<p> USING ORACLE 10g DATABASE VAULT</p><p>CONFIGURING DATABASE VAULT OPTIONS TO AN EXISTING ORACLE_HOME AND SETTING UP THE DATA VAULT OWNER IN THE DATABASE ‘VAULTDB’ dvca -action option -oh $ORACLE_HOME -s_path /tmp -logfile /tmp/log.out -owner_account dvo -owner_passwd Salom#2401 -jdbc_str jdbc:oracle:oci:@vaultdb -sys_passwd oracle -nodecrypt -silent vaultdb:/u02/oracle/10.2/bin> ./dvca -action option -oh $ORACLE_HOME -s_path /tmp -logfile /tmp/log.out -owner_account dvo -owner_passwd Salom#2401 -jdbc_> DVCA started Executing task RESTART_SERVICES_PATCH MANAGE_INSTANCE stop isqlplus MANAGE_INSTANCE stop OC4J MANAGE_LISTENER start listener MANAGE_LISTENER start listener result=/u02/oracle/10.2/bin/dvca_start_listener.sh,1, MANAGE_LISTENER start listener log= LSNRCTL for IBM/AIX RISC System/6000: Version 10.2.0.3.0 - Production on 08-OCT-2008 04:10:00</p><p>Copyright (c) 1991, 2006, Oracle. All rights reserved.</p><p>TNS-01106: Listener using listener name LISTENER has already been started</p><p>MANAGE_INSTANCE start RDBMS Executing task SQLPLUS_CATOLS Executing task RESTART_SERVICES_OLS MANAGE_INSTANCE stop isqlplus MANAGE_INSTANCE stop OC4J MANAGE_LISTENER start listener MANAGE_LISTENER start listener result=/u02/oracle/10.2/bin/dvca_start_listener.sh,1, MANAGE_LISTENER start listener log= LSNRCTL for IBM/AIX RISC System/6000: Version 10.2.0.3.0 - Production on 08-OCT-2008 04:15:52</p><p>Copyright (c) 1991, 2006, Oracle. All rights reserved.</p><p>TNS-01106: Listener using listener name LISTENER has already been started</p><p>MANAGE_INSTANCE start RDBMS Executing task SQLPLUS_CATMAC Executing task UNLOCK_DVSYS Executing task LOAD_NLS_FILES Executing task ACCOUNT_CREATE_OWNER Executing task GRANT_CONNECT_OWNER Executing task GRANT_ADMIN_DB_TRIG Executing task GRANT_ALTER_ANY_TRIG Executing task PASSWORD_CHANGE_DVSYS Executing task PASSWORD_CHANGE_DVF RULE_SYNC:TRUE Executing task GRANT_DV_OWNER_OWNER Executing task GRANT_DBMS_RLS_OWNER Executing task GRANT_AUDIT_TRAIL Executing task GRANT_DV_ACCTMGR_OWNER COMMAND_RULES:9 Executing task ALTER_TRIGGER_BEFORE_DDL Executing task ALTER_TRIGGER_AFTER_DDL Executing task REVOKE_CONNECT_DVSYS Executing task REVOKE_CONNECT_DVF Executing task LOCK_DVSYS Executing task LOCK_DVF Executing task ALTER_TRIGGER_LBACSYS1 Executing task ALTER_TRIGGER_LBACSYS2 Executing task ALTER_TRIGGER_LBACSYS3 Executing task DEPLOY_DVA DEPLOY_DVA,validate DEPLOY_DVA get EM home DEPLOY_DVA get EM home instance=tmpu008.bankwest.com_vaultdb DEPLOY_DVA stop isqlplus DEPLOY_DVA stop OC4J DEPLOY_DVA,modify /u02/oracle/10.2/oc4j/j2ee/OC4J_DBConsole_tmpu008.bankwest.com_vaultdb/config/server.xml DEPLOY_DVA,modify /u02/oracle/10.2/oc4j/j2ee/OC4J_DBConsole_tmpu008.bankwest.com_vaultdb/config/http-web-site.xml Executing task SQLPLUS_UTLRP Executing task INIT_AUDIT_SYS_OPERATIONS Executing task INIT_REMOTE_OS_AUTHENT Executing task INIT_REMOTE_OS_ROLES Executing task INIT_OS_ROLES Executing task INIT_SQL92_SECURITY Executing task INIT_OS_AUTHENT_PREFIX Executing task INIT_REMOTE_LOGIN_PASSWORDFILE Executing task INIT_RECYCLEBIN Executing task RESTART_SERVICES MANAGE_INSTANCE stop isqlplus MANAGE_INSTANCE stop OC4J MANAGE_INSTANCE stop RDBMS MANAGE_LISTENER stop listener MANAGE_LISTENER start listener MANAGE_INSTANCE start RDBMS MANAGE_INSTANCE start OC4J vaultdb:/u02/oracle/10.2/bin> Launch the Oracle Database Vault web application from the URL: http://tmpu008:1158/dva</p><p>CASE 1</p><p>User SYSTEM has SELECT ANY TABLE privilege and can select all the rows of the HR.REGIONS table.</p><p>Note that the banner indicates that Database Vault option has been added to the Oracle software vaultdb:/u02/oracle/10.2/install> sqlplus system/oracle</p><p>SQL*Plus: Release 10.2.0.3.0 - Production on Wed Oct 8 13:03:43 2008</p><p>Copyright (c) 1982, 2006, Oracle. All Rights Reserved.</p><p>Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.3.0 - 64bit Production With the Partitioning, Oracle Label Security, OLAP, Data Mining and Oracle Database Vault options</p><p>SQL> select * from hr.regions;</p><p>REGION_ID REGION_NAME ------1 Europe 2 Americas 3 Asia 4 Middle East and Africa Using Database Vault, we will set up security so that even a privileged user like SYSTEM is not able to access any tables owned by the schema HR</p><p>Connect as the Database Vault owner - dvo</p><p>Create a new security realm PROTECT_HR</p><p>ADD ALL TABLES OWNED BY HR TO THE SECURED REALM PROTECT_HR</p><p>TEST THE SAME BY CONNECTING AS SYSTEM AND TRYING TO ACCESS ANY TABLES OWNED BY HR vaultdb:/u02/oracle/10.2/install> sqlplus system/oracle</p><p>SQL*Plus: Release 10.2.0.3.0 - Production on Wed Oct 8 13:28:18 2008</p><p>Copyright (c) 1982, 2006, Oracle. All Rights Reserved.</p><p>Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.3.0 - 64bit Production With the Partitioning, Oracle Label Security, OLAP, Data Mining and Oracle Database Vault options</p><p>SQL> select * from hr.regions; select * from hr.regions * ERROR at line 1: ORA-01031: insufficient privileges</p><p>HOWEVER, SYSTEM USER CAN ACCESS OTHER TABLES IN THE DATABASE IN SCHEMAS OTHER THAN HR</p><p>SQL> select count(*) from sh.sales;</p><p>COUNT(*) ------918843 DATABASE VAULT ALSO TRACKS AND REPORTS ANY SECURITY VIOLATIONS THAT HAVE OCCURRED CASE TWO</p><p>In the second case study we will set up security using Database Vault so that any DELETE operation on a certain table can ONLY BE PERFORMED IF YOU CONNECT FROM A CLIENT MACHINE WITH A PARTICULAR IP ADDRESS – this will prevent any unauthorized access to data stored in sensitive tables CREATE A NEW RULE SET CALLED PRIVILEGED_CLIENT_MACHINE</p><p>While creating the RULE SET, we will provide the IP ADDRESS of the particular client machine that we want to restrict connections to.</p><p>NEXT WE ASSOCIATE THE RULE SET WE JUST CREATED WITH A PARTICULAR COMMAND – IN OUR CASE THE COMMAND IS DELETE</p><p>TEST THE SAME BY CONNECTING AS SYSTEM FROM A SQL*PLUS SESSION DIRECTLY FROM THE SERVER vaultdb:/u02/oracle/10.2/install> sqlplus system/oracle</p><p>SQL*Plus: Release 10.2.0.3.0 - Production on Wed Oct 8 14:48:56 2008</p><p>Copyright (c) 1982, 2006, Oracle. All Rights Reserved.</p><p>Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.3.0 - 64bit Production With the Partitioning, Oracle Label Security, OLAP, Data Mining and Oracle Database Vault options</p><p>SQL> delete sh.sales where rownum < 10; delete sh.sales where rownum < 10 * ERROR at line 1: ORA-01031: insufficient privileges ON THE CLIENT MACHINE WHICH HAS BEEN GRANTED ACCESS, CONFIGURE A LOCAL TNSNAMES.ORA CLIENT CONNECTION TO THE VAULTDB DATABASE AND CONNECT AS THE USER SYSTEM</p><p>NOTE THAT SINCE WE CONNECTING TO THE DATABASE FROM A CONNECTION THAT HAS BEEN SECURED BY DATABASE VAULT, THE DELETE OPERATION ON THE TABLE SALES CAN BE PERFORMED DISABLE DATABASE VAULT vaultdb:/u02/oracle/10.2/install> cd $ORACLE_HOME/rdbms/lib vaultdb:/u02/oracle/10.2/rdbms/lib> make -f ins_rdbms.mk dv_off lbac_off /bin/ar -X64 d /u02/oracle/10.2/rdbms/lib/libknlopt.a kzvidv.o /bin/ar -X64 cr /u02/oracle/10.2/rdbms/lib/libknlopt.a /u02/oracle/10.2/rdbms/lib/kzvndv.o /bin/ar -X64 d /u02/oracle/10.2/rdbms/lib/libknlopt.a kzlilbac.o /bin/ar -X64 cr /u02/oracle/10.2/rdbms/lib/libknlopt.a /u02/oracle/10.2/rdbms/lib/kzlnlbac.o vaultdb:/u02/oracle/10.2/bin> relink oracle chmod 755 /u02/oracle/10.2/bin</p><p>- Linking Oracle rm -f /u02/oracle/10.2/rdbms/lib/oracle ld -b64 -o /u02/oracle/10.2/rdbms/lib/oracle -L/u02/oracle/10.2/rdbms/lib/ -L/u02/oracle/10.2/lib/ -bbigtoc -bnoipath -bI:/u02/oracle/10.2/lib/ksms.imp /u02/oracle/10.2/rdbms/lib/opimai.o /u02/oracle/10.2/rdbms/lib/ssoraed.o /u02/oracle/10.2/rdbms/lib/ttcsoi.o -lperfsrv10 /u02/oracle/10.2/lib/nautab.o /u02/oracle/10.2/lib/naeet.o /u02/oracle/10.2/lib/naect.o /u02/oracle/10.2/lib/naedhs.o /u02/oracle/10.2/rdbms/lib/config.o -bI:/usr/lib/aio.exp -lserver10 /u02/oracle/10.2/lib/libodm10.so -lnnet10 -lskgxp10 -lsthasgen10 /u02/oracle/10.2/has/lib/clssgc.o /u02/oracle/10.2/lib/libstskgxn2.a -lstocr10 -lstocrb10 -lstocrutl10 -lsthasgen10 /u02/oracle/10.2/has/lib/clssgc.o /u02/oracle/10.2/lib/libstskgxn2.a -lclient10 -lvsn10 -lcommon10 -lgeneric10 `if [ -f /u02/oracle/10.2/lib/libavserver10.a ] ; then echo "-lavserver10" ; else echo "-lavstub10"; fi` `if [ -f /u02/oracle/10.2/lib/libavclient10.a ] ; then echo "-lavclient10" ; fi` /u02/oracle/10.2/rdbms/lib/defopt.o -lknlopt `if /bin/ar -X64 tv /u02/oracle/10.2/rdbms/lib/libknlopt.a | grep xsyeolap.o > /dev/null 2>&1 ; then echo "-loraolap10 -bE:/u02/oracle/10.2/rdbms/lib/olap.exp" ; fi` -lslax10 -lpls10 -lplp10 -bE:/u02/oracle/10.2/rdbms/lib/plsqlncomp.exp /u02/oracle/10.2/lib/libstclsra10.a -lstdbcfg10 -lserver10 -lclient10 -lvsn10 -lcommon10 -lgeneric10 -lknlopt -lslax10 -lpls10 -lplp10 -ljox10 -bE:/u02/oracle/10.2/rdbms/lib//oracle.exp `sed -e 's/-ljava//g' /u02/oracle/10.2/lib/ldflags` -lncrypt10 -lnsgr10 -lnzjs10 -ln10 -lnnz10 -lnl10 -lnzjs10 -lnro10 `sed -e 's/-ljava//g' /u02/oracle/10.2/lib/ldflags` -lncrypt10 -lnsgr10 -lnzjs10 -ln10 -lnnz10 -lnl10 -lnzjs10 -lclient10 -lvsn10 -lcommon10 -lgeneric10 -lmm -lsnls10 -lnls10 -lcore10 -lsnls10 -lnls10 -lcore10 -lsnls10 -lnls10 -lxml10 -lcore10 -lunls10 -lsnls10 -lnls10 -lcore10 -lnls10 `sed -e 's/-ljava//g' /u02/oracle/10.2/lib/ldflags` -lncrypt10 -lnsgr10 -lnzjs10 -ln10 -lnnz10 -lnl10 -lnzjs10 -lnro10 `sed -e 's/-ljava//g' /u02/oracle/10.2/lib/ldflags` -lncrypt10 -lnsgr10 -lnzjs10 -ln10 -lnnz10 -lnl10 -lnzjs10 -lclient10 -lvsn10 -lcommon10 -lgeneric10 -lpls10 -lsnls10 -lnls10 -lcore10 -lsnls10 -lnls10 -lcore10 -lsnls10 -lnls10 -lxml10 -lcore10 -lunls10 -lsnls10 -lnls10 -lcore10 -lnls10 -lclient10 -lvsn10 -lcommon10 -lgeneric10 -lsnls10 -lnls10 -lcore10 -lsnls10 -lnls10 -lcore10 -lsnls10 -lnls10 -lxml10 -lcore10 -lunls10 -lsnls10 -lnls10 -lcore10 -lnls10 -lserver10 `if /bin/ar -X64 tv /u02/oracle/10.2/rdbms/lib/libknlopt.a | grep "kxmnsd.o" > /dev/null 2>&1 ; then echo " " ; else echo "-lordsdo10"; fi` -lctxc10 -lctx10 -lzx10 -lgx10 -lctx10 -lzx10 -lgx10 -lordimt10 -lsnls10 -lnls10 -lcore10 -lsnls10 -lnls10 -lcore10 -lsnls10 -lnls10 -lxml10 -lcore10 -lunls10 -lsnls10 -lnls10 -lcore10 -lnls10 -lsnls10 -lunls10 -bE:/u02/oracle/10.2/rdbms/lib//libcorejava.exp -lld -lm `cat /u02/oracle/10.2/lib/sysliblist` -lm `if [ "\`/usr/bin/uname -v\`" = "4" ]; \ then echo "-bI:/u02/oracle/10.2/lib/pw-syscall.exp"; fi;` `if /bin/ar -X64 t /u02/oracle/10.2/rdbms/lib/libknlopt.a | grep '^'kcsm.o > /dev/null 2>&1 ; then echo "-lha_gs_r -lha_em_r -lpthreads"; fi` -locijdbcst10 -lwwg -bpT:0x100000000 -bpD:0x110000000 –bforceimprw ld: 0711-783 WARNING: TOC overflow. TOC size: 142864 Maximum size: 65536 Extra instructions are being generated for each reference to a TOC symbol if the symbol is in the TOC overflow area. mv -f /u02/oracle/10.2/bin/oracle /u02/oracle/10.2/bin/oracleO mv /u02/oracle/10.2/rdbms/lib/oracle /u02/oracle/10.2/bin/oracle chmod 6751 /u02/oracle/10.2/bin/oracle vaultdb:/u02/oracle/10.2/bin> sqlplus system/oracle</p><p>SQL*Plus: Release 10.2.0.3.0 - Production on Wed Oct 8 15:20:04 2008</p><p>Copyright (c) 1982, 2006, Oracle. All Rights Reserved.</p><p>Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.3.0 - 64bit Production With the Partitioning, OLAP and Data Mining options</p>