12.2 Multitenant New Security Features Clarify DevOps and DBA role separation

Transcription

1 Infrastructure at your Service Clarify DevOps and DBA role separation

2 Infrastructure at your Service. About me Franck Pachot Principal consultant Oracle Technology Leader Mobile Page 2

3 Who we are dbi services Experts At Your Service > 50 specialists in IT infrastructure > Certified, experienced, passionate Based In Switzerland > 100% self-financed Swiss company > Over CHF6 mio. turnover Leading In Infrastructure Services > More than 120 customers in CH, D, & F > Over 40 SLAs dbi FlexService contracted Page 3

4 12.2 Agenda 1. DevOps 2. Common and local users 3. Lockdown profiles and PDB isolation 4. Resource manager and PDB parameters 5. Conclusion Page 4

5 DevOps What is DevOps, What is Agile, What is Cloud? At operations our goal is stability > Run same old things for years > Don't touch anything when it works > We keep the keys of the system so that nobody breaks it At development our goal is evolution > What is ok today will be obsolete tomorrow > When it works we need to do better > We need to do it fast: agile > We can't depend on Ops: fast provisioning, fast refresh, Cloud Page 5

6 DevOps Roundrips between Dev and Ops is too long Each operation requires > several manual steps > from multiple teams Today we need > More automation > Faster provisioning > Less roundtrips between Dev and Ops > Ops provision an isolated database > Then give all rights it to Dev > And automation to clone, refresh,

7 DevOps Roundtrips between Dev and Ops is too long Need to create databases faster? > CREATE PLUGGABLE DATABASE Multitenant Need to refresh databases faster? > Snapshots, Thin Clones, refreshable PDBs Thin Clones Dev and Ops must communicate > Set the rules before arguing each request > Define clearly the Dev privileges: > Full power on his PDB only > No side effect on other PDBS For whatever reason this is called "CLOUD" DevOps Agile Lockdown profiles Resource manager Page 7

8 DevOps Exadata Express Cloud Service The first Oracle Cloud Service > Was: Schema as a Service > Focused at developers (goal was APEX) At OOW16 Oracle has released a new service for developers: > PDB as a Service rather than Schema as a Service > A PDB is a database (public objects, multiple schemas) > Provisioned in minutes - focused at developers: they are granted DBA > The CDB is managed by Oracle So can we give DBA rights to a developer on his PDB without compromising the system? > Yes, with multitenant architecture, in Oracle Database 12c Release 2 Page 8

9 DevOps Exadata Express lockdown & restrictions Admin privileges on the PDB But no access to the system Page 9

10 DevOps Exadata Express lockdown & restrictions Admin privileges on the PDB But using only allocated resources Page 10

11 Agenda 1. DevOps 2. Common and local users 3. Lockdown profiles and PDB isolation 4. Resource manager and PDB parameters 5. Other features 6. Conclusion Page 11

12 Users and privileges Common and local users Local users are created in the PDB > Are known in local container only > Created in one container with container=current Local user Common users are created in the CDB > Are known in all containers > Created in CDB$ROOT with container=all > Can change current container with alter session PDB_APP1 PDB$SEED Common user CDB$ROOT CDB1 Page 12

13 Users and privileges Common and local users Local users are for Dev APPLICATION SYSTEM > Application schemas > Application users PDB_APP1 PDB$SEED CDB$ROOT > Application admins Common users are for Ops > system administrator CDB1 > Oracle maintained > Monitoring, Multitenant architecture vs. non-cdb: separation of roles Page 13

14 Users and privileges Common and local roles and privileges Local roles and privileges > Granted to local or common user on local container Common roles and privileges > From CDB$ROOT with container=common > Granted to common users on all containers SQL> alter session set current_container=pdb; SQL> grant DBA to MY_DEVELOPER container=current; So you can grant DBA locally to the PDB local admin > But are you sure that his rights are limited to the PDB? Page 14

15 Users and privileges Demo Common user: CDB administrator SQL> show parameter prefix NAME TYPE VALUE common_user_prefix string C## SQL> create user C##CDBDBA identified by ops container=all; User created. Local user: PDB administrator SQL> alter session set container=pdb1; Session altered. SQL> create user PDBDBA identified by dev container=current; User created. SQL> grant DBA to PDBDBA identified by dev container=current; Grant succeeded. Page 15

16 Agenda 1. DevOps 2. Common and local users 3. Lockdown profiles and PDB isolation 4. Resource manager and PDB parameters 5. Other features 6. Conclusion Page 16

17 Lockdown profiles You want to delegate some DBA roles to a PDB owner > You need a finer level than system privileges SQL> create lockdown profile X20; Lockdown Profile created. SQL> select * from DBA_LOCKDOWN_PROFILES; PROFILE_NAME RULE_TYPE RULE CLAUSE CLAUSE_OPT OPTION_VAL STATUS APPDBA_PROF DISABLE SQL> alter session set container=pdb1; Session altered. SQL> alter system set pdb_lockdown=x20; System altered. With lockdown profiles you can lockdown local users > disable database options, features, access to system files, network > control what can be done by some powerful commands: > ALTER SYSTEM, ALTER SESSION, ALTER [PLUGGABLE] DATABASE Page 17

18 Lockdown profiles Demo - disable option CDB disables some options SQL> alter lockdown profile DEMO_LOCKDOWN DISABLE option = ('Partitioning'); Lockdown Profile altered. SQL> select * from dba_lockdown_profiles; PROFILE_NAME RULE_TYPE RULE CLAUSE CLAUSE_OPTION STATUS DEMO_LOCKDOWN OPTION PARTITIONING DISABLE Local user: PDB administrator SQL> create table TEST(c char) partition by hash(c) partitions 2; create table TEST(c char) partition by hash(c) partitions 2 * ERROR at line 1: ORA-00439: feature not enabled: Partitioning SQL> select banner from v$version; BANNER Oracle Database 12c Enterprise Edition Release bit Production Page 18

19 Lockdown profiles disable option You want to disable options (cf. V$OPTION): > Database queuing (also known as Advanced Queuing) > Oracle Data Guard > Partitioning > Real Application Clusters for a PDB SQL> alter lockdown profile APPDBA_PROF disable option = ('Partitioning'); Lockdown Profile altered. SQL> select * from DBA_LOCKDOWN_PROFILES; PROFILE_NAME RULE_TYPE RULE CLAUSE CLAUSE_OPT OPTION_VAL STATUS APPDBA_PROF OPTION PARTITIONING DISABLE > disable option all; > disable option all except=( ); Page 19

20 Lockdown profiles disable alter system Did you ever SQL> grant ALTER SYSTEM to MY_DEVELOPER; > so that they can kill their sessions? > That s a quite powerful privilege Alternative: SQL> create procedure kill_session ( ) as begin if /* check if session USERNAME */ execute immediate 'alter system kill session ' SQL> grant EXECUTE on kill_session to MY_DEVELOPER; > Great encapsulation, but how does it work with TOAD kill button? In 12cR2 Multitenant, there is a solution: lockdown profiles > available in Multitenant, also in Single-Tenant, but not in non-cdb > to control PDB local users beyond privileges Page 20

21 Lockdown profiles disable alter system You want to disable: > Some ALTER SYSTEM commands > But not revoke whole ALTER SYSTEM privilege for a PDB SQL> alter lockdown profile APPDBA_PROF disable statement = ('ALTER SYSTEM') clause all except = ('KILL SESSION'); SQL> select * from DBA_LOCKDOWN_PROFILES; PROFILE_NAME RULE_TYPE RULE CLAUSE CLAUSE_OPT OPTION_VAL STATUS APPDBA_PROF STATEMENT ALTER SYSTEM DISABLE APPDBA_PROF STATEMENT ALTER SYSTEM KILL SESSION ENABLE > Any user will get an ORA-01031: insufficient privileges for any ALTER SYSTEM command, except an ALTER SYSTEM KILL SESSION Page 21

22 Lockdown profiles disable alter system You want to disable: > Some ALTER SYSTEM commands > Allow ALTER SYSTEM SET, but for some parameters only SQL> alter lockdown profile APPDBA_PROF disable statement = ('ALTER SYSTEM') clause = ('SET'); Lockdown Profile altered. SQL> alter lockdown profile APPDBA_PROF enable statement = ('ALTER SYSTEM') clause = ('SET') option = ('undo_retention', 'temp_undo_enabled', 'resumable_timeout', 'cursor_sharing', 'session_cached_cursors', 'heat_map', 'resource_manager_plan', 'optimizer_dynamic_sampling'); Lockdown Profile altered. SQL> select * from DBA_LOCKDOWN_PROFILES where profile_name='appdba_prof'; PROFILE_NAME RULE_TYPE RULE CLAUSE CLAUSE_OPTION STATUS APPDBA_PROF STATEMENT ALTER SYSTEM SET DISABLE APPDBA_PROF STATEMENT ALTER SYSTEM SET CURSOR_SHARING ENABLE Page 22

23 Lockdown profiles Demo - alter system CDB administrator disables ALTER SYSTEM SQL> alter lockdown profile DEMO_LOCKDOWN 2 disable statement = ('ALTER SYSTEM'); PDB administrator cannot do any ALTER SYSTEM SQL> alter system kill session '395,37488' alter system kill session '395,37488' * ERROR at line 1: ORA-01031: insufficient privileges CDB administrator makes an exception for KILL SESSION SQL> alter lockdown profile DEMO_LOCKDOWN 2 enable statement = ('ALTER SYSTEM') clause = ('KILL SESSION'); PDB administrator can use ALTER SYSTEM only to kill sessions SQL> alter system kill session '395,37488' System altered. Page 23

24 Lockdown profiles disable alter system Example: SQL> alter system set optimizer_dynamic_sampling=4; System altered. SQL> alter system set optimizer_index_cost_adj=1; alter system set optimizer_index_cost_adj=1 * ERROR at line 1: ORA-01031: insufficient privileges When disabling, we can set the value, a list of value, or a min/max value: alter lockdown profile APPDBA_PROF disable statement=('alter SYSTEM') clause=('set') option=('cursor_sharing') value=('exact'); > Sets the value to in spfile > (re)start the PDB after setting the lockdown profile Page 24

25 Lockdown profiles disable alter system ALTER SYSTEM SET PDB_LOCKDOWN can be set only by a common user 18:39:35 SQL> show parameter lockdown NAME TYPE VALUE pdb_lockdown string DEMO_LOCKDOWN 18:39:43 SQL> alter session set pdb_lockdown=''; ERROR: ORA-02097: parameter cannot be modified because specified value is invalid ORA-01031: insufficient privileges ALTER SYSTEM RESET > is also disabled by clause=('set') Other statements: > ALTER SESSION (same clause/option than ALTER SYSTEM) > ALTER DATABASE > ALTER PLUGGABLE DATABASE Page 25

26 Lockdown profiles disable features You want to disable: > Network access > DBMS_DEBUG_JDWP, UTL_HTTP, UTL_INADDR, UTL_SMTP, UTL_TCP > XDB (the native XML storage in database) > COMMON_SCHEMA_ACCESS through proxy users > Such as connect for a PDB SQL> alter lockdown profile APPDBA_PROF disable feature = ('UTL_HTTP','UTL_SMTP','UTL_TCP'); > NETWORK_ACCESS disables all networking packages > OS_ACCESS disables all file manipulation > DROP_TABLESPACE_KEEP_DATAFILES needed to drop a tablespace without 'including datafiles' with non-omf datafile > 'AWR_ACCESS' needed to create snapshot Page 26

27 Lockdown profiles disable features Not all documented: strings $ORACLE_HOME/bin/oracle NETWORK_ACCESS COMMON_SCHEMA_ACCESS UTL_TCP UTL_HTTP UTL_SMTP UTL_INADDR XDB_PROTOCOLS CTX_PROTOCOLS CTX_LOGGING OS_ACCESS UTL_FILE EXTERNAL_PROCEDURES JAVA_OS_ACCESS JAVA_RUNTIME TRACE_VIEW_ACCESS AQ_PROTOCOLS EXTERNAL_AND_GLOBAL_AUTHENTICATION CONNECTIONS LOCAL_SYSOPER_RESTRICTED_MODE_CONNECT COMMON_USER_CONNECT FILE_TRANSFER AWR_ACCESS COMMON_USER_LOCAL_SCHEMA_ACCESS LOCAL_USER_COMMON_SCHEMA_ACCESS EXTERNAL_FILE_ACCESS DROP_TABLESPACE_KEEP_DATAFILES LOB_FILE_ACCESS ADR_ACCESS Page 27

28 Lockdown profiles Demo - disable features CDB administrator disables some features SQL> alter lockdown profile DEMO_LOCKDOWN 2 disable feature = ('DROP_TABLESPACE_KEEP_DATAFILES'); Lockdown Profile altered. SQL> alter lockdown profile DEMO_LOCKDOWN 2 disable feature = ('AWR_ACCESS'); Lockdown Profile altered. PDB user has insufficient privileges even when having DBA role SQL> drop tablespace USERS * ERROR at line 1: ORA-01031: insufficient privileges SQL> drop tablespace USERS including contents and datafiles; Tablespace dropped. > "ORA-01031: insufficient privileges" is the only info. Lockdown rules are not exposed Page 28

29 PDB isolation on OS PATH_PREFIX and CREATE_FILE_DEST We want to limit the access to filesystems by a PDB In 12.1 > PATH_PREFIX for directories In 12.2 > CREATE_FILE_DEST for directories SQL> create pluggable database PDB1 admin user admin identified by password create_file_dest='/u02/app/oracle/oradata/cdb2/pdb1'; Pluggable database created. SQL> create tablespace APPDATA datafile '/tmp/appdata.dbf' size 5M; create tablespace APPDATA datafile '/tmp/appdata.dbf' size 5M * ERROR at line 1: ORA-65250: invalid path specified for file - /tmp/appdata.dbf Page 29

30 PDB isolation on OS PDB_OS_CREDENTIALS A user can run a program on the host through > dbms_scheduler > external procedure You don t want it to run with the oracle user You create the credential for another OS user exec dbms_credential.create_credential( credential_name=>'pdb1_os_user', username=>'limiteduser', password=>'secret' ); And limit a PDB to use this user: alter session set container=pdb1; alter system set pdb_os_credential=cdb_pdb_os_user scope=spfile; Page 30

31 Agenda 1. DevOps 2. Common and local users 3. Lockdown profiles and PDB isolation 4. Resource manager and PDB parameters 5. Other features 6. Conclusion Page 31

32 Resource Manager Controls PDB usage of CDB resources Which resources? > CPU, Parallel servers, Exadata I/O Define SHARES to guarantee a minimum > Ensures that all PDBs get their part > When all CDB resources are used > DBs that use more that their share will wait Define UTILIZATION_LIMIT to throttle usage > In percentage of CDB resources > PDB that use more than a percentage of CDB resource wait > Parallel_utilization_limit is a % of parallel_servers_target Page 32

33 Resource Manager New in 12.2: memory usage Which resources? > Memory (PGA, Buffer Cache and Shared Pool) Define MEMORY_MIN for minimum allocation > Percentage scaled to 100% -> similar to shares > PDB using more is preferred for releasing memory > PDB using less is preferred for memory allocation Define MEMORY_LIMIT for maximum allocation > In percentage of CDB memory > PDB that use more than a percentage need to release before allocating Page 33

34 Resource Manager New in 12.2: Performance categories For rapid provisioning (cloud) > A CDB can define multiple profiles A CDB plan defines the profile DBMS_RESOURCE_MANAGER.create_cdb_profile_directive( plan => 'PDBAAS_CDB_PLAN', profile=> 'X20', shares=> 2, utilization_limit=> 20, memory_limit=> 20); PDBs sets its performance profile alter lockdown profile &&prof_name disable statement=('alter SYSTEM') clause=('set') option=('db_performance_profile') value=('x20'); Page 34

35 Resource Manager PDB memory parameters Fixed minimum and maximum size at PDB level > Only if you use ASMM for CDB, not AMM PGA_AGGREGATE_TARGET > Soft limit for PGA tunable size (workarea, goes to TEMP when reached) PGA_AGGREGATE_LIMIT > Hard limit for PGA. Aborts calls or session when limit is reached SGA_MIN_SIZE > Minimum SGA size for the PDB SGA_TARGET > Maximum SGA size for the PDB DB_CACHE_SIZE, SHARED_POOL_SIZE > Minimums at PDB levels Page 35

36 Resource Manager PDB I/O and CPU parameters SQL> select * from v$parameter where name like 'max ' or name='cpu_count'; NAME DESCRIPTION ISPDB max_iops MAX IO per second TRUE max_mbps MAX MB per second TRUE cpu_count number of CPUs for this instance TRUE Throttles I/O done to PDB datafile (non-exadata only) > Wait event "I/O rate limit" > At CDB level they act as a default for all PDBs CPU_COUNT > Instance caging at PDB level: sets maximum threads > Replaces UTILIZATION_LIMIT for CPU Page 36

37 Agenda 1. DevOps 2. Common and local users 3. Lockdown profiles and PDB isolation 4. Resource manager and PDB parameters 5. Conclusion Page 37

38 12c Multitenant How to learn it? Authors > Anton Els > Vít Špinka > Franck Pachot Reviewers > Deiby Gómez > Arup Nanda > Mike Donovan When? > Pre-order now on Amazon > Delivered 2 weeks after 12.2 Page 38

39 12c Multitenant Core Message Agility is not only fast and automated provisioning > You must give more privileges to avoid roundtrips between Dev and Ops > But you must establish detailed rules to control and isolate what Dev can do Lockdown options and features, control resource usage > In addition to fast provisioning: > Consolidate safely and keep agility > Provide only options/features required Any questions? Please do ask. Page 39

40 Let s meet at booth 242