

Se as etapas de solução de problemas de computação e rede não forem bem-sucedidas, você poderá usar a reinicialização de diagnóstico para reconstruir a instância inacessível, mas recomendo abrir um chamado para o time de OCI para analise e validação antes de utilizar este recurso.

Espero que isso possa te ajuda em algum momento.

Até a próxima.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

1. Stop the instance that you can’t log in to. 

Stop the instance that you can’t connect to. In the Oracle Cloud Infrastructure Console, go to the details page for the instance and click Stop.

2. Detach the boot volume.

Detach the boot volume. In the Boot Volume section, click the Actions icon and choose Detach. 

3. Attach the boot volume to a running Linux instance.

Attach the boot volume to another Linux instance by going to Block Storage >> Boot Volumes >> Boot Volumes Details.  Click  Attach to Instance in Attached Instances. 

Select the iSCSI, Select Instance and click in Attach

Run the iSCSI commands to attach the device and make it visible to the local operating system.

Your boot-volume should appear as /dev/sdb3.

4. Fix the authorized_keys file.

Make /dev/sdb3, which is the root (/) partition where you can recover the opc SSH key file, available to the local operating system using “mount” command.

sudo mount  /dev/sdb3 /mnt

5. Fix the opc SSH key by editing the /mnt/home/opc/.ssh/authorized_keys file and adding your SSH key public file.

sudo vi /mnt/home/opc/.ssh/authorized_keys

After you add or change the SSH public key you need to use, save, and exit it.

6. Run umount /mnt.

sudo umount /mnt

7. Detach the iSCSI boot volume by running the detach iSCSI commands.

Unmount the device and detach it by running the iSCSI commands

Ensure that the /dev/sdb disk is no longer available or visible through the SSH connection, and then detach it.

Click in Continue Detachment

Click in Detach

8. Reattach the boot volume to the instance where you wanted to recover the SSH key, wait for it to become operational.

Click in Attach Boot Volume

After the boot volume is attached, start the Compute Instance.

See you soon in other articles.

Stay tuned by following us on Twitter @aontalba and Linkedin.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.”

Benefits of Site-to-Site VPN over FastConnect

The added functionality of Site-to-Site VPN over FastConnect offers the following features and benefits:

• Combined benefits of FastConnect and IPsec: With Site-to-Site VPN over FastConnect, you can take advantage of the benefits of dedicated connectivity provided to you by FastConnect while encrypting your traffic with industry standard IPsec. FastConnect offers a dedicated, private, high bandwidth circuit with consistent and predictable network performance, and Site-to-Site VPN provides data confidentiality, integrity, and authentication for your traffic. Combining the two into a single solution allows you to maintain high-performance connectivity between dependent applications in the cloud with no re-architecture.

• FastConnect partner virtual circuits: FastConnect partners offer optimal performance and connectivity costs savings along with on-demand provisioning. With Site-to-Site VPN over FastConnect, customers who prefer to use FastConnect partners now have an OCI-native encryption solution for both Layer 2 and Layer 3 partner virtual circuits.

• Flexibility: Enable IPsec encryption for any existing or new FastConnect private peering virtual circuits. Configure one or more tunnels over the same virtual circuit and utilize the granular routing policy control offered by the enhanced DRG to control how traffic is routed over these tunnels or unencrypted over the same virtual circuit.
• OCI-managed service: Before the release of Site-to-Site VPN over FastConnect, if you needed IPsec encryption over FastConnect, you were required to either manage a third-party network virtual appliance to terminate IPsec VPN tunnels in your virtual cloud network (VCN) or by combining the two services manually using FastConnect public peering to reach the OCI Site-to-Site VPN public IP endpoint. Now, you can gain all the benefits of a Site-to-Site VPN managed service over FastConnect with simple to use provisioning through the Oracle Cloud Console, API, CLI, and Terraform.

• Compliance: Encrypt your OCI traffic to help address regulatory compliance objectives, such as FIPS, HIPAA, or PCI. Adhere to internal best practice configuration standards with flexibility in tunnel provisioning allowing for network segmentation of traffic to reduce your attack surface area.

Next article, I will demonstrate how we configure FastConnect with IPSec.

See you soon in other articles.

Stay tuned by following us on Twitter @aontalba and Linkedin.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.”

No inicio do dia 2 tive 2 sessões da minha empresa sobre Migration of a Fortune 50 Banking Client to a Multicloud Environment with OCI e Complex, Cross Platform Oracle Database and Applications Migration to OCI onde demonstramos nossos projetos que estamos trabalhando no dia a dia com nossos clientes sendo migrados para OCI.

Após estas palestras tivemos o Keynote do Building the More Intelligent Future of Cloud com Clay Magouyrk – EVP, Oracle Cloud Infrastructure, Oracle.

Onde ele demonstrou como podemos utilizar os produtos da Oracle de uma forma mais inteligente com toda automação e IA com produtos Oracle, assim como o poder de processamento da NVIDA e Ampere.

Após esta palestra foi tempo de dar uma respirada, almoçar e encontrar amigos durante o evento

Após esta merecida pausa, foi para o restante do dia de palestras onde pude ver as novidadaes do AHF com Oracle AHF Insights 23c: Deeper Diagnostic Insights for Your Oracle Database.

Sadesh Rao como sempre apresentando uma excelente palestra sobre as novidades deste incrivel produto para auxilia no monitoramento dos ambientes Exadata, RAC.

Após esta incrivel palestra assisti outra grande palestra Oracle Database 23c Single Server Rolling Database Maintenance Tips and Tricks com Markus Michalewicz – Vice President of Product Management, Oracle.

Onde ele demostrou o processo de Single Server Rolling Patch as novidades sobre esta feature, estarei descrevendo um artigo bem legal sobre isso logo.

No final do dia tivemos nosso anual jantar do ACE Dinner, que pudemos contar com a presença dos membros do Oracle Ace para uma confraternização.

Tivemos a presenca de Juan

Essa galera é da pesada turma muito boa e super experiente muito grato em fazer parte deste grande time.. Valeu galera !!!!

Para o fim do dia 2 tivemos a grande The CloudWorld Party com muita animação e música de alta qualidade com a banda Royal Machines.

Para o dia 3 não tenho muitas fotos pois foi o dia de despedida da turma e durante o dia não participei de nenhuma sessão pois estava ajudando no Oracle ACE Lounge, com a divulgação do nosso grupo de trabalho e fazendo networking com a comunidade.

Por fim o que dizer é espero voltar em 2024 para mais um evento do Oracle Cloud Wolrd.

Espero que eu possa ter compartilhado neste 2 artigos um pouco da experiência incrível que é este evento.

Te vejo em breve em outros artigos.

Fique ligado seguindo no twitter @aontalba and Linkedin.

Disclaimer: “The postings on this site are my own and don’t necessarily represent my actual employer positions, strategies, or opinions. The information here was edited  to be useful for general purpose, specific data, and identifications was removed to allow reach a generic audience and to be useful.”

Este ano percebi a presença de mais público e o fluxo entre as sessões melhorou muito, comparado ao ano passado.

A minha primeira sessão do dia foi sobre Oracle Fusion Apps, onde a Oracle demonstrou todos os avanços do Oracle Fusion Apps com integração IA e Machine Learning em diversos aspesctos.

Cada vez mais a Oracle está fazendo integrações em todas as cadeia de produto trazendo cada vez mais facilidades para seus clientes.

Durante está apresentação o time da Oracle também mostrou uma grande novidade que está sendo disponibilizada para seus clientes, Oracle Fusion Applications Environment Management.

Onde o cliente vai pode ser a gestão do seu ambiente em um único Dashboard, com uma visibilidade através de todos serviços da Oracle, como citado gerar uma refresh do ambiente para um teste, gerenciar patchs entre outros.

Achei muito legal, pois isso traz mais facilidades para os clientes e também uma visão global do seu ambiente.

Depois desta incrivel sessão tive um tempo para tirar algumas fotos com os amigos do Oracle ACE e com o pessoal do time da Oracle Sandesh Rao e Markus Michalewicz

Tivemos mais 2 Keynotes com Safra Catz e Larry Ellison, onde na primeira Keynote Safra Catz demostrou os casos de sucesso dos grandes players migrando para OCI, como exemplo da TIM Brasil que migrou todo seu workload para Oracle e com redução de TCO e aumento de perfomance impressionates.

No Keynote do Larry Ellison, ele falou muito sobre IA, HealthCare e sobre a parceria com a Microsoft para colocar os serviços de banco de dados Oracle no OCI, como Exadata e hardware OCI relacionado, em datacenters da Microsoft.

Isso abre uma nova era como o próprio Larry Ellison disse “customers should have the freedom and flexibility to choose the services”, trazendo muito beneficios e flexibilidade para os clientes de ambos hyperscales.

Tive mais 2 palestras técnicas uma focada em Melhores práticas para projetar e operar a infraestrutura Oracle Cloud, para mim como arquiteto de soluções foi muito legal pois a Oracle recomenda um conjunto de práticas para projetar e operar topologias de nuvem que proporcionem valor para o negócio seguro e imediato.

E por fim uma grande palestra sobre Oracle GoldenGate 23c Deep Dive onde o diretor do produto Alex Lima demonstrou as novidades do Oracle GoldenGate 23c assim como o lancamento do Oracle GoldenGate 23c Free.

Para finalizar o dia como bom fã de futebol e F1 não poderia perder a oportunidade de ver a Taça da Premier League (Oficial) e o incrivel carro de F1 da Oracle Red Bull Racing

Esse é o resumo do primeiro dia e espero que eu possa ter passado um pouco desta experiência que recomendo a todos que um dia puderam participar deste grande evento.

Amanhã trago mais nóticas dos segundo dia ….

Fique ligado seguindo no twitter @aontalba and Linkedin.

Disclaimer: “The postings on this site are my own and don’t necessarily represent my actual employer positions, strategies, or opinions. The information here was edited  to be useful for general purpose, specific data, and identifications was removed to allow reach a generic audience and to be useful.”