Oracle Database 11 g - Online Public Access Catalog

More documents

Recommendations

Info

260 CHAPTER 5 ■ DATABASE SECURITYThis is so because so many people have access to all these layers. With HSM, the keys are notstored in an operating system but at the physical device.You can configure HSMs such as Ingrian to be tamper-resistant. Ingrian is certified to FIPS140-2 Level 3, the widely accepted standard of government-specified best practices for networksecurity. Private keys are generated and stored in encrypted form within the HSM. Keys storedin the HSM are protected from physical attacks and cannot be compromised even by stealingthe Ingrian appliance. Attempts made to tamper with or probe the card will result in the immediatedestruction of all private key data, making it virtually impossible for either external orinternal hackers to access this vital information. 1The HSM product will be configured by the security administrator. Once the HSM productis configured successfully, you can proceed to modify your sqlnet.ora file and change theMETHOD value. Earlier in the chapter, you learned how to create a wallet and the method of thewallet in the operating system designated as a file. When you set up an HSM product, you mustassign the METHOD option the value of HSM, as shown here:ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=HSM)(METHOD_DATA=(DIRECTORY=/apps/oracle/admin/DBATOOLS/wallet)))The DIRECTORY value in this example is not required by the HSM but may be by other Oracleproducts such as RMAN. The DIRECTORY option is also mandatory when migrating from a software-basedwallet. The DIRECTORY path is used to locate the old wallet file.Your vendor will provide the appropriate PKCS#11 (an API defining a generic interface tocryptographic tokens) library file. TDE integration with HSM must utilize this library file providedby the vendor to interface with the HSM. You will need to copy the library file to a location inyour operating system accessible to the database server. A new database user is also requiredfor the database to communicate with the HSM. Once done, you will have to generate themaster encryption key for the HSM and open the new wallet with the designated user ID andpassword using the following syntax:alter system set encryption key identified by user_Id:password;You can optionally use the MIGRATE USING wallet password clause if you are migratingfrom an existing software-based wallet. The MIGRATE clause will decrypt the existing columnencryption keys and then encrypt them with the newly created, HSM-based master encryptionkey.There will be additional setup requirements provided by the HSM vendor to integrateOracle TDE with HSM. Once the HSM and TDE integration is complete, HSM can be used justlike any other software wallet.Oracle Advanced Security FeaturesIn addition to the security features available for mainstream DBAs, Oracle Database 11gstrengthens its premier advanced security options. The Oracle Kerberos client adds supportfor encryption algorithms such as 3DES and AES, thus making Kerberos more secure. Additionally,the enhanced Kerberos operates seamlessly with Microsoft and MIT Key Distribution1. Best practices for employing encryption to achieve maximum security from Ingrian Networks
CHAPTER 5 ■ DATABASE SECURITY 261Centers. Other Kerberos improvements are evident in the cross realm and in sysdba strongauthentication support.Kerberos Cross-Realm SupportOracle Database 11g enhances the Oracle Kerberos implementation to support cross-realmauthentication. Effective in Oracle Database 11g, a principal in one realm can authenticateto a principal in another Kerberos realm. By sharing an encryption key between two realms,Kerberos implements cross-realm authentication. The benefit of this feature is that it makesKerberos an acceptable solution for customers with strong security authentication requirements.This eliminates the need to manage certificates and PKI.Here is an example of creating an externally authenticated Oracle user that corresponds toa Kerberos user. For two realms, US.DBAEXPERT.COM and KR.DBAEXPERT.COM, these principalscould be krb_ckim@US.DBAEXPERT.COM and krb_ckim@KR.DBAEXPERT.COM:SQL> connect / as sysdba;SQL> create user "KRB_CKIM@KR.DBAEXPERT.COM" identified externally;SQL> grant create session to "KRB_CKIM@KR.DBAEXPERT.COM";Oracle Database 11g advanced security lifts the 30-character limitation for Kerberos principalaccounts.sysdba Strong AuthenticationOracle has had support for strong authentication since Oracle Database 8i for PKI, Kerberos,and Radius implementations. However, sysdba and sysoper connections were never supported. InOracle Database 11g, sysdba and sysoper accounts can connect using strong authentication.This release solidifies strong authentications to the database including those made as sysdbaand sysoper.Oracle Call Interface EnhancementsStarting with Oracle Database 11g, numerous initialization parameters allow DBAs to have amore granular level of security for OCI applications. These parameters are sec_* initializationparameters:SQL> show parameter sec_NAME TYPE VALUE------------------------------------ ----------- -------------sec_case_sensitive_logon boolean TRUE-- sec_max_failed_login_attempts integer 10-- sec_protocol_error_further_action string CONTINUE-- sec_protocol_error_trace_action string TRACE-- sec_return_server_release_banner boolean FALSE...The initialization parameters in the previous listing that start with dash dash sec (-- sec)are the initialization parameters specific for OCI. In addition, Oracle enables the DBAs to setbanner and audit pages through sqlnet.ora parameters. These features enable the DBAs to
Page 1:
The EXPERT’s VOIce ® IN ORACLEAl
Page 7:
Contents at a GlanceAbout the Autho
Page 11 and 12:
■CONTENTSixSQL*Plus New Features
Page 13 and 14:
■CONTENTSxiEnterprise Manager Int
Page 15 and 16:
■CONTENTSxiiiCombined Capture and
Page 17:
■CONTENTSxvImprovements in Redo T
Page 21:
About the Authors■SAM ALAPATI is
Page 24 and 25:
xxii■ACKNOWLEDGMENTSNothing I do
Page 26 and 27:
xxiv■INTRODUCTIONPerformance Mana
Page 28 and 29:
xxvi■INTRODUCTION• The easy add
Page 30 and 31:
xxviii■INTRODUCTION• The flashb
Page 32 and 33:
2 CHAPTER 1 ■ INSTALLING, UPGRADI
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
10 CHAPTER 1 ■ INSTALLING, UPGRAD
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
Page 88 and 89:
58 CHAPTER 2 ■ DATABASE DIAGNOSAB
Page 90 and 91:
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
Page 104 and 105:
Page 106 and 107:
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
Page 116 and 117:
Page 118 and 119:
Page 120 and 121:
Page 122 and 123:
Page 124 and 125:
Page 126 and 127:
Page 128 and 129:
Page 130 and 131:
100 CHAPTER 3 ■ DATABASE ADMINIST
Page 132 and 133:
Page 134 and 135:
Page 136 and 137:
Page 138 and 139:
Page 140 and 141:
Page 142 and 143:
Page 144 and 145:
Page 146 and 147:
Page 148 and 149:
Page 150 and 151:
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
Page 158 and 159:
Page 160 and 161:
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Page 182 and 183:
Page 184 and 185:
Page 186 and 187:
Page 188 and 189:
Page 190 and 191:
Page 192 and 193:
Page 194 and 195:
Page 196 and 197:
Page 198 and 199:
168 CHAPTER 4 ■ PERFORMANCE MANAG
Page 200 and 201:
Page 202 and 203:
Page 204 and 205:
Page 206 and 207:
Page 208 and 209:
Page 210 and 211:
Page 212 and 213:
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
Page 220 and 221:
Page 222 and 223:
Page 224 and 225:
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
Page 234 and 235:
Page 236 and 237:
Page 238 and 239:
Page 240 and 241: 210 CHAPTER 4 ■ PERFORMANCE MANAG
Page 256 and 257: 226 CHAPTER 5 ■ DATABASE SECURITY
Page 296 and 297: 266 CHAPTER 6 ■ BACKUP AND RECOVE
Page 340 and 341:
310 CHAPTER 6 ■ BACKUP AND RECOVE
Page 343 and 344:
CHAPTER 7■ ■ ■Data PumpDBAs a
Page 345 and 346:
CHAPTER 7 ■ DATA PUMP 315if test
Page 347 and 348:
CHAPTER 7 ■ DATA PUMP 317DBA11g1
Page 349 and 350:
CHAPTER 7 ■ DATA PUMP 319Encrypti
Page 351 and 352:
CHAPTER 7 ■ DATA PUMP 321Please b
Page 353 and 354:
CHAPTER 7 ■ DATA PUMP 323Remappin
Page 355 and 356:
CHAPTER 7 ■ DATA PUMP 325SELECT d
Page 357 and 358:
CHAPTER 7 ■ DATA PUMP 327Document
Page 359 and 360:
CHAPTER 7 ■ DATA PUMP 329SQL> sel
Page 361 and 362:
CHAPTER 7 ■ DATA PUMP 331SQL> sel
Page 363 and 364:
CHAPTER 7 ■ DATA PUMP 333DBMS_OUT
Page 365:
CHAPTER 7 ■ DATA PUMP 335If you a
Page 368 and 369:
338 CHAPTER 8 ■ ORACLE STREAMSLat
Page 370 and 371:
340 CHAPTER 8 ■ ORACLE STREAMSA s
Page 372 and 373:
342 CHAPTER 8 ■ ORACLE STREAMSSQL
Page 374 and 375:
344 CHAPTER 8 ■ ORACLE STREAMSThe
Page 376 and 377:
346 CHAPTER 8 ■ ORACLE STREAMSStr
Page 378 and 379:
348 CHAPTER 8 ■ ORACLE STREAMSDBM
Page 380 and 381:
350 CHAPTER 8 ■ ORACLE STREAMSPle
Page 382 and 383:
352 CHAPTER 8 ■ ORACLE STREAMSa p
Page 384 and 385:
354 CHAPTER 8 ■ ORACLE STREAMSSpl
Page 386 and 387:
356 CHAPTER 8 ■ ORACLE STREAMSpro
Page 388 and 389:
358 CHAPTER 8 ■ ORACLE STREAMSSup
Page 391 and 392:
CHAPTER 9■ ■ ■Storage Managem
Page 393 and 394:
CHAPTER 9 ■ STORAGE MANAGEMENT 36
Page 395 and 396:
Page 397 and 398:
Page 399 and 400:
Page 401 and 402:
Page 403 and 404:
Page 405 and 406:
Page 407 and 408:
Page 409 and 410:
Page 411 and 412:
Page 413 and 414:
Page 415 and 416:
Page 417 and 418:
Page 419 and 420:
Page 421 and 422:
Page 423 and 424:
Page 425 and 426:
Page 427 and 428:
Page 429 and 430:
Page 431 and 432:
Page 433 and 434:
Page 435 and 436:
Page 437 and 438:
Page 439 and 440:
Page 441 and 442:
Page 443:
Page 446 and 447:
416 CHAPTER 10 ■ DATA GUARD• Lo
Page 448 and 449:
418 CHAPTER 10 ■ DATA GUARDsql ch
Page 450 and 451:
420 CHAPTER 10 ■ DATA GUARDDBA11g
Page 452 and 453:
422 CHAPTER 10 ■ DATA GUARDWhile
Page 454 and 455:
424 CHAPTER 10 ■ DATA GUARDSQL> c
Page 456 and 457:
426 CHAPTER 10 ■ DATA GUARDSQL> a
Page 458 and 459:
428 CHAPTER 10 ■ DATA GUARD7. Swi
Page 460 and 461:
430 CHAPTER 10 ■ DATA GUARDwho ha
Page 462 and 463:
432 CHAPTER 10 ■ DATA GUARDSQL> s
Page 464 and 465:
434 CHAPTER 10 ■ DATA GUARDDynami
Page 466 and 467:
436 CHAPTER 10 ■ DATA GUARDSQL> B
Page 468 and 469:
438 CHAPTER 10 ■ DATA GUARDcomman
Page 470 and 471:
440 CHAPTER 10 ■ DATA GUARDCustom
Page 472 and 473:
442 CHAPTER 10 ■ DATA GUARDselect
Page 474 and 475:
444 CHAPTER 10 ■ DATA GUARDby Dat
Page 476 and 477:
446 CHAPTER 11 ■ APPLICATION DEVE
Page 478 and 479:
Page 480 and 481:
Page 482 and 483:
Page 484 and 485:
Page 486 and 487:
Page 488 and 489:
Page 490 and 491:
Page 492 and 493:
Page 494 and 495:
Page 496 and 497:
Page 498 and 499:
Page 500 and 501:
Page 502 and 503:
Page 504 and 505:
Page 506 and 507:
Page 508 and 509:
Page 510 and 511:
Page 512 and 513:
Page 514 and 515:
Page 516 and 517:
Page 518 and 519:
Page 520 and 521:
Page 522 and 523:
Page 524 and 525:
Page 526 and 527:
Page 528 and 529:
Page 530 and 531:
Page 532 and 533:
Page 534 and 535:
Page 536 and 537:
Page 538 and 539:
Page 540 and 541:
Page 542 and 543:
Page 545 and 546:
CHAPTER 12■ ■ ■Data Warehousi
Page 547 and 548:
CHAPTER 12 ■ DATA WAREHOUSING 517
Page 549 and 550:
Page 551 and 552:
Page 553 and 554:
Page 555 and 556:
Page 557 and 558:
Page 559 and 560:
Page 561 and 562:
Page 563 and 564:
Page 565 and 566:
Page 567 and 568:
Page 569 and 570:
Page 571 and 572:
Page 573 and 574:
Page 575 and 576:
Page 577 and 578:
Page 579 and 580:
Page 581 and 582:
Page 583 and 584:
Page 585 and 586:
Page 587 and 588:
Page 589 and 590:
Page 591 and 592:
Page 593:
Page 596 and 597:
566 ■INDEXadvise failure command,
Page 598 and 599:
568 ■INDEXDBMS_ADDM package, 216-
Page 600 and 601:
570 ■INDEXcdump diagnostic direct
Page 602 and 603:
572 ■INDEXcursor_sharing paramete
Page 604 and 605:
574 ■INDEXdb_file_name_convert 's
Page 606 and 607:
576 ■INDEXDBMS-WORKLOAD_REPOSITOR
Page 608 and 609:
578 ■INDEXencrypt keyword, 243ENC
Page 610 and 611:
580 ■INDEXdefined, 112-114enablin
Page 612 and 613:
582 ■INDEXinsert command, 114, 56
Page 614 and 615:
584 ■INDEXmanually loaded plans,
Page 616 and 617:
586 ■INDEXOCISessionGet( ) method
Page 618 and 619:
588 ■INDEXusability improvements,
Page 620 and 621:
590 ■INDEXpga_aggregate_target in
Page 622 and 623:
592 ■INDEXreader farm, 421read-on
Page 624 and 625:
594 ■INDEXrestoring backup contro
Page 626 and 627:
596 ■INDEXserver_file_system opti
Page 628 and 629:
598 ■INDEXsynchronous capture, 33
Page 630 and 631:
600 ■INDEXOracle Audit Vault, 259
Page 632:
602 ■INDEXxmldiff command-line ut
show all

Oracle Database 11 g - Online Public Access Catalog

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?