Oracle Database Security and Audit

Transcription

1 Copyright 2014, Oracle Database Security and Audit Beyond Checklists Learning objectives Understand Oracle architecture Database Listener Oracle connection handshake Client/server architecture Authentication methods Password protection Copyright 2014, Oracle architecture Architecture of an Oracle database instance Oracle Real Application Cluster (RAC) Control Oracle networking architecture Oracle Automatic Storage Management (ASM) Oracle Enterprise Manager (OEM) 12c Cloud Copyright 2014,

2 Copyright 2014, Oracle RDBMS Architecture Oracle database is not just a data store Complex system - like an operating system Networking services (FIFO pipes, etc.) and support for many protocols (TCP, etc.) File subsystem (space allocation, deletion, reuse, recovery, corruption detection, etc.) Job schedulers Kernel interrupts and instrumentation XML storage and processing Shared memory and memory pools Interprocess communication (IPC) and threading Large object storage and processing Encryption support at the data storage and network layers (strong algorithms, SSL support) Multiple authentication methods (database, Kerberos, LDAP, etc.) What is an Oracle instance? Composed of many subsystems This is same regardless if you are speaking of a single instance database, RAC database, or ASM database Based on UNIX architecture Software (executables, shared libraries, JAR files, etc) Disk files (database files, log files, control files) Shared memory Copyright 2014, Copyright 2014,

3 Copyright 2014, RAC Architecture High availability solution Multiple computers open and access one database instance Transparent application failover (network layer) Copyright 2014, ASM Architecture Disk volume manager for Oracle database configurations system Commonly used in Real Application Cluster (RAC) But, it can be used in a stand-alone single instance Implemented with a small Oracle companion database ASM database instance is not used to store client data - ever! Copyright 2014,

4 Copyright 2014, OEM 12c Infrastructure to manage, monitor, provision, and baseline enterprise computing platforms Oracle database repository (OMR) Web and application servers (OMS) Management agent (OMA) Console (OMC) Operating system configuration Database - single instance, RAC, and ASM services non-oracle databases via plugins Sensitive data discovery and mapping (Real Application Testing - RAT) Really, anything you want to monitor and/or manage and/ or test Copyright 2014, Deployed to target servers Web servers Database Copyright 2014,

5 Copyright 2014, Oracle networking dist_pro.htm#cncpt006 Database and database application are separated into a client/server architecture Client runs the database application SQL*Plus, Desktop programs, web applications, etc. Server runs the Oracle database software Functions for concurrent, shared data access Client/server architecture Copyright 2014, Oracle listener Server side process Traffic manager Incoming client connection requests Establishes a pathway to the database instance Copyright 2014,

6 Copyright 2014, Connection handshake pre-11g 05Logon! Essentially the same process regardless of database version. Client software such as SQL*Plus starts a connection with SQL>connect system/ manager Copyright 2014, The server retrieves the hash from sys.user$, generates a random number, and encrypts the random number with the The server receives the request, gets the hash and generates the session key Copyright 2014,

7 Copyright 2014, The server retrieves the hash from sys.user$, generates a random number, and encrypts the random number with the The server send the session key to the client 1) The client evaluates the Oracle password algorithm and generates the password hash 2) The password hash is used to decrypt the session key The server retrieves the hash from sys.user$, generates a random number, and encrypts the random number with the At this point it is possible to enumerate users in the database Copyright 2014, 1) The client evaluates the Oracle password algorithm and generates the password hash 2) The password hash is used to decrypt the session key The server retrieves the hash from sys.user$, generates a random number, and encrypts the random number with the The client evaluates the hash and decrypts the session key Copyright 2014,

8 Copyright 2014, 1) The client evaluates the Oracle password algorithm and generates the password hash 2) The password hash is used to decrypt the session key Client encrypts the clear text password using the session key as the new key Send encrypted password = AUTH_PASSWORD The server retrieves the hash from sys.user$, generates a random number, and encrypts the random number with the At this point, if we know the hash and have access to SQL*Net trace files we can decrypt the password 1) The client evaluates the Oracle password algorithm and generates the password hash 2) The password hash is used to decrypt the session key The server retrieves the hash from sys.user$, generates a random number, and encrypts the random number with the Client encrypts the clear text password using the session key as the new key Send encrypted password = AUTH_PASSWORD The server gets the password, creates the hash and checks if login can proceed The server decrypts the session key, evaluates the password algorithm, and compares the hash with sys.user$.password or sys.user$.spare4 Copyright 2014, 1) The client evaluates the Oracle password algorithm and generates the password hash 2) The password hash is used to decrypt the session key The server retrieves the hash from sys.user$, generates a random number, and encrypts the random number with the Client encrypts the clear text password using the session key as the new key Send encrypted password = AUTH_PASSWORD The server decrypts the session key, evaluates the password algorithm, and compares the hash with sys.user$.password or sys.user$.spare4 Session can begin to send and receive data from the database Begin Session If the hashes match, session is started Copyright 2014,

9 Copyright 2014, Client/server architectures Dedicated server architecture Server process created on behalf of each client process Shared server architecture Dispatcher directs incoming requests to pool of shared server processes Database resident connection pooling Connection pool of dedicated servers for typical Web application scenarios Dedicated server process Copyright 2014, Shared server process Copyright 2014,

10 Copyright 2014, Database resident connection pooling Oracle networking Establish and maintain connection between client and database Based on the OSI architecture Stack based architecture 3 basic type of connections Client/Server Connections Java Connections Web client connections architecture.htm#i ! Copyright 2014, Q&A Copyright 2014,