Oracle Database Advanced Security Administrators Guide 10g Release 2 (10.2) b14268

Description

Contents......Page 3 List of Figures......Page 15 List of Tables......Page 16 Documentation Accessibility......Page 19 Organization......Page 20 Related Documentation......Page 22 Conventions......Page 23 Oracle Database 10g Release 1 (10.1) New Features in Oracle Advanced Security......Page 27 Part I Getting Started with Oracle Advanced Security......Page 29 Security in Enterprise Grid Computing Environments......Page 31 Data Tampering......Page 32 Data Encryption......Page 33 RC4 Encryption:......Page 34 Data Integrity......Page 35 How Centralized Network Authentication Works......Page 36 Supported Authentication Methods......Page 37 Secure Sockets Layer......Page 38 Oracle Advanced Security Architecture......Page 39 Oracle Advanced Security Restrictions......Page 41 Oracle Net Manager......Page 43 Navigating to the Oracle Advanced Security Profile......Page 44 SSL Property Sheet......Page 45 Oracle Wallet Manager......Page 46 Navigator Pane......Page 47 Right Pane......Page 48 Wallet Menu......Page 49 Operations Menu......Page 50 Duties of a Security Administrator/DBA......Page 51 Part II Data Encryption and Integrity......Page 53 When to Use Transparent Data Encryption......Page 55 How Transparent Data Encryption Works......Page 56 Overview of Basic Transparent Data Encryption Operations......Page 57 Using Transparent Data Encryption......Page 58 Using Wallets with Automatic Login Enabled for Transparent Data Encryption......Page 59 Setting the Master Key for First Time Use of Transparent Data Encryption......Page 60 Creating Tables That Contain Encrypted Columns......Page 61 Creating an Encrypted Column on an External Table......Page 62 Encrypting Unencrypted Columns......Page 63 Changing the Encryption Key or Algorithm on Tables Containing Encrypted Columns......Page 64 Datatypes That Can Be Encrypted with the Transparent Data Encryption Feature......Page 65 Creating Wallets......Page 66 Backup and Recovery of Oracle Wallet......Page 67 Performance Effects of Transparent Data Encryption......Page 68 Transparent Data Encryption with OCI......Page 69 Transparent Data Encryption Data Dictionary Views......Page 70 About Encryption......Page 71 RSA RC4 Algorithm for High Speed Encryption......Page 72 Authentication Key Fold-in......Page 73 About Activating Encryption and Integrity......Page 74 REQUESTED......Page 75 Setting the Encryption Seed (Optional)......Page 76 Configuring Encryption on the Client and the Server......Page 77 Configuring Integrity on the Client and the Server......Page 78 Java Database Connectivity Support......Page 81 Securing Thin JDBC......Page 82 Client Encryption Level: ORACLE.NET.ENCRYPTION_CLIENT......Page 83 Client Integrity Selected List: ORACLE.NET.CRYPTO_CHEKSUM_TYPES_CLIENT......Page 84 Part III Oracle Advanced Security Strong Authentication......Page 87 RADIUS Overview......Page 89 RADIUS Authentication Modes......Page 90 Synchronous Authentication Mode......Page 91 Challenge-Response (Asynchronous) Authentication Mode......Page 92 Step 1: Configure RADIUS on the Oracle Client......Page 95 Step 2: Configure RADIUS on the Oracle Database Server......Page 96 Step 3: Configure Additional RADIUS Features......Page 98 Task 4: Configure External RADIUS Authorization (optional)......Page 101 Set RADIUS Accounting on the Oracle Database Server......Page 102 Task 9: Configure Mapping Roles......Page 103 Using RADIUS to Log In to a Database......Page 104 RSA ACE/Server Configuration Checklist......Page 105 Task 1: Install Kerberos......Page 107 Task 3: Extract a Service Table from Kerberos......Page 108 Task 6: Configure Oracle Net Services and Oracle Database......Page 109 Step 1: Configure Kerberos on the Client and on the Database Server......Page 110 Step 2: Set the Initialization Parameters......Page 111 Step 3: Set sqlnet.ora Parameters (optional)......Page 112 Task 9: Create an Externally Authenticated Oracle User......Page 113 Obtaining the Initial Ticket with the okinit Utility......Page 114 Configuring Interoperability with a Windows 2000 Domain Controller KDC......Page 115 Step 2: Specify the Oracle Configuration Parameters in the sqlnet.ora File......Page 116 Step 2: Create the Oracle Database Principal......Page 117 Task 4: Obtain an Initial Ticket for the Kerberos/Oracle User......Page 118 Troubleshooting......Page 119 Difference between SSL and TLS......Page 121 How SSL Works in an Oracle Environment: The SSL Handshake......Page 122 About Public Key Cryptography......Page 123 Certificate Revocation Lists......Page 124 Hardware Security Modules......Page 125 How SSL Works with Other Authentication Methods......Page 126 SSL and Firewalls......Page 127 SSL Usage Issues......Page 128 Step 1: Confirm Wallet Creation on the Server......Page 129 Step 2: Specify the Database Wallet Location on the Server......Page 130 Step 3: Set the SSL Cipher Suites on the Server (Optional)......Page 131 Step 5: Set SSL Client Authentication on the Server (Optional)......Page 133 Step 6: Set SSL as an Authentication Service on the Server (Optional)......Page 134 Step 1: Confirm Client Wallet Creation......Page 135 Step 2: Configure Oracle Net Service Name to Include Server DNs and Use TCP/IP with SSL on the Client......Page 136 Step 3: Specify Required Client SSL Configuration (Wallet Location)......Page 137 Step 4: Set the Client SSL Cipher Suites (Optional)......Page 138 Step 6: Set SSL as an Authentication Service on the Client (Optional)......Page 140 Troubleshooting SSL......Page 141 How CRL Checking Works......Page 144 Configuring Certificate Validation with Certificate Revocation Lists......Page 145 Certificate Revocation List Management......Page 147 Renaming CRLs with a Hash Value for Certificate Validation......Page 148 Listing CRLs Stored in Oracle Internet Directory......Page 149 Deleting CRLs from Oracle Internet Directory......Page 150 Oracle Net Tracing File Error Messages Associated with Certificate Validation......Page 151 General Guidelines for Using Hardware Security Modules with Oracle Advanced Security......Page 153 About Installing an nCipher Hardware Security Module......Page 154 Error Messages Associated with Using Hardware Security Modules......Page 155 Oracle Wallet Manager Overview......Page 157 Options Supported:......Page 158 Multiple Certificate Support......Page 159 LDAP Directory Support......Page 161 How to Create a Complete Wallet: Process Overview......Page 162 Required Guidelines for Creating Wallet Passwords......Page 163 Creating a Wallet to Store Hardware Security Module Credentials......Page 164 Opening an Existing Wallet......Page 165 Exporting Oracle Wallets to Tools that Do Not Support PKCS #12......Page 166 Downloading a Wallet from an LDAP Directory......Page 167 Saving the Open Wallet to a New Location......Page 168 Changing the Password......Page 169 Managing Certificates......Page 170 Adding a Certificate Request......Page 171 To import the user certificate from the text of the Certificate Authority's e-mail......Page 173 Importing Certificates and Wallets Created by Third Parties......Page 174 Removing a User Certificate from a Wallet......Page 175 Managing Trusted Certificates......Page 176 Removing a Trusted Certificate......Page 177 Exporting All Trusted Certificates......Page 178 Disabling Oracle Advanced Security Authentication......Page 179 Configuring Multiple Authentication Methods......Page 180 Setting the SQLNET.AUTHENTICATION_SERVICES Parameter in sqlnet.ora......Page 181 Setting OS_AUTHENT_PREFIX to a Null Value......Page 182 Part IV Appendixes......Page 185 Sample sqlnet.ora File......Page 187 Data Encryption and Integrity Parameters......Page 188 SQLNET.ENCRYPTION_SERVER Parameter......Page 189 SQLNET.ENCRYPTION_TYPES_SERVER Parameter......Page 190 SQLNET.ENCRYPTION_TYPES_CLIENT Parameter......Page 191 Seeding the Random Key Generator (Optional)......Page 192 sqlnet.ora File Parameters......Page 195 SQLNET.RADIUS_AUTHENTICATION_RETRIES......Page 196 SQLNET.RADIUS_ALTERNATE_PORT......Page 197 SQLNET.RADIUS_AUTHENTICATION_INTERFACE......Page 198 SSL Authentication Parameters......Page 199 Supported SSL Cipher Suites......Page 200 SSL Client Authentication Parameters......Page 201 SSL_SERVER_CERT_DN......Page 202 Wallet Location......Page 203 Customizing the RADIUS Challenge-Response User Interface......Page 205 Configuration Parameters......Page 207 Cryptographic Seed Value......Page 208 Status Information......Page 209 Physical Security......Page 210 Configuring FIPS Parameter......Page 211 Verifying FIPS Connections......Page 212 orapki Utility Syntax......Page 215 Creating and Viewing Oracle Wallets with orapki......Page 216 Adding Certificates and Certificate Requests to Oracle Wallets with orapki......Page 217 Exporting Certificates and Certificate Requests from Oracle Wallets with orapki......Page 218 orapki Usage Examples......Page 219 Syntax......Page 221 Purpose......Page 222 orapki crl list......Page 223 orapki wallet add......Page 224 Syntax......Page 225 Syntax......Page 226 Enhanced X.509-Based Authentication and Single Sign-On......Page 227 Entrust Authority for Oracle......Page 228 Entrust Authority IPSec Negotiator Toolkit......Page 229 Administrator-Created Entrust Profiles......Page 230 Configuring Entrust on the Client......Page 231 Configuring Entrust on a UNIX Server......Page 232 Configuring Entrust on a Windows Server......Page 233 Logging Into the Database Using Entrust-Enabled SSL......Page 234 Error Messages Returned When Running Entrust on Any Platform......Page 235 Error Messages Returned When Running Entrust on Windows Platforms......Page 236 Checklist for Entrust Installations on Windows......Page 238 Glossary......Page 241 E......Page 261 L......Page 262 R......Page 263 S......Page 264 X......Page 265