using mnConnect without specifying passwords in a text file

Easy, well you’d think.

There is a bit of a caveat, we  are creating a key file and a credential file.  If people can get a hold of these, then they can run nm commands as that user without needing to know the username and password, so you need to keep these files a little bit secure and secret.  chmod is your friend.

firstly, lets explain the problem

if a shell script, you run the following to start a server

/u01/oracle/Oracle/Middleware/Oracle_Home/oracle_common/common/bin/wlst.sh /u01/startscripts/nmStartServer.py

import sys;
print 'Starting with :',str(sys.argv);
if len(sys.argv) != 1:
  print 'Usage nmstartsvr.py servername'
  sys.exit(2)
try:
  print 'Connecting to nodemanager and creating encrypted credentials'
  nmConnect('weblogic','mySecurityHole',domainName='e1_apps', port='5556', nmType='ssl');

So that is great, we need to stop using mySecurityHole, so we now create a new script:

This has the connect and the following line:

import sys;
print 'Starting with :',str(sys.argv);
if len(sys.argv) != 1:
  print 'Usage nmEncryptPassword.py '
  sys.exit(2)
try:
  print 'Connecting to nodemanager and creating encrypted credentials'
  nmConnect('weblogic',’mySecurityHole;,domainName='e1_apps', port='5556', nmType='ssl');
  storeUserConfig(userConfigFile='/u01/startscripts/userconfig.secure', userKeyFile='/u01/startscripts/userkey.secure',nm='true');
except:
  print 'Could not change the password or store it to nodemanager'
  sys.exit(2)
exit()

So you can create the two files '/u01/startscripts/userconfig.secure', & '/u01/startscripts/userkey.secure' – the script will do this for you.

You only run the above once, which is nice.  The next thing you do is change your nmConnect line like below:

import sys;
print 'Starting with :',str(sys.argv);
if len(sys.argv) != 1:
  print 'Usage nmstartsvr.py servername'
  sys.exit(2)
try:
  print 'Connecting to nodemanager and creating encrypted credentials'
  nmConnect(userConfigFile='/u01/startscripts/userconfig.secure', userKeyFile='/u01/startscripts/userkey.secure',domainName='e1_apps', port='5556', nmType='ssl');

viola! You are now using a keyfile to run start, not the plain text credentials.

Note that in between I started to get:

Connecting to nodemanager
Connecting to Node Manager ...
This Exception occurred at Thu Sep 15 14:09:14 AEST 2016.
java.io.IOException: Get a TLS/SSL Alert. Connection is rejected. Probably caused by attempting to connect to a SSL server (SecureListener==true in nodemanager.properties) with a Plain client.
Could not connect to nodemanager

I noticed that I’d cut and pasted wrong  nmConnect(userConfigFile='/u01/startscripts/userconfig.secure', userKeyFile='/u01/startscripts/userkey.secure',domainName='e1_apps', port='5556', nmType=’plain’);

Once this was back to ssl, all was good in the WLST world.