Configure the discovery tool

1. In a web browser access: https://ip_address:5000, where ip_address is the IP address of the discovery tool from Deploy Discovery Tool. The discovery tool uses a self-signed certificate for HTTPS connection which results in a security warning. Choose Accept the risk and continue to continue to the discovery tool console.

2. If you're accessing the discovery tool console for the first time, create a discovery tool login password. Create a password, which you will use for future logins.

   Important

   Remember this password - there is no password recovery mechanism.

1. SSH to the discovery tool VM.

   ssh discovery@<discovery-tool-vm-ip>

2. Edit the Kerberos configuration file at /etc/krb5.conf.

   sudo nano /etc/krb5.conf

   Add the following configuration, replacing the placeholder values with your environment details.

   [libdefaults]
       default_realm = EXAMPLE.COM
       dns_lookup_realm = false
       dns_lookup_kdc = true
   
   [realms]
       EXAMPLE.COM = {
           kdc = dc01.example.com
       }
   
   [domain_realm]
       .example.com = EXAMPLE.COM
       example.com = EXAMPLE.COM

   Important

   Kerberos is case-sensitive. The realm name must be in uppercase (for example, EXAMPLE.COM, not example.com). The domain name in the [domain_realm] section must be in lowercase.

   Multiple Active Directory domains

   The discovery tool supports multiple Kerberos credentials for different Active Directory domains. Each credential authenticates independently, so you can configure multiple credentials normally and isolation is automatic.

   If you have servers in multiple domains, add entries for each realm in your /etc/krb5.conf file:

   [libdefaults]
       default_realm = DEV.COMPANY.COM
       dns_lookup_realm = false
       dns_lookup_kdc = true
   
   [realms]
       DEV.COMPANY.COM = {
           kdc = dc01.dev.company.com
       }
       PROD.COMPANY.COM = {
           kdc = dc01.prod.company.com
       }
   
   [domain_realm]
       .dev.company.com = DEV.COMPANY.COM
       dev.company.com = DEV.COMPANY.COM
       .prod.company.com = PROD.COMPANY.COM
       prod.company.com = PROD.COMPANY.COM

3. Verify that you can obtain a Kerberos ticket by running the kinit command.

   kinit username@REALM.COM

   Enter the password when prompted. If the command completes without errors, authentication succeeded.

4. Verify the ticket by running the klist command.

   klist

   The expected output is similar to the following.

   Ticket cache: FILE:/tmp/krb5cc_1000
   Default principal: username@REALM.COM
   
   Valid starting       Expires              Service principal
   01/01/2025 12:00:00  01/01/2025 22:00:00  krbtgt/REALM.COM@REALM.COM

5. Configure the discovery tool with the same case-sensitive principal that you used with kinit (for example, username@REALM.COM).

1. On the Discovery tool page, under Step 1. Configure discovery sources, choose Configure sources.

2. On the Configure discovery sources page, provide the Friendly name, vCenter FQDN/IP, Username, and Password.

3. Choose Save configuration.

   The discovery tool begins to collect vCenter information, as described in Discovered Inventory.

1. On the Discovery tool page, under Step 1. Configure discovery sources, choose Configure sources.

2. On the Configure discovery sources page, provide a friendly name, the host FQDN or IP address, the authentication type (NTLM or Kerberos), the WinRM username, and the WinRM password.

3. Choose Save configuration.

   The discovery tool begins to collect Hyper-V information, as described in Discovered inventory.

1. Navigate to the Import servers page from the Discovery tool homepage.

2. Prepare a CSV file with the following columns: hostname_or_ip (required), os_credential_name (optional), and oracle_credential_name (optional).

   • The hostname_or_ip value must be a valid IPv4 address or a fully qualified domain name (FQDN).

   • The os_credential_name value, if provided, must match the friendly name of an OS credential that you already configured (SSH, WinRM, or SNMP). Leave empty for servers where you have not yet configured an OS credential.

   • The oracle_credential_name value, if provided, must match the friendly name of an Oracle credential that you already configured.

3. Upload the CSV file. The tool validates all rows and rejects the file if any row is invalid.

1. Ssh to Discovery tool VM

2. Place the CA certificate(s) that signed your target servers' WinRM certificates into trust store directory /etc/pki/ca-trust/source/anchors/ on the discovery tool VM. For example: sudo cp winrm-ca.pem /etc/pki/ca-trust/source/anchors/winrm-ca.pem. Note: If your target servers use certificates signed by different CAs, copy all relevant CA certificates to this directory.

3. Update the certificate trust store: sudo update-ca-trust

4. Reboot the VM

5. (Optional) To verify that certificates have been successfully imported, you can run the following command. sudo trust list —filter=ca-anchors | grep -A 5 "<certificate_name>"

Enable discovery tool OS Access

1. Navigate to the Set up OS access page to provide Windows and Linux credentials.

2. Choose a protocol that you want to add credentials for.

3. Provide the required credentials for the selected protocol.

4. Select Auto-connect to enable the discovery tool to try all provided credentials on discovered servers until matching credentials are found for each server.

   See Using Auto-Connect Feature With Caution for important security recommendations regarding the auto-connect feature.

5. Choose Set up and connect.

1. On the Discovery tool page, in the sidebar, choose Database access.

2. Choose Add Oracle credential.

3. Provide the following information:

   • Friendly name – A descriptive name for this credential (for example, Oracle Production).

   • Port – The Oracle listener port (default 1521).

   • Service name – The Oracle service name for the target database.

   • Username – The Oracle service account username.

   • Password – The Oracle service account password.

   • Auto-connect – Turn on this option to try the credential against all servers in your inventory. Turn off this option to manually assign the credential to specific servers.

4. To add more credentials (for example, for different Oracle environments), choose Add Oracle credential again.

5. Choose Save.

To manually update the tool

1. Download the latest discovery tool image file (OVA for VMware or VHD for Hyper-V) from the provided link.

2. (Optional) We recommend that you delete the previous discovery tool image file before you deploy the latest one.

3. Follow the steps in the Deploy the discovery tool section to deploy the updated version.