Wednesday, November 29, 2017

SSL Reverse Proxy using nginx without using Oracle Wallet

In my previous post, I mentioned that we can use stunnel to get around using https in oracle utl_http call. Today I ran into this 404 not found problem and there is no solution.

I am forced to switch to nginx. Setup was extremely easy. Most likely I am going to use nginx in the future.

With this setup, I can issue http://localhost:8103 and nginx will load balance between https://web1.remote.com:8443 and https://web2.remote.com:8443

Bonus is I don’t need to worry about oracle wallet anymore. It is a nightmare to maintain, especially internal hostname with https.

nginx.conf
worker_processes  1;
pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    keepalive_timeout 65;

upstream tomcathosts {
      server web1.remote.com:8443;
      server web2.remote.com:8443;
  }

server {
    listen 8103;
    server_name  localhost;
    location / {
        root /;
        proxy_connect_timeout       600;
        proxy_send_timeout          600;
        proxy_read_timeout          600;
        send_timeout                600;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass https://tomcathosts;
    }
  }
}

After everything is working, I use nssm to make nginx a window service.

P.S. If you don't have two upstream servers for load balancing, remove the upstream section and put the upstream server hostname directly in proxy_pass

Enable/Disable Archive Log Mode

Verify database log mode
sqlplus / as sysdba
archive log list

Non-RAC database

Enable archive log
shutdown immediate;
startup mount;
alter database archivelog;
alter database open;

Disable archive log
shutdown immediate;
startup mount;
alter database noarchivelog;
alter database open;

RAC database

Enable archive log
srvctl stop database -d orcl
srvctl start database -d orcl -o mount
 
sqlplus / as sysdba
alter database archivelog;
EXIT;

srvctl stop database -d orcl
srvctl start database -d orcl 

Disable archive log
srvctl stop database -d orcl
srvctl start database -d orcl -o mount
 
sqlplus / as sysdba
alter database noarchivelog;
EXIT;

srvctl stop database -d orcl
srvctl start database -d orcl 

Saturday, October 21, 2017

Dump windows scheduled tasks

From time to time, peoples asked me what is scheduled on the server.

Human readable format
schtasks /query /v /fo LIST
CSV
schtasks /query /v /fo CSV > tasks.csv

Friday, September 8, 2017

Increase the Size of an AWS EBS Cloud Volume Attached to a Linux Machine

  1. Stop the instance
  2. Make a snapshot of the volume that we want to increase
  3. Write down the attachment information
    Attachment information: i-f0cacda3 (PROD):/dev/sdf1 (attached)
    
  4. Detach the volume
  5. Create a new volume with larger size, pick the same zone, pick the snapshot that we create in Step #2
  6. Attach the new volume to the instance with the same attachment information (see Step #3)
  7. Start the instance
  8. ssh into the instance as usual
  9. df -h should still show the old size even we are using a larger volume
  10. Run resize2fs /dev/sdf1 to increase the size to match the larger volume
  11. Reboot (optional)

Saturday, September 2, 2017

Update ESXi Embedded Host Client

1. ssh into the ESXi host as root

2. Goto ESXi Embedded Host Client Site and copy the vib link.

3. install the vib
The time and date of this login have been sent to the system logs.

VMware offers supported, powerful system administration tools.  Please
see www.vmware.com/go/sysadmintools for details.

The ESXi Shell can be disabled by an administrative user. See the
vSphere Security documentation for more information.
[root@shuttle:~] esxcli software vib install -v http://download3.vmware.com/software/vmw-tools/esxui/esxui-signed-6360286.vib
Installation Result
Message: Operation finished successfully.
Reboot Required: false
VIBs Installed: VMware_bootbank_esx-ui_1.23.0-6360286
VIBs Removed: VMware_bootbank_esx-ui_1.8.0-4516221
VIBs Skipped: 
[root@shuttle:~]

Monday, August 28, 2017

iReport Builder and SVN keywords

In iReport Builder, there is no comment field to store SVN keywords.

As a workaround, I add a new "No Data" band, set the"print when expression" to "new Boolean (false)" and then I put a static field in the band.
REM SVN Revision Information: DO NOT REMOVE
REM $Revision: 2593 $
REM $Author: pchiu $
REM $Date: 2017-08-28 19:39:41 -0400 (Mon, 28 Aug 2017) $

This works as long as I don't need to display anything when the report is empty.

Sunday, August 27, 2017

zfs replace faulty disk

The disk already crashed. We have already pull it out and replace it with a good one. Now, we just need to fix zpool setup.

First we put the disk offline.
# zpool offline opt2 14610995796361758680
# zpool status -v opt2
  pool: opt2
 state: DEGRADED
status: One or more devices has been taken offline by the administrator.
        Sufficient replicas exist for the pool to continue functioning in a
        degraded state.
action: Online the device using 'zpool online' or replace the device with
        'zpool replace'.
  scan: scrub repaired 0 in 21h9m with 0 errors on Tue Jul 25 00:42:02 2017
config:

        NAME                      STATE     READ WRITE CKSUM
        opt2                      DEGRADED     0     0     0
          raidz1-0                DEGRADED     0     0     0
            da3                   ONLINE       0     0     0
            da4                   ONLINE       0     0     0
            14610995796361758680  OFFLINE      0     0     0  was /dev/da5


And then we replace it with the new device
# zpool replace opt2 da5 /dev/da5
# zpool status -v opt2
  pool: opt2
 state: DEGRADED
status: One or more devices is currently being resilvered.  The pool will
        continue to function, possibly in a degraded state.
action: Wait for the resilver to complete.
  scan: resilver in progress since Sun Aug 27 11:21:53 2017
        28.5G scanned out of 4.77T at 96.7M/s, 14h18m to go
        9.50G resilvered, 0.58% done
config:

        NAME                        STATE     READ WRITE CKSUM
        opt2                        DEGRADED     0     0     0
          raidz1-0                  DEGRADED     0     0     0
            da3                     ONLINE       0     0     0
            da4                     ONLINE       0     0     0
            replacing-2             OFFLINE      0     0     0
              14610995796361758680  OFFLINE      0     0     0  was /dev/da5/old
              da5                   ONLINE       0     0     0  (resilvering)

errors: No known data errors

Thursday, July 13, 2017

How to get A+ on SSL Labs running Tomcat

In my previous posting, we brought our tomcat server to Grade A on SSL Labs.
However, to archive A+, it requires more.

You need to enable HSTS. You can following this post to enable HSTS.

One problem I encountered with SSL Labs is the SNI. If we run the test under the default domain, HSTS test works. But if we run it under other domains, HSTS test will fail. So you end up with Grade A instead of A+.

So make sure you test it using your default domain.

Monday, July 3, 2017

ORDS Install/Upgrade (ORDS Versions 3.0 to 21.4)

Install

If your ords directory is e:\ords, use e:\ below. Do not include \ords

Stop Tomat
copy ords.war apex.war
rmdir $CATALINA_HOME/webapps/apex
copy apex.war $CATALINA_HOME/webapps/
java -jar apex.war configdir e:\
java -jar apex.war

Validate ORDS installation
java -jar apex.war validate

Run this if validation fails
java -jar apex.war schema

Configure Multiple Databases
Do not use workspace-id when adding APEX
java -jar apex.war setup --database dev
java -jar apex.war map-url --type base-path /dev dev
Start Tomcat


Upgrade


Stop Tomat
copy ords.war apex.war
rmdir $CATALINA_HOME/webapps/apex
copy apex.war $CATALINA_HOME/webapps/
java -jar apex.war configdir e:\
java -jar apex.war schema
Start Tomcat

Saturday, July 1, 2017

SSL Reverse Proxy using stunnel without using Oracle Wallet

EDIT: Using nginx is a better solution.

Making https call from oracle is a nightmare. As a minimum, you need to import the site certificate into Oracle wallet.

However, if there is any problem with the certificate, it is next to impossible to debug.
Oracle XE doesn't come with Oracle wallet, utl_http may not support SNI, all depends on the oracle database version, etc...

As a workaround, use stunnel to listen on localhost and let it talk to the remote site via https.

In this example, it is listening on 8103 protocol http and talk to remote site via 8443 protocol https.
doing http://127.0.0.1:8103 just like https://web1.remote.com:8443

stunnel.conf
[web1]
client = yes
accept = 127.0.0.1:8103
connect = web1.remote.com:8443
CAfile = ca-certs.pem

Friday, June 23, 2017

Oracle APEX dynamic style base on domain name

Add a new process with the following PL/SQL code to the login page Before Header Section.

Pre-Rendering->Before Header->Processes

DECLARE
  v_http_host varchar2(1000);
BEGIN 
  v_http_host := lower(owa_util.get_cgi_env('HTTP_HOST'));

  if v_http_host = 'domain1.com' or v_http_host like '%.domain1.com' then
    apex_theme.set_session_style(p_theme_number=> 242, p_name => 'my_style1');
  elsif v_http_host = 'domain2.com' or v_http_host like '%.domain2.com' then
    apex_theme.set_session_style(p_theme_number=> 242, p_name => 'my_style2');
  else 
    apex_theme.set_session_style(p_theme_number=> 242, p_name => 'my_style1');
  end if;
END;