Oracle Database 11 g - Online Public Access Catalog

More documents

Recommendations

Info

262 CHAPTER 5 ■ DATABASE SECURITYsecure databases for all applications that leverage OCI. The OCI security enhancements areenabled for databases starting in Oracle Release 1(11.1) and for any version of the client. OracleDatabase 11g OCI security allows you to harden the database further by enabling you to dothe following:• Set the level of information captured for perceived bad packets on the server.• Drop or delay database connections because of bad packet overflow.• Configure the maximum number of connection attempts.• Control the display of database release information.• Set up the banner for unauthorized access.Set the Level of Information Captured for Bad PacketsFirst we’ll show what you can do in Oracle Database11g relative to bad packets received on thedatabase tier. Bad packets can be received because of network protocol errors or maliciousattacks by hackers to send a large amount of bad packets. Either way, bad packets can createhavoc to the database environment by causing disk space outages or denial of service.Now, you can leverage the SEC_PROTOCOL_ERROR_TRACE_ACTION database initialization parameterto determine the level of information you want to capture for bad packets. This parameteraccepts the values for NONE, TRACE, LOG, and ALERT. The default setting for this parameter is TRACE.When SEC_PROTOCOL_ERROR_TRACE_ACTION is set to TRACE, trace files generate on the databaseserver. You can leave this setting for debugging purposes. The LOG value produces an entry inthe alert log file but does not generate a trace file. This is the preferable option for a lot of DBAs.You can set this parameter to LOG, and if problems persist, you can change the parameter toALERT. By setting the parameter to ALERT, Oracle will produce an entry in the alert log file andyet generate a trace file. Lastly, SEC_PROTOCOL_ERROR_TRACE_ACTION can be set to NONE to specifythat you do not want to generate a trace file or produce alert log entries for bad packets. Youcan set this parameter to LOG using the alter system command, as shown here:SQL> alter system set sec_protocol_error_trace_action = LOG;System altered.Delay or Drop Database ConnectionsNot only can Oracle Database 11g protect you from a flood of bad packets to the database server,but it can also protect you by disconnecting or deferring the connections made to the server.The initialization parameter SEC_PROTOCOL_ERROR_FURTHER_ACTION controls this behavior. Bydefault, this parameter value is set to CONTINUE and does not stop connections from being droppedor deferred. You can modify the behavior of server continuity by using the following syntax:1* alter system set sec_protocol_error_further_action = "(DROP,30)"SQL> /System altered.
CHAPTER 5 ■ DATABASE SECURITY 263The DROP option will drop the database connection after n number of bad packets. In thisparticular example, the client will disconnect from the database after 30 bad packet transfers tothe database. The database will go into self-preservation mode. The worst-case scenario for theclient is that it may have to reestablish the connection to the database. If you consider databasedisconnectivity too harsh, you can use the DELAY value to delay the client by n seconds beforethe database will accept another packet from the client for the same session. Let’s look at settingthe DELAY option:SQL> alter system set sec_protocol_error_further_action = "(DELAY,15)";System altered.In this particular example, the client connection will forcibly delay sending packets by 15seconds. This allows the database to protect itself from denial-of-service attacks. The risk to theclient is that the application may suffer from degraded performance.Configure Maximum Number of Server Connection AttemptsThe maximum number of OCI authentication attempts is set to 10 by default. For security reasons,you may want to change this setting to a number acceptable to your security administrators. Youcan change this behavior by setting the SEC_MAX_FAILED_LOGIN_ATTEMPTS initialization parameter.Unfortunately, modification to the SEC_MAX_FAILED_LOGIN_ATTEMPTS parameter requires a databasebounce. You can change the SEC_MAX_FAILED_LOGIN_ATTEMPTS parameter using the followingALTER SYSTEM command:SQL> alter system set sec_max_failed_login_attempts = 5 scope=spfile;System alteredIn this particular example, the OCI connection allows only five authentication attemptsbefore it is disconnected.Control the Display of Database Release InformationJust like you can see the database version in SQL*Plus, you can display the database versionbanner for OCI connections. SEC_RETURN_SERVER_RELEASE_BANNER controls this behavior. Thedefault value for SEC_RETURN_SERVER_RELEASE_BANNER is FALSE, which means Oracle displaysthe version number to the client. Therefore, by default, Oracle will display only the high-levelversion information to the client, as shown here:Oracle Database 11g Enterprise Edition Release 11.1.0.0.0 – ProductionIf you set SEC_RETURN_SERVER_RELEASE_BANNER to YES, then Oracle will disclose the fullversion of the database including the release number. You can do this by using this syntax:SQL> alter system set sec_return_server_release_banner = TRUEscope=spfile;System altered.
Page 1:
The EXPERT’s VOIce ® IN ORACLEAl
Page 7:
Contents at a GlanceAbout the Autho
Page 11 and 12:
■CONTENTSixSQL*Plus New Features
Page 13 and 14:
■CONTENTSxiEnterprise Manager Int
Page 15 and 16:
■CONTENTSxiiiCombined Capture and
Page 17:
■CONTENTSxvImprovements in Redo T
Page 21:
About the Authors■SAM ALAPATI is
Page 24 and 25:
xxii■ACKNOWLEDGMENTSNothing I do
Page 26 and 27:
xxiv■INTRODUCTIONPerformance Mana
Page 28 and 29:
xxvi■INTRODUCTION• The easy add
Page 30 and 31:
xxviii■INTRODUCTION• The flashb
Page 32 and 33:
2 CHAPTER 1 ■ INSTALLING, UPGRADI
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
10 CHAPTER 1 ■ INSTALLING, UPGRAD
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
Page 88 and 89:
58 CHAPTER 2 ■ DATABASE DIAGNOSAB
Page 90 and 91:
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
Page 104 and 105:
Page 106 and 107:
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
Page 116 and 117:
Page 118 and 119:
Page 120 and 121:
Page 122 and 123:
Page 124 and 125:
Page 126 and 127:
Page 128 and 129:
Page 130 and 131:
100 CHAPTER 3 ■ DATABASE ADMINIST
Page 132 and 133:
Page 134 and 135:
Page 136 and 137:
Page 138 and 139:
Page 140 and 141:
Page 142 and 143:
Page 144 and 145:
Page 146 and 147:
Page 148 and 149:
Page 150 and 151:
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
Page 158 and 159:
Page 160 and 161:
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Page 182 and 183:
Page 184 and 185:
Page 186 and 187:
Page 188 and 189:
Page 190 and 191:
Page 192 and 193:
Page 194 and 195:
Page 196 and 197:
Page 198 and 199:
168 CHAPTER 4 ■ PERFORMANCE MANAG
Page 200 and 201:
Page 202 and 203:
Page 204 and 205:
Page 206 and 207:
Page 208 and 209:
Page 210 and 211:
Page 212 and 213:
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
Page 220 and 221:
Page 222 and 223:
Page 224 and 225:
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
Page 234 and 235:
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
Page 242 and 243: 212 CHAPTER 4 ■ PERFORMANCE MANAG
Page 256 and 257: 226 CHAPTER 5 ■ DATABASE SECURITY
Page 296 and 297: 266 CHAPTER 6 ■ BACKUP AND RECOVE
Page 343 and 344:
CHAPTER 7■ ■ ■Data PumpDBAs a
Page 345 and 346:
CHAPTER 7 ■ DATA PUMP 315if test
Page 347 and 348:
CHAPTER 7 ■ DATA PUMP 317DBA11g1
Page 349 and 350:
CHAPTER 7 ■ DATA PUMP 319Encrypti
Page 351 and 352:
CHAPTER 7 ■ DATA PUMP 321Please b
Page 353 and 354:
CHAPTER 7 ■ DATA PUMP 323Remappin
Page 355 and 356:
CHAPTER 7 ■ DATA PUMP 325SELECT d
Page 357 and 358:
CHAPTER 7 ■ DATA PUMP 327Document
Page 359 and 360:
CHAPTER 7 ■ DATA PUMP 329SQL> sel
Page 361 and 362:
CHAPTER 7 ■ DATA PUMP 331SQL> sel
Page 363 and 364:
CHAPTER 7 ■ DATA PUMP 333DBMS_OUT
Page 365:
CHAPTER 7 ■ DATA PUMP 335If you a
Page 368 and 369:
338 CHAPTER 8 ■ ORACLE STREAMSLat
Page 370 and 371:
340 CHAPTER 8 ■ ORACLE STREAMSA s
Page 372 and 373:
342 CHAPTER 8 ■ ORACLE STREAMSSQL
Page 374 and 375:
344 CHAPTER 8 ■ ORACLE STREAMSThe
Page 376 and 377:
346 CHAPTER 8 ■ ORACLE STREAMSStr
Page 378 and 379:
348 CHAPTER 8 ■ ORACLE STREAMSDBM
Page 380 and 381:
350 CHAPTER 8 ■ ORACLE STREAMSPle
Page 382 and 383:
352 CHAPTER 8 ■ ORACLE STREAMSa p
Page 384 and 385:
354 CHAPTER 8 ■ ORACLE STREAMSSpl
Page 386 and 387:
356 CHAPTER 8 ■ ORACLE STREAMSpro
Page 388 and 389:
358 CHAPTER 8 ■ ORACLE STREAMSSup
Page 391 and 392:
CHAPTER 9■ ■ ■Storage Managem
Page 393 and 394:
CHAPTER 9 ■ STORAGE MANAGEMENT 36
Page 395 and 396:
Page 397 and 398:
Page 399 and 400:
Page 401 and 402:
Page 403 and 404:
Page 405 and 406:
Page 407 and 408:
Page 409 and 410:
Page 411 and 412:
Page 413 and 414:
Page 415 and 416:
Page 417 and 418:
Page 419 and 420:
Page 421 and 422:
Page 423 and 424:
Page 425 and 426:
Page 427 and 428:
Page 429 and 430:
Page 431 and 432:
Page 433 and 434:
Page 435 and 436:
Page 437 and 438:
Page 439 and 440:
Page 441 and 442:
Page 443:
Page 446 and 447:
416 CHAPTER 10 ■ DATA GUARD• Lo
Page 448 and 449:
418 CHAPTER 10 ■ DATA GUARDsql ch
Page 450 and 451:
420 CHAPTER 10 ■ DATA GUARDDBA11g
Page 452 and 453:
422 CHAPTER 10 ■ DATA GUARDWhile
Page 454 and 455:
424 CHAPTER 10 ■ DATA GUARDSQL> c
Page 456 and 457:
426 CHAPTER 10 ■ DATA GUARDSQL> a
Page 458 and 459:
428 CHAPTER 10 ■ DATA GUARD7. Swi
Page 460 and 461:
430 CHAPTER 10 ■ DATA GUARDwho ha
Page 462 and 463:
432 CHAPTER 10 ■ DATA GUARDSQL> s
Page 464 and 465:
434 CHAPTER 10 ■ DATA GUARDDynami
Page 466 and 467:
436 CHAPTER 10 ■ DATA GUARDSQL> B
Page 468 and 469:
438 CHAPTER 10 ■ DATA GUARDcomman
Page 470 and 471:
440 CHAPTER 10 ■ DATA GUARDCustom
Page 472 and 473:
442 CHAPTER 10 ■ DATA GUARDselect
Page 474 and 475:
444 CHAPTER 10 ■ DATA GUARDby Dat
Page 476 and 477:
446 CHAPTER 11 ■ APPLICATION DEVE
Page 478 and 479:
Page 480 and 481:
Page 482 and 483:
Page 484 and 485:
Page 486 and 487:
Page 488 and 489:
Page 490 and 491:
Page 492 and 493:
Page 494 and 495:
Page 496 and 497:
Page 498 and 499:
Page 500 and 501:
Page 502 and 503:
Page 504 and 505:
Page 506 and 507:
Page 508 and 509:
Page 510 and 511:
Page 512 and 513:
Page 514 and 515:
Page 516 and 517:
Page 518 and 519:
Page 520 and 521:
Page 522 and 523:
Page 524 and 525:
Page 526 and 527:
Page 528 and 529:
Page 530 and 531:
Page 532 and 533:
Page 534 and 535:
Page 536 and 537:
Page 538 and 539:
Page 540 and 541:
Page 542 and 543:
Page 545 and 546:
CHAPTER 12■ ■ ■Data Warehousi
Page 547 and 548:
CHAPTER 12 ■ DATA WAREHOUSING 517
Page 549 and 550:
Page 551 and 552:
Page 553 and 554:
Page 555 and 556:
Page 557 and 558:
Page 559 and 560:
Page 561 and 562:
Page 563 and 564:
Page 565 and 566:
Page 567 and 568:
Page 569 and 570:
Page 571 and 572:
Page 573 and 574:
Page 575 and 576:
Page 577 and 578:
Page 579 and 580:
Page 581 and 582:
Page 583 and 584:
Page 585 and 586:
Page 587 and 588:
Page 589 and 590:
Page 591 and 592:
Page 593:
Page 596 and 597:
566 ■INDEXadvise failure command,
Page 598 and 599:
568 ■INDEXDBMS_ADDM package, 216-
Page 600 and 601:
570 ■INDEXcdump diagnostic direct
Page 602 and 603:
572 ■INDEXcursor_sharing paramete
Page 604 and 605:
574 ■INDEXdb_file_name_convert 's
Page 606 and 607:
576 ■INDEXDBMS-WORKLOAD_REPOSITOR
Page 608 and 609:
578 ■INDEXencrypt keyword, 243ENC
Page 610 and 611:
580 ■INDEXdefined, 112-114enablin
Page 612 and 613:
582 ■INDEXinsert command, 114, 56
Page 614 and 615:
584 ■INDEXmanually loaded plans,
Page 616 and 617:
586 ■INDEXOCISessionGet( ) method
Page 618 and 619:
588 ■INDEXusability improvements,
Page 620 and 621:
590 ■INDEXpga_aggregate_target in
Page 622 and 623:
592 ■INDEXreader farm, 421read-on
Page 624 and 625:
594 ■INDEXrestoring backup contro
Page 626 and 627:
596 ■INDEXserver_file_system opti
Page 628 and 629:
598 ■INDEXsynchronous capture, 33
Page 630 and 631:
600 ■INDEXOracle Audit Vault, 259
Page 632:
602 ■INDEXxmldiff command-line ut
show all

Oracle Database 11 g - Online Public Access Catalog

Create successful ePaper yourself

Delete template?

Save as template?