A customer had to move hundreds of PDBs using AutoUpgrade and refreshable clone PDBs. As a cool customer, they wanted to automate the entire process.

The PDBs are encrypted, so AutoUpgrade needs the source and target TDE keystore passwords. AutoUpgrade stores these passwords in its own keystore until they are needed.

You can manually load the passwords into the AutoUpgrade keystore using the load password console (-load_password).

But loading passwords manually doesn’t fit very well with automation.

The Solution

For security reasons, there is no native way in AutoUpgrade to load these passwords besides typing them manually.

Loading passwords via response files or command line parameters exposes the sensitive information, e.g., in your command history.

But if you accept the risk, you can load passwords using the expect command. You’ll need to place the passwords in clear-text in a file for a short period. When the loading completes, you can remove the file and the passwords are now safely stored in the AutoUpgrade keystore.

Loading Passwords Using Expect

1. Here’s my AutoUpgrade config file called sales.cfg:

   global.autoupg_log_dir=/home/oracle/autoupgrade/logs
   global.keystore=/home/oracle/autoupgrade/keystore
   upg1.sid=CDB19
   upg1.target_cdb=CDB26
   upg1.pdbs=SALES
   upg1.source_home=/u01/app/oracle/product/19.0.0.0/dbhome_1
   upg1.target_home=/u01/app/oracle/product/23.0.0.0/dbhome_1
   upg1.target_pdb_copy_option.SALES=file_name_convert=NONE
   upg1.source_dblink.SALES=CLONE_LINK_SALES 300
   upg1.start_time=01/01/2030 08:03:00
   

   • I’ve configured the location of the AutoUpgrade keystore using the global.keystore parameter.

2. I create an expect file called sales.exp. I set the executable flag and ensures no others can read the file:

   touch /dev/shm/sales.exp
   chmod 700 /dev/shm/sales.exp
   

   • Since the file will contain my passwords, I place it in /dev/shm which is a tmpfs or RAM-based file system. I don’t want the file on persistent storage.

3. I add the following to my expect file.

   #!/usr/bin/expect
   
   spawn java -jar autoupgrade.jar -config sales.cfg -load_password
   expect "Enter password:"
   send -- "MyS3cr3tPassw0rd#\r"
   expect "Enter password again:\r"
   send -- "MyS3cr3tPassw0rd#\r"
   expect "TDE>\r"
   send -- "add CDB19\r"
   expect "Enter your secret/Password:\r"
   send -- "Databas3CDB19#\r"
   expect "Re-enter your secret/Password:\r"
   send -- "Databas3CDB19#\r"
   expect "TDE>\r"
   send -- "add CDB26\r"
   expect "Enter your secret/Password:\r"
   send -- "Databas3CDB26#\r"
   expect "Re-enter your secret/Password:\r"
   send -- "Databas3CDB26#\r"
   expect "TDE>\r"
   send -- "save\r"
   expect "Select auto-login mode for the AutoUpgrade keystore"
   send -- "YES\r"
   expect "TDE>\r"
   send -- "exit\r"
   expect eof	
   

   • Using the spawn command I start the AutoUpgrade load password console.
   • I can wait for AutoUpgrade to print certain information using the expect command.
   • Then I can send the appropriate response – a command or a password – using the send command.
   • Be sure to add the \r at the end of your commands or passwords. All the passwords end with a # so you can see how the control character is appended.
   • This file contains the passwords in clear-text. Make sure the file is protected with restrictive file permissions.

4. I start the password loading using expect:

   expect /dev/shm/sales.exp
   

   • expect starts the AutoUpgrade load password console and inputs the passwords when needed.

5. I remove the expect file:

   rm /dev/shm/sales.exp
   

6. Now that the keystore is populated with the TDE keystore passwords, I can move on with the process.

MOS Credentials For Patch Downloading

Pardon me for sidetracking a bit.

• You can use the same approach to populate the keystore with MOS credentials for patch downloading.
• Here’s an example of an expect file:

  #!/usr/bin/expect
  
  spawn java -jar autoupgrade.jar -patch -config download.cfg -load_password
  expect "Enter password:"
  send -- "MyS3cr3tPassw0rd#\r"
  expect "Enter password again:\r"
  send -- "MyS3cr3tPassw0rd#\r"
  expect "MOS>\r"
  send -- "add -user ash@weyland-yutani.com\r"
  expect "Enter your secret/Password:\r"
  send -- "MyS3cr3tMOSPassw0rd#\r"
  expect "Re-enter your secret/Password:\r"
  send -- "MyS3cr3tMOSPassw0rd#\r"
  expect "MOS>\r"
  send -- "save\r"
  expect "Select auto-login mode for the AutoUpgrade keystore"
  send -- "YES\r"
  expect "MOS>\r"
  send -- "exit\r"
  expect eof
  

  • Replace MyS3cr3tPassw0rd# with the password you want for the AutoUpgrade keystore.
  • Replace ash@weyland-yutani.com with your MOS username.
  • Replace MyS3cr3tMOSPassw0rd# with your MOS password.

That’s It

With expect you can automate the loading of passwords into the AutoUpgrade keystore.

I consider it safer to load passwords manually, but to fully automate the process you must cut a corner.

I suggest using a unique keystore for each of your AutoUpgrade invocations. This makes it easier to automate. AutoUpgrade can also create a shared keystore that you can create once and then distribute to other servers.

Happy upgrading!