Oracle Advanced Security Administrator's Guide Release 8.1.6 A76932-01 |
|
This chapter describes how to configure and use SecurID authentication with the Oracle server and clients. It assumes that you are familiar with the Security Dynamics ACE/Server and that the ACE/Server is installed and running.
This chapter covers the following topics:
See "Related Publications" in the Preface for a list of documents related to SecurID authentication.
More Information:
The requirements for using SecurID authentication included in Oracle Advanced Security are as follows:
Because SecurID card codes can be used only once, SecurID authentication does not support database links, also known as proxy authentication.
When using SecurID authentication, password encryption is disabled. This means that the SecurID card code and, if you use standard cards, the PIN, are sent over to the Oracle server in clear text. This can be a security problem. Consequently, Oracle Corporation recommends that you enable Oracle Advanced Security encryption, which ensures that the PIN is encrypted when it is sent to the Oracle server.
Enable SecurID authentication by performing the following tasks:
Task 1: Register Oracle as a SecurID Client
Task 2: Install Oracle Advanced Security
Task 3: Ensure that Oracle Can Find the Correct UDP Port
Task 4: Configure Oracle as a SecurID Client
Register the machine on which the Oracle Server resides as a SecurID client with the ACE server. You can do this with the Security Dynamics tool sdadmin. To create a client, go to the Client menu and choose Create Client on the ACE/Server 1.2.4 or Add Client on the ACE/Server 2.0.
Install Oracle Advanced Security on the Oracle server and Oracle client when you install Oracle8i using the Oracle Installer.
Verify that the ACE/Server, the Oracle server, and the Oracle Advanced Security are installed.
Ensure that the Oracle server can discover the correct UDP port for contacting the ACE/Server. Port numbers are typically stored in a file called services. On UNIX-based operating systems, the file is typically located in the /etc directory. If you are using Network Information Services (NIS) as a naming service, ensure that the services map contains the correct entries for SecurID.
This section provides separate instructions for Windows and UNIX-based platform for the following options:
You need the following from the SecurID administrator:
\VAR\ACE
SERVICES
file
Install the SecurID configuration files on the Oracle server machine. You can obtain the files from any other SecurID client or from the machine that runs the ACE/Server.
These files are typically stored in /var/ace
. Create this directory on the Oracle server machine and copy the configuration files to it. At the minimum, you need the sdconf.rec
file. The configuration files are used by both Oracle and the standard SecurID tools. Because the SecurID tools run setuid root, there can be a problem with the access permissions on the directory /var/ace
and the files in this directory. Ensure that the owner of the oracle executable, such as the user "oracle8," is able to read all the files in /var/ace
and can create new files in this directory.
There are two methods for configuring Oracle as a SecurID client without compromising security. Both methods work, but Oracle Corporation recommends that you use Method #1. Both methods allow you to use Oracle with SecurID authentication and still continue using the other SecurID tools.
The owner of the oracle executable should also own the /var/ace
directory and the files in /var/ace
. For example, if the owner of the oracle executable is the user "oracle8," perform the following steps as root:
# chown oracle8 /var/ace # chmod 0770 /var/ace # chown oracle8 /var/ace/* # chmod 0660 /var/ace/*
The other option is to have root own the /var/ace
directory and the files in /var/ace, but give the Oracle group read and write access. If the Oracle group is dba, execute the following commands as root:
# chown root /var/ace # chmod 0770 /var/ace # chgrp dba /var/ace # chown root /var/ace/* # chmod 0660 /var/ace/* # chgrp dba /var/ace/*
The VAR_ACE environment variable is not supported. You have to store the configuration data in the /var/ace directory. If you currently have the ACE configuration data in a different location, create a symbolic link using the following command:
# ln -s $VAR_ACE /var/ace
Oracle needs to be able to read and write the ACE configuration data. This data is stored in the directory /var/ace
, or $VAR_ACE if you use the symbolic link shown above.
Whether Oracle can read the configuration data depends on how the ACE client software is installed on the Oracle server. During the installation of the ACE client software, specify which administrator should own the configuration files.
If root is the owner of the ACE server configuration data files, change the UNIX file permissions so that the owner of the oracle executable can read and write to these files. For example, the following commands give Oracle access to the files, and all the Security Dynamics tools that run as setuid root can still access the files.
# chown oracle8 /var/ace
# chown oracle8 /var/ace/*
# chmod 0770 /var/ace
# chmod 0660 /var/ace/*
If the environment variable VAR_ACE is set to a different location than /var/ace
, you should instead execute the following commands:
# ln -s $VAR_ACE /var/ace# chown oracle8 $VAR_ACE
# chown oracle8 $VAR_ACE/*
# chmod 0770 $VAR_ACE
# chmod 0660 $VAR_ACE/*
If the ACE files are not owned by root, you have the following options:
You must install the ACE software as root, but you can specify which administrator should own the files. Specify the same user as the owner of the Oracle executable, typically "oracle8".
For the change to take effect, perform the following steps:
Perform the following steps to configure SecurID authentication service:
The Oracle Advanced Security tabbed pages appear.
The sqlnet.ora
file updates with the following entries:
SQLNET.AUTHENTICATION_SERVICES=(SECURID)
You create users for SecurID authentication by performing the following steps:
When the sdadmin tool asks for a login name when creating a new user, enter the same name you will use later to create the Oracle user.
More Information:
See the Security Dynamics documentation listed in "Related Publications" in the Preface. |
If you want the user to be able to specify a new PIN to the card using the Oracle tools, choose the option that allows the user to make up his or her own PIN. If you do not allow this, the user will have to use the Security Dynamics tools to generate a PIN if the card is in new-PIN mode. Activate the user on the Oracle server. The Oracle server should already be registered as a SecurID client.
You can create an Oracle server account using SQL*Plus connected as a user with the CREATE USER database privilege. Enter the following to create an account:
SQL> CONNECT system/manager SQL> CREATE USER os_authent_prefix username IDENTIFIED EXTERNALLY
The OS_AUTHENT_PREFIX Oracle initialization parameter has a default value of OPS$. The user name should be the same as the name you assigned to the card in Task 1: Assign a Card Using Security Dynamics sdadmin Program.
For example, suppose you have assigned a card to the user king, and
OS_AUTHENT_PREFIX has been set to a null value (""). At this point, create an Oracle user account as follows:
SQL> CREATE USER king IDENTIFIED EXTERNALLY;
Grant the user the required database privileges. At a minimum, the user should be granted the CREATE SESSION privilege, as in the following example:
SQL> GRANT CREATE SESSION TO king;
The user king can now connect to Oracle using the appropriate SecurID card.
More Information:
For information on how to log on to an Oracle server after SecurID authentication has been installed and configured, see "Logging On to the Oracle Server" in this chapter. |
This section describes how to use SecurID authentication with the Oracle client tools. It assumes that you are already familiar with SecurID concepts, and that you have configured Oracle for use with the SecurID authentication.
This section contains the following topics:
Before using SecurID authentication to verify passwords, ensure that the following tasks have been completed:
SecurID authentication allows users to log on to the Oracle server with the PASSCODE that is generated by the SecurID card. The PASSCODE replaces the password in the Oracle connect statement.
There are two types of SecurID cards:
Depending on the type of card, you enter the PIN either:
The standard cards generate and display a PASSCODE. When logging in to Oracle, specify the user name, PIN, and current PASSCODE as follows:
sqlplus username/<pin><passcode>@net_service_name
For example, if the card is assigned to user king, the PIN is 3511, and the card shows the number 698244, log into Oracle using SQL*Plus as follows:
% sqlplus king/3511698244@oracle_database
or
% sqlplus king@oracle_database % enter password: 3511698244
If you have a PINPAD card, you first have to enter the PIN on the card and generate a new PASSCODE. Use the PASSCODE to connect to Oracle as follows:
sqlplus username/passcode@net_service_name
For example, if the card is assigned to user king, first generate a PASSCODE by entering the PIN on the PINPAD card as described in the Security Dynamics documentation.
For example, if the generated PASSCODE is 698244, connect to Oracle using SQL*Plus as follows:
% sqlplus king/698244@oracle_dbname
If you are logging in for the first time or the administrator has put the card in the new-PIN mode, you must assign a PIN to the card. You can tell that this is the case if, while trying to connect to Oracle, you receive the following error message:
To assign a PIN to a card you connect to the Oracle Server using a special syntax. First select a PIN, which is typically four to eight digits long. Depending on the type of SecurID card you have, you might be able to use letters as well.
If you have cleared the old PIN, use the following the syntax while connecting to the Oracle database:
sqlplus username/+new_pin+tokencode@oracle_dbname
For the tokencode, enter the card code that is currently displayed on the SecurID card's LCD. If you have a PINPAD card, do not enter the PIN on the card.
For example, if the card is assigned to user king, the new PIN is 45618, and the SecurID card currently displays number 564728, enter the following:
% sqlplus king/"+45618+564728"@oracle_dbname
If the old PIN was not cleared, use the following syntax while connecting to the database. Otherwise, the administrator must select the new PIN for you.
sqlplus username/+new_pin+old_pintokencode@oracle_dbname
For the tokencode, enter the card code that is currently displayed on the SecurID card. If you have a PINPAD card, do not enter the PIN on the card.
If the new PIN is accepted, you are connected to Oracle. The next time you want to connect to Oracle you should use the procedure described in "Logging On to the Oracle Server" in this chapter. If the new PIN is rejected, you receive the following error:
The following are possible reasons for why a PIN is rejected:
As an additional safety step, the ACE/Server sometimes asks for the next card code, to ensure that the person who is trying to log in actually has the card in his or her possession. This is the case if you get the following error message when you try to log into Oracle:
The next time you want to log on Oracle, you must specify the next two card codes. The syntax you use to log into Oracle depends on the kind of SecurID card you have, Standard or PINPAD.
If you have a standard card, specify the following:
Steps 1, 2, and 3 above replace the password. The + character is important, because it separates the first card code (passcode) from the second one. Use the following syntax:
sqlplus <username>/ "pincodepasscode+next_passcode"@<net_service_name>
For example, if the card is assigned to user king, the PIN is 3511, and the card first shows the number 98244 and the next number is 563866, enter the following:
% sqlplus king/"3511698244+563866"@oracle_database
This connects you to the Oracle server and puts the card back into normal mode. The next time you want to log in to the Oracle server, use the procedure described in "Logging On to the Oracle Server" in this chapter.
If you have a PINPAD card, perform the following steps to log on to the Oracle server:
sqlplus username/ "<first passcode+second passcode"@net_service_name
For example, if the card is assigned to user king, perform the following steps:
% sqlplus king/"231003+831234"@oracle_dbname
This connects you to Oracle and puts the card back into normal mode. The next time you want to log in to Oracle, use the procedure described in"Logging On to the Oracle Server".
If you experience problems while configuring SecurID authentication, verify the following:
Use the SecurID tool kitconts (for ACE/Server 1.2.4) or sdinfo (for ACE/Server 2.0) to verify the name of the authentication service and the port numbers that SecurID is expecting to use. Verify that these port numbers match those in /etc/services
, or the services map if you are using NIS.
ACE/Server release 1.2.4 only: Verify that the /var/ace/sdconf.rec
file is present on the machine running the Oracle server. Also verify that the permissions on the /var/ace/sdconf.rec
file and the directory /var/ace
are set so that the Oracle process can read and write in the directory.
ACE/Server release 2.0 only: Make sure the ACE configuration data is in the /var/ace
directory. Use of the VAR_ACE environment variable is not supported. Also make sure that the owner of the oracle executable can read and write the files in this directory.
sqlnet.ora
file on the Oracle side:
trace_level_server = admin
Turning tracing on at the client side is less informative, because all interaction between the Oracle server and the ACE server happens at the Oracle server side of the Net8 connection. Be sure to turn off tracing when you have completed your check.
SQL> SELECT * FROM all_users;
to get a list of all database users.
sqlplus system/manager@oracle_dbname
the SecurID log file displays the following:
03/24/99 10:04 User not on client machinename
This is not an error. Since the Oracle client and server negotiated to use SecurID because of the SQLNET.AUTHENTICATION_SERVICES line in the sqlnet.ora
file, Oracle contacts the ACE/Server to validate "system." When validation fails, Oracle validates the password internally. If the password is valid, you are able to connect.
The only way to eliminate the warning message is to disable SecurID authentication. To do so, change the sqlnet.ora file on the Oracle client to the following:
SQLNET.AUTHENTICATION_SERVICES=(NONE)
Setting this parameter to NONE disables the SecurID authentication adapter and you can no longer connect to Oracle using the SecurID card.
|
![]() Copyright © 1999 Oracle Corporation. All Rights Reserved. |
|