Exadata Database Machine Security

Transcription

1 Exadata Database Machine Security Dan Norris MAA Team, Oracle Development May 2, 2016

2 MAA with Oracle Engineered Systems (e.g. Exadata) Further Reduce Cost & Complexity for any Service Level Within Exadata Within a Site Across Sites Compute servers, DB servers, disks, flash, network, power Hardware Redundancy RAC, ASM, Flashback SoNware Fault Tolerance DATABASE IN-MEMORY AcBve Data Guard DATABASE IN-MEMORY Local standby for High-Availability Failover Redundant Systems Redundant Databases DATABASE IN-MEMORY Remote standby for Disaster Recovery Redundant Systems Redundant Databases Online patching, reconfigurabon, expansion LAN WAN Fastest RAC Node Failure Recovery Deep ASM Mirroring IntegraBon Fastest Backup - RMAN Offload to Storage Fastest Data Guard Redo Apply Complete Failure TesBng 2

3 Program Agenda PreparaQon for installaqon InstallaQon, deployment Post-deployment configuraqon Database creaqon and configuraqon OperaQonal security consideraqons 3

4 Security Terminology GeWng us on the same page AWack surface the code within a computer system that can be run by unauthorized users Port network term referring to a virtual endpoint Service operaqng system term referring to a background process or daemon CPU CriQcal Patch Update, quarterly released security patches for Oracle products 4

5 PreparaQon for InstallaQon Security starts early Get educated Collect security-related requirements from all stakeholders Determine whether role-separated installaqon is required Plan network layout Subscribe to security alerts - hwp://is.gd/orasec Review MOS note : Guidelines for enhancing the security for an Oracle Database Machine deployment Review MOS : Responses to common Exadata security findings 5

6 Plan Network Layout Perimeter security for networks Client Access is entry point for most accesses from applicaqons Management (Admin) should be restricted InfiniBand is private to machine, physical security protects it 6

7 InstallaQon and Deployment Implement the available features and security plan Exadata includes many security features by default Implement the recommended security step during deployment AKA Resecure Machine step Start secure, only open what is necessary Doing security later almost never happens (or works) Configure ASM audits to use syslog (audit_syslog_level) Configure ASM & DB init.ora: audit_sys_operaqons=true 7

8 Default Security Features Implement the available features and security plan short package install list only necessary services enabled hwps management interface sshd secure default sekngs password aging maximum failed login awempts auditd monitoring enabled cellwall: iptables firewall CPUs included in patch bundles, releases synchronized system hardening boot loader password protecqon 8

9 Resecure Machine Step Implement the available features and security plan In this step, several security changes are made: password complexity requirements are added (passwdqc: dis,dis,16,12,8) passwords are expired (forcing reset on next login) password aging implemented permissions Qghtened 9

10 Resecure Machine Step $./install.sh cf maa-phys.xml -l 1. Validate Configuration File 2. Setup Required Files <snip many steps> 17. Install Exachk 18. Create Installation Summary 19. Resecure Machine 10

11 Resecure Machine Step $./install.sh cf maa-vm.xml -l 1. Validate Configuration File 2. Create Virtual Machine 3. Create Users <snip many steps> 17. Create Installation Summary 18. Resecure Machine 11

12 Post-Deployment ConfiguraQon Address site-specific requirements Change all passwords for all default accounts (MOS ) Perform validaqon for local policies or rules See MOS for commonly idenqfied audit findings Exadata Security especially for consolidaqon environments 12

13 Post-Deployment ConfiguraQon Cell Lockdown *New* in Cells can have remote access disabled no direct SSH access to OS Must enable temporarily for maintenance (upgrades) New cell awributes: remoteaccessperm, remoteaccesstemp Can temporarily enable access, automaqc lock up at a specified Qme Can sqll access console via ILOM Use exacli/exadcli from DB nodes for cell commands 13

14 Post-Deployment ConfiguraQon Cell Lockdown Setup cellcli> create role administrator cellcli> grant privilege all actions on all objects all attributes with all options to role administrator cellcli> create user celladministrator password='*' cellcli> grant role administrator to user celladministrator 14

15 Post-Deployment ConfiguraQon Cell Lockdown # cellcli -e list cell detail egrep -i 'cellversion accesslevel' accesslevelperm: cellversion: remotelogindisabled OSS_ _LINUX.X64_ exacli> alter cell accessleveltemp=((accesslevel="remoteloginenabled", - starttime="now", - duration="30m", - reason="quarterly maintenance")) 15

16 Post-Deployment ConfiguraQon Centralized syslog Cells have syslogconf cell awributes (for quite a while) DB nodes have /etc/rsyslog.conf On & later, also have syslogconf dbserver awribute 16

17 Post-Deployment ConfiguraQon Centralized syslog setup On receiving side, for rsyslogd, modify /etc/rsyslogd.conf: # Provides UDP syslog reception $ModLoad imudp $UDPServerRun 514 The HUP rsyslogd: kill -HUP $(cat /var/run/syslogd.pid) 17

18 Post-Deployment ConfiguraQon Centralized syslog cellcli> alter cell cellcli> alter cell validate syslogconf 'authpriv.error'; dbmcli> alter dbserver dbmcli> alter dbserver validate syslogconf 'authpriv.error'; 18

19 Exadata Security (ASM, Griddisks) ConsolidaBon: sharing without peeking Privileges on griddisk level Restrict griddisks to certain clusters and/or certain database(s) Especially effecqve to manage mulqple administrators See whitepapers Oracle Exadata Database Machine ConsolidaQon: SegregaQng Databases and Roles - hwp://is.gd/exaconsolidaqon Best PracQces for Database ConsolidaQon On Exadata Database Machine - hwp:// is.gd/orclconswp 19

20 Database CreaQon and ConfiguraQon Implement database-specific features and best pracbces Stay current with Exadata bundle patches ( ) Bundle patches include latest CPU patches Consider TDE, network encrypqon, Data Vault, Audit Vault Review whitepaper: Cost EffecQve Security and Compliance with Oracle Database 11g Release 2 - hwp://is.gd/seccompliance11gr2 Take the Enterprise Data Security Assessment at hwp://is.gd/ entsecassessment 20

21 Oracle Database Security Defense in Depth PREVENTIVE DETECTIVE ADMINISTRATIVE Encryption & Redaction Activity Monitoring Key & Wallet Management Masking & Subsetting Database Firewall Privilege & Data Discovery DBA Controls & Cyber Security Auditing and Reporting Configuration Management 21

22 OperaQonal Security ConsideraQons Remain security-minded when patching, upgrading, backing up Changes permiwed on DB nodes, not cells Backups can be encrypted Patching or upgrading may undo some changes; verify aner DB node updates use yum commands with excludes (see doc for excludes) 22

23 OperaQonal Security ConsideraQons Remain security-minded when patching, upgrading, backing up Periodic reviews to ensure sekngs remain and vulnerabiliqes don t Secure erase for storage cells is available Disk drive retenqon is available Oracle Enterprise Manager Governance, Risk & Compliance Manager conqnuously reviews the system 23

24 OperaQonal Security ConsideraQons Update JDK on DB nodes- a relabvely common request (MOS ) (root)# dbmcli -e alter dbserver shutdown services ms Stopping MS services... The SHUTDOWN of MS services was successful. (root)# rpm -qa grep jdk jdk1.8.0_ _66-fcs.x86_64 (root)# rpm -Uvh /tmp/jdk-8u77-linux-x64.rpm Preparing... ########################################### [100%] 1:jdk1.8.0_77 ########################################### [100%] <output removed> (root)# rpm -qa grep jdk jdk1.8.0_ _66-fcs.x86_64 jdk1.8.0_ _77-fcs.x86_64 (root)# 24

25 OperaQonal Security ConsideraQons Update JDK on DB nodes- a relabvely common request (MOS ) (root)# rpm -qa grep jdk jdk1.8.0_ _66-fcs.x86_64 jdk1.8.0_ _77-fcs.x86_64 (root)# rpm -e --nodeps jdk1.8.0_ _66-fcs.x86_64 (root)# rpm -qa grep jdk jdk1.8.0_ _77-fcs.x86_64 (root)# (root)# cd /opt/oracle/dbserver/dbms/deploy/scripts/unix/ (root)# sh setup_dynamicdeploy DB <lots of output> (root)# dbmcli -e alter dbserver startup services ms Starting MS services... The STARTUP of MS services was successful. (root)# 25

26 OperaQonal Security ConsideraQons Patching considerabons Component Database Patch set Database Bundle Patch Grid Infrastructure Exadata Database Server (OS) Exadata Storage Server InfiniBand Switch Access Required Database server root, sonware home owner, passwordless SSH to all sonware home owners (on other nodes) Database server root, sonware home owner Same as Database Database server root, passwordless SSH to database server root Database server root, passwordless SSH from database server root to storage server root (temporarily disable lockdown) Database server root, InfiniBand switch passwordless SSH to switch root 26

27 Late Breaking Security Updates MOS Note or URL DescripBon Disable SSLv2 on Oracle Exadata Database Machine hwp://badlock.org/ glibc vulnerability (CVE ) patch availability for Oracle Exadata Database Machine Badlock bug CVE Exadata images not affected (images don't include samba packages by default) 27

28 Summary PreparaQon for installaqon InstallaQon, deployment Post-deployment configuraqon Database creaqon and configuraqon OperaQonal security consideraqons 28

29 References Note or URL hwp://is.gd/orasec Oracle Security Alerts subscripqon DescripBon Guidelines for enhancing the security for an Oracle Database Machine deployment How to change OS user password for Cell Node, Database Node, ILOM, KVM, Infiniband Switch, GigaBit Ethernet Switch and PDU on Exadata Exadata Database Machine and Exadata Storage Server Supported Versions Responses to common Exadata security scan findings hwp://is.gd/exaconsolidaqon hwp://is.gd/entsecassessment Oracle Exadata Database Machine ConsolidaQon: SegregaQng Databases and Roles Enterprise Data Security Assessment 29

30 References MOS Note or URL DescripBon HOWTO: Update JDK on Exadata Database Nodes HOWTO: Update JDK on Exadata Storage Cell Nodes 30

31 Safe Harbor Statement The preceding is intended to outline our general product direcqon. It is intended for informaqon purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or funcqonality, and should not be relied upon in making purchasing decisions. The development, release, and Qming of any features or funcqonality described for Oracle s products remains at the sole discreqon of Oracle. 31

32 32

33