|Oracle® Database Security Guide
12c Release 1 (12.1)
|PDF · Mobi · ePub|
This appendix contains:
This appendix describes how to configure Oracle Database for the Federal Information Processing Standard (FIPS), for the current standard, 140-2, and for 140-1. You can verify the current status of the certification at the Cryptographic Modules Validation Program Web site address:
The security policy, which is available at the NIST site upon successful certification, includes requirements for secure configuration of the host operating system.
This section contains:
The cryptographic libraries included in Oracle Database are designed to meet Federal Information Processing Standard (FIPS) 140-2 Level 2 certification. These libraries are designed to protect data at rest and in transit over the network. Oracle Database uses these cryptographic libraries for Secure Sockets Layer (SSL).
You can configure the SSL adapter to run in FIPS mode by setting the
SSLFIPS_140 parameter to
TRUE in the
fips.ora file. Ensure that the
fips.ora file is either located in the
/ldap/admin directory, or is in a location pointed to by the
FIPS_HOME environment variable.
When you set
TRUE, cryptographic operations take place in the embedded RSA/Micro Edition Suite (MES) library in FIPS mode. These cryptographic operations are accelerated by the CPU when hardware acceleration is available and properly configured in the host hardware and software.
If you set
FALSE, then cryptographic operations take place in the embedded RSA/Micro Edition Suite (MES) library in non-FIPS mode, and as with the
TRUE setting, the operations are accelerated if possible.
For native network encryption, cryptographic operations will take place in the embedded RSA/Micro Edition Suite (MES) library in non-FIPS mode as well. They are accelerated if possible. Note that this is true regardless of the
SSLFIPS_140 setting in
FIPS_140 setting in
sqlnet.ora, various settings in
init.ora, and the supported operating system that the database is running on (including Solaris)
For example, to set SSLFIPS_140 to
This parameter is set to
FALSE by default. You must set it to
TRUE on both the client and the server for FIPS mode operation.
You can repeat this procedure in any Oracle Database home for any database server or client.
SSLFIPS_140parameter replaces the
SQLNET.SSLFIPS_140parameter used in Oracle Database 10g Release 2 (10.2). You must set the parameter in the
fips.orafile, and not the
A cipher suite is a set of authentication, encryption, and data integrity algorithms used for exchanging messages between network nodes. During an SSL handshake, for example, the two nodes negotiate to see as to which cipher suite they will use when transmitting messages back and forth.
Only the following cipher suites are approved for FIPS validation:
Oracle Database SSL cipher suites are automatically set to FIPS approved cipher suites. If you wish to configure specific cipher suites, you can do so by editing the
SSL_CIPHER_SUITES parameter in the
sqlnet.ora or the
You can also use Oracle Net Manager to set this parameter on the server and the client.
See Also:"Step 1C: Set the Secure Sockets Layer Cipher Suites on the Server (Optional)" and "Step 2D: Set the Client Secure Sockets Layer Cipher Suites (Optional)" for more information on setting cipher suites.
Set execute permissions on all Oracle executable files to prevent the execution of Oracle Cryptographic Libraries by users who are unauthorized to do so, in accordance with the system security policy.
Set read and write permissions on all Oracle executable files to prevent accidental or deliberate reading or modification of Oracle Cryptographic Libraries by any user.
To comply with FIPS 140-2 Level 2 requirements, in the security policy, include procedures to prevent unauthorized users from reading, modifying or executing Oracle Cryptographic Libraries processes and the memory they are using in the operating system.
trace_directory_server=trace_dir trace_file_server=trace_file trace_level_server=trace_level
trace_directory=/private/oracle/owm trace_file_server=fips_trace.trc trace_level_server=6
Trace level 6 is the minimum trace level required to check the results of the FIPS self-tests.
This section contains:
Note:The information contained in this section should be used with the information provided in Appendix B, "Data Encryption and Integrity Parameters".
The Oracle Database FIP 140-1 implementation has been validated under Federal Information Processing Standard (FIPS) 140-1 at the Level 2 security level. This appendix describes the formal configuration required to comply with the FIPS 140-1 standard. Refer to the NIST Cryptographic Modules Validation list at the following Web site address:
This section contains:
This appendix contains information about the Oracle Database parameters required in the
sqlnet.ora files to ensure that any connections created between a client and server are encrypted under the control of the server.
By default, the
sqlnet.ora file is located in the
/network/admin directory or in the location set by the
TNS_ADMIN environment variable. Ensure that you have properly set the
TNS_ADMIN variable to point to the correct
sqlnet.ora file. See SQL*Plus User's Guide and Reference for more information and examples of setting the
These configuration parameters are contained in the
sqlnet.ora file that is held locally for each of the client and server processes. The protection placed on these files should be equivalent to the level of a DBA.
The FIPS 140-1-related
sqlnet.ora parameters are as follows:
Setting the encryption as
REQUIRED on the server side of the connection permits a connection only if encryption is used, irrespective of the parameter value on the client.
A connection to the server is only possible if there is agreement between client and server for the connection encryption. The server has this set to
REQUIRED, therefore the client must not reject encryption for a valid connection to be the result. Failure to specify one of these values results in error when attempting to connect to a FIPS 140-1 compliant server.
sqlnet.ora parameter specifies a list of encryption algorithms that the server can use when acting as a server in the order of required usage. Ensure that you have installed the specified algorithm, or else the connection terminates. For FIPS 140-1 compliance, only DES encryption is permitted and therefore the following parameter setting is mandatory:
sqlnet.ora parameter specifies the list of encryption algorithms that the client is prepared to use for the connection with the server. In order for a connection to be successful, ensure that the algorithm is installed and that the encryption type is mutually acceptable to the server.
To create a connection with a server that is configured for FIPS 140-1, the following parameter setting is mandatory:
The default setting of the
sqlnet.ora parameter is
FALSE. Setting the parameter to
TRUE is mandatory for both client and server to ensure Oracle Database complies with the standards defined in FIPS 140-1 as follows:
Note:Use a text editor to set the
FIPS_140parameter in the
sqlnet.orafile. You cannot use Oracle Net Manager to set this parameter.
Set the execute permissions on all Oracle executable files to prevent execution by users who are unauthorized to do so in accordance with the system security policy.
Set read and write permissions on all executable files to prevent accidental or deliberate reading or modification of Oracle files by any user.
To comply with FIPS 140-1 Level 2 requirements, in the security policy, include procedures to prevent unauthorized users from reading or modifying Oracle processes and the memory they are using in the operating system.
SELECT * from V$SESSION_CONNECT_INFO to display the product banner information for the active connection. Table E-1 shows an example of a connection configuration where both DES encryption and MD5 data integrity is defined: