5 Configuring Users, Groups and Environments for Oracle Database

5.1 Creating Required Operating System Groups and Users

Depending on if this is the first time Oracle software is being installed on your system and on the products that you are installing, you may have to create several operating system groups and users.

However, if you use Oracle Preinstallation RPM to provision your Linux operating system for an Oracle Grid Infrastructure or Oracle Database installation, then it configures an Oracle database installation owner (oracle), an Oracle Inventory group (oinstall), and an Oracle administrative privileges group (dba).

If you prefer to allocate operating system user privileges so that you can use one administrative user and one group for operating system authentication for all administrative privileges, then you can use the oracle user as the installation owner, and use one group as the primary group for any user requiring administrative privileges for Oracle ASM, and Oracle Database administration. This group must also be the Oracle Inventory group. To simplify using the defaults for Oracle tools the group name should be oinstall.

You can also create custom configuration groups and users based on job role separation that divide access privileges.

Log in as root, and use the instructions in the following sections to locate or create the Oracle Inventory group and a Oracle software owner user:

• Determining If the Oracle Inventory and Oracle Inventory Group Exists

• Creating the Oracle Inventory Group If an Oracle Inventory Does Not Exist

• About Oracle Installations with Job Role Separation

• Descriptions of Job Role Separation Groups and Users

• Creating Job Role Separation Database Operating System Groups and Users

# /usr/sbin/groupadd -g 54321 oinstall

# /usr/sbin/groupadd -g 54322 dba

# /usr/sbin/groupadd -g 54323 oper

# /usr/sbin/groupadd -g 54324 backupdba

# /usr/sbin/groupadd -g 54325 dgdba

# /usr/sbin/groupadd -g 54326 kmdba

# /usr/sbin/groupadd -g 54327 asmdba

# /usr/sbin/groupadd -g 54328 asmoper

# /usr/sbin/groupadd -g 54329 asmadmin

# id oracle
# id grid

uid=54321(oracle) gid=54321(oinstall) groups=54322(dba),54323(oper)

uid=54322(grid) gid=54321(oinstall) groups=54321(oinstall),54329(asmadmin),54327(asmdba),54322(dba)

# /usr/sbin/usermod -g oinstall -G dba,asmdba,backupdba,dgdba,kmdba[,oper] oracle

5.2 Checking Resource Limits for Oracle Software Installation Users

For each installation software owner, check the resource limits for installation, using the following recommended ranges:

To check resource limits:

1. Log in as an installation owner.

2. Check the soft and hard limits for the file descriptor setting. Ensure that the result is in the recommended range, for example:

   $ ulimit -Sn
   1024
   $ ulimit -Hn
   65536
   

3. Check the soft and hard limits for the number of processes available to a user. Ensure that the result is in the recommended range, for example:

   $ ulimit -Su
   2047
   $ ulimit -Hu
   16384
   
   

4. Check the soft limit for the stack setting. Ensure that the result is in the recommended range, for example:

   $ ulimit -Ss
   10240
   $ ulimit -Hs
   32768
   

5. Repeat this procedure for each Oracle software installation owner.

If necessary, update the resource limits in the /etc/security/limits.conf configuration file for the installation owner. However, note that the configuration file is distribution specific. Contact your system administrator for distribution specific configuration file information.

5.3 Setting Remote Display and X11 Forwarding Configuration

If you are on a remote terminal, and the local system has only one visual (which is typical), then use the following syntax to set your user account DISPLAY environment variable:

Bourne, Korn, and Bash shells:

$ export DISPLAY=hostname:0

C shell:

$ setenv DISPLAY hostname:0

For example, if you are using the Bash shell and if your host name is local_host, then enter the following command:

$ export DISPLAY=local_host:0

To ensure that X11 forwarding does not cause the installation to fail, create a user-level SSH client configuration file for the Oracle software owner user, as follows:

1. Using any text editor, edit or create the software installation owner's ~/.ssh/config file.

2. Ensure that the ForwardX11 attribute in the ~/.ssh/config file is set to no. For example:

   Host * ForwardX11 no
   

3. Ensure that the permissions on the ~/.ssh are secured to the oracle or grid user. For example:

   $ ls -al .ssh
   total 28
   drwx------  2 oracle oinstall 4096 Jun 21 2012
   drwx------ 19 oracle oinstall 4096 Jun 21 2012
   -rw-r--r--  1 oracle oinstall 1202 Jun 21 2012 authorized_keys
   -rwx------  1 oracle oinstall  668 Jun 21 2012 id_dsa
   -rwx------  1 oracle oinstall  601 Jun 21 2012 id_dsa.pub
   -rwx------  1 oracle oinstall 1610 Jun 21 2012 known_hosts
   

5.4 Stopping Existing Oracle Processes

Consider the following before you install Oracle Grid Infrastructure for a standalone server, or Oracle Database:

• If you plan to use Oracle Restart, then you must install Oracle Grid Infrastructure for a standalone server before you install and create the database. When you perform a database installation, the database must use the same listener created during the Oracle Grid Infrastructure for a standalone server installation, thereafter you do not have to perform the steps listed in this section.

  The default listener and any additional listeners must run from the Oracle Grid Infrastructure home. See "Configuring Oracle Software Owner Environment" to continue.

• If you have an existing Oracle Database 12c running on Oracle ASM, then stop any existing Oracle ASM instances. After you finish installing Oracle Grid Infrastructure for a standalone server, start the Oracle ASM instance again.

If you create a database during the software installation, then most installation types configure and start a default Oracle Net listener using TCP/IP port 1521 and the IPC key value EXTPROC. If an existing Oracle Net listener process is using the same port or key value, Oracle Universal Installer looks for the next available port (for example, 1522) and configures and starts the new listener on this available port.

To determine if an existing listener process is running and to shut it down, if necessary:

1. Switch user to oracle:

   # su - oracle
   

2. Enter the following command to determine if a listener process is running and to identify its name and the Oracle home directory in which it is installed:

   $ ps -ef | grep tnslsnr
   

   This command displays information about the Oracle Net listeners running on the system:

   ... oracle_home1/bin/tnslsnr LISTENER -inherit
   

   In this example, oracle_home1 is the Oracle home directory where the listener is installed and LISTENER is the listener name.

   Note:

   If no Oracle Net listeners are running, then see "Configuring Oracle Software Owner Environment" to continue.

3. Set the ORACLE_HOME environment variable to specify the appropriate Oracle home directory for the listener:

   • Bourne, Bash, or Korn shell:

     $ ORACLE_HOME=oracle_home1
     $ export ORACLE_HOME
     

   • C or tcsh shell:

     % setenv ORACLE_HOME oracle_home1
     

4. Enter the following command to identify the TCP/IP port number and IPC key value that the listener is using:

   $ $ORACLE_HOME/bin/lsnrctl status listenername
   

   Note:

   If the listener uses the default name LISTENER, then you do not have to specify the listener name in this command.

5. Enter a command similar to the following to stop the listener process:

   $ $ORACLE_HOME/bin/lsnrctl stop listenername
   

6. Repeat this procedure to stop all listeners running on this system.

5.5 Configuring Oracle Software Owner Environment

You must run Oracle Universal Installer from the oracle or grid account. However, before you start Oracle Universal Installer, you must configure the environment of the oracle or grid user. To configure the environment, you must:

• Set the default file mode creation mask (umask) to 022 in the shell startup file.

• Set the DISPLAY environment variable.

To set the Oracle software owners' environments, follow these steps, for each software owner (oracle, grid). The following procedure lists the steps for the oracle user only:

1. Start a new X terminal session (xterm).

2. Enter the following command to ensure that X Window applications can display on this system:

   $ xhost + RemoteHost
   

   where RemoteHost is the fully qualified remote host name. For example:

   $ xhost + somehost.example.com
   

3. If you are not logged in as the user, then switch to the software owner user you are configuring. For example, as the oracle user.

   $ su - oracle
   

4. To determine the default shell for the oracle user, enter the following command:

   $ echo $SHELL
   

5. Open the user's shell startup file in any text editor:

   • Bash shell (bash):

     $ vi .bash_profile
     

   • Bourne shell (sh) or Korn shell (ksh):

     $ vi .profile
     

   • C shell (csh or tcsh):

     % vi .login
     

6. Enter or edit the following line, specifying a value of 022 for the default file mode creation mask:

   umask 022
   

7. Save the file and exit from the text editor.

8. To run the shell startup script, enter one of the following commands:

   • Bash shell:

     $ . ./.bash_profile
     

   • Bourne or Korn shell:

     $ . ./.profile
     

   • C shell:

     % source ./.login
     

9. If you are not installing the software on the local computer, then run the following command on the remote computer to set the DISPLAY variable:

   • Bourne, Bash or Korn shell:

     $ export DISPLAY=local_host:0.0       
     

   • C shell:

     % setenv DISPLAY local_host:0.0
     

   In this example, local_host is the host name or IP address of the system (your workstation, or another client) on which you want to display the installer.

   Run the following command on the remote system to check if the SHELL and the DISPLAY environment variables are set correctly:

   echo $SHELL
   echo $DISPLAY
   

   To change the display location from the default display to a remote system display, run the following command on the local computer:

   $ xhost + RemoteHost
   

   To verify that the X applications display is set properly, run an X11-based program that comes with the operating system such as xclock.

   $ xclock
   

   In this example, you can find xclock at /usr/X11R6/bin/xclocks.

   If the DISPLAY environment variable is set correctly, then you can see xclock on your computer screen. If you get any display errors see "X Window Display Errors". If xclock does not start, then contact your system administrator.

10. If the /tmp directory has less than 1 GB of free disk space, then identify a file system with at least 1 GB of free space and set the TMP and TMPDIR environment variables to specify a temporary directory on this file system:

    1. To determine the free disk space on each mounted file system use the following command:

       # df -h /tmp
       

    2. If necessary, enter commands similar to the following to create a temporary directory on the file system that you identified, and set the appropriate permissions on the directory:

       $ sudo - s
       # mkdir /mount_point/tmp
       # chmod 775 /mount_point/tmp
       # exit
       

    3. Enter commands similar to the following to set the TMP and TMPDIR environment variables:

       • Bourne, Bash, or Korn shell:

         $ TMP=/mount_point/tmp
         $ TMPDIR=/mount_point/tmp
         $ export TMP TMPDIR
         

       • C shell:

         % setenv TMP /mount_point/tmp
         % setenv TMPDIR /mount_point/tmp
         

11. If you have had an existing installation on your system, and you are using the same user account to install this installation, then unset the ORACLE_HOME, ORACLE_BASE, ORACLE_SID, TNS_ADMIN environment variables and any other environment variable set for the Oracle installation user that is connected with Oracle software homes.

    Enter the following commands to ensure that the ORACLE_HOME, ORACLE_BASE, ORACLE_SID and TNS_ADMIN environment variables are not set:

    • Bourne, Bash, or Korn shell:

      $ unset ORACLE_HOME
      $ unset ORACLE_BASE
      $ unset ORACLE_SID
      $ unset TNS_ADMIN
      

    • C shell:

      % unsetenv ORACLE_HOME
      % unsetenv ORACLE_BASE
      % unsetenv ORACLE_SID
      % unsetenv TNS_ADMIN
      

    Use the following command to check the PATH environment variable:

    $ echo $PATH
    

    Ensure that the $ORACLE_HOME/bin path is removed from your PATH environment variable.

    Note:

    If the ORACLE_HOME environment variable is set, then Oracle Universal Installer uses the value that it specifies as the default path for the Oracle home directory. If you set the ORACLE_BASE environment variable, then Oracle recommends that you unset the ORACLE_HOME environment variable and choose the default path suggested by Oracle Universal Installer.

12. To verify that the environment has been set correctly, enter the following commands:

    $ umask
    $ env | more
    

    Verify that the umask command displays a value of 22, 022, or 0022 and that the environment variables you set in this section have the correct values.

5.6 Determining Root Script Execution Plan

During an Oracle Grid Infrastructure installation, Oracle Universal Installer prompts you to run scripts with superuser (or root) privileges to complete several system configuration tasks. You can either run these root scripts manually as root when prompted, or during installation you can provide configuration information and passwords using one of the following root privilege delegation options:

• Use root user credentials

  Provide the superuser (or root) password. This option runs the root scripts automatically as the root user.

• Use Sudo

  Sudo is a UNIX and Linux utility that allows members of the sudoers group privileges to run individual commands as root. To enable Sudo, have a system administrator with the appropriate privileges configure a user that is a member of the sudoers list, and provide the username and password when prompted during installation.