ahf security

9.5.7 ahf security

Use the ahf security command to manage AHF users.

AHF 25.1

Secure SSH Key Storage

SSH Keys are often required for secure access to resources automatically. However, storing these keys on systems can pose potential security risks.

AHF can now generate and securely store SSH keys for remote components used by Oracle Orachk and Oracle Exachk. These keys are encrypted and stored within the AHF wallet, ensuring they are protected from unauthorized access. AHF automatically detects the configured SSH keys for a remote system and uses them to login.

To create and add SSH key with password:

ahf security add-credentials --node NODE --user-name USER --type ssh-key --generate-ssh-key --password

To add SSH key from a file path with password:

ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file <FILEPATH> --password

To add an already added SSH key with password:

ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file <FILEPATH> --password

ahf security add-credentials --node NODE --user-name USER --type ssh-key --generate-ssh-key --password

To create and add SSH key for passwordless setup:

ahf security add-credentials --node NODE --user-name USER --type ssh-key --generate-ssh-key

To add SSH key from a file path for passwordless setup:

ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file <FILEPATH>

To add SSH key from a file path where the key is already added to remote host:

ahf security add-credentials --node NODE --user-name USER --type ssh-key --ssh-key-file <FILEPATH>

To remove SSH key:

ahf security remove-credentials --node NODE --user-name USER --type ssh-key

To check SSH key:

ahf security check-credentials --node NODE --user-name USER --type ssh-key

To get stored SSH key:

ahf security get-credentials --node NODE --user-name USER --type ssh-key

Credential Management

This release introduces improvements to the ahf security command category, streamlining the management of credentials used to log in to remote machines or nodes.

To add and store password for a node or a list of nodes, use:

ahf security add-credentials --type password [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]

To remove the stored password for a node or a list of nodes, use:

ahf security remove-credentials --type password [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]

To get the stored password for a node or a list of nodes, use:

ahf security get-credentials --type password [--node NODE] [--nodes NODES-LIST][--user-name USER] [--exacli]

To check if a password is set for a node or a list of nodes, use:

ahf security check-credentials --type password [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]

Syntax: ahf security

ahf security action [options]
Action: add-user,remove-user,promote-user,demote-user,grant-role,revoke-role,list-users,reset-users,block-user,unblock-user, add-credentials, remove-credentials, get-credentials, check-credentials

Action	Description
`add-user`	Adds a user to the AHF access list. Usage: `ahf security add-user --user USER_NAME`
`remove-user`	Removes a user from the AHF access list. Usage: `ahf security remove-user [--user USER_NAME\|--all]`
`promote-user`	Promotes a user to have admin access to AHF. Usage: `ahf security promote-user --user USER_NAME`
`demote-user`	Demotes a user from having admin access to AHF. Usage: `ahf security demote-user --user USER_NAME`
`grant-role`	Grants a role to a non-root user. Usage: `ahf security grant-role --user USER_NAME --role ROLE`
`revoke-role`	Revokes the role granted to a non-root user. Usage: `ahf security revoke-role --user USER_NAME --role ROLE`
`list-users`	Prints the list of users. Usage: `ahf security list-users`
`reset-users`	Resets the AHF access list to default AHF users. Usage: `ahf security reset-users`
`block-user`	Blocks the specified user's access to AHF. Usage: `ahf security block-user --user USER_NAME`
`unblock-user`	Unblocks the specified blocked user's access to AHF. Usage: `ahf security unblock-user --user USER_NAME`
`add-credentials`	Adds and stores the password or SSH key for a specified node or a list of nodes. Usage: `ahf security add-credentials --type password\|ssh-key [--generate-ssh-key] [--ssh-key-file PATH] [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]`
`remove-credentials`	Removes the stored password or SSH key for a specified node or a list of nodes. Usage: `ahf security remove-credentials --type password\|ssh-key [--generate-ssh-key] [--ssh-key-file PATH] [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]`
`get-credentials`	Gets the stored password or SSH key for a specified node or a list of nodes. Usage: `ahf security get-credentials --type password\|ssh-key [--generate-ssh-key] [--ssh-key-file PATH] [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]`
`check-credentials`	Checks the password or SSH key for a specified node or a list of nodes. Usage: `ahf security check-credentials --type password\|ssh-key [--generate-ssh-key] [--ssh-key-file PATH] [--node NODE] [--nodes NODES-LIST] [--user-name USER] [--exacli]`

Table 9-131 ahf security add-user

Option	Description
`--to-json`	Prints the output in JSON format.
`--user USER_NAME`	Specifies the user to add.

Table 9-132 ahf security remove-user

Option	Description
`--to-json`	Prints the output in JSON format.
`--user USER_NAME`	Specifies the user to remove.
`--all`	Specifies to remove all users.

Table 9-133 ahf security promote-user

Option	Description
`--to-json`	Prints the output in JSON format.
`--user USER_NAME`	Specifies the user to promote.

Table 9-134 ahf security demote-user

Option	Description
`--to-json`	Prints the output in JSON format.
`--user USER_NAME`	Specifies the user to demote.

Table 9-135 ahf security grant-role

Option	Description
`--to-json`	Prints the output in JSON format.
`--user USER_NAME`	Specifies the user required to run this command.
`--role ROLE`	Specifies the role to grant to the user.

Table 9-136 ahf security revoke-role

Option	Description
`--to-json`	Prints the output in JSON format.
`--user USER_NAME`	Specifies the user required to run this command.
`--role ROLE`	Specifies the role to revoke from the user.

Table 9-137 ahf security list-users

Option	Description
`--to-json`	Prints the output in JSON format.

Table 9-138 ahf security reset-users

Option Description

Option	Description
`--to-json`	Prints the output in JSON format. The default users are the DB/CRS owner and the installer user.

--to-json

Prints the output in JSON format.

The default users are the DB/CRS owner and the installer user.

Table 9-139 ahf security block-user

Option	Description
`--to-json`	Prints the output in JSON format.
`--user USER_NAME`	Specifies the user to block.

Table 9-140 ahf security unblock-user

Option	Description
`--to-json`	Prints the output in JSON format.
`--user USER_NAME`	Specifies the user to unblock.

Table 9-141 ahf security add-credentials

Option	Description
`--to-json`	Prints the output in JSON format.
`--type TYPE`	Specifies the type of security: `password` \| `ssh-key`. Options for `--type password`: `--node` `--nodes NODES-LIST` `--user-name USER` `--exacli` Options for `--type ssh-key`: `--node NODE` `--nodes NODES-LIST` `--user-name USER` `--generate-ssh-key` `--ssh-key-file PATH` `--password`
`--node NODE`	Specifies the node.
`--nodes NODES-LIST`	Specifies the comma-delimited list of nodes
`--user-name USER`	Specifies the user for whom you want to set password.
`--exacli`	Specifies to set password for `exacli` user of a cell.
`--generate-ssh-key`	Specifies to generate the SSH key pair.
`--ssh-key-file PATH`	Specifies the path to the existing SSH key file.
`--password`	Prompts for password to log in to the remote system.

Table 9-142 ahf security remove-credentials

Option	Description
`--to-json`	Prints the output in JSON format.
`--type TYPE`	Specifies the type of security: `password` \| `ssh-key`. Options for `--type password`: `--node` `--nodes NODES-LIST` `--user-name USER` `--exacli` Options for `--type ssh-key`: `--node NODE` `--nodes NODES-LIST` `--user-name USER` `--generate-ssh-key` `--ssh-key-file PATH` `--password`
`--node NODE`	Specifies the node.
`--nodes NODES-LIST`	Specifies the comma-delimited list of nodes
`--user-name USER`	Specifies the user for whom you want to remove password.
`--exacli`	Specifies to remove password for `exacli` user of a cell.
`--generate-ssh-key`	Specifies to generate the SSH key pair.
`--ssh-key-file PATH`	Specifies the path to the existing SSH key file.
`--password`	Prompts for password to log in to the remote system.

Table 9-143 ahf security get-credentials

Option	Description
`--to-json`	Prints the output in JSON format.
`--type TYPE`	Specifies the type of security: `password` \| `ssh-key`. Options for `--type password`: `--node` `--nodes NODES-LIST` `--user-name USER` `--exacli` Options for `--type ssh-key`: `--node NODE` `--nodes NODES-LIST` `--user-name USER` `--generate-ssh-key` `--ssh-key-file PATH` `--password`
`--node NODE`	Specifies the node.
`--nodes NODES-LIST`	Specifies the comma-delimited list of nodes
`--user-name USER`	Specifies the user for whom you want to fetch password.
`--exacli`	Specifies to fetch password for `exacli` user of a cell.
`--generate-ssh-key`	Specifies to generate the SSH key pair.
`--ssh-key-file PATH`	Specifies the path to the existing SSH key file.
`--password`	Prompts for password to log in to the remote system.

Table 9-144 ahf security check-credentials

Option	Description
`--to-json`	Prints the output in JSON format.
`--type TYPE`	Specifies the type of security: `password` \| `ssh-key`. Options for `--type password`: `--node` `--nodes NODES-LIST` `--user-name USER` `--exacli` Options for `--type ssh-key`: `--node NODE` `--nodes NODES-LIST` `--user-name USER` `--generate-ssh-key` `--ssh-key-file PATH` `--password`
`--node NODE`	Specifies the node.
`--nodes NODES-LIST`	Specifies the comma-delimited list of nodes
`--user-name USER`	Specifies to check if password is set for the specified.
`--exacli`	Specifies to check if password is set for `exacli` user of a cell.
`--generate-ssh-key`	Specifies to generate the SSH key pair.
`--ssh-key-file PATH`	Specifies the path to the existing SSH key file.
`--password`	Prompts for password to log in to the remote system.

Parent topic: Running Unified AHF CLI Administration Commands