Oracle® Secure Enterprise Search

1.1.1 General Requirements for Installing Oracle Software

The following sections describe the general requirements for installing Oracle software:

• Logging In to the System as root

• Required Operating System Group and User

Logging In to the System as root

Before you install Oracle software, you must complete several tasks as the root user. To log in as the root user, complete one of the following procedures:

• If you are installing the software from an X Window System workstation or X terminal, then:

  1. Start a local terminal session, for example, an X terminal (xterm).

  2. If you are not installing the software on the local system, then enter the following command to enable the remote host to display X applications on the local X server:

     $ xhost fully_qualified_remote_host_name
     
     

  3. If you are not installing the software on the local system, then use the ssh, rlogin, or telnet command to connect to the system on which you want to install the software:

     $ telnet remote_host
     
     

  4. If you are not logged in as the root user, then enter the following command to switch user to root:

     $ su - root
     
     

• If you are installing the software from a PC or other system with X server software installed, then:

  Note:

  If required, refer to your X server documentation for more information about completing this procedure. Depending on the X server software that you are using, you may need to complete the tasks in a different order.

  1. Start the X server software.

  2. Configure the security settings of the X server software to permit remote hosts to display X applications on the local system.

  3. Connect to the remote system on which you want to install the software and start a terminal session on that system, for example, an X terminal (xterm).

  4. If you are not logged in as the root user on the remote system, then enter the following command to switch user to root:

     $ su - root
     
     

Required Operating System Group and User

Depending on whether this is the first time Oracle software is being installed on this system and on the products that you are installing, you may need to create the following operating system group and user:

• Oracle Inventory group (typically, oinstall)

  You must create the Oracle Inventory group the first time you install Oracle software on the system. The usual name chosen for this group is oinstall. This group owns the Oracle inventory, which is a catalog of all Oracle software installed on the system.

  Note:

  If Oracle software is already installed on the system, then the existing Oracle Inventory group must be the primary group of the operating system user that you use to install new Oracle software.

• Oracle software owner user (typically, oracle)

  You must create the Oracle software owner user the first time you install Oracle software on the system. This user owns all of the software installed during a given installation. This user must have the Oracle Inventory group as its primary group.

  Note:

  In Oracle documentation, the Oracle software owner user is referred to as the oracle user.

A single Oracle Inventory group is required for all installations of Oracle software on the system. After the first installation of Oracle software, you must use the same Oracle Inventory group for all subsequent Oracle software installations on that system. However, you can choose to create different Oracle software owner users for different installations.

The following sections describe how to create the Oracle Inventory group and the Oracle software owner user:

• Oracle Inventory Group

• Oracle Software Owner User

Oracle Inventory Group

If Oracle software is already installed on the system, then the existing Oracle Inventory group must be the primary group of the operating system user that you use to install new Oracle software. This section describes how to identify an existing Oracle Inventory group and, if required, to create it.

When you install Oracle software on the system for the first time, Oracle Universal Installer creates the oraInst.loc file. This file identifies the name of the Oracle Inventory group and the path of the Oracle Inventory directory. To determine if the Oracle Inventory group exists, enter the following command:

more /var/opt/oracle/oraInst.loc

If the output of this command shows the oinstall group name, then the group already exists.

If the oraInst.loc file exists, then the output from this command is similar to the following:

inventory_loc=/u01/app/oracle/oraInventory
inst_group=oinstall

The inst_group parameter shows the name of the Oracle Inventory group, oinstall.

If the oraInst.loc file does not exist, then enter the following command to create the oinstall group:

# /usr/sbin/groupadd oinstall

Oracle Software Owner User

You must create an Oracle software owner user if any of the following conditions is true:

• An Oracle software owner user does not exist; for example, if this is the first installation of Oracle software on the system.

• An Oracle software owner user exists, but you want to use a different operating system user.

  Note:

  In this document, the Oracle software owner user is referred to as oracle.

To determine if an Oracle software owner user named oracle exists, enter the following command:

# id oracle

If the oracle user exists, then the output from this command is similar to the following:

uid=440(oracle) gid=200(oinstall) groups=201(dba),202(oper)

If the user exists, then determine whether you want to use the existing user or create a new user. If you want to use the existing user, then ensure that the user's primary group is the Oracle Inventory group.

If the Oracle software owner user does not exist or if you require a new Oracle software owner user, then create it as follows:

1. To create the oracle user, enter a command similar to the following:

   # /usr/sbin/useradd -g oinstall[ -G dba] oracle
   
   

   In this command:

   • The -g option specifies the primary group, which must be the Oracle Inventory group, for example oinstall.

   • The -G option specifies optional secondary groups.

2. Set the password of the oracle user as follows:

   # passwd oracle
   
   

If the oracle user exists, but its primary group is not oinstall, then enter a command similar to the following, specifying the primary group using the -g option and any required secondary groups using the -G option:

# /usr/sbin/usermod -g oinstall -G dba oracle

1.1.2 Checking the Software Requirements

The system must meet the following minimum software requirements, depending on your HP-UX PA-RISC distribution and version.

The following patches must be installed:

• For HP-UX 11.11:

  • PHCO_28123: cumulative SAM patch

  • PHKL_29198: Psets Enablement Patch; top(1)

  • PHNE_28476: Cumulative STREAMS Patch

  • PHNE_28923: LAN product cumulative patch

  • PHSS_28871: ld(1) and linker tools cumulative patch

  • PHSS_28880: HP aC++ -AA runtime libraries (aCC A.03.50)

  • PHCO_26331: mountall cumulative patch, Dev IDs enabler

  • PHCO_29109: Pthread enhancement and fixes

  • PHKL_25468: eventport (/dev/poll) pseudo driver

  • PHKL_25842: Thread Abort

  • PHKL_25993: thread nostop for NFS, rlimit, Ufalloc fix

  • PHKL_25994: Thread NOSTOP, Psets Enablement, Ufalloc

  • PHKL_25995: ufalloc;VxFS3.5;SPP fragmentation

  • PHKL_26468: Shared synchronization performance support

  • PHKL_28489: copyin EFAULT, LDCD access type

• For HP-UX 11.23:

  • PHNE_30580 (HMP)

  • PHSS_31072

  • PHSS_30771

  • PHSS_30795

  • PHCO_31820

  • PHSS_31849

  • PHSS_31852

To ensure that the system meets these requirements:

1. To determine the version of HP-UX installed, enter the following command:

   # uname -a
   HP-UX hostname B.11.11 U 9000/800 109444686 unlimited-user license
   
   

   In this example, the version of HP-UX 11i is 11.11.

2. To determine whether the HP-UX 11i Quality Pack is installed, enter the following command:

   # /usr/sbin/swlist -l bundle | grep GOLD
   
   

   If the Quality Pack is not installed, or if the date is before June 2003, download the latest Quality Pack from the following URL and install it:

   http://www.software.hp.com/SUPPORT_PLUS/qpk.html

3. To determine whether a patch is installed, enter a command similar to the following:

   # /usr/sbin/swlist -l patch | grep PHSS_28880
   
   

   Alternatively, to list all installed patches, enter the following command:

   # /usr/sbin/swlist -l patch | more
   
   

   If a required patch is not installed, download it from the following URL and install it:

   http://itresourcecenter.hp.com

1.1.3 Checking the Hardware Requirements

Oracle SES requires a minimum of 3 gigabytes of disk space. This includes 2 gigabytes to install and approximately .5 gigabyte to create the initial Oracle SES index. Additional Oracle SES requirements are based on the amount of data that you need to search. Here are some configuration examples:

To index 100,000 documents:

• 4 gigabytes disk space

• 1 gigabyte RAM

To index 1,000,000 documents:

• 20 gigabytes disk space

• 6 gigabytes RAM

The system must meet the following minimum hardware requirements:

• 512 MB of physical RAM

• 1 GB of swap space (or twice the size of RAM)

  On systems with 2 GB or more of RAM, the swap space can be between one and two times the size of RAM.

• 400 MB of disk space in the /tmp directory

• Between 1.5 GB and 3 GB of disk space for the Oracle software, depending on the installation type and platform.

To ensure that the system meets these requirements, perform the following steps:

1. To determine the physical RAM size, enter the following command:

   # /usr/sbin/dmesg | grep "Physical:"
   
   

   If the size of the physical RAM installed in the system is less than 256 MB, you must install more memory before continuing.

2. To determine the size of the configured swap space, enter the following command:

   # /usr/sbin/swapinfo -a
   
   

   If necessary, see your operating system documentation for information about how to configure additional swap space.

3. To determine the amount of free disk space available in the /tmp directory, enter the following command:

   # bdf /tmp
   
   

   If there is less than 400 MB of disk space available in the /tmp directory, complete one of the following steps:

   • Delete unnecessary files from the /tmp directory to achieve the required disk space.

   • Set the TEMP and TMPDIR environment variables when setting the oracle user's environment (described later).

   • Extend the file system that contains the /tmp directory. If necessary, contact your system administrator for information about extending file systems.

4. To determine the amount of free disk available on the system, enter the following command:

   # bdf
   
   

   This command displays the disk space usage on all mounted file systems. To complete the installation, identify a file system with sufficient disk space.

5. To determine whether the system architecture is 64-bit, enter the following command:

   # /bin/getconf KERNEL_BITS
   
   

   This command should return the following output. If you do not see the expected output, you cannot install the software on this system.

For installation help, including pre-installation tips, see the Oracle SES tutorial:

http://st-curriculum.oracle.com/tutorial/SESAdminTutorial/index.htm

1.1.4 Configuring Kernel Parameters

Verify that the following kernel parameters are set either to the formula shown, or to values greater than or equal to the recommended value shown:

To view the current value or formula specified for these kernel parameters, and to change them if necessary, follow these steps:

1. Optionally, set the DISPLAY environment variable to specify the display of the local system:

   • Bourne, Bash, or Korn shell:

     $ DISPLAY=local_host:0.0 ; export DISPLAY
     
     

   • C shell:

     % setenv DISPLAY local_host:0.0
     
     

2. Start System Administration Manager (SAM):

   # /usr/sbin/sam
   
   

3. Choose the Kernel Configuration area, then choose the Configurable Parameters area.

4. Check the value or formula specified for each of these parameters and, if necessary, modify that value or formula.

   If necessary, see the SAM online help for more information about completing this step.

5. Exit from SAM.

   If you modified the value specified for any static parameter, you must rebuild the kernel and reboot the system.

6. If necessary, when the system restarts, log in and switch user to root.

1.1.5 Installing on a Port Number Less Than 1024

Oracle SES must be installed by a non-root user. However, UNIX operating systems require that only root users can bind to ports less than 1024. Follow these steps to install Oracle SES on a port number less than 1024:

1. During installation, specify a port greater than or equal to 1024 (for example, 7777).

2. After the installation is complete, follow the instructions in the following section, "Changing the Oracle SES Middle Tier Port", to change to a port number less than 1024 (for example, 80).

1.1.6 Changing the Oracle SES Middle Tier Port

To change the Oracle SES middle tier port, follow these steps:

1. Shutdown the middle tier with the following command:

   $ORACLE_HOME/bin/searchctl stop
   
   

2. Edit the value for the port attribute in $ORACLE_HOME/oc4j/j2ee/OC4J_SEARCH/config/http-web-site.xml. (Make sure that the new port is not already in use.)

3. To change to a port less than 1024:

   1. Run chgrp -R root $ORACLE_HOME/jdk

   2. Log on as the root user and perform step 5.

4. To change from a port that was less than 1024 to a port that is greater than or equal to 1024:

   1. Log on as the root user.

   2. Run the following:

      chown -R <user> $ORACLE_HOME/search/opmn
      $ORACLE_HOME/oc4j/j2ee/OC4J_SEARCH/persistence
      
      

      where <user> is the user that installed Oracle SES

   3. Log off from root user and log on as the user that installed Oracle SES.

5. Start the middle tier with the following command:

   $ORACLE_HOME/bin/searchctl start
   

1.2.1 Mounting the DVD-ROM

Follow these steps if your computer does not automount the DVD-ROM:

1. Place the DVD in the DVD drive.

2. Log in as the root user and create a DVD mount point directory, if one does not already exist, by using the following commands:

   $ su -root
   /usr/bin/mkdir /SD_DVDROM
   
   

   Note:

   Use the following command to determine the device name:

   $ ioscan -fun -C disk
   

   The output is similar to the following:

   disk 10 10/12/5.2.0 sdisk CLAIMED DEVICE TOSHIBA DVD-ROM XM-5701TA
   /dev/dsk/c0t6d0 /dev/rdsk/c0t6d0
   
   

   If there is no entry in the /etc/pfs_fstab file for your DVD device, then you must add one. As the root user, use a system editor to add a line to the /etc/pfs_fstab file following this format:

   device_file mount_point filesystem_type
   
   

   In the preceding format, the first entry is the DVD device and the second entry indicates the mount point. The device_file in this example is /dev/dsk/c0t6d0. For a DVD device with the path /dev/dsk/c0t6d0, enter the following:

   /dev/dsk/c0t6d0 /SD_DVDROM pfs-rrip xlat=unix 1 0
   
   

3. Mount the DVD by entering the following command:

   # /usr/sbin/mount -F cdfs -o rr /dev/dsk/cxdytz /SD_DVDROM
   
   

   In the preceding example, /SD_DVDROM is the disc mount point directory and /dev/dsk/cxdytz is the device name for the disc device, for example /dev/dsk/c0d6t0.

4. Log out of the root account.

   # exit
   
   

1.3.1 Selecting a Response File

Before performing a silent installation, you must provide information specific to your installation in a response file. The installer will fail if you attempt an installation using a response file that is not configured correctly. Response files are text files that you can create or edit in a text editor.

The Oracle SES DVD provides the following templates for the Oracle Universal Installer response files:

Response files are located in the /response directory on Disk 1 of the Oracle SES DVD. You must edit the response file according to your requirements for silent installation.

To use a response file, first copy it from the DVD to your system. For example:

1. Go to the /response directory

2. Copy the server.rsp file to your system hard drive:

   # cp server.rsp /private/ses/response/server.rsp
   

1.3.2 Editing the Response File

Use any text editor to edit the response file to include information specific for your system. You must specify values for variables in your response file. Each variable listed in the response file is associated with a comment, which identifies the variable type. For example:

string = "Sample Value"
Boolean = True or False
Number = 1000
StringList = {"StringValue 1", "String Value 2"}

The values that are given as <Value Required> must be specified for silent installation. Remove the comment from the variable values in the response file before starting the Oracle SES installation.

1.3.3 Specifying a Response File and Starting the Installation

Before you specify a response file, ensure that all the values in the response file are correct. To make Oracle Universal Installer use the response file at installation time, specify the location of the response file as a parameter when starting Oracle Universal Installer. To perform a silent installation, use the -silent parameter:

# ./runInstaller -silent -responseFile absolute_path_and_filename

The success or failure of silent installations is logged in the installActions.log file. Additionally, the silent installation creates the silentInstall.log file. The log files are created in the $ORACLE_HOME/oraInventory/logs directory.

The silentInstall<Date_Time>.log file contains the following line if the installation was successful:

The installation of Oracle Secure Enterprise Search was successful.

The corresponding installActions<Date_Time>.log file contains specific information regarding installation.

1.3.4 Security Tips for Silent Installations

The response file contains the installation password in clear text. To minimize security issues, follow these guidelines:

• Set the permissions on the response files so that they are readable only by the operating system user performing the silent installation.

• If possible, remove the response files from the system after the silent installation is completed.

1.3.5 Error Handling

Values for variables that are of the wrong context, format, or type are treated as if no value were specified. Variables that are outside any section are ignored.

If you attempt a silent installation with an incorrect or incomplete response file, or if Oracle Universal Installer encounters an error, such as insufficient disk space, the installation fails.

1.4.1 Certifications and Patches

The Oracle SES administration tool and default query application are certified on the following browsers:

• Firefox 1.0, 1.0.1, 1.0.6, 1.0.7, 1.5

• Internet Explorer 6.0

• Netscape 7.1, 7.2

• Mozilla 1.7.3

The requirements and certifications included in this installation guide were current at the time this guide was published. See the certification matrix on the OracleMetalink Web site for the most up-to-date information.

2.1.1 Backing Up the Oracle SES 10.1.6 Instance

There is no downgrade support from 10.1.8. Before upgrading, first shutdown Oracle SES, then back up the 10.1.6 ORACLE_HOME directory, the oradata directory, and the entire oraInventory directory to a different location. (The oraInventory directory is a central inventory of all Oracle homes. Its location is specified in /var/opt/oracle/oraInst.loc.)

For example:

$ORACLE_HOME/bin/searchctl stopall
cd ~
msu password
tar cvf ses.tar {$ORACLE_HOME} 
tar cvf ses.tar {oraInventory} 
tar cvf ses.tar {oradata}

If the upgrade should fail, then restore your 10.1.6 instance by cleaning up the ORACLE_HOME, oradata, and oraInventory directories and using the tar command to copy them back to the same location. For example:

tar xvf ses.tar {$ORACLE_HOME} 
tar xvf ses.tar {oraInventory} 
tar xvf ses.tar {oradata}

After your 10.1.6 environment is back, you can retry the 10.1.8 upgrade.

2.1.2 Upgrading on a Port Number Less than 1024

If the 10.1.6 installation is bound to a port number less than 1024, then first change the Oracle SES middle tier port to a port number greater than 1024. After the upgrade completes, you can change the Oracle SES middle tier port back to a port number less than 1024.

2.1.3 Moving QTA Jar Files

For any custom query-time authorization (QTA) jar files in the 10.1.6 Oracle home directory, manually move them into the new Oracle home directory or into an entirely new location. Also, for any sources that used these QTA jar files, update the location in the Jar File Name field on the Home - Sources - Authorization page. This protects you from inadvertently deleting these jar files if you remove the old Oracle home directory after the upgrade process.

2.4.1 Migrating Federated Sources

To migrate federated sources in the 10.1.6 installation, you must edit each federated source in the 10.1.8 installation. On the Home - Sources - Customize Federated Source page, enter the Web services URL for the source.

After editing the source, you can have public federated search on the remote Oracle SES instances. For secure federated search, see the section "Setting Up Secure Federated Search" in the Oracle Secure Enterprise Search Administrator's Guide. If the remote Oracle SES instances are using the 10.1.6 installation, then they also need to be upgraded to 10.1.8 for secure federated search to work.

2.4.2 Migrating Single Sign-On Configuration

If the 10.1.6 Oracle SES instance had been configured to use a single sign-on URL to access the Oracle SES search page and administration tool, then do the following to migrate the configuration to 10.1.8:

1. Edit the $ORACLE_HOME/oc4j/j2ee/OC4J_SEARCH/config/http-web-site.xml file. In the element web-site, change the attribute protocol from "http" to "ajp13":

   <web-site ... protocol="ajp13" ... >
   
   

2. Restart the Oracle SES middle tier using searchctl restart.

3. Configure mod_osso to protect the search with SSO. Add the following lines to $AS_HOME/Apache/Apache/conf/mod_osso.conf within the IfModule element:

   <Location /search/query/formlogin.uix>
     require valid-user
     AuthType Basic
   </Location>
   
   

4. Restart Oracle HTTP Server. On the OracleAS middle tier host, run the following command:

   $AS/opmn/bin/opmnctl restartproc process-type=HTTP_Server
    
   opmnctl: restarting opmn managed processes...
   

2.4.3 Changes in 10.1.8

• If 10.1.6 was connected to Oracle Internet Directory, then after upgrade, you may see "orclApplicationCommonName=oesEntity_ ... " in the user name on the Global Settings - Identity Management Setup page. This user was created implicitly by Oracle SES 10.1.6 when the instance connected to Oracle Internet Directory, and it was used internally for Oracle Internet Directory authentication and authorization. After upgrade, 10.1.8 continues to use the user for Oracle Internet Directory authentication and authorization.

• In 10.1.6, the jar files for custom crawler plug-ins were located in the $ORACLE_HOME/search/lib/agent directory. This directory does not exist in 10.1.8. These jar files from 10.1.6 were migrated to the $ORACLE_HOME/search/lib/plugins directory.