Importing oracle trusted certificate into oracle wallets

Importing oracle trusted certificate into oracle wallets

 

I am assuming user is created trusted certificate and hand over to you. As a oracle dba

 you have to import the trusted certificate in the oracle database server.

 

How to import user trusted certificate into oracle wallets

1. Create wallet
1. Syntax: orapki wallet create -wallet
2. $orapki wallet create -wallet ‘/home/oracle/admin/WALLETS’
1. Enter password:
2.  Enter password again:
3. copy/ftp the user trusted certificate to database server temp location
1. /tmp/testwallet_ssl.cer
4. To add a trusted certificate to an Oracle wallet:
1. Syntax:  orapki wallet add -wallet -trusted_cert -cert
2. $orapki wallet add -wallet ‘/home/oracle/admin/WALLETS’ -trusted_cert -cert ‘/tmp/testwallet_ssl.cer’
5. To view an Oracle wallet:
1.  Syntax:  orapki wallet display -wallet
2. $orapki wallet display -wallet ‘/home/oracle/product/WALLETS/oracle’

 

Securing the Oracle Listener

The Oracle Database Listener is the database server software component that manages the network traffic between the Oracle Database and the client. The Oracle Database Listener listens on a specific network port (default 1521) and forwards network connections to the Database.

The listener is one of the most critical components to database operations;

• It is responsible for the ability to have a client/server communication
• In dedicated mode it is responsible for creating a new process (or thread on Windows) on behalf of the client and setting up the communications
• On Windows each such server process actually speaks on a new tcpip port and the listener redirects the client to this port
• On Unix streaming continues on the original port
  • The listener forks a new process
  • The listener then closes its own fd-s; the new process continues to speak on the fd-s

In MTS the listener is responsible to assign and set up the connection with the least loaded dispatcher. The dispatchers get requests from the client and place them on the request queues for the shared server processes, and read responses from the response queues to send to the client

How to set listener password

Set the Listener password to stop most attacks and security issues. Setting the password manually in listener.ora using the PASSWORDS_ parameter will result in the password being stored in cleartext.


LSNRCTL> set current_listener
LSNRCTL> change_password Old password:

New password:
Reenter new password:

LSNRCTL> set password Password:
LSNRCTL> save_config

Column Masking using Virtual Private Database (VPD)

Column masking is a simple way to hide you valuable data from certain users without having to apply encrypt/decrypt techniques, In conventional Virtual Private Database the VPD Policy is applied to the whole row. By default a Column-Level VPD Policy allows you to restrict the rows displayed only if specified columns are accessed.

Column masking behaviour is implemented by using the "sec_relevant_cols_opt => DBMS_RLS.ALL_ROWS" parameter. This allows you to display all rows but mask the values of the specified columns for the restricted rows

There are 3 steps for accomplish column masking:

1. A function to be used by the policy (function policy) created in next step.
2. Use dbms_rls package to create the policy.
3. Assign “exempt access policy” to users to be excluded from the policy. These users can see all data with no masking.

Example

CONN sys/password@db10g AS SYSDBA GRANT EXECUTE ON dbms_rls TO scott;

CONN scott/tiger@db10g -- Create the policy function to restrict access to SAL and COMM columns -- if the employee is not part of the department 20. CREATE OR REPLACE FUNCTION pf_job (oowner IN VARCHAR2, ojname IN VARCHAR2) RETURN VARCHAR2 AS   con VARCHAR2 (200); BEGIN   con := 'deptno = 20';   RETURN (con); END pf_job; /

-- Add policy BEGIN   DBMS_RLS.ADD_POLICY (object_schema         => 'scott',                        object_name           => 'emp',                        policy_name           => 'sp_job',                        function_schema       => 'scott',                        policy_function       => 'pf_job',                        sec_relevant_cols     => 'sal,comm',                        sec_relevant_cols_opt => DBMS_RLS.ALL_ROWS); END; /

-- All rows are returned but the SAL and COMM values are only
-- shown for employees in department 20.

-- Remove the policy function from the table.

BEGIN   DBMS_RLS.DROP_POLICY (object_schema => 'scott', object_name => 'emp', policy_name => 'sp_job'); END; /

Are you encrypting database traffic?

Encrypting Oracle network traffic safeguards sensitive data such as social security numbers, credit card numbers and other personally identifiable information against packet sniffing. Packet sniffing is where an attacker tries to capture unencrypted data by using a network sniffer. This sniffing takes place without the knowledge of either the client machine or database server.

With Oracle Advanced Security, you can set up network encryption to your database in a matter of hours. You can also configure your Oracle databases to only accept mutually authenticated and encrypted connections. This means that in addition to protecting against network eavesdropping, you can also protect against unauthorized connections to your database.

 

Oracle Net Native Encryption

These lines were added to sqlnet.ora on the database server: SQLNET.ENCRYPTION_TYPES_SERVER = RC4_256
SQLNET.ENCRYPTION_SERVER = required

You can also use Oracle Net manager to achieve the same result (do this on both client/server)

1.       Go to Local -> Profile

2.       Select Oracle Advanced Security -> Encrytion

 

No additional configuration was necessary. We connected to the database and retrieved the same data.

 http://www.oracle.com/webfolder/technetwork/tutorials/obe/db/11g/r2/prod/security/network_encrypt/ntwrkencrypt.htm

Client Access Control

Oracle Net valid node checking lets you allow or deny access to an Oracle database server based on the IP address (or host name) of the client machine making the request. You can control access to the database server by specifying either which machines are allowed access or which machines are denied access.

To use the node validation feature, set the following sqlnet.ora (protocol.ora for Oracle 8) parameters on the database server:

# Enable node validation
tcp.validnode_checking = YES

# Prevent these client IP addresses from
# making connections to the Oracle listener.
tcp.excluded_nodes = {list of IP addresses}

# Allow these IP addresses to connect.
tcp.invited_nodes = {list of IP addresses}

Protecting Oracle Network Traffic with SSH Tunnelling

SSH provides a secure encrypted communications channel between two machines over an insecure network. A client machine can connect to an Oracle database over a secure SSH connection by using port forwarding. SSH port forwarding provides another way to protect data privacy through encryption and safeguard against data interception and alteration.

Creating an SSH tunnel between a client machine and an Oracle database server requires an SSH client to be present on the client machine and an SSH server to be present on the database server. No configuration is necessary on the database server.

On the Server

1.       Install CopSSH http://www.itefix.no/i2/copssh

2.       Create a windows user and activate this user

On the Client

1.       Install Putty

2.       Under connection ->SSH -> Tunnels.

a.       Enter a source port (can be any free port eg 8080)

b.      Enter the Destination , the database server IP address, listener port (eg 192.168.1.1:1521

c.       Check the local ports accept connections from other hosts

 

 

Modified the tnsnames.ora to use localhost and source port

In addition to being encrypted, data passed through an SSH tunnel is automatically integrity checked and authenticated by using SSH credential