Skip Headers

O racle® Database Advanced Security Administrator's Guide
10g Release 1 (10.1)

Part Number B10772-01
Go to Index
Index
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Master Index
Master Index
Go to Feedback page
Feedback

Go to previous page
Previous
Go to next page
Next
View PDF


Preface

Welcome to the Oracle Database Advanced Security Ad ministrator's Guide for the 10g Release 1 (10.1) of Oracle Advanced Security.

Oracle Advanced Security contains a comprehensive suite of security features that protect enterprise networks and securely extend them to the Internet. It provides a single source of integration with multiple network encryption and authentication solutions , single sign-on services, and security protocols.

The Oracle Database Advanced Security Adm inistrator's Guide describes how to implement, configure and administer Oracle Advanced Security.

This preface contains these topics:

Audience

The Oracle Database Advanced Security Administrator's Guide is intended f or users and systems professionals involved with the implementation, configuration, and administration of Oracle Advanced Security in cluding:

Organization

This document contains the followin g chapters:

Part&n bsp;I, "Getting Started with Oracle Advanced Security"

Chapter 1, "Introduction to Oracle Advanced Security"

This chapter provides an overview of Oracle Advanced Security features provided with this release.

< a name="971195">
Chapter 2, "Confi guration and Administration Tools Overview"

This chapter provides an introductio n and overview of Oracle Advanced Security GUI and command-line tools.

Part II, "Network Data Encryption and Integrity"

Chapter 3, "Configuring Ne twork Data Encryption and Integrity for Oracle Servers and Clients"

This chapter describes how to configure data encryption and integrity within an existing Oracle Net Services 10g Release 1 (10.1) network.

Chapter 4, "Configuring Network Data Encryption and Integrity for Thin JDBC Clients"

This chapter provides an overview of the Java implementation of Oracle Advanced Security, which lets Thin Java Database Con nectivity (JDBC) clients securely connect to Oracle Database databases.

Part III, "Oracle Advanced Security Strong Authentica tion"

Chapter 5, "Configuring RADIUS Authentication"

This chapter describes how to configure Oracle for use with RADIUS (Remote Authentication Dial-In User Service). It provi des an overview of how RADIUS works within an Oracle environment, and describes how to enable RADIUS authentication and accounting. I t also introduces the challenge-response user interface that third party vendors can customize to integrate with third party authenti cation devices.

Chapter 6, "Configuring Kerberos Authentication"

This chapter describes how to configure Oracle for use with MIT Kerberos and provides a brief overview of steps to configure Kerber os to authenticate Oracle users. It also includes a brief section that discusses interoperability between the Oracle Advanced Securit y Kerberos adapter and a Microsoft KDC.

Chapter 7, "Configuring Secure Sockets Layer Authentication"

This chapter describes how Oracle Advanced Security supports a public key infrastructure (PKI). It includes a discussion of configuring and using the Secure Sockets Layer (SSL), certificate validation, and hardware security modul e support features of Oracle Advanced Security.

Chapter 8, "Using Oracle Wallet Manager"

Thi s chapter describes how to use Oracle Wallet Manager to manage Oracle wallets and PKI credentials.

Chapter 9, "Configuring Multiple Authentication Methods and Disabling Oracle Advanced Security"

This chapter describes the auth entication methods that can be used with Oracle Advanced Security, and how to use conventional user name and password authentication. It also describes how to configure the network so that Oracle clients can use a specific authentication method, and Oracle servers c an accept any method specified.

Chapter 10, "Configuring Oracle DCE Integration"

This chapte r provides a brief discussion of Open Software Foundation (OSF) DCE and Oracle DCE Integration, including what you need to do to conf igure DCE to use Oracle DCE Integration, how to configure the DCE CDS naming adapter, DCE parameters, and how clients outside of DCE can access Oracle databases using another protocol such as TCP/IP.

Part IV, "Enterprise User Security"

Chapter 11, "Getting Started with Enterpris e User Security"

This chapter describes the Oracle LDAP directory and database i ntegration that enables you to store and manage users' authentication information in Oracle Internet Directory. This feature makes id entity management services available to Oracle databases, which provides single sign-on to users (users can authenticate themselves t o the database once and subsequent authentications occur transparently). It describes the components and provides an overview of how Enterprise User Security works.

Chapter 12, "Enterprise User Security Configuration Tasks and Troubleshooting"
< /a>

This chapter explains how to configure Enterprise User Security, providing a configuration steps roadmap and the t asks required to configure password-, SSL-, and Kerberos-based Enterprise User Security authentication.

Chapter 13, "Administering Enterprise Use r Security"

This chapter describes how to use the Enterprise Security Manager to define directory identity management realm properties and to manage enterprise users, enterprise domains, and enterprise roles.

Part V, "Appendix es"

App endix A, "Data Encryption and Integrity Parameters"

This appendix describes Oracle Advanced Security data encryption and integrity configuration parameters.

Appendix B, "Authentication Parameters"

This appendix describes Oracle Advanced Security authentication configuration file parameters.

Appendix C, "Integrating Authentication Devices Using RADIUS"

This appendix explains how third party aut hentication device vendors can integrate their devices and customize the graphical user interface used in RADIUS challenge-response a uthentication.

Appe ndix D, "Oracle Advanced Security FIPS 140-1 Settings"

This appendix descri bes the sqlnet.ora configuration parameters required to comply with the FIPS 140-1 Level 2 evaluated configuration.

Appendix E, "orapk i Utility"

This appendix provides the syntax for the orapki command line utility. This utility must be used to manage certificate revocation lists (CRLs). You can also use this utility to create and m anage Oracle wallets; create certificate requests, signed certificates, and user certificates for testing purposes; and to export cer tificates and certificate requests from Oracle wallets.

Appendix F, "Entrust-Enabled SSL Authentication"

This appendix describes how to configure and use Entrust-enabled Oracle Advanced Security for Secure Sockets Layer (SSL) a uthentication.

Appe ndix G, "Using the User Migration Utility"

This appendix describes the User Migration Utility, which can be used to perform bulk migrations of database users to an LDAP directory where they are stored and man aged as enterprise users. It provides utility syntax, prerequisites, and usage examples.

< a href="asogls.htm#431353">Glossary

< font face="Arial, Helvetica, sans-serif">Related Documentation

For more information, see these Oracle resources:

Many books in the documentation set use the sample schemas of the seed database, which is installed by default when you install Oracle. Refer to Oracle Database Sample Schemas for information on how these schemas wer e created and how you can use them yourself.

Printed documentation is available for sale in the Oracle Store at

http://oraclestore.oracle.com/<
/a>

To download free release notes, installation documentation, whi te papers, or other collateral, please visit the Oracle Technology Network (OTN). You must register online before using OTN; registra tion is free and can be done at

http://otn.oracl
e.com/membership/

If you already have a username and password f or OTN, then you can go directly to the documentation section of the OTN Web site at

http://otn.oracle.com/documentation/

For information from third-party vendors, see:

  • ACE/Server Administration Manual, from Security Dynamics
  • ACE/Server Client for UNIX, from Security Dynamics
  • ACE/Server Installation Manual, from Security Dynamics
  • RADIUS Administrator's Guide
  • Notes about building and installing Kerberos from Kerberos version 5 source distribution
  • Entrust/PKI for Oracle
  • Ad ministering Entrust/PKI on UNIX
  • Transarc DCE User's Gui de and Reference
  • Transarc DCE Application Development G uide
  • Transarc DCE Application Development Reference
  • Transarc DCE Administration Guide
  • Transarc DCE Administration Reference
  • Transarc DCE Porting and Testing Guide
  • Application Environment Specification/Distributed Computing
  • Transarc DCE Technical Supplement

For conceptual information about the network security technologies supported by Oracle Advanced Security, you can refer to the following third-party publications:

  • Applied Cryptography, Second Edition: Protocols, Algorithms, and Source Code in C by Bruce Schneier. New York: John Wiley & ; Sons, 1996.
  • SSL & TLS Essentials: Securing the Web by Stephen A. Thomas. New York: John Wiley & Sons, 2000.
  • Understanding and Deploying LDAP Directory Services by Timothy A. Howes, Ph.D., Mark C. Smith, and Gordon S. Good . Indianapo lis: New Riders Publishing, 1999.
  • Understanding Public-Key I nfrastructure: Concepts, Standards, and Deployment Considerations by Carlisle Adams and Steve Lloyd. Indianapolis: New Riders Pu blishing, 1999.

Conventions

This section describes the conventions used in the text and code examples of this documentati on set. It describes:

Conventions in Text

We use various conventions in text to help you more quickly identify special terms. The following table describes t hose conventions and provides examples of their use.

Convention Meaning Example

Bold

Bold typeface indicates terms that are defined in the text or terms that appear in a glossary, or both.

When you specify thi s clause, you create an index-organized table.

Italics

Italic typeface indicates book titles or emphasis.

Oracle Database Concepts

Ensure that the recovery cata log and target database do not reside on the same disk.

UPPERCASE monospace (fixed-width) font

Uppercase monospace typeface indicates elements supplied by the system. Such ele ments include parameters, privileges, datatypes, RMAN keywords, SQL keywords, SQL*Plus or utility commands, packages and methods, as well as system-supplied column names, database objects and structures, usernames, and roles.

You can specify this clause only for a NUMBER column.

You can back up the database by using the BACKUP command.

Query the TABLE _NAME column in the USER_TABLES data dictionary view.

Use the DBMS_ STATS.GENERATE_STATS procedure.

lowercase monospace (fixed-width) font

Lowercase monospace typeface indicates executables, filenames, directory names, and sample user-supplied ele ments. Such elements include computer and database names, net service names, and connect identifiers, as well as user-supplied databa se objects and structures, column names, packages and classes, usernames and roles, program units, and parameter values.

Note: Some programmatic elements use a mixture of UPPERCASE and lowercase. Enter these elements as shown.

Enter sqlplus to open SQL*Plus.

The password is specified in the orapwd file.

Back up the datafiles and control files in the /disk1/oracle/dbs directory.

The department_id, department_name, and location_id columns are in the hr.de partments table.

Set the QUERY_REWRITE_ENABLED initialization parameter t o true.

Connect as oe user.

The JRepUtil class implements these methods.

lowercase italic monospace (fixed-width) font

Lowercase italic monospace font represents placeholders or variables.

You can specify the parallel_clause. < /p>

Run Uold_release.SQL where old_release refers to the release you installed prior to upgrading.

Conventions in Code Examples

Code examples illustrate SQ L, PL/SQL, SQL*Plus, or other command-line statements. They are displayed in a monospace (fixed-width) font and separated from normal text as shown in this example:

SELECT username FROM dba_users WHERE username = 'MIGRATE';
<
a name="970284">

The following table describes typographic conventions used in code e xamples and provides examples of their use.

Convention Meaning Example
[ ]

Brackets enclose one or more optional items. Do not enter the brackets.

DECIMAL (digits [ , precision ])
{ }

Braces enclose two or more items, one of which is required. Do not enter the braces.

{ENABLE | DISABLE}
|

A vertical bar represents a choice of two or more options within brackets or braces. Enter one of the options. Do not enter the vertical bar.

{ENABLE | DISABLE}
[COMPRESS
| NOCOMPRESS]
...

Horizontal ellipsis points indicate either:

  • That we have omitted parts of the code that are not directly related t o the example
  • That you can repeat a portion of the code

CREATE TABLE ... AS subquery;

SELECT col1, col2, ... , col
n FROM 
employees;
 .
 .
 .

Vertical ellipsis points indicate that we have omitted several lines of code not directly related to the example.

SQL> SELECT NAME FROM V$DATAFILE;
NAME
------------------------------------
/fsl/dbs/tbs_01.dbf
/fs1/dbs/tbs_02.dbf
.
.
.
/fsl/dbs/tbs_09.dbf
9 rows sel
ected.

Oth er notation

You must enter symbols other than brackets, braces, ve rtical bars, and ellipsis points as shown.

acctbal NUMBER(11,2);

acct    CONSTANT NUMBER(4) := 3;
Italics

< /a>

Italicized text indicates placeholders or variables for which you must supply particular values.

CONNECT SYSTEM/system_password
DB_NAM
E = database_name

UPPERCASE

Uppercase typefac e indicates elements supplied by the system. We show these terms in uppercase in order to distinguish them from terms you define. Unl ess terms appear in brackets, enter them in the order and with the spelling shown. However, because these terms are not case sensitiv e, you can enter them in lowercase.

SELECT last_name, employee_i
d FROM 
employees;
SELECT * FROM USER_TABLES;
DROP TABLE hr.employees;
lowercase

Lowercase typeface indicates programmatic elements that you supply. For example , lowercase indicates names of tables, columns, or files.

Note: Some programmatic elements use a mixture of UPPERCASE and lowercase. Enter these elements as shown.

< pre class="CEW">SELECT last_name, employee_id FROM employees; sqlplus hr/hr CREATE USER mjones IDENTIFIED BY ty3MU9;

Conventions for Windows Operating Systems

The following table describes conventions for Windows operating systems and provides examples of their use.

< /tr>
Convention Meaning Example

Choose Start &g t;

How to start a program.

To start the Database Configuration Assistant, choose Start > Programs > Oracle - HOME_NAME > Configuration and Migration Tools > Database Configuration Assistant.

File and directory names

File and directory names are not case sensitive. The following special characters are not al lowed: left angle bracket (<), right angle bracket (>), colon (:), double quotation marks ("), slash (/), pipe (|), and dash (- ). The special character backslash (\) is treated as an element separator, even when it appears in quotes. If the file name begins wi th \\, then Windows assumes it uses the Universal Naming Convention.

c:\winnt"\"system32 is the same as 
C:\WINNT\SYSTEM32

C:\>

Represents the Windows command prompt of the current hard disk drive. The escape character in a command prompt is the caret (^). Your prompt reflects the subdirectory in which you are working. Referred to as the command prompt in this man ual.

C:\oracle\oradata>

Special characters

The backslash (\) special character is sometimes required as an escape character for the doubl e quotation mark (") special character at the Windows command prompt. Parentheses and the single quotation mark (') do not require an escape character. Refer to your Windows operating system documentation for more information on escape and special characters.

C:\>exp scott/tiger TABLES=emp 
QUERY=\"WHERE job='SALESMAN' and 
s
al<1600\"
C:\>imp SYSTEM/password FROMUSER=scott 
TABLES=(emp, dept)
H
OME_NAME

Represents the Oracle home name. The home name c an be up to 16 alphanumeric characters. The only special character allowed in the home name is the underscore.

C:\> net start OracleHOME_NAMETNSListener

ORACLE_HOME and ORACLE_BASE

In releases prior to Oracle8i release 8.1.3, when you installed Oracle components, all subdirectories were located under a top lev el ORACLE_HOME directory. For Windows NT, the default location was C:\orant.

This release complies with Optimal Flexible Architecture (OFA) guidelines. All subdirectories are not under a top level ORACLE_HOME directory. There is a top level directory called ORACLE_BASE that by de fault is C:\oracle. If you install the latest Oracle release on a computer with no other Oracle software installed, then the default setting for the first Oracle home directory is C:\oracle\orann, where nn is the latest release number. The Oracle home directory is located directly under ORACLE_BASE.

All directory path examples in this guide follow OFA conventions.

Refer to Oracle Database Platform Guide for Windows for additional information about OFA compliances a nd for information about installing Oracle products in non-OFA compliant directories.

Go to the ORACLE_BASE\ORACLE_HOME\rdbms\admin directory.

Documenta tion Accessibility

Our goal is to make Oracle products, services, and supporting doc umentation accessible, with good usability, to the disabled community. To that end, our documentation includes features that make inf ormation available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitat e access by the disabled community. Standards will continue to evolve over time, and Oracle is actively engaged with other market-lea ding technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For addit ional information, visit the Oracle Accessibility Program Web site at

http://www.oracle.com/accessibility/

Accessibility of Code Examples in Documentation

JAWS, a Windows screen reader, may not always correctly read the code examples in this document. The conventions for writing c ode require that closing braces should appear on an otherwise empty line; however, JAWS may not always read a line of text that consi sts solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any represe ntations regarding the accessibility of these Web sites.