Security, yup! No really!

I hardly dare to commence again....
Started with checking the configuration and testing the stuff that used to work. You don't know, nowadays, with these gremlins.
And sure enough:

D:\>tnsping o1003
TNS Ping Utility for 32-bit Windows: Version 10.1.0.4.0 - Production on 16-FEB-2006 15:36:29
Copyright (c) 1997, 2003, Oracle. All rights reserved.

Used parameter files:
D:\oracle\ora92\network\ADMIN\sqlnet.ora

Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCPS)(HOST = 192.168.1.199)(PORT = 2484))) (CONNECT_DATA = (SERVICE_NAME = o10gR1))
( SECURITY = (SSL_SERVER_CERT_DN = cn=o10gR1,cn=OracleContext,dc=cs,dc=nl)))
TNS-12560: TNS:protocol adapter error

So, what is wrong here? That used to work!
Same here; this test worked, too!

D:\>sqlplus system@o10ssl
SQL*Plus: Release 10.1.0.4.0 - Production on Thu Feb 16 15:35:44 2006
Copyright (c) 1982, 2005, Oracle. All rights reserved.

Enter password:
ERROR:
ORA-28759: failure to open file

Okay - I know that one: the wallet is not set for autologin. Fired up the wallet manager, and changed that; the error is now more what I expected:

ORA-29003: SSL transport detected mismatched server certificate.

Okay - I know that one, too: change SSL_SERVER_DN_MATCH in SQLNET.ORA from YES to NO, and you're done! And in fact, I already hinted that would be a problem.
So, I am going to continue this, without the server authentication (which you can see, works! or rather, fails, and thus proves to work).
Let's create a demouser on the server:

[oracle10@csdb01 admin]$ sqlplus system/manager
SQL*Plus: Release 10.1.0.4.0 - Production on Thu Feb 16 16:43:10 2006
Copyright (c) 1982, 2005, Oracle. All rights reserved.

Connected to:
Oracle Database 10g Enterprise Edition Release 10.1.0.4.0 - Production
With the Partitioning, OLAP and Data Mining options

SQL> create user certdemo identified externally as 'CN=frankbo, O=CarrotSoft, C=NL';
User created.

SQL> grant create session to certdemo;
Grant succeeded.

SQL>

Okay, let's see if I can login from my (Windows) client:

D:\>sqlplus /nolog
SQL*Plus: Release 10.1.0.4.0 - Production on Thu Feb 16 15:56:39 2006
Copyright (c) 1982, 2005, Oracle. All rights reserved.

SQL> connect / @o1003
ERROR:
ORA-01017: invalid username/password; logon denied

Hmmmm. This seems to be some weird mismatch between globally and externally defined users; the used syntax seems to be OK for 10g Release 2. Thanks to Fabrizio, who hinted that here.

SO, let's revert on the server:

SQL> drop user certdemo cascade;
User dropped.

SQL> create user certdemo identified globally as 'CN=frankbo, O=CarrotSoft, C=NL';
User created.

SQL> grant create session to certdemo;
Grant succeeded.

And try the client again:

SQL> connect /@o1003
Connected.
SQL> show user
USER is "CERTDEMO"
SQL>

So, finally, I'm able to say: finally!

Forgot OID administrator password?

In an environment, that already had the infrastructure install, I wanted to install the Application Server Middle tier. One thing Portal wants, is the connection to the LDAP server (Oracle Internet Directory server, or OID).
I was quite sure about the password, but always got errors during install. After checking (using netstat -a) I was actually using the correct port for LDAP (the default 389), I realized the password could have been expired.
This is the code to reset it:
D:\oracle\10.1\HTTP\BIN>oidpasswd connect=test1 unlock_su_acct=true
OID DB user password:
OID super user account unlocked successfully.

The OID DB user account is what you would enter as password here:
SQL> connect ods@test1
Enter password:
Connected.

Edit:

In addition to that, you cannot logon, using Single Sign On (SSO) anymore.
Some odd actions are to be taken here:

1. start Oracle Directory Manager
2. Log on, using the cn=orcladmin account, and the password you just reset...
3. Navigate to your realm, something like
   cn=orcladmin, cn=Users, dc=yourcompany, dc=yourcountry
4. scroll all the way down, to the userpassword entry, step over to the asterixes, and retype your password.
5. Apply

You can now use your SSO logon again.

And now for something different: scripts

It's been a while (year-end releases, 80-hour weeks...), but here's something I think more people will find useful.
It's a script, called check_alert, and it will inspect and rotate your alert log file(s). If you want just rotation, take a serious look at logrotate, a system utility that comes with most *nix distributions nowadays (except HP-UX, but you can download it - or search here).
I made check_alert as configurable as possible, by means of external files. Feel free to use and alter, though I'd appreciate that my name remains mentioned.
Anyway here's the link for the zipped file, and just to make you curious, here's the README:

README file for check_alert

Purpose: checl_alert will check the alert log files of Oracle
  databases for errors, and will notify DBAs by email

Written: Januari 2006, by Frank van Bortel

check_alert is configurable by means of two external files, check_alert.errors, and
check_alert.conf

check_alert.conf contains the following variables, used by check_alert: 

MAILLIST: 
 contains the list of people that are mailed with the findings of check_alert.
 It should be compliant with the mail program you have defined in MAILPROG.
 Example: MAILLIST=f.w.j.van.bortel@nospam.com


ERRORSONLY:
 a switch [Y,N] designating whether only errors should be mailed (Y), or 
 whether findings should always be mailed (N), even when no errors are found.
        The errors that are reported can be configured in check_alert.errors
 Example: ERRORSONLY=Y

KEEPREPORT:
 a switch [Y,N] designating whether the log reporting file should be kept (Y),
 or deleted (N), when done. 

TMPDIR:
 variable designates a temporary directory; no files will be left there, but
 check_alert must have read/write permissions there.
 Example: TMPDIR=/tmp

ORATAB: designates the location of the oratab file, as maintained by Oracle installation tools
 Note that different platforms use different locations
 Example: ORATAB=/etc/oratab

EXTDATE: 
 defines how long the logs should be kept; format mask according to the date 
 executable. Most date executables support these formats:
  +%m%d will append MMDD to the logfile, keeping the logfiles for a year
  +%d will append the day of the month (DD) format, keeping logfiles for a month
  +%w will append the day-of-the week [0-6], keeping the logfiles for a week
  +%u will append the day-of-the week [1-7], starting monday, rotating logfiles weekly
  see also man date for more formats
 Example: EXTDATE=`date '+%u'`

MAILPROG:
 The name of the executable to send email from this environment. The program must support 
 the -s (subject) switch. Must distributions will use mail, that also supports the -s switch,
 HP-UX does not, and has mailx for this purpose.
 Example: MAILPROG=mailx

ERRORS:
 The file where error patterns are kept. check_alert uses grep -if to scan for errors, making
 the matching case INsensitive.
 NOTE: DO NOT LEAVE THIS FILE EMPTY
 Example: ERRORS=check_alert.errors

Example of check_alert.errors:
ora-
error

check_alert will read the contents of the file, defined in ORATAB, ignore all empty lines, comment 
lines (lines, starting with the # sign), and undefined entries (lines, starting with *).
For each valid entry, the ORACLE_SID is determined, as well as the value of PACKAGE, if not defined.
Based on that, ORACLE_BASE is defined. ORACLE_BASE will be /oracle/$PACKAGE, if PACKAGE is defined,
or the first two subdirectories of ORACLE_HOME as defined in ORATAB.
According to the standards in place, the alert log file for ORACLE_SID can be found at
ORACLE_BASE/admin/dbORACLE_SID/bdump/alert_ORACLE_SID.log

If the alert log can not be found, an entry is made in the log report and the following
three possible locations are tried:
# $ORACLE_BASE/admin/oracle/db$ORACLE_SID
# $ORACLE_HOME/rdbms/log
# $ORACLE_HOME/admin/rdbms/log
If a directory exists, the log file is assumed to be in that directory.
If it still does not exist, an entry is made in the log report and checking is
skipped. 
The log report is a temporary file in TMPDIR, named TMPDIR/check_alert_ORACLE_SID.log

If the alert log file is found, it is checked for errors. The error patterns to be checked
on are defined in check_alert.errors. Matching lines are copied to the log report file.
If no errors are found, a note is made in the log report as well.

As a last step, the alert log file contents is copied to a backup file, with an extension,
defined in EXTDATE. This will govern how long rotated alert log files are kept: if a single
day-of-week number is used, files will be overwritten after a week. Subsequently, if a
day-of-month schema is used, logfiles will be rotated monthly.
Using a naming schema with month or day-of-year naming schema is not advised.
The original alert log file is deleted (as Oracle opens and closes the alert log file on
writes, this can be doen without the need of recreating the file, and setting ownership).

The log report is then sent to the receipties, defined in MAILLIST, using the program, defined
in MAILPROG, based on the fact whether ERRORSONLY is set to Y or N.
If ERRORSONLY is set to Y, the report will only be sent if errors are found, as defined in
check_alert.errors. This is the 'no news means good news' option.

If ERRORSONLY is set to N, the report will be sent regardless of any errors found.

When done, the log report file is removed when the KEEPREPORT flag is set to N.
When testing, or in new environments, it may be beneficial to leave ERRORSONLY=Y, but
set KEEPREPORT=Y. In that manner, relevant files can still be viewed on the system, but
the DBA is not overwhelmed by emails, most of which just indicate all is well (I hope).

Koning winter is gearriveerd

Vrijdag kostte me het 7 1/2 uur om thuis te komen, mede door sneeuw en files. Wat duidelijk was, is dat de wegbeheerder zijn zaakjes niet voor elkaar had; eerder werd nog preventief gestrooid, nu te laat (of niet, door de files).
Op de A1 stond het vast, omdat trucks geen grip hadden op de weg tussen Apeldoorn-Zuid en afslag Kootwijk/Harderwijk; de weg gaat daar namelijk de hoogte in. Als daar nu zwaar materieel was ingezet, om deze vrachtwagens weg te slepen, dan had niemand op de A1 's nachts in de file hoeven te slapen...
Als winterbanden nu eens verplicht werden gesteld....
Als de lease maatschappijen daar nu eens mee begonnen....
Dan was dit allemaal niet zo erg geweest. Maar dan is er geen agent te vinden - ja, de eenzame BOA, die z'n flitser opbergt, omdat er met 3km/uur geen geld te verdienen valt voor baassie Spee... Zielig he?

Getting spammed...

In order to get rid of comment spam, I had to turn on Word Verification for comments. Don't let this prevent you from commenting....
Sorry, but there seems no other way; I have been deleting unrelated comments on a regular basis, and quite frankly, got fed up.

OpenOffice.org 2.0 officially released!

The beta, released in June, finally has a successor!

Insanity or safety?

The US government seems to be sure that the US economy does not need tourism.
In yet another attempt to distract attention from domestic problems and failures, the US government has decided that everybody, flying to the US of A needs to indicate the details of their whereabouts for the duration of the stay.
Really, the US of A will get safer... No, really!