Simon Pane First4 Database Partners March 15, 2012

Transcription

1 Simon Pane First4 Database Partners March 15, 2012

2 Review some of the lesser used security features of the Oracle database Discuss both advantages and disadvantages (or limitations) Tips or recommendations from experience

3

4 There s a lot a value and legitimate reasons to use: Copying users from one database to another Resetting passwords Comparing environments Safe way to record DDL in scripts, tickets, etc

5

6 Before 11g we could see the password hash in DBA_USERS Visible to anyone with the SELECT_CATALOG_ROLE In 11g password hashes moved to sys.user$ Visible only with SELECT ANY DICTIONARY With 11g there are two password hashes Case in-sensitive version (16 digit HEX) for backwards compatibility New case sensitive 11g version (60 digit HEX prefixed by S: )

7

8 Keep things simple and consistent (>= 9i)

9 How did we lock users in Oracle 7.3? USERNAME PASSWORD Encryption Algorithm

10 Put in a non-hex value: Technically impossible to crack ORA-1017 gives less information to an intruder than ORA-28000

11

12 The Oracle Database Scheduler allows for jobs that run both inside the database and externally at the OS level known as external jobs Privileges CREATE JOB and CREATE EXTERNAL JOB are required to create and run external jobs OS Security context for non DBA/SYSDBA users to use when running external jobs is defined in $ORACLE_HOME/rdbms/admin/externaljob.ora

13 Default UNIX setting in the extjob file is: run_user = nobody run_group = nobody Don t change this, for example: run_user = oracle run_group = oinstall This becomes an OS-injection risk The program being run could be sh Actual OS commands could be the arguments

14 Windows adds the service OracleJobScheduler<ORACLE_SID> This service runs non-sys scheduler jobs Service ownership defaults to LocalSystem change to a low level user or disable (default)!

15 Do use the Oracle Database Scheduler Handles databases outages Handles RAC node availability and stickiness Secure for DB centric jobs (no credentials required) Probably should be used for DBA maintenance tasks, not application focused tasks

16 External jobs owned by SYS always: Run as oracle on UNIX Run as LocalSystem on Windows Make sure the scripts/executables being called can t be compromised or changed!

17

18 Something we should always do when creating a new database Defaults to the SYSTEM tablespace even in 11gR2! A DOS attack can fill the SYSTEM tablespace Fragmentation can never be removed even with a STARTUP UPGRADE many SYS objects cannot be moved or reorged Reduced Performance due to fragmentation Complete outage if tablespace is FULL

19 DBMS_AUDIT_MGMT actually introduced in 10g but only supposed to be used as part of Audit Vault Re-introduced for general use in 11gR2 Great for relocating the audit trail to a new tablespace while the database is online and auditing!

20 Simple to implement:

21 For 10g (actually < 11.2) still relocate manually (MOS Note for example) Can be used to purge old auditing data Plenty of Bugs (MOS Note ) Doesn t delete records from an old DBID Can create a scheduler job but takes multiple steps Simpler to just make your own audit data clean-up job.

22

23 DBAs (SYSDBA connections) can compromise the database audit trail (sys.aud$) AUDIT_SYSLOG_LEVEL = AUTH.INFO Writes audit data to the system s syslog daemon log files owned by root AUDIT_SYS_OPERATIONS = TRUE Captures SQL, not just CONNECT, STARTUP, and SHUTDOWN (the default options)

24 AUDIT_SYS_OPERATIONS and AUDIT_SYSLOG_LEVEL are not dynamic parameters Database restart required to change: Parameter change may be recorded to the syslog At the very least the DB restart will be recorded Make sure to disable before running an upgrade to avoid generating a large syslog file!

25 Only captures SYSDBA connections Users with the DBA role can still: Compromise the database audit trails Change protective security/grants on the tables Change auditing options A proper auditing tool (i.e. Audit Vault) may be required to capture all activity

26 Is reactive doesn t prevent the DBAs from seeing the data Database Vault and a dedicated Security Administrator (a different person) required to truly prevent DBA access to the data

27

28 EXP / IMP EXPDP / IMPDP

29 Listener Node Checking Database Vault Oracle Label Security Database Firewall

30 Will work but is probably based on the module name which can be spoofed or changed But what about? move sqlplus.exe myapp.exe

31 A simple application based way to prevent access through authorized apps: Must be set :

32 Password is by-passed when role grant is nested! Password sent clear-text in SQLNET may be sniffed or identified by SQLNET tracing

33

34 Like a simple firewall: Prevent connections from un-authorized servers From TEST or DEV to PROD DB Links after refreshes accidental use Only allow connections from authorized application servers and DBA desktops Prevent unauthorized access via desktop tools from non-dbas No additional license required Available from 9i onwards

35 Three parameters in sqlnet.ora Contrary to documentation can be adjusted dynamically without a restart tcp.validnode_checking = {YES, NO} tcp.invited_nodes = ( {hostnames/ips} ) tcp.excluded_nodes = ( {hostnames/ips} ) Set either one or the other but not both Can t use wildcards

36 Scripting mistakes can happen

37 When the database registers against a listener, it passes across all environment variables! From lsnrctl: set displaymode verbose services

38 As of Oracle 10g, only local connections permitted by default: LOCAL_OS_AUTHENTICATION_<listener> = ON If set to OFF listener behaves like an Oracle 8i/9i listener meaning remote admin connections are permitted Also set ADMIN_RESTRICTIONS_<listener> = ON

39

40 Without the ASO passwords are sent in clear text through SQLNET: ALTER USER SIMON IDENTIFIED BY Password123; Can easily be traced by a network sniffing tool SQLNet Tracing Use the SQLPlus PASSWORD command instead

41 Added in Oracle 11g but requires ASO Even if the password is well known or hardcoded in scripts, encryption can provide off-site / backup vendor protection

42 SET ENCRYPTION ON IDENTIFIED BY mypasswd ONLY; BACKUP FULL DATABASE;

43 ENCRYPTION = {ALL DATA_ONLY ENCRYPTED_COLUMNS_ONLY METADATA_ONLY NONE} ENCRYPTION_ALGORITHM = { AES128 AES192 AES256 } ENCRYPTION_PASSWORD = {password}

44 There are many less often used security options built-in to the Oracle database Most have both advantages and limitations A secure deployment is going to be multifaceted

45