4 Oracle Database Companion CD Postinstallation Tasks

4.2.3.1 Step1: Copying and Opening the httpd.conf File

Copy the Oracle HTTP Server configuration httpd.conf file used by the previous release to the current release configuration file directory.

To copy and open the http.conf file:

1. Change directory to the configuration file directory for the current release of Oracle HTTP Server:

   c:\> cd ORACLE_BASE\ORACLE_HOME\Apache\Apache\conf
   

2. Back up the httpd.conf file:

   c:\> copy httpd.conf httpd.conf.orig
   

3. Back up the configuration file directory for the current release of Oracle HTTP Server:

   c:\> copy ORACLE_BASE\ORACLE_HOME\Apache\Apache\conf ORACLE_BASE\ORACLE_HOME
   

4. Change directory to the configuration file directory:

   c:\> cd ORACLE_BASE\ORACLE_HOME\Apache\Apache\conf
   

5. Copy the httpd.conf file used by the previous release to the current directory, for example:

   c:\> copy \OLD_ORACLE_HOME\Apache\Apache\conf\httpd.conf
   

6. Open the httpd.conf file in any text editor.

4.2.3.2 Step 2: Making Global Changes

To make the following global changes to the httpd.conf file:

1. Search for all occurrences of the old Oracle home directory path and replace them with the current Oracle home directory path.

2. Change all occurrences of mod_ssl.c to mod_ossl.c.

   Note:

   Oracle recommends that you change the SSL related directives in the httpd.conf file, even if SSL is not used.

4.2.3.3 Step 3: Modifying the List of LoadModule Directives

To modify the list of LoadModule directives:

1. Remove the following directives:

   LoadModule oprocmgr_module    libexec\liboprocmgr.so
   LoadModule rewrite_module     libexec\mod_rewrite.so
   

   
   

   Note: You must add a LoadModule directive for the mod_rewrite module later in the file.

   
   

2. Add the following directive, which loads the onsint module, immediately before the <IfDefine SSL> section:

   LoadModule onsint_module      libexec\mod_onsint.so
   

3. In the LoadModule directive in the <IfDefine SSL> section, change ssl_module to ossl_module and change mod_ssl.so to mod_ossl.so, as follows:

   LoadModule ossl_module      libexec\mod_ossl.so
   

4.2.3.4 Step 4: Removing Directives and Sections for Unsupported Features

To remove all directives and sections for unsupported features:

1. Remove the following directives from the <IfModule mod_alias.c> section:

   Alias /jservdocs/ "\ORACLE_BASE\ORACLE_HOME\Apache\Jserv\docs\"
   Alias /soapdocs/ "\ORACLE_BASE\ORACLE_HOME\soap\"
   

2. Remove the following directive from the <IfModule mod_fastcgi> section:

   FastCGIServer fcgi-bin/echo -initial-env ORACLE_HOME \
                                -initial-env NLS_LANG
   

3. Remove the following include directive:

   include "/ORACLE_BASE/ORACLE_HOME/Apache/Jserv/etc/jserv.conf"
   

4. Remove the <IfModule mod_oprocmgr.c> section.

4.2.3.5 Step 5: Modifying Port Numbers

The httpd.conf file is used by previous releases of Oracle HTTP Server that were installed with Oracle HTTP Server or Oracle Database. This file specifies different ports for non-SSL (HTTP) requests depending on whether you started an SSL-enabled server. These ports are shown as port1 and port2 in the following example:

Port port1
Listen port1

<IfModule mod_ossl.c>
  Port port2
  Listen port2
  Listen SSL_port
</IfModule>

To modify the port numbers:

1. If you did not use SSL, remove the following directives:

   Port port2
   Listen port2
   

   Oracle HTTP Server listens for HTTP requests on port port1.

2. If you used only the ports defined for SSL, change the directives as shown in the following example:

   Port port2
   Listen port2
   
   <IfModule mod_ossl.c>
     Listen SSL_port
   </IfModule>
   

   Oracle HTTP Server listens for HTTP requests on port port2 and for HTTPS requests on port SSL_port.

3. If you intend to continue using the previous version of Oracle HTTP Server concurrently with this release, change the ports specified by the Port and Listen directives to unused ports.

4. If you changed SSL_port in the previous step, complete the following steps:

   1. Locate the <VirtualHost _default_:SSL_port> directive and ensure that the value of SSL_port matches the value specified by the Listen directive in the <IfModule mod_ossl.c> section.

   2. In the <VirtualHost _default_:SSL_port> section, ensure that the port number specified by the Port directive equals SSL_port.

4.2.3.6 Step 6: Modifying Existing Sections and Directives

To modify the following sections and directives in httpd.conf:

1. In the default directory section, <Directory />, add the MultiViews option to the Options directive. For example:

   <Directory />
       Options FollowSymLinks MultiViews
       AllowOverride None
   </Directory>
   

2. In the <IfModule mod_alias.c> section, create a new <IfModule mod_perl.c> section and move the Alias directive that defines the /perl/ alias into this section. For example:

   <IfModule mod_alias.c>
   ...
       <IfModule mod_perl.c>
           Alias /perl/ "\ORACLE_BASE\ORACLE_HOME\Apache\Apache\cgi-bin\"
       </IfModule>
   ...
   </IfModule>
   

3. Modify the <IfModule mod_dms.c> section as shown in the following example, substituting the appropriate values for the hostname and domain variables:

   <IfModule mod_dms.c>
     <Location /dms0>
       SetHandler dms-handler
       Order deny,allow
       Deny from all
       Allow from localhost hostname.domain hostname
     </Location>
   </IfModule>
   

4. In the directive that sets the PERL5LIB environment variable, edit the Perl directory location and version, as shown in the following example:

   SetEnv PERL5LIB "\ORACLE_BASE\ORACLE_HOME\perl\5.6.1\lib:\ORACLE_BASE\ORACLE_HOME\perl\site\5.6.1\lib"
   

   Enter this setting on one line.

4.2.3.7 Step 7: Adding New Sections and Directives

To add the following new sections and directives to the http.conf file:

1. Add the following section to protect the WEB-INF directories:

   #Protect WEB-INF directory
   
   <DirectoryMatch /WEB-INF/>
    Order deny,allow
    Deny from all
   </DirectoryMatch>
   

2. Add the following lines before the line that includes the oracle_apache.conf file:

   # Include the configuration files needed for mod_oc4j
   include "\ORACLE_BASE\ORACLE_HOME\Apache\Apache\conf\mod_oc4j.conf"
   
   # Loading mod_rewrite module here as it loads before mod_oc4j
   LoadModule rewrite_module     modules/ApacheModuleRewrite.dll
   

4.2.3.8 Step 8: Migrating Your Server Certificate and Private Key

If you use SSL and have an existing server certificate and private key, you must migrate them to the format required by mod_ossl before using them with this release of Oracle HTTP Server.

To migrate an existing server certificate and private key:

1. Enter a command using the following syntax in a separate terminal window:

   \ORACLE_BASE\ORACLE_HOME\Apache\Apache\bin\ssl2ossl -cert cert_file \
                                                       -key key_file \
                                                    {[ -chain chain_file] |
                                                     [ -cafile CA_file] |
                                                     [ -capath CA_path] }\
                                                       -wallet wallet_path \
                                                     [ -certpass key_file_pwd] 
                                                     [ -wltpass wallet_pwd] \
                                                     [ -ssowallet yes] \
                                                     [ -validate yes]
   

   The following table lists the recommended value for each option available with the ssl2ossl command:

   Note:

   You must specify at least one option: -chain, -cafile, or -capath.

   Option	Recommended Value
   -cert	Use the value specified by the SSLCertificateFile directive in the httpd.conf file for the previous release.
   -key	Use the value specified by the SSLCertificateKeyFile directive in the httpd.conf file for the previous release.
   -chain	Use the value specified by the SSLCertificateChainFile directive in the httpd.conf file for the previous release, if that directive is not preceded by the comment character (#). Note: If the SSLCertificateChainFile directive is not specified or is preceded by a comment character, do not specify the -chain option.
   -cafile	Use the value specified by the SSLCACertificateFile directive in the httpd.conf file for the previous release. Note: If the SSLCACertificateFile directive is not specified or is preceded by a comment character, do not specify the -cafile option.
   -capath	Use the value specified by the SSLCACertificatePath directive in the httpd.conf file for the previous release. Note: If the SSLCACertificatePath directive is not specified or is preceded by a comment character, do not specify the -capath option.
   -wallet	Specify the path to the directory in which you want to create the wallet. The default value is: \ORACLE_BASE\ORACLE_HOME\Apache\Apache\conf\ssl.wlt\default
   -certpass	Specify the password for your private key file, if it is encrypted.
   -wltpass	Specify a password for your new wallet. If you do not specify this option, the ssl2ossl utility prompts you to enter and verify the wallet password.
   -ssowallet	Specify the value yes to create a wallet that is compatible with Oracle Single Sign-On.
   -validate	Specify the value yes to verify that the wallet to be converted successfully. If you specify this option with the value yes, the wallet is not created.

   
   

2. Optionally, enter a command similar to the following to generate an encrypted version of the wallet password you specified in the ssl2ossl command:

   ORACLE_BASE\ORACLE_HOME\Apache\Apache\bin\iasobf -p wallet_pwd
   

   Note:

   If you specify the -ssowallet option in the ssl2ossl command, you do not complete this step. Otherwise, because the password must be specified in the httpd.conf file, Oracle recommends that you encrypt it.

   The output from this command is the encrypted version of the password specified by the -p option. In the following section, you must specify this value for the SSLWalletPassword directive.

4.2.3.9 Step 9: Modifying the Secure Socket Layer Sections and Directives

Make the following changes to the directives contained in the <IfModule mod_ossl.c> sections:

1. Change the setting for the SSLSessionCache directive as follows:

   SSLSessionCache shmcb:/ORACLE_BASE/ORACLE_HOME/Apache/Apache/logs/ssl_scache(512000)
   

2. Change the setting for the SSLCipherSuite directive as follows:

   SSLCipherSuite SSL_RSA_WITH_RC4_128_MD5:SSL_RSA_WITH_RC4_128_SHA:SSL_RSA_WITH_3DES_EDE_CBC_SHA:SSL_RSA_WITH_DES_CBC_SHA:SSL_RSA_EXPORT_WITH_RC4_40_MD5:SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
   

3. Remove the following directives and their associated comments:

   SSLRandomSeed
   SSLCertificateFile
   SSLCertificateKeyFile
   SSLCertificateChainFile
   SSLCACertificateFile
   SSLCACertificatePath
   SSLVerifyDepth
   

4. In the <VirtualHost _default_:SSL_port> section, add the following lines:

   #   Server Wallet:
   #   The server wallet contains the server's certificate, private key
   #   and trusted certificates. Set SSLWallet at the wallet directory
   #   using the syntax:  file:<path-to-wallet-directory>
   SSLWallet file:\ORACLE_BASE\ORACLE_HOME\Apache\Apache\conf\ssl.wlt\default
   
   #   Server Wallet Password:
   #   Both clear text wallet password and obfuscated password are allowed
   #   here. An obfuscated one is recommended.
   #   Examples:
   #   SSLWalletPassword <clear_pass>
   #   SSLWalletPassword <obfuscated_pass>
   #SSLWalletPassword ...
   

5. If you migrated a server certificate and private key, complete the following steps:

   1. Change the value specified by the SSLWallet directive to specify the wallet path, if it is different from the default value.

   2. If you did not create a wallet that is compatible with Oracle Single Sign-On (using the -ssowallet yes option in the previous section), remove the comment from the SSLWalletPassword directive and specify the clear-text or encrypted wallet password as its value.

4.2.3.10 Step 10: Copying or Moving the Required Files to New Directories

Copy (or move) any scripts for files from the document root and script directories to the equivalent directories for the new release.

You must copy or move only files that are located in subdirectories of the previous release Oracle home directory. Alias directories in other locations continue to be accessible, because the permissions on these directories and their contents enables the server to read them. If you changed the User or Group directive, you must change these permissions.

Copy the following files, as appropriate

• Files and subdirectories in directories specified by a DocumentRoot or Alias directive

• CGI, Perl, and FastCGI programs and scripts and their associated files in directories specified by a ScriptAlias directive

4.3.2.1 Oracle HTTP Server Release 9.0.3

If you are upgrading Oracle HTML DB and run the version of Oracle HTTP Server included with Oracle Database release 9.2.0.x, you must modify the parameter password in the wdbsvr.app file.

To modify the parameter password in the wdbsvr.app file:

1. Use a text editor and open the wdbsvr.app file.

   ORACLE_BASE\ORACLE_HOME\Apache\modplsql\cfg\wdbsvr.app
   

2. Find the DAD settings for Oracle HTML DB by searching for the following:

   DAD_htmldb
   

3. Edit value next to the parameter password to match the password you provided during the installation.

4. Save your changes.

5. Stop and restart Oracle HTTP Server:

   • Stop Oracle HTTP Server: From the Start menu, select Programs, Oracle - OraHome, Oracle HTTP Server, and Stop HTTP Server.

   • Restart Oracle HTTP Server: From the Start menu, select Oracle - OraHome, Oracle HTTP Server, and Start HTTP Server.

4.3.2.2 Oracle HTTP Server 10g Release 1

If you are upgrading Oracle HTML DB and run Oracle HTTP Server 10g release 1, you must modify the parameter PlsqlDatabasePassword in the marvel.conf file.

To modify the parameter PlsqlDatabasePassword in the marvel.conf file:

1. Use a text editor and open the marvel.conf file:

   ORACLE_BASE\ORACLE_HOME\Apache\modplsql\conf\marvel.conf
   

2. Find the DAD settings for Oracle HTML DB by searching for the following:

   /pls/htmldb
   

3. Modify the value of the parameter PlsqlDatabasePassword to match the password you provided during installation.

4. Save your changes.

5. Stop and restart Oracle HTTP Server:

   ORACLE_BASE\ORACLE_HOME\opmn\bin\opmnctl stopproc ias-component=HTTP_Server
   ORACLE_BASE\ORACLE_HOME\opmn\bin\opmnctl startproc ias-component=HTTP_Server
   

4.3.3.1 Obfuscating Passwords in a New Oracle HTML DB Installation

In a new Oracle HTML DB installation, the PlsqlDatabasePassword parameter is found in the dads.conf file. To obfuscate passwords in a new installation, run the dadTool.pl utility by following the instructions in the dadTool.README file.

4.3.3.2 Obfuscating Passwords if Upgrading Oracle HTML DB

If you have upgraded from a previous release of Oracle HTML DB, the DAD information is in the file marvel.conf. Before you can run the dadTool.pl script, you must copy the DAD entry from the marvel.conf file to the dads.conf file.

To obfuscate passwords when upgrading:

1. Use a text editor and copy the entry for /pls/htmldb from the marvel.conf file into the dads.conf file, located in:

   ORACLE_BASE\ORACLE_HOME\Apache\modplsql\conf\dads.conf
   

2. Run dadTool.pl by following the instructions in the dadTool.README file.

3. Copy the entry for /pls/htmldb from the dads.conf file back into marvel.conf.

4. Remove the entry for /pls/htmldb from the dads.conf file.

4.3.4.1 Requirements for Running htmldbca

To use htmldbca, you must have the following requirements in place:

• A local Oracle Database Companion CD installation that has HTML DB installed. The htmldbca executable is in the bin directory in the same Oracle home as Oracle HTML DB.

• A remote Oracle database. This database can be on the same computer as the Oracle HTML DB home or on an Oracle database installation on a remote computer. You must have a valid connection to this remote Oracle database installation.

• Connection privileges to the remote Oracle database. You should be able to connect as SYS using the SYSDBA privilege. htmldbca prompts you for the password for user SYS.

  See Also:

  Oracle Database Net Services Administrator's Guide for information on connecting to another Oracle database

4.3.4.2 Syntax for htmldbca

The syntax for htmldbca is as follows:

htmldbca [options]

where options are:

• -oracle_home string: Enter the location of the Oracle home where Oracle HTML DB is installed. If you do not specify this Oracle home, htmldbca tries to use the ORACLE_HOME environment variable setting. If ORACLE_HOME is not set or is unusable, and if you do not specify the oracle_home option, htmldbca prompts for the Oracle home. Required. For example:

  htmldbca -oracle_home c:\oracle\product\10.2.0\db_2
  

• -db_host string: Host name of the remote Oracle Database. Required, but if you do not specify it, htmldbca prompts for it. For example:

  htmldbca -db_host shobeen
  

• -db_servicename string: Oracle Database service name. Required, but if you do not specify it, htmldbca prompts for it. For example:

  htmldbca -db_servicename welcome
  

• sys_password | -sys_obfuscatedPassword string: Remote password or obfuscated password for SYS. Required, but if you do not specify either of these parameters, htmldbca prompts for the sys_password. In that case, sys_obfuscatedPassword becomes optional. For example:

  htmldbca -sys_password welcome
  

• -htmldb_password | -htmldb_obfuscatedPassword string: Oracle HTML DB password | obfuscated password. Password or obfuscated password for Oracle HTML DB. Required, and if you do not specify either of these passwords, htmldbca prompts for the htmldb_password. (If you are upgrading from an earlier version of Oracle HTML DB, enter the password you had created for that version of the HTMLDB_PUBLIC_USER schema.) For example:

  htmldbca -htmldb_password htmldb_welcome
  

  After the installation, you can use this password to connect to Oracle HTML DB as the administrative user. The password that you specify is also used for the HTMLDB_PUBLIC_USER schema, which is used by mod_plsql to connect to the database, and for the FLOWS_010600 and FLOWS_FILES schemas.

  If you want to obfuscate the password after installation, see "Obfuscating Passwords in a New Oracle HTML DB Installation" for more information.

• -ts_htmldb string: Specifies the name of the HTML DB tablespace to be created for the remote HTML DB. Required, but if you do not specify it, htmldbca prompts for it. For example:

  htmldbca -ts_htmldb sysaux
   
  

• -ts_files string: Oracle HTML DB Files tablespace. By default, htmldbca uses the ts_htmldb value. Optional, but if you enter an invalid value, htmldbca prompts for a valid one. For example:

  htmldbca -ts_files sysaux
  

• -ts_temp string: Oracle HTML DB Temporary tablespace. The default value is set to use temp tablespace. Optional, but if you enter an invalid value, htmldbca prompts for a valid one.

• -load_lang string [,string[,string[...]]]: Specifies one or more additional languages to install. Optional, but if you enter an invalid value, htmldbca prompts for a valid response. (In this case, you can only enter one language.) If you do not enter a value, English is selected. For example:

  htmldbca -load_lang de, fr, it
  

  Language choices are as follows:

  • de: German

  • en: English, which is the default. If the English version of Oracle HTML DB is installed in the remote Oracle database, htmldbca displays a notification message and exits.

  • es: Spanish

  • fr: French

  • it: Italian

  • ja: Japanese

  • ko: Korean

  • pt-br: Brazilian Portuguese

  • zh-cn: PRC Chinese

  • zh-tw: Taiwan Chinese

  Oracle Database Globalization Support Guide provides information about language support for Oracle Database.

• -DAD_name string: Creates a new Database Access Descriptor Name for Oracle HTML DB. The default value is htmldb. htmldbca updates the ORACLE_BASE\ORACLE_HOME\Apache\modplsql\conf\marvel.conf file with the new DAD value. Optional, but if you enter an duplicate value, htmldbca prompts for a valid one. In order for the changes to take effect, you must restart Oracle HTTP Server, in which case you can use the -restart parameter, described in the next section. For example:

  htmldbca -DAD_name my_htmldb -restart
  

  Alternatively, after you run htmldbca, you can enter the following command at a command prompt to restart Oracle HTTP Server:

  ORACLE_BASE\ORACLE_HOME\opmn\bin\opmnctl restartproc ias-component=HTTP_Server
  

  Afterward, users can access this instance by entering a URL using the following syntax:

  http://host:port/pls/DAD_name
  

  For example:

  http://mycompany:7778/pls/my_html
  

• -restart: Restarts Oracle HTTP Server after the configuration completes. Optional and is not prompted. For example:

  htmldbca -restart
  

• -interactive on|off: Turns interactive mode on or off. When interactive mode is on, htmldbca prompts for missing or incorrect parameter values. When off, no prompts appear; hence, you must specify all the required prompt values at the command line when you run htmldbca. By default, htmldbca runs in interactive mode. Optional and is not prompted. For example:

  htmldbca -interactive off
  

• -help: Displays brief usage description for htmldbca. Optional and is not prompted. For example:

  htmldbca -help
  

4.3.4.3 Running htmldbca

To run htmldbca, open a Windows command prompt and either run htmldba by itself or run it using any combination of the options described in the previous section. For example:

c:\> htmldbca

Unless the -interactive mode is set to off, htmldbca prompts you for any required information that you do not specify in the command line.