Connecting to a server using the OCI Bastion Service

OCI Bastion Service
  • Allows to securely access a private cloud instance without exposing a public IP address to the internet. 
  • Provides a fully managed, time-limited gateway that acts as a secure bridge

Step 1: Enable the Bastion Agent 
  • Instances -> server1 -> Management -> Oracle Cloud Agent 
  • Bastion: Enabled
  • For the cloud agent to communicate properly, private subnet's Route Table must have a rule pointing to a NAT Gateway or a Service Gateway so it can reach Oracle's internal infrastructure
Configure Service Gateway 
  • Private virtual machine (VM) can talk to Oracle's internal infrastructure and keep the Bastion plugin running, need to add a route rule. 
    Phase 1: Create the Service Gateway
    1. zyn-vcn -> Ggateway -> Service Gateways -> Create Service Gateway 
    2. Name: zyn_svc_gateway
    3. Services: All SYD Services In Oracle Services Network
    4. Create Service Gateway
    Phase 2: Add the Rule to your Private Subnet's Route Table
    1. zyn-vcn -> Routing -> Route table -> Default route-table for zyn-vcn -> Route Rules -> Add Route Rules 
    • Target Type: Service Gateway.
    • Destination Service: OCI SYD Object Storage
    • Target Service Gateway: zyn_svc_gateway
    Phase 3: Verify the Security List
    The gateway allows data to travel, but your firewall rules must allow it to leave the VM.
    1. zyn-vcn -> Security -> Security List -> Default Security List for zyn-vcn -> Security Rules -> Egress Rules -> Add Egress Rules 
    • Destination type: Service 
    • Destination Service: All SYD Services In Oracle Services Network
    • IP Protocol: All 
    Wait for 5 to 10 minutes to sync up, then try starting a new Bastion session.

Step 2: Create the OCI Bastion Gateway
Build the Bastion service container 
  • Hamburger Menu -> Identity & Security -> Bastion -> Create Bastion.
  • Name: zynBastion
  • Target VCN: zyn-vnc
  • Target Subnet: zyn-public-subnet
  • CIDR Block Allowlist: 0.0.0.0/0 / own ip
  • Click Create Bastion 

Step 3: Update Subnet Firewall Rule
Subnet's firewall must trust incoming traffic sent by the Bastion.
  • Bastion -> zynBastion ->  copy the Private Endpoint IP Address. (10.0.1.70) 
  • zyn-vcn -> security -> security list -> Default security list for zyn-vcn 
  • Security rules -> Add Ingress Rule
    • Source Type: CIDR
    • Source CIDR: Paste the Private Endpoint IP Address (10.0.1.70/32) 
    • IP Protocol: TCP
    • Destination Port Range: 22 
  • Click Add Ingress Rule.

Step 4: Create a Bastion Session
  • Identity & Security -> Bastion -> zynBastion -> Sessions -> Create Session.
  • Session Type: Managed SSH Session
  • Session name: zyn_session
  • Username: opc
  • Target Compute Instance: server1
  • Add SSH Key: Upload or paste the Public Key (.pub) file 
  • Create Session 
Step 5: Connect From Local Terminal
Use the pre-built connection link provided by Oracle Cloud.
  • Bastion -> zynBastion -> sessions -> zynsessions -> 3 dots (...) -> view/copy ssh command -> 
  • Open the Terminal / PowerShell 
  • Paste the command into a text editor first and fix the placeholders:
    • Replace <privateKey> with the actual path to your downloaded private key file 
  • Press Enter to execute the command in your terminal.
  • sudo su - # to login as root user
    ===============================================================

Comments

Post a Comment

Popular posts from this blog

 Exadata  Oracle Exadata Smart Flash Cache * Exadata cell -> Flash LUN -> Cell Disk -> Flash Cache/Flash Log  * CELL_FLASH_CACHE - – DEFAULT (LRU), KEEP, NONE * ALTER TABLE <TABLE_NAME> STORAGE(FLASH_CACHE [NONE|DEFAULT|KEEP]) * ALTER INDEX <INDEX NAME> STORAGE(FLASH_CACHE [NONE|DEFAULT|KEEP]) Smart Flash Cache Mode: 1. Write Through Flash Cache Mode (Default):  Write on Disk -> Copy to Flash Cache  * excellent for absorbing repeated random reads  * commonly found in OLTP applications. * dcli -g cell_servers -l celladmin cellcli -e "list cell attributes flashcachemode" * Steps to enable Write-Through Mode CellCLI> ALTER FLASHCACHE ALL FLUSH CellCLI> DROP FLASHCACHE CellCLI> ALTER CELL SHUTDOWN SERVICES CELLSRV CellCLI> ALTER CELL flashCacheMode=WriteThrough CellCLI> ALTER CELL STARTUP SERVICES CELLSRV CellCLI> CREATE FLASHCACHE ALL 2. Write Back Flash Cache Mode:  Write on Flash -> Copy to Disk  * best ...
Read more

Database Network : Configuration Parameters

LSNRCTL> command [listener_name] lsnrctl @file_name  #to execute in batch mode. REM or # to identify comments in the batch script Listener.ora file parameters: ·          PASSWORDS_listener_name  #an unencrypted password ·          LSNRCTL> change_password #to establish an encrypted password ·          LSNRCTL> SAVE_CONFIG  #Any changes are stored in listener.ora ·          LSNRCTL> SET PASSWORD  #If a password is set, then issue SET PASSWORD command before changing the password. Use the command SET PASSWORD prior to privileged Listener Control utility commands ·          Reload : the database services, instances, service handlers, and listening endpoints that were dynamically registered with the listener will be unregistered and subseque...
Read more

Undo Segments : Drop Problematic Undo Segments

ERROR about to recover undo segment 98 status:6 inst:0 mark undo segment 98 as available status:6 ret:1  about to recover undo segment 46 status:6 inst:0 mark undo segment 46 as available status:6 ret:1   SQL> select * from V$FAST_START_TRANSACTIONS; USN SLT SEQ STATE UNDOBLOCKSDONE UNDOBLOCKSTOTAL PID CPUTIME PARENTUSN PARENTSLT PARENTSEQ XID PXID RCVSERVERS CON_ID ---------- ---------- ---------- ---------------- -------------- --------------- ---------- ---------- ---------- ---------- 46 46 2313064 RECOVERING 505 24992423 77 5586 0 0 0 10001000684B2300 0000000000000000 1 0 98 25 1352150 RECOVERING 0 226231 78 5586 0 0 0 30001900D6A11400 0000000000000000 1 0   SQL> SELECT segment_name, tablespace_name  FROM dba_rollback_segs  WHERE segment_id IN (98, 46); SEGMENT_NAME               TABLESPACE_NAME ------------------------------ ----------------------------...
Read more