OCI load balancer redirection using Routing Policies

In Layman terms, load balancers helps in distributing the requests to the backend servers based upon certain algorithms. OCI Load Balancers helps in achieving high availability and scalability. Based upon our requirement we can induce multiple policies and application level health checks in OCI Load Balancer. In this post, i am going to demonstrate how we can leverage routing policies to redirect requests to backend servers using certain conditions. If you want to know how to create a Load balancer, you can refer to my earlier post https://samappsdba.blogspot.com/2020/05/configuring-oci-load-balancer-for-ebs.html

 I have a webserver1 with Public IP:-X.X.X.65. This is registered under DNS as dumka.tk 

I have an another webserver2 with Public IP:-X.X.X.61. This is registered under DNS as dumka.ml

Now i will create the Load balancer

I will add the backend later

Load balancer will now be created.

Add the backends now

Create listener for two backends

Now create the hostnames

Edit the listener and add the respective hostnames

Now Define the Routing Policies

At last, add the Public IP of the Load balancer to the DNS Zones.

Perform the testing

There are many other advanced configurations which we can use with our OCI Load Balancer for which we can go through the Advanced OCI LB Concepts. You can also refer my earlier post OCI LB Redirection on how i had used Path Route set for Load balance Redirection. This post is all about how using one Network load balancer, we can serve multiple websites using hostname and Routing policies. Hope this post helps someone. Keep learning cloud.

connect to Compute instance on Private Subnet using Public Load balancer OCI

 In this post, i am going to demonstrate on how we can connect to a VM Compute instance running on Private Subnet using a Network Load balancer. There are many ways available through which you can connect using Fast Connect, IPSec VPN or using Bastion Service which are beyond the scope for this post. The Oracle Cloud Infrastructure Flexible Network Load Balancing service (Network Load Balancer) provides automated traffic distribution from one entry point to multiple backend servers in your virtual cloud network (VCN). It operates at the connection level and load balances incoming client connections to healthy backend servers based on Layer 3/Layer 4 (IP protocol) data. The service offers a load balancer with your choice of a regional public or private IP address that is elastically scalable and scales up or down based on client traffic with no bandwidth configuration requirement.

Network Load Balancer provides the benefits of flow high availability, source and destination IP addresses, and port preservation. It is designed to handle volatile traffic patterns and millions of flows, offering high throughput while maintaining ultra low latency. Network load balancers have a default 1 million concurrent connection limit. Network Load Balancer is the ideal load balancing solution for latency sensitive workloads. For more information, you can refer to https://docs.oracle.com/enus/iaas/Content/NetworkLoadBalancer/overview.htm

Steps:- I have two subnets one is private and another one is public. The compute instance is created in Private Subnet and Network Load balancer is defined under Public subnet. Both the subnets have their respective Security lists and Route Tables. The compute instance will be accessible through SSH port 22.

Create a VCN

Create a NAT Gateway

Create  a Service gateway

Create Route Rule

Create a Security List 

192.168.0.8/30 is the CIDR for LB subnet

Create a Compute instance on private Subnet

Next, Create a the public Subnet which will host the LB.

Create the NSG for defining the ingress and egress of LB

Now Create the Network Load balancer

unselect Preserve Source IP

make Sure the health checks are passed

Now use the Public IP of the LB to connect to the private Compute instance using SSH

In this Blog Post, we looked into one of the easiest solution on how to connect to Compute instance running on Private Subnet. Using Network Load balancer, we can also connect to DB running on specific port, Windows RDP etc. I hope this post will help someone. Till then, enjoy learning Cloud.

create oci iam user with least privilege

 The IAM service lets you control who has access to cloud resources. You can control what type of access a group of users has and to which specific resources. The service enables you to enforce the security principle of least privilege by default. New users aren’t allowed to perform actions on any resources until they’re granted the appropriate permissions. With the IAM service, you can use a single model for authentication and authorization across all OCI services. IAM makes it easy to manage access for organizations of all sizes—from one person working on a single project to large companies with many groups working on many projects at the same time—within a single account.

In my last post https://samappsdba.blogspot.com/2022/06/protect-accidental-termination-of-OCI-Compute-instance.html i had explained, how we can protect any compute instance from getting terminated by mistake. In this post, i will go through the demonstration on how we should create users when first time our instance is provisioned. Basically, when our instance is provisioned, we are given the tenancy administrator credentials. This user is the root user and it should not be used in our daily operations. Thus, when an instance is provisioned, the administrator should create separate user which can be used for day to day activities and this user should have the least privileges. 

Source-Oracle Documentations

In my tenancy, i have created one group

I will now create a user and assign the user to the group

User is assigned to group

Now once we reset the password for the user and set the email, the user is good to login to OCI. But will he/she be able to do anything. No, because the group, in which user has been assigned, doesn’t have any policies set

 We will get the below message

Thus, we will now create a policy and add the policy to the group

Now if the user try to login to the OCI Console, he/she will be able to see the instance now. The above policy will allow the user to work in only one compartment but under that specific compartment he/she can do all the work. If they go into other compartment in that case they cannot see the resources in other compartments. They will get an unauthorized error message

To further narrow down the scope in one specific compartment, i just want the user to see the compute instance and nothing else. In that case, my policy will be

Allow group REST_USERS to manage instance-family in compartment OCIPROF

Other example can be

Virtual-network-family

Database-family

Volume-family

I hope, this post gives an overview of how privileges are given to user and how least privileges are enforced to new user. Hope, this post helps someone. Till then happy learning cloud.

References:-https://docs.oracle.com/en-us/iaas/Content/Resources/Assets/whitepapers/best-practices-for-iam-on-oci.pdf

protect accidental termination of OCI Compute instance and secure your data

 It is very important for any organizations to protect its resources against accidental termination and especially when it comes to compute instance. You not only secure your data but you are also ensuring that the services which are running on the compute instance are always up. In the cloud world, creation and maintenance of the resources have been made much easier. Within a click of button, one can create the resources and even terminate them easily. What if, unintentionally someone terminate the instance which was not supposed to be? All Data Gone????

Normally, when we create users in OCI, we give them some privileges through which they perform some tasks. These privileges comes through Policies. As a best practice, we should always follow the principle of giving least privileges. If the privileges are wide open, then in that case users can easily go and terminate an instance accidentally.

In the above case, user having the privileges can easily terminate, stop, reboot the instance. Basically it can perform all the instance management operations. The instance management operations are basically categorized as 

In this post, the user should not have privileges to terminate an instance. In my instance, i have a group REST_USERS and all the users except Tenancy Administrator are part of this group. Thus my policy will be like

Allow group REST_USERS to manage instance-family in tenancy

 where request.permission!='INSTANCE_DELETE'

Allow group REST_USERS to use volume-family in tenancy

Allow group REST_USERS to use virtual-network-family in tenancy

Now if the user tries to terminate the instance, he/she will get the error as below

This is how we can protect our compute instance from getting accidentally terminated. In this case, only the tenancy administrator can terminate an instance The other instance management operations such as Start, Stop, Reboot can be performed by other users and thus it is not going to hamper the daily operations.

I hope this post will help someone. Till, then happy learning cloud

Golden gate Extract is not starting because of ORA-28374: typed master key not found in wallet

We had an issue where all of a sudden after the DB bounce, extract was not coming up with errors ORA-28374: typed master key not found in wallet. This GG environment was acting a downstream mining and redo logs were coming from Source SaaS(Oracle Fusion). The first thing i did, is to go through the alert log. Found the trace file from the alert log and got the below warnings being reported.

kcrf_decrypt_redokey: dumping redo key 1344d0d94ad0a8347de7dda9e709dbff ======>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> DB is looking for this key as per trace file

kcrf_decrypt_redokey: dumping mkloc 1 mkid in log header 2f4219da61094fefbfc613ba4b51407a ======>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> DB is looking for this key as per trace file

kcrf_decrypt_redokey: dumping active kcbtsemkloc 1, kcbtsemkid 8655dd60aa2c4f6ebfd407dbecfd5e5b ======>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> DB is looking for this key as per trace file

Now from the information above, how can we know which keys does the DB is referring to

How we can decrypt it:-

SQL> select utl_raw.cast_to_varchar2( utl_encode.base64_encode('01'||'2f4219da61094fefbfc613ba4b51407a')) from dual;

UTL_RAW.CAST_TO_VARCHAR2(UTL_ENCODE.BASE64_ENCODE('01'||'2F4219DA61094FEFBFC613B

--------------------------------------------------------------------------------

AS9CGdphCU/vv8YTuktRQHo=

Run the below command to check existing keys present in wallet

SQL> select key_id from v$encryption_keys;

KEY_ID

------------------------------------------------------------------------------

ARBCnkv3lU/qv7MNJhC2AeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AYZV3WCqLE9uv9QH2+z9XlsAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Thus, we can see that one key is missing and this is the reason why extract is not coming up. So, we got the keys from Source and imported it to our target database using the below command

ADMINISTER KEY MANAGEMENT IMPORT KEYS WITH SECRET "***" FROM 'path where key file have been placed' FORCE KEYSTORE IDENTIFIED BY "YOUR DB WALLET PASSWORD" with backup;

Upon importing the key to our wallet, we were able to successfully start the extract

Hope it helps someone

Monitor oci compute instance using free audit service and perform analysis on a systematic way

There is a service in OCI known as Audit service which records calls to all supported Oracle Cloud Infrastructure public application programming interface (API) endpoints as log events. By default, Audit logs are retained for 365 days. Retention period is a tenancy-level setting. The value of the retention period setting affects all regions and all compartments. The retention period cannot be changed. Currently, all services support logging by Audit.

Information in the logs includes the following:

Time the API activity occurred

Source of the activity

Target of the activity

Type of action

Type of response

In this post, we will stop the instance and through audit service, we will find the details on who did what. 

We will open the compute instance and choose the Audit option

Click on filter options

Once we click on apply, the results will be displayed in below format

Now filter with "POST" 

Click on the drop down option on the right most side,

Expand the "StatusChange" option

Now to know who did it, click on the identity option

Thus in an environment, where you have many users accessing console and doing the activities, the OCI Audit Service helps us to know the details in a much granular manner. I hope this post will be helpful for someone. Till then, happy learning cloud