Skip to content

Commit 36a6f0b

Browse files
gnsuryangnsuryan
authored
Merge pull request #4 from gnsuryan/julypatchsecurityfix-1
July 2021 Patch security fix - 1
2 parents f42b598 + 19df1f2 commit 36a6f0b

File tree

3 files changed

+176
-1
lines changed

3 files changed

+176
-1
lines changed

‎weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/setupAdminDomain.sh‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -474,6 +474,60 @@ function mountFileShare()
474474
fi
475475
}
476476

477+
#this function set the umask 027 (chmod 740) as required by WebLogic security checks
478+
function setUMaskForSecurityDir()
479+
{
480+
echo "setting umask 027 (chmod 740) for domain/admin security directory"
481+
482+
if [ -f "$DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security/boot.properties" ];
483+
then
484+
runuser -l oracle -c "chmod 740 $DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security/boot.properties"
485+
fi
486+
487+
if [ -d "$DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security" ];
488+
then
489+
runuser -l oracle -c "chmod 740 $DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security"
490+
fi
491+
492+
}
493+
494+
#this function disables remote anonymous requests as required by Weblogic security checks
495+
function disableRemoteAnonymousRequests()
496+
{
497+
echo "DisableRemoteAnonymousRequests for domain $wlsDomainName"
498+
cat <<EOF >$DOMAIN_PATH/disableAnonymousRequests.py
499+
connect('$wlsUserName','$wlsPassword','t3://$wlsAdminURL')
500+
try:
501+
edit("$wlsServerName")
502+
startEdit()
503+
cd("SecurityConfiguration/$wlsDomainName")
504+
505+
if hasattr(cmo,'setRemoteAnonymousRMIIIOPEnabled'):
506+
cmo.setRemoteAnonymousRMIIIOPEnabled(false)
507+
else:
508+
print 'no attribute: SecurityConfiguration/$wlsDomainName: cmo.setRemoteAnonymousRMIIIOPEnabled'
509+
510+
if hasattr(cmo,'setRemoteAnonymousRMIT3Enabled'):
511+
cmo.setRemoteAnonymousRMIT3Enabled(false)
512+
else:
513+
print 'no attribute: SecurityConfiguration/$wlsDomainName: setRemoteAnonymousRMIT3Enabled'
514+
515+
save()
516+
activate()
517+
except Exception,e:
518+
print e
519+
print "Failed to DisableRemoteAnonymousRequests for domain $wlsDomainName"
520+
dumpStack()
521+
disconnect()
522+
EOF
523+
sudo chown -R $username:$groupname $DOMAIN_PATH
524+
runuser -l oracle -c ". $oracleHome/oracle_common/common/bin/setWlstEnv.sh; java $WLST_ARGS weblogic.WLST $DOMAIN_PATH/disableAnonymousRequests.py"
525+
if [[ $? != 0 ]]; then
526+
echo "Error : Failed to DisableRemoteAnonymousRequests for domain $wlsDomainName"
527+
exit 1
528+
fi
529+
530+
}
477531

478532
#main script starts here
479533

@@ -483,6 +537,7 @@ BASE_DIR="$(readlink -f ${CURR_DIR})"
483537
#read arguments from stdin
484538
read wlsDomainName wlsUserName wlsPassword wlsAdminHost oracleHome storageAccountName storageAccountKey mountpointPath isHTTPAdminListenPortEnabled adminPublicHostName isCustomSSLEnabled customIdentityKeyStoreData customIdentityKeyStorePassPhrase customIdentityKeyStoreType customTrustKeyStoreData customTrustKeyStorePassPhrase customTrustKeyStoreType serverPrivateKeyAlias serverPrivateKeyPassPhrase
485539

540+
wlsServerName="admin"
486541
DOMAIN_PATH="/u01/domains"
487542
startWebLogicScript="${DOMAIN_PATH}/${wlsDomainName}/startWebLogic.sh"
488543
stopWebLogicScript="${DOMAIN_PATH}/${wlsDomainName}/bin/customStopWebLogic.sh"
@@ -526,8 +581,13 @@ create_adminserver_service
526581

527582
admin_boot_setup
528583

584+
setUMaskForSecurityDir
585+
529586
enableAndStartAdminServerService
530587

531588
echo "Waiting for admin server to be available"
532589
wait_for_admin
533590
echo "Weblogic admin server is up and running"
591+
592+
disableRemoteAnonymousRequests
593+

‎weblogic-azure-vm/arm-oraclelinux-wls-cluster/arm-oraclelinux-wls-cluster/src/main/scripts/setupClusterDomain.sh‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -745,6 +745,60 @@ sudo chmod -R 750 ${stopWebLogicScript}
745745
746746
}
747747
748+
#this function set the umask 027 (chmod 740) as required by WebLogic security checks
749+
function setUMaskForSecurityDir()
750+
{
751+
echo "setting umask 027 (chmod 740) for domain/$wlsServerName security directory"
752+
753+
if [ -f "$DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security/boot.properties" ];
754+
then
755+
runuser -l oracle -c "chmod 740 $DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security/boot.properties"
756+
fi
757+
758+
if [ -d "$DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security" ];
759+
then
760+
runuser -l oracle -c "chmod 740 $DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security"
761+
fi
762+
}
763+
764+
#this function disables remote anonymous requests as required by Weblogic security checks
765+
function disableRemoteAnonymousRequests()
766+
{
767+
echo "DisableRemoteAnonymousRequests for domain $wlsDomainName"
768+
cat <<EOF >$DOMAIN_PATH/disableAnonymousRequests.py
769+
connect('$wlsUserName','$wlsPassword','t3://$wlsAdminURL')
770+
try:
771+
edit("$wlsServerName")
772+
startEdit()
773+
cd("SecurityConfiguration/$wlsDomainName")
774+
775+
if hasattr(cmo,'setRemoteAnonymousRMIIIOPEnabled'):
776+
cmo.setRemoteAnonymousRMIIIOPEnabled(false)
777+
else:
778+
print 'no attribute: SecurityConfiguration/$wlsDomainName: cmo.setRemoteAnonymousRMIIIOPEnabled'
779+
780+
if hasattr(cmo,'setRemoteAnonymousRMIT3Enabled'):
781+
cmo.setRemoteAnonymousRMIT3Enabled(false)
782+
else:
783+
print 'no attribute: SecurityConfiguration/$wlsDomainName: setRemoteAnonymousRMIT3Enabled'
784+
785+
save()
786+
activate()
787+
except Exception,e:
788+
print e
789+
print "Failed to DisableRemoteAnonymousRequests for domain $wlsDomainName"
790+
dumpStack()
791+
disconnect()
792+
EOF
793+
sudo chown -R $username:$groupname $DOMAIN_PATH
794+
runuser -l oracle -c ". $oracleHome/oracle_common/common/bin/setWlstEnv.sh; java $WLST_ARGS weblogic.WLST $DOMAIN_PATH/disableAnonymousRequests.py"
795+
if [[ $? != 0 ]]; then
796+
echo "Error : Failed to DisableRemoteAnonymousRequests for domain $wlsDomainName"
797+
exit 1
798+
fi
799+
800+
}
801+
748802
#main script starts here
749803
750804
CURR_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
@@ -809,13 +863,16 @@ then
809863
createStopWebLogicScript
810864
create_nodemanager_service
811865
admin_boot_setup
866+
setUMaskForSecurityDir
812867
create_adminserver_service
813868
enabledAndStartNodeManagerService
814869
enableAndStartAdminServerService
815870
wait_for_admin
871+
disableRemoteAnonymousRequests
816872
else
817873
updateNetworkRules "managed"
818874
create_managedSetup
875+
setUMaskForSecurityDir
819876
create_nodemanager_service
820877
enabledAndStartNodeManagerService
821878
wait_for_admin

‎weblogic-azure-vm/arm-oraclelinux-wls-dynamic-cluster/arm-oraclelinux-wls-dynamic-cluster/src/main/scripts/setupDynamicClusterDomain.sh‎

Lines changed: 59 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -840,6 +840,61 @@ function storeCustomSSLCerts()
840840
fi
841841
}
842842
843+
#this function set the umask 027 (chmod 740) as required by WebLogic security checks
844+
function setUMaskForSecurityDir()
845+
{
846+
echo "setting umask 027 (chmod 740) for domain/$wlsServerName security directory"
847+
848+
if [ -f "$DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security/boot.properties" ];
849+
then
850+
runuser -l oracle -c "chmod 740 $DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security/boot.properties"
851+
fi
852+
853+
if [ -d "$DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security" ];
854+
then
855+
runuser -l oracle -c "chmod 740 $DOMAIN_PATH/$wlsDomainName/servers/$wlsServerName/security"
856+
fi
857+
858+
}
859+
860+
#this function disables remote anonymous requests as required by Weblogic security checks
861+
function disableRemoteAnonymousRequests()
862+
{
863+
echo "DisableRemoteAnonymousRequests for domain $wlsDomainName"
864+
cat <<EOF >$DOMAIN_PATH/disableAnonymousRequests.py
865+
connect('$wlsUserName','$wlsPassword','t3://$wlsAdminURL')
866+
try:
867+
edit("$wlsServerName")
868+
startEdit()
869+
cd("SecurityConfiguration/$wlsDomainName")
870+
871+
if hasattr(cmo,'setRemoteAnonymousRMIIIOPEnabled'):
872+
cmo.setRemoteAnonymousRMIIIOPEnabled(false)
873+
else:
874+
print 'no attribute: SecurityConfiguration/$wlsDomainName: cmo.setRemoteAnonymousRMIIIOPEnabled'
875+
876+
if hasattr(cmo,'setRemoteAnonymousRMIT3Enabled'):
877+
cmo.setRemoteAnonymousRMIT3Enabled(false)
878+
else:
879+
print 'no attribute: SecurityConfiguration/$wlsDomainName: setRemoteAnonymousRMIT3Enabled'
880+
881+
save()
882+
activate()
883+
except Exception,e:
884+
print e
885+
print "Failed to DisableRemoteAnonymousRequests for domain $wlsDomainName"
886+
dumpStack()
887+
disconnect()
888+
EOF
889+
sudo chown -R $username:$groupname $DOMAIN_PATH
890+
runuser -l oracle -c ". $oracleHome/oracle_common/common/bin/setWlstEnv.sh; java $WLST_ARGS weblogic.WLST $DOMAIN_PATH/disableAnonymousRequests.py"
891+
if [[ $? != 0 ]]; then
892+
echo "Error : Failed to DisableRemoteAnonymousRequests for domain $wlsDomainName"
893+
exit 1
894+
fi
895+
896+
}
897+
843898
844899
#main script starts here
845900
@@ -923,14 +978,17 @@ then
923978
create_adminSetup
924979
createStopWebLogicScript
925980
admin_boot_setup
981+
setUMaskForSecurityDir
926982
create_adminserver_service
927983
create_nodemanager_service
928984
enableAndStartAdminServerService
929985
enabledAndStartNodeManagerService
930-
wait_for_admin
986+
wait_for_admin
987+
disableRemoteAnonymousRequests
931988
else
932989
updateNetworkRules "managed"
933990
create_managedSetup
991+
setUMaskForSecurityDir
934992
create_nodemanager_service
935993
enabledAndStartNodeManagerService
936994
start_cluster

0 commit comments

Comments
 (0)