Oracle Advanced Security Administrator's Guide
Release 8.1.6
A76932-01

Library
Product
Contents
Index

Prev Next

7
Configuring SecurID Authentication

This chapter describes how to configure and use SecurID authentication with the Oracle server and clients. It assumes that you are familiar with the Security Dynamics ACE/Server and that the ACE/Server is installed and running.

This chapter covers the following topics:

System Requirements

The requirements for using SecurID authentication included in Oracle Advanced Security are as follows:

Known Limitations

Because SecurID card codes can be used only once, SecurID authentication does not support database links, also known as proxy authentication.

When using SecurID authentication, password encryption is disabled. This means that the SecurID card code and, if you use standard cards, the PIN, are sent over to the Oracle server in clear text. This can be a security problem. Consequently, Oracle Corporation recommends that you enable Oracle Advanced Security encryption, which ensures that the PIN is encrypted when it is sent to the Oracle server.

More Information:

See Chapter 2, "Configuring Data Encryption and Integrity". 

Enabling SecurID Authentication

Enable SecurID authentication by performing the following tasks:

Task 1: Register Oracle as a SecurID Client

Register the machine on which the Oracle Server resides as a SecurID client with the ACE server. You can do this with the Security Dynamics tool sdadmin. To create a client, go to the Client menu and choose Create Client on the ACE/Server 1.2.4 or Add Client on the ACE/Server 2.0.

More Information:

See the Security Dynamics ACE/Server Instruction manual, version 1.2.4, or to the Security Dynamics ACE/Server version 2.0 Administration manual for more detailed information. 

Task 2: Install Oracle Advanced Security

Install Oracle Advanced Security on the Oracle server and Oracle client when you install Oracle8i using the Oracle Installer.

More Information:

See the platform-specific installation instructions. 

Task 3: Ensure that Oracle Can Find the Correct UDP Port

Verify that the ACE/Server, the Oracle server, and the Oracle Advanced Security are installed.

Ensure that the Oracle server can discover the correct UDP port for contacting the ACE/Server. Port numbers are typically stored in a file called services. On UNIX-based operating systems, the file is typically located in the /etc directory. If you are using Network Information Services (NIS) as a naming service, ensure that the services map contains the correct entries for SecurID.

Note:

You can verify which port the ACE server is using by running the Security Dynamics tool Kitconts, for ACE/Server 1.2.4, or sdinfo, for ACE/Server 2.0. 

Task 4: Configure Oracle as a SecurID Client

This section provides separate instructions for Windows and UNIX-based platform for the following options:

Windows NT and Windows 95/98 Platforms

You need the following from the SecurID administrator:

UNIX-Based Platform and ACE/Server Release 1.2.4

Install the SecurID configuration files on the Oracle server machine. You can obtain the files from any other SecurID client or from the machine that runs the ACE/Server.

These files are typically stored in /var/ace. Create this directory on the Oracle server machine and copy the configuration files to it. At the minimum, you need the sdconf.rec file. The configuration files are used by both Oracle and the standard SecurID tools. Because the SecurID tools run setuid root, there can be a problem with the access permissions on the directory /var/ace and the files in this directory. Ensure that the owner of the oracle executable, such as the user "oracle8," is able to read all the files in /var/ace and can create new files in this directory.

Caution:

Do not attempt to overcome this by running Oracle setuid root. It is not necessary, and it is dangerous to do so. 

There are two methods for configuring Oracle as a SecurID client without compromising security. Both methods work, but Oracle Corporation recommends that you use Method #1. Both methods allow you to use Oracle with SecurID authentication and still continue using the other SecurID tools.

Method #1

The owner of the oracle executable should also own the /var/ace directory and the files in /var/ace. For example, if the owner of the oracle executable is the user "oracle8," perform the following steps as root: 

# chown oracle8 /var/ace
# chmod 0770 /var/ace
# chown oracle8 /var/ace/*
# chmod 0660 /var/ace/*
Method #2

The other option is to have root own the /var/ace directory and the files in /var/ace, but give the Oracle group read and write access. If the Oracle group is dba, execute the following commands as root: 

# chown root /var/ace
# chmod 0770 /var/ace
# chgrp dba /var/ace
# chown root /var/ace/*
# chmod 0660 /var/ace/*
# chgrp dba /var/ace/*

UNIX-Based Platforms and ACE/Server Release 2.0

The VAR_ACE environment variable is not supported. You have to store the configuration data in the /var/ace directory. If you currently have the ACE configuration data in a different location, create a symbolic link using the following command: 

# ln -s $VAR_ACE /var/ace

Oracle needs to be able to read and write the ACE configuration data. This data is stored in the directory /var/ace, or $VAR_ACE if you use the symbolic link shown above.

Whether Oracle can read the configuration data depends on how the ACE client software is installed on the Oracle server. During the installation of the ACE client software, specify which administrator should own the configuration files.

Attention:

Whether you use Method 1 or Method 2, described below, ensure that you do not install Oracle as root. 

Method #1

If root is the owner of the ACE server configuration data files, change the UNIX file permissions so that the owner of the oracle executable can read and write to these files. For example, the following commands give Oracle access to the files, and all the Security Dynamics tools that run as setuid root can still access the files. 

# chown oracle8 /var/ace 
# chown oracle8 /var/ace/*
# chmod 0770 /var/ace
# chmod 0660 /var/ace/*

If the environment variable VAR_ACE is set to a different location than /var/ace, you should instead execute the following commands: 

# ln -s $VAR_ACE /var/ace
# chown oracle8 $VAR_ACE
# chown oracle8 $VAR_ACE/*
# chmod 0770 $VAR_ACE
# chmod 0660 $VAR_ACE/*
Method #2

If the ACE files are not owned by root, you have the following options:

For the change to take effect, perform the following steps:

  1. Log out and log in again as the Oracle owner.

  2. Restart the listener.

  3. Restart the Oracle server.

Task 5: Configure SecurID Authentication

Perform the following steps to configure SecurID authentication service:

  1. Start Net8 Assistant:

    • On UNIX, run netasst from $ORACLE_HOME/bin.

    • On Windows NT, choose Start > Programs > Oracle - HOME_NAME > Network Administration > Net8 Assistant.

  2. In the navigator's pane, expand Local > Profile.

  3. From the list in the right pane, select Oracle Advanced Security.

    The Oracle Advanced Security tabbed pages appear.

  4. Click the Authentication tab.


  5. From the Available Methods list, select SECURID.

  6. Move SECURID to the Selected Methods list by clicking the right-arrow button [>].

  7. Arrange the selected methods in order of desired use. To do this, select a method in the Selected Methods list, then click Promote or Demote to position it in the list. For example, for SECURID to be the first service used, move it to the top of the list.

  8. Choose File > Save Network Configuration.

    The sqlnet.ora file updates with the following entries: 

    SQLNET.AUTHENTICATION_SERVICES=(SECURID)

Creating Users for SecurID Authentication

You create users for SecurID authentication by performing the following steps:

Task 1: Assign a Card Using Security Dynamics sdadmin Program

When the sdadmin tool asks for a login name when creating a new user, enter the same name you will use later to create the Oracle user.

More Information:

See the Security Dynamics documentation listed in "Related Publications" in the Preface. 

If you want the user to be able to specify a new PIN to the card using the Oracle tools, choose the option that allows the user to make up his or her own PIN. If you do not allow this, the user will have to use the Security Dynamics tools to generate a PIN if the card is in new-PIN mode. Activate the user on the Oracle server. The Oracle server should already be registered as a SecurID client.

Task 2: Create an Oracle Server Account for the User

You can create an Oracle server account using SQL*Plus connected as a user with the CREATE USER database privilege. Enter the following to create an account: 

SQL> CONNECT system/manager
SQL> CREATE USER os_authent_prefix username IDENTIFIED EXTERNALLY

The OS_AUTHENT_PREFIX Oracle initialization parameter has a default value of OPS$. The user name should be the same as the name you assigned to the card in Task 1: Assign a Card Using Security Dynamics sdadmin Program.

Note:

Because user names can be long and Oracle user names are limited to 30 characters, Oracle Corporation strongly recommends that OS_AUTHENT_PREFIX be set to a null value as follows:

OS_AUTHENT_PREFIX=""

At this point, an Oracle user with username should not yet exist. 

For example, suppose you have assigned a card to the user king, and
OS_AUTHENT_PREFIX has been set to a null value (""). At this point, create an Oracle user account as follows: 

SQL> CREATE USER king IDENTIFIED EXTERNALLY;

Task 3: Grant the User Database Privileges

Grant the user the required database privileges. At a minimum, the user should be granted the CREATE SESSION privilege, as in the following example: 

SQL> GRANT CREATE SESSION TO king;

The user king can now connect to Oracle using the appropriate SecurID card.

More Information:

For information on how to log on to an Oracle server after SecurID authentication has been installed and configured, see "Logging On to the Oracle Server" in this chapter. 

Using SecurID Authentication

This section describes how to use SecurID authentication with the Oracle client tools. It assumes that you are already familiar with SecurID concepts, and that you have configured Oracle for use with the SecurID authentication.

This section contains the following topics:

Before using SecurID authentication to verify passwords, ensure that the following tasks have been completed:

Logging On to the Oracle Server

SecurID authentication allows users to log on to the Oracle server with the PASSCODE that is generated by the SecurID card. The PASSCODE replaces the password in the Oracle connect statement.

There are two types of SecurID cards:

Depending on the type of card, you enter the PIN either:

Using Standard Cards

The standard cards generate and display a PASSCODE. When logging in to Oracle, specify the user name, PIN, and current PASSCODE as follows: 

sqlplus username/<pin><passcode>@net_service_name

For example, if the card is assigned to user king, the PIN is 3511, and the card shows the number 698244, log into Oracle using SQL*Plus as follows: 

% sqlplus king/3511698244@oracle_database

or 

% sqlplus king@oracle_database
% enter password: 3511698244

Note:

The Security Dynamics tools support the following characters as delimiters between the PIN and the PASSCODE:

" " <tab> \ / ; :

Do not use these characters, because Oracle interprets these characters differently. 

Using PINPAD Cards

If you have a PINPAD card, you first have to enter the PIN on the card and generate a new PASSCODE. Use the PASSCODE to connect to Oracle as follows: 

sqlplus username/passcode@net_service_name

For example, if the card is assigned to user king, first generate a PASSCODE by entering the PIN on the PINPAD card as described in the Security Dynamics documentation.

For example, if the generated PASSCODE is 698244, connect to Oracle using SQL*Plus as follows: 

% sqlplus king/698244@oracle_dbname

Assigning a New PIN to a SecurID Card

If you are logging in for the first time or the administrator has put the card in the new-PIN mode, you must assign a PIN to the card. You can tell that this is the case if, while trying to connect to Oracle, you receive the following error message:

ORA-12681 "Login failed: the SecurID card does not have a pincode yet"

To assign a PIN to a card you connect to the Oracle Server using a special syntax. First select a PIN, which is typically four to eight digits long. Depending on the type of SecurID card you have, you might be able to use letters as well.

Old PIN Cleared

If you have cleared the old PIN, use the following the syntax while connecting to the Oracle database: 

sqlplus username/+new_pin+tokencode@oracle_dbname

Note:

You must add the two plus (+) characters in the connect string, because they tell Oracle that this is an attempt to assign a PIN to the card. Also, they separate the new PIN from the passcode.

You must also enclose the PIN/passcode combination in double quotes. Some Oracle tools such as SQL*Plus truncate the password string (PIN/passcode) just before the + character. Surrounding the password string (PIN/passcode) in double
quotes (" ") prevents the password string from being truncated. 

For the tokencode, enter the card code that is currently displayed on the SecurID card's LCD. If you have a PINPAD card, do not enter the PIN on the card.

For example, if the card is assigned to user king, the new PIN is 45618, and the SecurID card currently displays number 564728, enter the following: 

% sqlplus king/"+45618+564728"@oracle_dbname

Old PIN Not Cleared

If the old PIN was not cleared, use the following syntax while connecting to the database. Otherwise, the administrator must select the new PIN for you. 

sqlplus username/+new_pin+old_pintokencode@oracle_dbname

For the tokencode, enter the card code that is currently displayed on the SecurID card. If you have a PINPAD card, do not enter the PIN on the card.

If the new PIN is accepted, you are connected to Oracle. The next time you want to connect to Oracle you should use the procedure described in "Logging On to the Oracle Server" in this chapter. If the new PIN is rejected, you receive the following error:

ORA-12688 "Login failed: the SecurID server rejected the new pincode"

Possible Reasons for PIN Rejection:

The following are possible reasons for why a PIN is rejected:

Logging on When the SecurID Card is in "Next Code" Mode

As an additional safety step, the ACE/Server sometimes asks for the next card code, to ensure that the person who is trying to log in actually has the card in his or her possession. This is the case if you get the following error message when you try to log into Oracle:

ORA-12682, "Login failed: the SecurID card is in next PRN mode"

The next time you want to log on Oracle, you must specify the next two card codes. The syntax you use to log into Oracle depends on the kind of SecurID card you have, Standard or PINPAD.

Logging on with a Standard Card

If you have a standard card, specify the following:

  1. the PIN

  2. the current card code

  3. a plus (+) character and the next card code

Steps 1, 2, and 3 above replace the password. The + character is important, because it separates the first card code (passcode) from the second one. Use the following syntax: 

sqlplus <username>/ "pincodepasscode+next_passcode"@<net_service_name>

Note:

You must enclose the PIN/passcode/next passcode combination in double quotes. Some Oracle tools such as SQL*Plus truncate the password combination just before the plus (+) character. Surrounding the PIN and passcode in double quotes ("") prevents the password combination from being truncated. 

For example, if the card is assigned to user king, the PIN is 3511, and the card first shows the number 98244 and the next number is 563866, enter the following: 

% sqlplus king/"3511698244+563866"@oracle_database

This connects you to the Oracle server and puts the card back into normal mode. The next time you want to log in to the Oracle server, use the procedure described in "Logging On to the Oracle Server" in this chapter.

Logging on with a PINPAD Card

If you have a PINPAD card, perform the following steps to log on to the Oracle server:

  1. Enter the PIN on the card to generate the first PASSCODE.

  2. Clear the card's memory by pressing P and wait for the next PASSCODE.

  3. Log on to the Oracle server with the two passcodes, separated by a + character as follows: 

    sqlplus username/ "<first passcode+second passcode"@net_service_name

For example, if the card is assigned to user king, perform the following steps:

  1. Enter the PIN on the PINPAD card to generate a passcode, such as 231003.

  2. Clear the card's memory. The next displayed number might be 831234.

  3. To log in, use the following syntax, entering the two passcodes generated in steps 1 and 2: 

    % sqlplus king/"231003+831234"@oracle_dbname

This connects you to Oracle and puts the card back into normal mode. The next time you want to log in to Oracle, use the procedure described in"Logging On to the Oracle Server".

Troubleshooting the Configuration of SecurID Authentication

If you experience problems while configuring SecurID authentication, verify the following:

Prev Next
Oracle
Copyright © 1999 Oracle Corporation.
All Rights Reserved.

Library
Product
Contents
Index