|Oracle® Database Advanced Security Administrator's Guide
11g Release 2 (11.2)
|PDF · Mobi · ePub|
This appendix contains:
This appendix describes how to configure Oracle Database for the Federal Information Processing Standard (FIPS), for the current standard, 140-2, and for 140-1. You can verify the current status of the certification at the Cryptographic Modules Validation Program Web site address:
The security policy, which is available at the NIST site upon successful certification, includes requirements for secure configuration of the host operating system.
This section contains:
The cryptographic libraries for SSL included in Oracle Database 10g are designed to meet FIPS 140-2 Level 2 certification. Oracle Advanced Security makes use of these cryptographic libraries for SSL authentication. Please verify the current status of the certification at the Cryptographic Modules Validation Program Web site address:
Oracle Advanced Security SSL adapter can be configured to run in FIPS mode by setting the
SSLFIPS_140 parameter to
TRUE in the
This parameter is set to
FALSE by default. It must be set to
TRUE on both the client and the server for FIPS mode operation.
Make sure that the
fips.ora file is either located in the
/ldap/admin directory, or is pointed to by the
FIPS_HOME environment variable. This procedure can be repeated in any Oracle home for any database server or client.
SSLFIPS_140parameter replaces the
SQLNET.SSLFIPS_140parameter used in Oracle Database 10g Release 2 (10.2). The parameter needs to be set in the
fips.orafile, and not the
A cipher suite is a set of authentication, encryption and data integrity algorithms used for exchanging messages between network nodes. During an SSL handshake, for example, the two nodes negotiate to see as to which cipher suite they will use when transmitting messages back and forth.
Only the following cipher suites are approved for FIPS validation:
Oracle Advanced Security SSL cipher suites are automatically set to FIPS approved cipher suites. If you wish to configure specific cipher suites, you can do so by editing the
SSL_CIPHER_SUITES parameter in the
sqlnet.ora or the
You can also use Oracle Net Manager to set this parameter on the server and the client.
See Also:"Step 2C: Set the Secure Sockets Layer Cipher Suites on the Server (Optional)" and "Step 3D: Set the Client Secure Sockets Layer Cipher Suites (Optional)" for more information on setting cipher suites.
After installation, the following permissions must be verified in the operating system:
Execute permissions must be set on all Oracle executable files so as to prevent execution of Oracle Cryptographic Libraries by users who are unauthorized to do so in accordance with the system security policy.
Read and write permissions must be set on all Oracle executable files so as to prevent accidental or deliberate reading or modification of Oracle Cryptographic Libraries by any user.
To comply with FIPS 140-2 Level 2 requirements, the security policy must include procedures to prevent unauthorized users from reading, modifying or executing Oracle Cryptographic Libraries processes and the memory they are using in the operating system.
To check if FIPS mode is enabled, tracing can be added to the
sqlnet.ora file. FIPS self-test messages can be found in the trace file. Add the following lines to
sqlnet.ora to enable tracing:
trace_directory_server=trace_dir trace_file_server=trace_file trace_level_server=trace_level
trace_directory=/private/oracle/owm trace_file_server=fips_trace.trc trace_level_server=6
Trace level 6 is the minimum trace level required to check the results of the FIPS self-tests.
This section contains:
Note:The information contained in this section should be used with the information provided in Appendix A, "Data Encryption and Integrity Parameters".
The Oracle Database FIP 140-1 implementation has been validated under Federal Information Processing Standard (FIPS) 140-1 at the Level 2 security level. This appendix describes the formal configuration required to comply with the FIPS 140-1 standard. Refer to the NIST Cryptographic Modules Validation list at the following Web site address:
This appendix contains information on the Oracle Advanced Security parameters required in the
sqlnet.ora files to ensure that any connections created between a client and server are encrypted under the control of the server.
Configuration parameters are contained in the
sqlnet.ora file that is held locally for each of the client and server processes. The protection placed on these files should be equivalent to the level of a DBA.
The following configuration parameters are described in this appendix:
The server side of the negotiation notionally controls the connection settings. The following parameter in the server file is mandatory:
Setting the encryption as
REQUIRED on the server side of the connection ensures that a connection is only permitted if encryption is used, irrespective of the parameter value on the client.
ENCRYPTION_CLIENT parameter specifies the connection behavior for the client. One of the following parameter settings in the client file is mandatory:
A connection to the server is only possible if there is agreement between client and server for the connection encryption. The server has this set to
REQUIRED, therefore the client must not reject encryption for a valid connection to be the result. Failure to specify one of these values results in error when attempting to connect to a FIPS 140-1 compliant server.
ENCRYPTION_TYPES_SERVER parameter specifies a list of encryption algorithms that the server is permitted to use when acting as a server in the order of required usage. The specified algorithm must be installed or the connection terminates. For FIPS 140-1 compliance, only DES encryption is permitted and therefore the following parameter setting is mandatory:
ENCRYPTION_TYPES_CLIENT parameter specifies the list of encryption algorithms which the client is prepared to use for the connection with the server. In order for a connection to be successful, the algorithm must first be installed and the encryption type must be mutually acceptable to the server.
To create a connection with a server that is configured for FIPS 140-1, the following parameter setting is mandatory:
The default setting of the
FIPS_140 parameter is
FALSE. Setting the parameter to
TRUE is mandatory for both client and server to ensure Oracle Advanced Security complies with the standards defined in FIPS 140-1 as follows:
Note:Use a text editor to set the
FIPS_140parameter in the
sqlnet.orafile. You cannot use Oracle Net Manager to set this parameter.
After the installation, the following permissions must be verified in the operating system:
Execute permissions must be set on all Oracle Advanced Security executable files so as to prevent execution of Oracle Advanced Security by users who are unauthorized to do so in accordance with the system security policy.
Read and write permissions must be set on all executable files so as to prevent accidental or deliberate reading or modification of Oracle Advanced Security files by any user.
To comply with FIPS 140-1 Level 2 requirements, the security policy must include procedures to prevent unauthorized users from reading or modifying Oracle Advanced Security processes and the memory they are using in the operating system.
Status information for Oracle Advanced Security is available after the connection has been established. The information is contained in the RDBMS virtual table
Running the query
SELECT * from V$SESSION_CONNECT_INFO displays all of the product banner information for the active connection. Table D-1 shows an example of a connection configuration where the DES encryption data integrity is defined:
Oracle Bequeath operating system adapter for Solaris, v188.8.131.52.0
Oracle Advanced Security: encryption service for Solaris
Oracle Advanced Security: DES encryption service adapter
Oracle Advanced Security: crypto-checksumming service
Oracle Advanced Security: SHA-1 crypto-checksumming service adapter.
To comply with FIPS 140-1 Level 2 requirements, tamper-evident seals must be applied to the cover of each computer to ensure that removal of the cover is detectable.