Oracle® Database Vault

Installation Guide

10g Release 2 (10.2) for hp OpenVMS

E13804-01

February 2009

Oracle Database Vault Installation Guide, 10g Release 2 (10.2) for hp OpenVMS

E13804-01

Copyright © 2009, Oracle and/or its affiliates. All rights reserved.

Primary Author: Prakash Jashnani, Sumit Jeloka

Contributing Author: Patricia Huey and Prakash Jashnani

Contributors: Scott Gaetjen, Xiaofang Wang, Jack Brinson, Chi Ching Chui, Kamal Tbeileh, Trivikrama Samudrala, Madhu Velukur, Rahul Joshi

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.

Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Contents

Preface

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

Part I Oracle Database Vault Installation

1 Oracle Database Vault Installation Overview

- 1.1 Database Vault Installation Environment

- 1.2 Database Vault Accounts

- 1.2.1 Database Vault Owner

- 1.2.2 Database Vault Account Manager

- 1.3 Default Audit Policy and Initialization Parameters

- 1.4 Installation Considerations

- 1.4.1 Hardware and Software Certification

- 1.4.2 Multiple Oracle Homes

- 1.4.3 Logical Names and Symbols

2 Installing Oracle Database Vault as an Option

- 2.1 Preinstallation and Installation Tasks

- 2.1.1 Become Familiar with the Features of Oracle Database Vault

- 2.1.2 Check the Hardware Requirements

- 2.1.2.1 Minimum Hardware Requirements

- 2.1.2.2 Disk Space Requirements

- 2.1.3 Check the Operating System Requirements

- 2.1.4 Installation Specific Issues and Restrictions

- 2.1.4.1 Install Oracle Database Vault into an Existing Oracle Home Only

- 2.1.4.2 Do Not Modify the JDK

- 2.1.5 Plan for the Use of Oracle Database Vault Administrator

- 2.1.6 Check the Database Requirements

- 2.1.6.1 Apply Oracle Database Release 10.2.0.4 Patch Set

- 2.1.7 Prepare a Backup Strategy

- 2.1.8 Disable Custom Profiles (If Any)

- 2.1.9 Verify That Oracle Clusterware Is Running (RAC Only)

- 2.1.10 Stop Existing Oracle Processes

- 2.1.11 Configure the Oracle User's Environment

- 2.1.12 Run Oracle Universal Installer to Install Oracle Database Vault

- 2.2 Postinstallation Tasks

- 2.2.1 Review the Database Vault Configuration Assistant Related Files

- 2.2.2 Back Up the Database

- 2.2.3 Change Passwords for Oracle-Supplied Accounts

- 2.2.4 Disable Remote SYSDBA Connections (Optional)

- 2.2.5 Start the Listener and Database on Other Nodes (RAC Only)

- 2.2.6 Running DVCA on Other Oracle Real Application Nodes

- 2.2.7 Running Oracle Database Vault Administrator

- 2.3 Disabling Oracle Database Vault

Part II Appendixes

A How to Stop Processes in an Existing Oracle Real Application Clusters Database

B Using Response Files

- B.1 How Response Files Work

- B.1.1 Creating the oraInst.loc File

- B.1.2 General Procedure for Using Response Files

- B.2 Installing Database Vault Using a Response File

- B.2.1 Step 1: Prepare the Response File

- B.2.2 Step 2: Run Oracle Universal Installer Using the Response File

- B.3 Troubleshooting Silent Mode Installation

C Running DVCA After Installing the Database Vault Software

D Database Listener Security Recommendations

- D.1 Security Checklist for the Database Listener

E Initialization Parameters

Index

Preface

The Oracle Database Vault Installation Guide explains how to prepare for, install, and configure Oracle Database Vault on hp OpenVMS. It also discusses the Oracle software technology components that Database Vault requires.

This preface contains:

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

Note:
Instructions for both hp Open VMS Alpha and hp OpenVMS Itanium are usually the same. Any instructions specific to only hp Open VMS Alpha or hp OpenVMS Itanium are clearly provided.

Audience

This document is intended for Oracle DBAs as well as System Administrators who are involved in the installation of Oracle Database Vault and its related components.

Documentation Accessibility

Our goal is to make Oracle products, services, and supporting documentation accessible to all users, including users that are disabled. To that end, our documentation includes features that make information available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at http://www.oracle.com/accessibility/.

Accessibility of Code Examples in Documentation

Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites.

TTY Access to Oracle Support Services

To reach AT&T Customer Assistants, dial 711 or 1.800.855.2880. An AT&T Customer Assistant will relay information between the customer and Oracle Support Services at 1.800.223.1711. Complete instructions for using the AT&T relay services are available at http://www.consumer.att.com/relay/tty/standard2.html. After the AT&T Customer Assistant contacts Oracle Support Services, an Oracle Support Services engineer will handle technical issues and provide customer support according to the Oracle service request process.

Related Documents

For more information, refer to the following documents:

- Oracle Database Vault Release Notes for hp OpenVMS

- Oracle Database Vault Administrator's Guide

- Oracle Database Installation Guide for hp OpenVMS

- Oracle Database Oracle Clusterware and Oracle Real Application Clusters Administration and Deployment Guide

Conventions

The following text conventions are used in this document:

Convention

Meaning

boldface

Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary.

italic

Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.

monospace

Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

Part I

Oracle Database Vault Installation

Part I introduces you to Oracle Database Vault installation concepts, requirements, and steps. This part contains the following chapters:

- Chapter 1, "Oracle Database Vault Installation Overview"

- Chapter 2, "Installing Oracle Database Vault as an Option"

1 Oracle Database Vault Installation Overview

Oracle Database Vault enables you to secure business data in ways that were not possible before. Database Vault uses a multifactored and multilayered approach to implementing database security.

This chapter provides an overview of the Database Vault installation process. This chapter includes the following sections:

- Database Vault Installation Environment

- Database Vault Accounts

- Installation Considerations

1.1 Database Vault Installation Environment

Oracle Database Vault can be installed as an option to the following:

- Oracle Database 10g Release 2 (10.2.0.4) standalone installation

- Oracle Database 10g Release 2 (10.2.0.4) with Oracle Real Application Clusters (RAC)

1.2 Database Vault Accounts

Database Vault uses two accounts that you can create during installation. These are the Database Vault Owner and the Database Vault Account Manager accounts. You must supply an account name and password for the Database Vault Owner during installation. Creating a Database Vault Account Manager is optional.

1.2.1 Database Vault Owner

The Database Vault Owner account is granted the DV_OWNER role. This account can manage Database Vault roles and configuration.

The Database Vault Owner user name can be a minimum of 2, and a maximum of 30 characters long. The account password can be a minimum of 8, and a maximum of 30 characters.

The password that you choose for the Database Vault Owner account must be a secure one. The following password restrictions are enforced:

- The password must include at least one alphabet, one digit, and one non alphanumeric character (symbol).

- The password cannot be the same as the account name.

- The password cannot contain any consecutive repeating characters.

- This symbol can be either the # symbol or an underscore (_).

1.2.2 Database Vault Account Manager

The Database Vault Account Manager is granted the DV_ACCTMGR role. This account is used to manage database user accounts. The Database Vault Account Manager is created to facilitate separation of duties. If you do not opt to create the Database Vault Account Manager account, then the DV_ACCTMGR role is granted to the Database Vault Owner account by default.

The Database Vault Account Manager user name can be a minimum of 2, and a maximum of 30 characters long. The account password can be a minimum of 8, and a maximum of 30 characters.

The same password restrictions that apply to Database Vault Owner are applicable to Database Vault Account Manager as well.

1.3 Default Audit Policy and Initialization Parameters

Oracle Database Vault installs a baseline database auditing policy. This policy covers the access control configuration information stored in Database Vault database tables, information stored in Oracle Catalog (rollback segments, tablespaces, and so on), the use of system privileges, and Oracle Label Security configuration.

See Also:
Oracle Database Vault Administrator's Guide for more information on the database audit policy

When you install Oracle Database Vault, the security specific database initialization parameters are initialized with default values. These security specific initialization parameters are listed in Appendix E

1.4 Installation Considerations

This section contains information that you should consider before deciding how to install this product. It contains the following sections:

- Hardware and Software Certification

- Multiple Oracle Homes

- Logical Names and Symbols

1.4.1 Hardware and Software Certification

The platform-specific hardware and software requirements included in this installation guide were current at the time this guide was published. However, because new platforms and operating system software versions might be certified after this guide is published, review the certification matrix on the OracleMetaLink Web site for the most up-to-date list of certified hardware platforms and operating system versions. The OracleMetaLink Web site is available at the following URL:

http://metalink.oracle.com

If you do not have a current Oracle Support Services contract, then you can access the same information at the following Web site:

http://www.oracle.com/technology/support/metalink/content.html

1.4.2 Multiple Oracle Homes

This product supports multiple Oracle homes. This means that you can install this release of the software more than once on the same system.

1.4.3 Logical Names and Symbols

Note:
The Oracle Database Vault installation session must not have any logical names or symbols defined as a result of execution of the orauser.com script. If any such logical names or symbols are defined, you must exit the current process and then log back in

Ensure that the LOGIN.COM file of the account that is used to install Oracle Database Vault does not define any of the Oracle logical names or symbols, and does not run any command file that may define them. Ensure that none of the general Oracle specific logical names (typically beginning with ORA_) are defined in the system table, except for some of the logical names related to mailbox devices and shared libraries. Oracle Database Vault may not run correctly if these logical names are defined.

2 Installing Oracle Database Vault as an Option

This chapter includes an overview of the major steps required to install Oracle Database Vault into an existing Oracle Database 10g release 2 (10.2.0.4) database. These procedures transform an existing Oracle Database system (including associated applications) into an Oracle Database Vault system. Databases upgraded using the procedures described in this chapter can work almost in the same manner as in earlier releases and, optionally, can leverage new Oracle Database Vault functionality. For a list of changes that Database Vault makes, refer to Appendix E, "Initialization Parameters" and the Oracle Database Vault Administrator's Guide.

Note:
In order to upgrade a pre-10g release 2 Oracle Database to Oracle Database Vault, you first must upgrade the database to a 10g release 2 (10.2.0.4) database.

See Also:

- Oracle Database Upgrade Guide, 10g Release2 (10.2) for information about upgrading your Oracle Database to Oracle Database 10g release 2.

- ora_root:[rdbms]readmemigvms.doc, a text file in the Oracle Database Release 10.2 code tree. It is essential reading for Oracle software upgrades on hp OpenVMS.

- OracleMetaLink Note 316889.1, "Complete Checklist for Manual Upgrades to 10gR2". You can access OracleMetaLink from the following URL:
http://metalink.oracle.com

This chapter covers the following topics:

- Preinstallation and Installation Tasks

- Postinstallation Tasks

- Disabling Oracle Database Vault

2.1 Preinstallation and Installation Tasks

This section covers the following topics:

- Become Familiar with the Features of Oracle Database Vault

- Check the Hardware Requirements

- Check the Operating System Requirements

- Installation Specific Issues and Restrictions

- Plan for the Use of Oracle Database Vault Administrator

- Check the Database Requirements

- Prepare a Backup Strategy

- Disable Custom Profiles (If Any)

- Verify That Oracle Clusterware Is Running (RAC Only)

- Stop Existing Oracle Processes

- Configure the Oracle User's Environment

- Run Oracle Universal Installer to Install Oracle Database Vault

2.1.1 Become Familiar with the Features of Oracle Database Vault

Before you plan the upgrade process, become familiar with the features of Oracle Database Vault. The Oracle Database Vault Administrator's Guide discusses the basic features of Oracle Database Vault.

2.1.2 Check the Hardware Requirements

The following sections describe the minimum hardware requirements for installing Oracle Database Vault on an OpenVMS system.

- Minimum Hardware Requirements

- Disk Space Requirements

2.1.2.1 Minimum Hardware Requirements

The following are the minimum hardware requirements for installing Oracle Database Vault.

RAM

A minimum of one GB RAM is required to install Oracle Database Vault.

To determine the amount of RAM installed on the system as well as the amount of paging currently configured on the system, enter the following command:

$ SHOW MEMORY

To review memory reservations on the node, run the following command:

$ SHOW MEMORY/RESERVED
System Memory Resources on 13-JUL-2002 09:57:11.72

Memory Reservations (pages):   Group   Reserved  In Use  Type
ORA_PROD_SGA                   SYSGBL  5120      0       Allocated
ORA_PROD_SGA                   SYSGBL  5         0       Page Table
Total (40.04 Mbytes reserved)          5125      0

See Also:

- Oracle Database Installation Guide for hp OpenVMS

- Hewlett-Packard documentation for more information about reserving memory

Chip Set

Hp OpenVMS AlphaServer systems must have an EV56 or later generation CPU.

There are no restrictions on hp OpenVMS Itanium CPUs.

2.1.2.2 Disk Space Requirements

The disk space requirements do not include the size of the database. Oracle Database Vault requires a minimum of 250 MB for installation and an additional 1 GB for the staging area defined with the logical name TMP.

2.1.3 Check the Operating System Requirements

Depending on the products that you intend to install, verify that the following software is installed on the system. The procedure following the table describes how to verify whether these requirements are addressed.

Note:
Oracle Universal Installer performs checks on your system to verify that it meets the listed requirements. To ensure that these checks pass, verify the requirements before you start Oracle Universal Installer.

Item

Requirement

Minimum Operating System Requirement

For OpenVMS Alpha:
OpenVMS version 8.2

OpenVMS 8.3 is suggested

For OpenVMS Itanium:

OpenVMS version 8.2-1

OpenVMS 8.3-1H1 is suggested

Oracle Universal Installer

X Window and X/Motif software:

Oracle Net Services Requirements

Oracle Net Services on OpenVMS is developed and certified using TCP/IP Services for OpenVMS (UCX). If you want to use the TCP/IP protocol adapter for Oracle Net Services, then you should have Version 5.5 ECO 1 or later of TCP/IP Services for OpenVMS installed.
Caution: TCP/IP protocol stacks from other vendors may work with Oracle, but this is not guaranteed by Oracle. Any TCP/IP problems that cannot be reproduced using TCP/IP Services for OpenVMS should be referred to the TCP/IP vendor.

VendorEprovided protocol services are usually upward-compatible, so existing applications will continue to work without modification. Therefore, later releases of TCP/IP are upward-compatible with Oracle Net Services, as long as the vendorEspecified application programming interface (API) does not change with new releases.

Oracle JDBC/OCI Drivers

You can use the following JDK versions with the Oracle JDBC/OCI drivers:
For OpenVMS Alpha:

- HP JDK v 1.3.1

- HP JDK v 1.2

- HP JDK 1.4.2

However, they are not required for the installation.

For OpenVMS Itanium:

- HP JDK 1.4.2

Note: HP JDK v 1.4.2 is installed as part of a standard Oracle software installation.

To ensure that the system meets these requirements:

1. To determine which version of OpenVMS is installed, enter the following command:
For OpenVMS Alpha:

$ WRITE SYS$OUTPUT F$GETSYI("VERSION")
V8.2

For OpenVMS Itanium:

$ WRITE SYS$OUTPUT F$GETSYI("VERSION")
V8.2-1

If necessary, refer to the operating system documentation for information about upgrading the operating system.

2. To display additional information about the operating system, enter the following command:

$ SHOW SYSTEM /NOPROCESS /FULL

To view information about all nodes in a cluster, add the /CLUSTER qualifier to this command.

3. To determine the version of TCP/IP installed, enter the following command:
For OpenVMS Alpha:

$ tcpip show version
HP TCP/IP Services for OpenVMS Alpha Version V5.5 - ECO 1
on a AlphaServer GS160 6/731 running OpenVMS V8.2

For OpenVMS Itanium:

$ tcpip show version
HP TCP/IP Services for OpenVMS Industry Standard 64
Version V5.5 - ECO 1
on an HP rx4640 (1.50GHz/6.0MB) running OpenVMS V8.2-1

Oracle Net Services OpenVMS Mailbox Driver

The Oracle Net Services OpenVMS Mailbox driver (protocol IPC) is included in NETWORK. You do not need an Oracle Net Services license to use the OpenVMS Mailbox driver.

2.1.4 Installation Specific Issues and Restrictions

There are factors that can affect the installation or use of Oracle Database. This section discusses these factors:

- Install Oracle Database Vault into an Existing Oracle Home Only

- Do Not Modify the JDK

2.1.4.1 Install Oracle Database Vault into an Existing Oracle Home Only

For both single-instance and Oracle Real Application Clusters installations, you must install Oracle Database Vault into the root directory of an existing Oracle Database installation for release 10.2.0.4. Do not install Oracle Database Vault into a new Oracle home.

For Oracle Real Application Clusters, ensure that you install Oracle Database Vault from the same node that you used to install Oracle Database.

2.1.4.2 Do Not Modify the JDK

The JDK release that is shipped with Oracle Database is used by Oracle Java applications such as Oracle Universal Installer and is the only JDK that is supported to run with these applications. You must not modify this JDK, unless it is done through a patch provided by Oracle Support Services.

2.1.5 Plan for the Use of Oracle Database Vault Administrator

Oracle Database Vault Administrator is a graphical user interface for administering Oracle Database Vault. However, Database Vault Administrator is not available on the hp OpenVMS platform. It is only available in Oracle Database Release 11g Release 1 (11.1) as an installation option. If you have access to this release, you can remotely connect Database Vault Administrator to an Oracle Database Release 10g Release 2 (10.2.0.4) installation on hp OpenVMS. See Oracle Database Vault Administrator's Guide for information about making this remote connection.

If you do not have access to Oracle Database 11g, then you can use the DVSYS PL/SQL packages and the PL/SQL interfaces described in Oracle Database Vault Administrator's Guide to manage Oracle Database Vault.

2.1.6 Check the Database Requirements

In order to install Oracle Database Vault, you must be running the Enterprise Edition of Oracle Database 10g release 2 (10.2.0.4).

A listener must have been configured for the existing database. Oracle Net Configuration Assistant configures the listener when you first install the database.

You must have an existing password file for the database. The password file authentication parameter, REMOTE_LOGIN_PASSWORDFILE must have been set to EXCLUSIVE or SHARED.

You can set the REMOTE_LOGIN_PASSWORDFILE parameter in the init.ora file. Use the orapwd utility to create and manage password files.

See Also:
Oracle Database Administrator's Guide for more information on creating and maintaining a password file

2.1.6.1 Apply Oracle Database Release 10.2.0.4 Patch Set

To install Oracle Database Vault, you must upgrade the database to Oracle Database release 10.2.0.4. Oracle strongly recommends that you back up your database before performing any upgrade or installation.

See Also:
Oracle Database Backup and Recovery User's Guide for information on database backups

This section covers the following topics:

- Patch Set Overview

- Oracle Universal Installer Version Requirements

- Patch Set Documentation

- Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.4) Patch Set 1 for hp OpenVMS

- Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.4) Patch Set 1

Patch Set Overview

You can apply the Oracle Database release 10.2.0.4 patch set to the following Oracle Database 10g release 2 installations:

- Oracle Database

- Oracle Real Application Clusters

Oracle Universal Installer Version Requirements

This patch set includes Oracle Universal Installer release 10.2.0.4, which is also installed when you install this patch set. This is to ensure that your Oracle home can be patched in the future. You should not use the Installer from the earlier maintenance release media or Oracle home.

This is not a complete software distribution. You must install it in an existing Oracle Database 10g release 2 patch set 10.2.0.4 installation.

Patch Set Documentation

There are two documents related to this release of the Oracle Database patch set:

- Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.4) Patch Set 1 for hp OpenVMS

- Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.4) Patch Set 1

Both of these documents are included with the patch set. In addition, they are available from document 316900.1, ALERT: Oracle 10g release 2 (10.2) Support Status and Alerts on the OracleMetaLink Web site:

http://metalink.oracle.com

To locate document 316900.1:

1. Log on to OracleMetaLink.

2. Click Advanced at the top of the OracleMetaLink page.

3. Enter 316900.1 in the Document ID field, then click Submit.

The following sections describe the contents of the Oracle Database Patch Set Notes and the Oracle Database List of Bugs Fixed documents.

Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.4) Patch Set 1 for hp OpenVMS

This document provides:

- System requirements and information about how to install, reinstall or remove the patch set

- A list of all bugs fixed to date that are specific to Oracle Database for hp OpenVMS

- A list of known issues relating to Oracle Database on hp OpenVMS

Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.4) Patch Set 1

The List of Bugs Fixed is a list of all generic bugs related to Oracle Database that have been fixed to date.

2.1.7 Prepare a Backup Strategy

Oracle strongly recommends that you back up your database before performing any upgrade or installation. The ultimate success of your upgrade depends heavily on the design and execution of an appropriate backup strategy. To develop a backup strategy, consider the following questions:

- How long can the production database remain inoperable before business consequences become intolerable?

- What backup strategy should be used to meet your availability requirements?

- Are backups archived in a safe, offsite location?

- How quickly can backups be restored (including backups in offsite storage)?

- Have recovery procedures been tested successfully?

Your backup strategy should answer all of these questions and include procedures for successfully backing up and recovering your database.

See Also:
Oracle Database Backup and Recovery User's Guide for information on database backups

2.1.8 Disable Custom Profiles (If Any)

If you have created custom profiles and password complexity checks in your existing database, then you must disable these before performing the installation. You can reenable these after the installation is complete. Use the following steps to achieve this:

1. Extract the profile names and associated settings for each profile that is being used. You can use a script to accomplish this.

Example 2-1 shows a sample script that extracts the profile names and settings to create an output script called, myprofiles.sql. After the installation is complete, you can run myprofiles.sql to restore the profile settings.

Example 2-1 Extracting Profiles

set serverout on size 100000
spool myprofiles.sql
declare
l_last varchar2(30) := 'X';
l_count number := 0;
begin
for c in (
select profile, resource_name , limit
from dba_profiles
order by profile, resource_name
) loop
if l_last <> c.profile then
l_last := c.profile;
if l_count > 0 then
dbms_output.put_line(';');
end if;
l_count := l_count + 1;
dbms_output.put_line('create profile ' || c.profile || ' limit ');
else
dbms_output.put_line('    ' || c.resource_name || ' ' || c.limit);
end if;
end loop;
dbms_output.put_line(';');
end;
/
spool off

2. Disable the custom profiles and password complexity settings. For example:

SQL> ALTER PROFILE SomeCustomProfile LIMIT
PASSWORD_REUSE_MAX UNLIMITED -- The number of times a password can be reused
PASSWORD_REUSE_TIME UNLIMITED -- The number of days between reuses of a password
PASSWORD_VERIFY_FUNCTION NULL
/

3. After the Oracle Database Vault installation is complete, reenable the profiles by running the script created in Step 1.

SQL>@myprofiles.sql

2.1.9 Verify That Oracle Clusterware Is Running (RAC Only)

Oracle Clusterware should be running for the Database Vault installer to find the existing Real Application Clusters (RAC) databases. If you have stopped Oracle Clusterware, then you should restart it before running Oracle Universal Installer. Use the following command to verify if Oracle Clusterware is running:

$ CRSCTL CHECK CRS

The output from this command should indicate the health of the Oracle Clusterware server processes of the current node. Run this command on each node of the RAC cluster. In the following example, the CSS, CRS, and EVM processes are healthy.

$ CRSCTL CHECK CRS
CSS appears healthy
CRS appears healthy
EVM appears healthy

2.1.10 Stop Existing Oracle Processes

See Also:
Oracle Database Administrator's Reference for information about stopping existing Oracle processes on Oracle RAC

Caution:
If you are installing additional Oracle Database 10g products in an existing Oracle home, then stop all processes running in the Oracle home. You must complete this task to enable Oracle Universal Installer to relink certain executables and libraries.

to stop the existing Oracle processes:

1. Log in as the owner of the Oracle installation.

2. For each database associated with the installation, perform these steps:

1. Run the orauser.com script with the SID of the database instance, for example, assuming the SID is PROD:

@DISK$ORACLE:[ORACLE10GR2]ORAUSER PROD

2. Shut the database down.

3. Shut down all listeners.
For example, to stop listeners LISTENER1 and LISTENER2:

LSNRCTL STOP LISTENER1
LSNRCTL STOP LISTENER2

4. Shut down all other services.

5. Log out.

2.1.11 Configure the Oracle User's Environment

Before you start Oracle Universal Installer, you must configure the environment of the Oracle database account.

To configure the Oracle database account environment:

1. Start a new terminal session.

2. Set up the display by using the SET DISPLAY command.
If you are not installing the software on the local system, then enter the following command to direct X applications to display on the local system:

$ SET DISPLAY/CREATE/TRANSPORT=TCPIP/NODE=ip_address

To confirm that the display is set correctly, run the following command:

$ RUN SYS$SYSTEM:DECW$CLOCK

3. If the database to be updated with this Oracle Database Vault installation is not an Oracle Real Applications Clusters (RAC) database, then define the ORA_DB_NONRAC_INSTALL logical name as follows:

$ DEFINE ORA_DB_NONRAC_INSTALL "TRUE"

4. Ensure that the file oraInst.loc file points to the inventory for the correct Oracle home.

By default, the oraInst.loc file is in disk:[login_dir.hostname], where login_dir is the equivalent of the SYS$LOGIN logical name, and hostname is the name of the network node where the databases have been created.

5. Ensure that the ORATAB file exists and contains information about all Oracle databases created on the node.
The database entries in this file are of the following form:

ORACLE_SID:ORACLE_HOME:[N|Y]

By default, the ORATAB file is in the same directory as oraInst.loc discussed in Step 4.

6. Copy the DV.RSP file from the [.response] subdirectory of your Oracle Database Vault kit to any location where you can edit this file, for example, SYS$LOGIN.

7. Edit the DV.RSP file and provide all the required values, making sure to enclose them in double quotation marks (").
For more information about the response file, see Appendix B, "Using Response Files".

8. Enter the following command:

$ SET NOVERIFY

9. Enter the following command:

$ SET PROCESS/PRIV=ALL

10. Start Oracle Universal Installer.
See "Run Oracle Universal Installer to Install Oracle Database Vault".

2.1.12 Run Oracle Universal Installer to Install Oracle Database Vault

Run Oracle Universal Installer (OUI) to install Oracle Database Vault into an existing Oracle Database 10g release 2 (10.2.0.4) database.

To start Oracle Universal Installer:

1. Ensure that you have created a response file.
You must use a response file to install Oracle Database Vault on an hp OpenVMS system. See Appendix B, "Using Response Files" for details about creating response files. Also, ensure that you have completed the instructions in "Configure the Oracle User's Environment".

2. Run the following command:

$ @kit_device:[Disk1]runInstaller.com -responseFile response_file

In this specification:

- kit_device is the disk that contains the Oracle Database Vault installation kit.

- response_file is the full specification in OpenVMS format of the DV.RSP file that you edited in "Configure the Oracle User's Environment".

Optionally, you can use the -silent parameter if you want to bypass the Graphical User Interface of Oracle Universal Installer. For example:

$ @kit_device:[Disk1]runInstaller.com -responseFile response_file -silent

For more information about other options that you can use with the runInstaller utility, enter the following command:

$ @kit_device:[Disk1]runInstaller.com -HELP

If you omit the -silent parameter, then Oracle Universal Installer loads the values you created in the response file. The following actions take place:

1. The Summary screen displays, showing the installation details. Verify these details and then click Install.

2. The Installation screen appears next. After the installation completes, Database Vault Configuration Assistant (DVCA) runs automatically to configure the Database Vault.

2.2 Postinstallation Tasks

This section lists the tasks to perform after you have completed an upgrade of your database. The following topics are discussed:

- Review the Database Vault Configuration Assistant Related Files

- Back Up the Database

- Change Passwords for Oracle-Supplied Accounts

- Disable Remote SYSDBA Connections (Optional)

- Start the Listener and Database on Other Nodes (RAC Only)

- Running DVCA on Other Oracle Real Application Nodes

- Running Oracle Database Vault Administrator

2.2.1 Review the Database Vault Configuration Assistant Related Files

The installation of the Oracle Database Vault triggers an automatic execution of the dvca.com script. This Database Vault Configuration Assistant procedure uses a dvca.args file that is generated by the installer. The script also creates and leaves behind the dvca.jinput file. When the configuration phase completes, it renames the dvca.args file to dvca.args_OLD. Both, the dvca.jinput and the dvca.args_OLD files reside in your ORACLE_HOME location. Even though the access to these files is limited to the SYSTEM and the owner accounts, you may want to delete files, or otherwise secure these files because they contain sensitive database access information.

2.2.2 Back Up the Database

Make sure you perform a full backup of the production database. See Oracle Database Backup and Recovery User's Guide for details on backing up a database.

2.2.3 Change Passwords for Oracle-Supplied Accounts

Oracle strongly recommends that you change the password for each account after installation. This enables you to effectively implement the strong security provided by Oracle Database Vault.

To unlock and reset user account passwords using SQL*Plus:

1. Start SQL*Plus and log in using the Database Vault Account Manager account. If you did not create the Database Vault Account Manager account during installation, then you must log in using the Database Vault Owner account.

2. Enter a command similar to the following, where account is the user account that you want to unlock and password is the new password:

SQL> ALTER USER account [ IDENTIFIED BY password ] ACCOUNT UNLOCK;

In this example:

- The ACCOUNT UNLOCK clause unlocks the account.

- The IDENTIFED BY password clause resets the password.

Note:
If you unlock an account but do not reset the password, then the password remains expired. The first time someone connects as that user, they must change the user's password.
To permit unauthenticated access to your data through HTTP, unlock the ANONYMOUS user account.

See Also:
Oracle Database Administrator's Guide for more information about:

- Unlocking and changing passwords after installation

- Oracle security procedures

- Best security practices

2.2.4 Disable Remote SYSDBA Connections (Optional)

Oracle Database Vault allows you to disable remote logins with SYSDBA privileges. This enables enhanced security for your database.

To disable remote SYSDBA connections, re-create the password file with the nosysdba flag set to y (Yes). A user can still log in AS SYSDBA locally using Operating System (OS) authentication. However, remote connections AS SYSDBA will fail.

Use the following syntax to re-create the password file:

orapwd file=filename password=password [entries=users] force=y nosysdba=y

In this specification:

- file: Name of password file (mandatory)

- password: Password for SYS (mandatory). Enter at least six alphanumeric characters.

- entries: Maximum number of distinct DBA users

- force: Whether to overwrite the existing file

- nosysdba: Whether to enable or disable the SYS logon
The default is no, so if you omit this flag, the password file will be created enabling SYSDBA access for Oracle Database Vault instances.

For example, to create a password file for an Oracle database named orcl:

orapwd file=ORA_ROOT:[DBS]orapworcl.ora password=sys_password force=y nosysdba=y

Note:
Do not insert spaces around the equal (=) character.

See Also:
Oracle Database Administrator's Guide for more information on using the orapwd utility.

When you re-create the password file, any accounts other than SYS that were granted the SYSDBA or SYSOPER privileges will have those privileges removed. You must regrant the privileges for these accounts after you have re-created the password file.

You can reenable the ability to connect with the SYSDBA privilege by re-creating the password file with the nosysdba flag set to n (No). You might need to reenable the ability to connect with the SYSDBA privilege, if certain products or utilities require it's use.

2.2.5 Start the Listener and Database on Other Nodes (RAC Only)

You must start the listener and database on all RAC nodes other than the one on which the installation is performed. Use the following commands to start the listener and the database:

Note:
You need SYSDBA privileges to run these commands.

$ SRVCTL start listener "-n" node_name
$ SRVCTL start instance "-d" sid "-i" instance_name

Note:
You must use the Server Control (srvctl) utility to start and stop Oracle Database Vault RAC instances. Do not use SQL*Plus to start and stop RAC instances.

2.2.6 Running DVCA on Other Oracle Real Application Nodes

For this release of Oracle Database Vault on the hp OpenVMS platform, you do not need to run DVCA on other nodes in a RAC installation.

2.2.7 Running Oracle Database Vault Administrator

See Oracle Database Vault Release Notes for hp OpenVMS for more information.

2.3 Disabling Oracle Database Vault

You cannot remove or uninstall the Database Vault option. However, you can disable Oracle Database Vault. Refer to the following documents for details:

- Oracle Database Vault Release Notes for hp OpenVMS for information about enabling and disabling Oracle Database Vault on the hp OpenVMS platform

- Oracle Database Vault Administrator's Guide for how to check if Database Vault is enabled or disabled, and reasons why you would need to disable it

Part II

Appendixes

Part II includes the appendixes. The contents of this part are:

- Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database"

- Appendix B, "Using Response Files"

- Appendix C, "Running DVCA After Installing the Database Vault Software"

- Appendix D, "Database Listener Security Recommendations"

- Appendix E, "Initialization Parameters"

A How to Stop Processes in an Existing Oracle Real Application Clusters Database

This appendix describes how to stop all processes in an Oracle Real Application Clusters (RAC) database, in preparation for installing Database Vault.

Note:
Before you make any changes to the Oracle software, Oracle recommends that you create a backup of the Oracle Database installation.

To stop all processes in an Oracle Real Application Clusters (RAC) database, use the following steps:

Note:
You must perform these steps in the order listed.

1. Establish the Oracle Database logical name as follows:

1. Login to OpenVMS using the Oracle 10.2 administrator's account.

2. Run ORAUSER for the installation you want to upgrade.
For example,

$ @DISK:[DIR]ORAUSER 'sid'

In this example, DISK:[DIR] is the location of the existing 10.2.0.4 installation.

2. Shut down any processes in the Oracle home on each node that can access a database.

3. Shut down all RAC instances on all nodes. To shut down all RAC instances for a database, enter the following command, where db_name is the name of the database:

$ SRVCTL STOP DATABASE "-d" db_name

4. Stop the database listener.

$ SRVCTL STOP LISTENER "-n" node_name

Here, node_name is the name of the database listener on the node where the command is run.

Note:
You must run the preceding command on all nodes. You can run the SRVCTL command from any node in the Oracle RAC cluster.

B Using Response Files

This appendix describes how to install Oracle Database Vault using a response file. It includes the following topics:

- How Response Files Work

- Installing Database Vault Using a Response File

- Troubleshooting Silent Mode Installation

B.1 How Response Files Work

You can automate the installation and configuration of Oracle software by specifying a response file when you start Oracle Universal Installer. Oracle Universal Installer uses the values contained in the response file to provide answers to some or all of Oracle Universal Installer prompts.

Typically, Oracle Universal Installer runs in interactive mode, which means that it prompts you to provide information in graphical user interface (GUI) screens. When you use response files to provide this information, you effectively eliminate some or all of the installer dialog screens. To completely suppress the graphical user interface session, add the -silent parameter to the runInstaller command.

During a silent mode installation, Oracle Universal Installer does not display any screens. Instead, it displays progress information in the terminal that you used to start it.

You define the settings for a silent mode installation by entering values for the variables listed in the response file. For instance, to specify the Oracle home, you would supply the appropriate value for the ORACLE_HOME variable, as in the following example:

ORACLE_HOME = "/disk$oracle10/home10204"

See Also:
Oracle Universal Installer and OPatch User's Guide for more information about response file formats

B.1.1 Creating the oraInst.loc File

If you plan to install Oracle products noninteractively, then you must manually create the oraInst.loc file, if it does not exist. This file specifies the location of the Oracle Inventory directory where Oracle Universal Installer creates the inventory of Oracle products that are installed on the system.

Note:
If Oracle software has been installed previously on the system, then the oraInst.loc file may exist. If the file does exist, then you do not need to create a new file.

To create the oraInst.loc file, follow these steps:

1. Go to the [.nodename] subdirectory under the SYS$LOGIN directory, which is where the oraInst.loc file must reside.

2. Set the default directory to the directory that will contain the oraInst.loc file:

$ SET DEFAULT logindisk:[logindir.nodename]

3. Use a text editor to create the oraInst.loc file, containing the following lines:

inventory_loc=oraInventory_location
inst_group=group_id

In this example, oraInventory_location is the location of the Oracle Inventory directory, which is on an ODS-5 volume and is specified in UNIX syntax, and group_id is the group ID of the Oracle Database account. Ensure that the oraInventory_location setting points to the existing inventory of your Oracle Database 10g release 2 (10.2.0.4) database installation.

4. Set the file protection on the oraInst.loc file as follows:

$ SET FILE/PROT=(S:RWED,O:RWED,G:RWE,W:RE) oraInst.loc

B.1.2 General Procedure for Using Response Files

The following are the general steps to install and configure Oracle products using Oracle Universal Installer in silent mode:

Note:
You must complete all required preinstallation tasks on a system before running Oracle Universal Installer in silent mode. See "Configure the Oracle User's Environment".

1. Verify that the oraInst.loc file is created and exists as described in "Creating the oraInst.loc File".

2. Prepare a response file.

3. Run Oracle Universal Installer in silent mode by executing runInstaller.com with the response file listed as a command argument.

B.2 Installing Database Vault Using a Response File

Use the following steps to install Database Vault using a response file:

Note:
By default, the oraInst.loc file should be present in the directory described in "Creating the oraInst.loc File". This is because Oracle Database Vault is installed into an existing Oracle Database installation.

- Step 1: Prepare the Response File

- Step 2: Run Oracle Universal Installer Using the Response File

B.2.1 Step 1: Prepare the Response File

Oracle Database Vault comes with a response file template (dv.rsp) that you can edit to customize your installation. You can use this response file for silent mode installations.

The dv.rsp file is located in the response directory on the installation media. Use the following steps to copy and modify the response file:

1. Copy the response file from the response directory to a directory on your system.

$ COPY kit_device:[Disk1.response]DV.RSP local_directory

In this example:

- kit_device is the disk containing your Oracle Database Vault installation kit.

- local_directory is the path to a directory on your disk.

2. Open the response file in a text editor:

$ EDIT [local_directory]dv.rsp

The response file contains variables that store information required by Oracle Universal Installer. You must set these variable values in the file. For example, you must specify values for the Oracle home location, Database Vault owner name, and other such information required by Oracle Universal Installer.

The response file contains two parts. You should edit the variables only in the first part. The second part of the file contains preset variables, which must not be edited. This instruction is also provided in the response file.

Some of the variables are mandatory while others are optional. The mandatory variables must be supplied for a successful installation. Each variable is explained within the response file. Examples are also provided within the response file.

The following excerpt from the response file shows instructions related to setting the Oracle home variable:

#-----------------------------------------------------------------------------
#Name       : ORACLE_HOME
#Datatype   : String
#Description: Complete path of the existing 10.2.0.4.0 database Oracle
#             Home into which Oracle Database Vault will be installed.
#
#Requirement: 1) Must have Oracle Database Enterprise Edition release
#                10.2.0.4.0 installed.
#             2) Cannot contain Oracle Database Vault.
#
#Example: ORACLE_HOME = "/dka100/oracle_db1"
#-----------------------------------------------------------------------------
ORACLE_HOME=<Value Required>

Lines starting with the # symbol are comment entries. If you want to omit an optional variable, you can comment it by adding the # symbol to the beginning of the line. You cannot comment lines containing mandatory variables, such as ORACLE_HOME.

See Also:
Oracle Universal Installer and OPatch User's Guide for detailed information on creating response files.

3. Follow the instructions in the file to edit it. Save and close the file.

Note:
Oracle Universal Installer fails if you do not correctly configure the response file. Refer to Troubleshooting Silent Mode Installation for more information about troubleshooting a failed silent mode installation.

4. Grant read, write, and execute permissions to the Oracle software owner, but not to any other users.

$ SET SECURITY/PROTECTION=(O:RWED,S,G,W) response_file.rsp

Caution:
A fully specified response file for an Oracle Database Vault installation contains the passwords for database administrative accounts. Ensure that only the Oracle software owner user can view or modify response files or consider deleting them after the installation succeeds.

B.2.2 Step 2: Run Oracle Universal Installer Using the Response File

Now, you are ready to run Oracle Universal Installer at the command line, specifying the response file you created, to perform the installation. The Oracle Universal Installer executable, runInstaller, provides several options.

To run Oracle Universal Installer using a response file:

1. Complete the preinstallation tasks listed in Chapter 2, "Installing Oracle Database Vault as an Option".

See Also:
Frequently Asked Questions in the Oracle Database Vault Release Notes for hp OpenVMS for a checklist of the preinstallation requirements

2. Log in as the Oracle software owner user (for example, ORACLE).

3. To start Oracle Universal Installer, enter a command similar to the following:

$ @kit_device:[Disk1]runInstaller [-silent] -responseFile response_filename

Note:
Do not specify a relative path to the response file. If you specify a relative path, Oracle Universal Installer fails.

In this example:

- kit_device is the disk containing your Oracle Database Vault installation kit.

- -silent indicates that you want to run Oracle Universal Installer in silent mode.

- responsefilename is the full path and file name of the installation response file that you configured. Provide this path using the OpenVMS syntax.

Note:
For more information about other options for the runInstaller command, enter the following command:

$ kit_device:[Disk1]runInstaller -help

B.3 Troubleshooting Silent Mode Installation

During a silent installation, Oracle Universal Installer records all the actions that it performs in a log file. If you encounter problems during the installation, review the log file for information about possible causes of the problem.

To view the log file:

1. Determine the location of the oraInventory directory. This can be found as the value of the inventory_loc parameter in the oraInst.loc file, which is located in the hostname subdirectory of SYS$LOGIN.

2. Set default to the directory determined in Step 1, and then to the LOGS subdirectory.

3. Obtain a directory listing to determine the file name of the log file. Installer log files have names similar to the following, where date_time indicates the date and time when your Oracle Database Vault installation started:

installationActionsdate_time.LOG

This command lists the files in the order of creation, with the most recent file shown last.

4. If an error displayed by Oracle Universal Installer or listed in the log file indicates a relinking problem, refer to the following file for more information:

ORA_ROOT:[INSTALL]MAKE.LOG

A silent installation fails in the following conditions:

- You do not specify a response file

- You specify an incorrect or incomplete response file

- Oracle Universal Installer encounters an error, such as insufficient disk space

- The Database Vault installation prerequisites have not been met

Oracle Universal Installer or configuration assistant validates the response file at run time. If the validation fails, the silent mode installation or configuration process ends. Oracle Universal Installer treats values for parameters that are of the wrong context, format, or type as if no value was specified in the file.

C Running DVCA After Installing the Database Vault Software

You should run Database Vault Configuration Assistant (DVCA) after you install the Database Vault software, if any of the following conditions is true:

- Database Vault is installed into an Oracle home that has more than one database. You must run DVCA on the other databases in the Oracle home. This enables Database Vault security for those databases. The databases should meet the prerequisites for installing Oracle Database Vault, as discussed in "Preinstallation and Installation Tasks".

- Database Configuration Assistant (DBCA) is used to create a new database in an Oracle home that has a Database Vault installed. DVCA loads the Database Vault schema objects into the new database, creates the DV_OWNER and optional DV_ACCTMGR accounts, and deploys the Database Vault Administrator application for the database.

To run the DVCA utility, you must place its arguments in a file named dvca.args, located in the ORACLE_HOME directory. If there is a dvca.args file there, rename it to a backup name (for example, dvca.args_OLD), and then re-create this file using the following arguments as needed for your purpose:

- -action: The action to perform. option creates the Database Vault schema objects, creates the DV_OWNER account and the optional DV_ACCTMGR account, and deploys the Database Vault Administrator application.

- -racnode: The host name of the Real Application Clusters (RAC) node on which the action is being performed. Do not include the domain name with the host name. Use this option if this is a RAC database.

- -oh: The Oracle home for the database.

- -jdbc_str: The JDBC connection string used to connect to the database. For example, jdbc:oracle:oci:@orcl1, where orcl1 is the net service name in the tnsnames.ora file (ORACLE_HOME/network/admin/tnsnames.ora).

- -sys_passwd: Password for user SYS. The command prompts for the password, if you do not enter it on the command line.

- -owner_account: Oracle Database Vault Owner account name

- -owner_passwd: Oracle Database Vault owner account password. The command prompts for the password, if you do not enter it on the command line.

- -acctmgr_account: (Optional) Oracle Database Vault Account Manager user

- -acctmgr_passwd: Oracle Database Vault Account Manager password (if a user name has been specified). The command prompts for the password, if you do not enter it on the command line.

- -logfile: Optionally, specify a log file name and location. You can enter an absolute path or a path that is relative to the location of the ORACLE_HOME/bin directory

- -silent: Required if you are not running DVCA in an xterm window

- -nodecrypt: Reads plaintext passwords as passed on the command line. You must use this option if you are passing plaintext passwords to the command.

- -lockout: Disables SYSDBA operating system authentication

- -languages: Declares the language content to load, defaults to "en" (English). You can specify multiple languages. Include each language in quotation marks with commas separating different languages. Enclose the list of languages in braces. For example, -languages {"en","fr","ja"}.
The following lists the language key:

- de: German

- en: English

- es: Spanish

- fr: French

- it: Italian

- ja: Japanese

- ko: Korean

- pt_BR: Brazilian Portuguese

- zh_CN: Simplified Chinese

- zh_TW: Traditional Chinese

For example, you could create the following dvca.args file if you wanted to add English and French:

-action addlanguages
-oh /INST03/10204TESTING/EFRIEDMA/10204_IA2
-instance myinstance -dbname mydbname
-jdbc_str jdbc:oracle:oci:@orcl1
-languages {"es","fr"}
-owner_account dvowner
-owner_passwd password
-jdbc_str jdbc:oracle:oci:@eia1
-sys_passwd admin
-nodecrypt

Then, from the Oracle home directory, run DVCA as follows:

$ dvca

To view the DVCA parameters, run this command:

$ dvca -help

The DVCA session generates a file called dvca.jinput that contains all DVCA command arguments, including the contents of the dvca.args file. This dvca.jinput along with the dvca.args file renamed to dvca.args_OLD remain in your ORACLE_HOME directory after the Database Vault Configuration tool exits. These files may contain sensitive database access information; therefore you should delete or secure them.

Note:

- You should also run DVCA before and after installing database options such as Spatial, Java, and Intermedia. See Oracle Database Vault Administrator's Guide for more details.

- Before you run this command, make sure that the database and listener are running.

- After you install Database Vault for a Real Application Clusters (RAC) instance, you no not need to run DVCA on the other RAC nodes.

D Database Listener Security Recommendations

This appendix lists the security recommendations for protecting the database listener.

D.1 Security Checklist for the Database Listener

The following configuration guidelines help enhance the security for your database listener:

- The database listener configuration file, listener.ora, and the supporting OracleNet configuration file, tnsnames.ora, should have the ADMIN_RESTRICTIONS_LISTENER_SID=ON protection enabled.

- The database listener configuration file, listener.ora, and the supporting OracleNet configuration file, tnsnames.ora, should have the PLSExtProc service disabled.

- The listener should be configured to listen on a nonstandard port. This means that the default port (1521) should be changed.

- The listener should be password protected or leverage operating system (OS) authentication based on the organizational security policy.

- The listener should use a unique name, which should be different from the default name.

- The listener.ora file should have the following parameter set:

INBOUND_CONNECT_TIMEOUT_ListenerName = 10

- The sqlnet.ora file should have the following parameters set:

SQLNET.INBOUND_CONNECT_TIMEOUT  = 12
SQLNET.EXPIRE_TIME = 10

- The listener should have logging enabled as follows:

LOGGING_LISTENER = ON
LOG_STATUS = ON
LOG_DIRECTORY_ListenerName = Directory_owned_by_Oracle_account
LOG_FILE_ListenerName = File_owned_by_Oracle_account

- The listener should have tracing enabled as follows:

TRACE_DIRECTORY_ListenerName = Directory_owned_by_Oracle_account
TRACE_FILE_ListenerName = File_owned_by_Oracle_account
TRACE_LEVEL = user
TRACE_FILELEN_ListenerName = 512
TRACE_FILENO_ListenerName = 1000
TRACE_TIMESTAMP_ListenerName = dd-mon-yyyy hh:mi:ss:mil

E Initialization Parameters

When you install Oracle Database Vault, the security specific database initialization parameters are initialized with default values. The following list shows the default values for these security specific initialization parameters:

REMOTE_LOGIN_PASSWORDFILE = default, EXCLUSIVE
AUDIT_SYS_OPERATIONS = TRUE
REMOTE_OS_AUTHENT = FALSE
REMOTE_OS_ROLES = FALSE
OS_ROLES = FALSE
OS_AUTHENT_PREFIX = ''
SQL92_SECURITY = TRUE
O7_DICTIONARY_ACCESSIBILITY = FALSE

Index
A  B  C  D  E  F  H  I  J  L  M  N  O  P  R  S  T  U  X

Numerics

10.2.0.4 patch set, 2.1.6.1

A

accounts

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

unauthenticated access to, 2.2.3

ANONYMOUS user

unauthenticated account access with, 2.2.3

applying 10.2.0.4 patch set, 2.1.6.1 audit policy, 1.3

B

backups

after upgrading, 2.2.2

importance, 2.1.7

preparing a strategy, 2.1.7

C

caution

if installing additional Oracle Database 10g products in an existing Oracle home, stop all processes running in the Oracle home, 2.1.10

TCP/IP protocol stacks from other vendors may work with Oracle, but customers use these products at their own risk, 2.1.3

certification, hardware and software, 1.4.1 change passwords

for oracle-supplied accounts, 2.2.3

checking

database requirements, 2.1.6

hardware requirements, 2.1.2

software requirements,operating system requirements, 2.1.3

code example

command to determine version of OpenVMS, 2.1.3

creating the oraInst.loc file for noninteractive installation, B.1.1

commands

SHOW SYSTEM

operating system information, 2.1.3

configuring

oracle user environment, 2.1.11

custom profiles, disable, 2.1.8

D

database (RAC)

starting, 2.2.5

database requirements, 2.1.6 Database Vault

accounts, 1.2

audit policy, 1.3

initialization parameters, 1.3

Database Vault Account Manager account, 1.2.2

password, 1.2.2

user name, 1.2.2

Database Vault Configuration Assistant, 2.2.6 Database Vault Owner account, 1.2.1

password, 1.2.1

user name, 1.2.1

disabling, Oracle Database Vault, 2.3 disk space

requirements, 2.1.2.2

DV_ACCTMGR role, 1.2.2 DV_OWNER role, 1.2.1 DVCA

See Database Vault Configuration Assistant

dvca command, 2.2.6, C

E

environment

configuring for oracle user, 2.1.11

errors

silent mode, B.3

EV56, minimum hp OpenVMS ALphaServer chip set required for Oracle Database 10g, 2.1.2.1

F

files

oraInst.loc, B.1.1

response files, B.2.1

H

hardware and software certifications, 1.4.1

hardware certification, 1.4.1

hardware requirements, 2.1.2

I

initialization parameters, 1.3, E

installation, 2.1

considerations, 1.4

errors

silent mode, B.3

noninteractive

oraInst.loc file, B.1.1

response files, B, B.2.1

preparing, B.2.1

silent mode, B.3

templates, B.2.1

silent mode, B.2.2

error handling, B.3

tasks, 2.1 installing

Oracle Universal Installer, using, 2.1.12

issues and restrictions, port-specific, 2.1.4

J

JDK

installation issues, 2.1.4.2

L

listener, 2.1.6

security checklist, D.1

stopping existing listener process before new db installation, 2.1.10

listener (RAC)

starting, 2.2.5

logging on

SYSDBA privilege connections, disabling, 2.2.4

M

Mailbox driver, OpenVMS

preinstallation, 2.1.3

memory requirements, 2.1.2 multiple Oracle homes, supported by Oracle Database 10g, 1.4.2

N

noninteractive installation

oraInst.loc file, B.1.1

O

OpenVMS Mailbox driver

preinstallation, 2.1.3

operating system requirements, 2.1.3 Oracle

Oracle Spatial

Motif requirement, 2.1.3

requirement for example programs, 2.1.3

Oracle Clusterware

starting, 2.1.9

Oracle Database

Client

chip set requirements, 2.1.2.1

Oracle Database Vault

audit policy, 1.3

initialization parameters, 1.3, E

Oracle Database Vault Administrator (DVA), 2.1.5 Oracle Network Manager

stopping existing listener, 2.1.10

Oracle software owner user

configuring environment for, 2.1.11

Oracle Universal Installer, 2.1.6.1, 2.1.12

response files, B

oracle user

configuring environment for, 2.1.11

ORACLE_HOME logical

requirements, 2.1.4.1

oracle-supplied accounts

change passwords, 2.2.3

oraInst.loc file, B.1.2 orapwd utility, 2.2.4 OUI, 2.1.6.1

P

paging

determine amount of paging configured on the system, 2.1.2.1

password file, 2.1.6 passwords

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

password files, 2.2.4

resetting

with SQL*Plus, 2.2.3

unlocking

with SQL*Plus, 2.2.3

patch set

applying, 2.1.6.1

documentation, 2.1.6.1

preinstallation, 2.1

tasks, 2.1

process

stopping existing, 2.1.10

stopping existing listener process, 2.1.10

R

RAM

determining amount of RAM installed on the system, 2.1.2.1

RAM requirements, 2.1.2 Real Application Clusters

Instance Parameters, setting, 2.2.6

SYSDBA sessions, locking, 2.2.6

remote SYSDBA connections

disabling, 2.2.4

REMOTE_LOGIN_PASSWORDFILE parameter, 2.1.6 requirements

database, 2.1.6

disk space, 2.1.2.2

hardware, 2.1.2

JDK

used by Oracle Java applications, 2.1.4.2

listener, 2.1.6 Oracle Database 10.2.0.4 patch set, 2.1.6.1 ORACLE_HOME, 2.1.4.1 password file, 2.1.6 software, operating system, 2.1.3 response files

about, B.1

general procedure, B.1.2

passing values at command line, B.1

specifying with Oracle Universal Installer, B.2.2

See also silent mode, B.1

response files installation

about, B

roles

DV_ACCTMGR, 1.2.2

DV_OWNER, 1.2.1

S

security checklist

database listener, D.1

SHOW SYSTEM command

operating system information, 2.1.3

silent mode installation, B.2.2 sizer command, 2.1.3 software and hardware certifications, 1.4.1 software certification, 1.4.1 software requirements, operating system requirements, 2.1.3 srvctl command, 2.2.5 stopping

Oracle processes, 2.1.10

swap space

requirements, 2.1.2

SYSDBA remote connections

disabling, 2.2.4

T

tasks

installation, 2.1

preinstallation, 2.1

temporary disk space

requirements, 2.1.2

U

upgrading

after upgrading, 2.2

backup strategy, 2.1.7

post upgrade actions, 2.2

user names

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

users

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

X

X Window

and X/Motif Software development, Motif requirement, 2.1.3

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2016, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Alpha and Beta Draft Documentation Notice

If this document is in private preproduction status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your beta trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.