Implementing Oracle Enterprise User Security

Transcription

1 Implementing Oracle Enterprise User Security February 2003 Bill Parsley Database Administration

2 Environment Very Heterogeneous Server/OS Environment Mainframes, CICS, VSAM, etc... 4,600+ Windows/Intel servers 1,100+ UNIX servers (Sun, HP, IBM) Oracle Environment 630+ Oracle database instances (development & production) database servers, almost all UNIX. 100 s(?) Oracle database applications, many client/server. (Oracle Forms, Reports, VisualBasic, Pro*C/Cobol, etc ) Database Support 7 on-call production support DBAs. 3 plan/build DBAs

3 Business Drivers for Enterprise User Security (EUS) Weak Password Security Users managed many passwords (Windows account, UNIX account, firewall account, account, etc ) Difficult to implement security features such as password aging, password complexity rules, and failed attempt lockouts. Managing Oracle passwords User passwords stored in 100 s of database instances. Many Oracle applications require passwords to be coordinated between multiple database instances. Overall Security Goal: reduce the number of places where passwords are stored and managed. Password coordination, not single sign-on. Integrate Oracle Internet Directory with enterprise LDAP

4 Novell DirXML Novell edirectory Oracle Internet Directory ldap user web page Active Directory User accounts provisioned and deprovisioned through edirectory (directly from Human Resources system) User passwords set from web page (enforces complexity) userpassword vs. orclpassword attributes in OID entry.

5 Enterprise User Security in the Database Global Shared Schema Database USER function does not return correct user name, user is not shown in v$session. sys_context( USERENV, EXTERNAL_NAME ) Must implement OID Enterprise Roles. Simple user provisioning and deprovisioning, all done in central OID server. Global Private Schema Database USER function returns correct user name, v$ tables & audit triggers function normally. Existing database application roles and non-default roles work without change. User provisioning requires database schema creation, deprovisioning requires cleanup. Unresolved issues: How to manage temp tables, pl/sql direct grants, user_role_privs, etc

6 Enterprise User Security in the Database Goal: Improve password security with minimal impact on existing applications ==> Global Private Schema. alter user bill identified globally as cn=bill,cn=staff,dc=nationwide,dc=com ; Required 9.2 application database. Supports 7.3, 8i, 9i clients. No ldap or digital certificate on clients

7 OID Processes on UNIX 9.2 Databases Server-2 LDAP configset=1 LDAP on SSL LDAP process Oracle Net LDAP Names Proxy (9i) OID listener port 636 SSL Replication Server oidctl tool LDAP process LDAP process LDAP process OS OS oidmon Oracle Net Net listener Server RDBMS Repository

8 OID Architecture - Stage 1 Production Data Center Disaster Recovery Data Center Server-1 V480 active SunFireV480 Server-2 V480 passive SunFire V480 Server-3 V480 disaster recovery SunFireV480 Sun Veritas Cluster Sun Disk Hot Copy Sun EMC EMC

9 Architecture Stage 2 - OID Replication Content Switch Content Switch External Storage Array External Storage Array SunFire V480 SunFire V480 Sun Sun South Datacenter Slave-1 Read Only OID Server Slave-2 Read Only OID Server North Datacenter External Storage Array SunFire V480 External Storage Array?? Future Server Multi-Master Sun Master OID server dirxml edirectory

10 Oracle GUI Tools for OID. oidadmin - Oracle Directory Manager Create/delete ldap DIT, manage OID server configurations and ACLs.. netca - Network Configuration Assistant Create/upgrade an Oracle context, or the Oracle OID schema.. netmgr - Network Manager Create/delete database service name entries.. esm - Enterprise Security Manager Register databases (9i only), create/delete enterprise users and roles.. owm - Oracle Wallet Manager Load and manage digital certificates for SSL connections

11 OID Server Installation Steps Installed OID from 9.2 RDBMS media, patch to Use oidca tool to create database schema for OID. Use owm (oracle Wallet Manager) to create certificate wallet, load Certificate Authority and user certificate. Use oidadmin tool to create new configset for SSL listener. User oidadmin tool to create subscriber subtree (dc=nationwide,dc=com). Use netca tool to create OracleContext under new subscriber tree

12 Database Server Setup for OID Use owm to create certificate wallet, load Certificate authority, one user certificate per database instance. Put WALLET_LOCATION in sqlnet.ora Create ldap.ora file in TNS_ADMIN directory. Use esm (Enterprise Security Manager) tool to register database instance in OID. Set RDBMS_SERVER_DN = cn=mysid,cn=oraclecontext,dc=nationwide,dc=com ) in init.ora alter user bill identified globally as cn=bill,cn=staff,dc=nw,dc=com ;

13 Useful Metalink Reference Papers Config & Test OID with SSL Troubleshooting Enterprise User Security Example: Setting up EUS with Password Authentication How to Configure Database SSL using DN Certificate Quickstart Guide: OID Replication Setup ldaprepl.sh steps for OID 9.2 Replication Setup Misc. Solutions for OID Replication Setup & Config Quickstart Guide: OID Replication Setup 2.11/3.01/9i

14 Results Large reduction in help desk calls for ID resets. More consistent implementation of password complexity rules (different vendor rules require least common denominator) Centralized management of password aging, lockout. Fewer postit notes on monitors

15 Net Service Names Resolution Oracle 8i & 9i Clients (ldap.ora ) LDAP Oracle Internet Directory Server SQL NET Oracle Database LDAP v7, v8, v9 Oracle Clients (sqlnet.ora) SQL NET Oracle 9i Names Server Proxy

16 Questions?