This chapter includes an overview of the major steps required to install Oracle Database Vault into an existing Oracle Database 10g Release 2 (10.2.0.5) database. These procedures transform an existing Oracle Database system (including associated applications) into an Oracle Database Vault system. Databases upgraded using the procedures described in this chapter can work almost in the same manner as in earlier releases and, optionally, can leverage new Oracle Database Vault functionality. For a list of changes that Database Vault makes, refer to Appendix F, "Initialization Parameters" and Oracle Database Vault Administrator's Guide.
Note:
In order to upgrade a pre-10g Release 2 Oracle Database to Oracle Database Vault, first upgrade the database to a 10g Release 2 (10.2.0.5) database.See Also:
Oracle Database Upgrade Guide for information about upgrading your Oracle Database to Oracle Database 10g Release 2This chapter covers the following topics:
This section covers the following topics:
Before you plan the upgrade process, become familiar with the features of Oracle Database Vault. Oracle Database Vault Administrator's Guide discusses the basic features of Oracle Database Vault.
The system must meet the following minimum hardware requirements:
At least 1024 MB of physical RAM
The following table describes the relationship between installed RAM and the configured swap space requirement.
RAM | Swap Space |
---|---|
Between 1024 MB and 2048 MB | 1.5 times the size of RAM |
Between 2049 MB and 8192 MB | Equal to the size of RAM |
More than 8192 MB | 0.75 times the size of RAM |
400 MB of disk space in the /tmp
directory
Between 1.5 GB and 3.5 GB of disk space for the Oracle software, depending on the installation type
1.2 GB of disk space for a preconfigured database that uses file system storage (optional)
Note:
The disk space requirement for databases that use Automatic Storage Management or raw device storage is described later in this chapter.Additional disk space, either on a file system or in an Automatic Storage Management disk group, is required for the flash recovery area if you choose to configure automated backups.
To ensure that the system meets these requirements:
To determine the physical RAM size, enter the following command:
# grep MemTotal /proc/meminfo
If the size of the physical RAM is less than the required size, then you must install more memory before continuing.
To determine the size of the configured swap space, enter the following command:
# grep SwapTotal /proc/meminfo
If necessary, refer to the operating system documentation for information about how to configure additional swap space.
To determine the available RAM and swap space, enter the following command:
# free
Note:
Oracle recommends that you take multiple values for the available RAM and swap space before freezing on a value. This is because the available RAM and swap space keep changing depending on the user interactions with the computer.To determine the amount of disk space available in the /tmp
directory, enter the following command:
# df -h /tmp
If there is less than 400 MB of free disk space available in the /tmp
directory, then complete one of the following steps:
Delete unnecessary files from the /tmp
directory to meet the disk space requirement.
Set the TEMP
and TMPDIR
environment variables when setting the oracle
user's environment.
Extend the file system that contains the /tmp
directory. If necessary, contact your system administrator for information about extending file systems.
To determine the amount of free disk space on the system, enter the following command:
# df -h
To determine whether the system architecture can run the software, enter the following command:
# grep "model name" /proc/cpuinfo
Note:
This command displays the processor type. Verify that the processor architecture matches the Oracle software release to install. If you do not see the expected output, then you cannot install the software on this system.Depending on the products that you intend to install, verify that the following software is installed on the system. The procedure following the table describes how to verify whether these requirements are addressed.
Note:
Oracle Universal Installer performs checks on your system to verify that it meets the listed requirements. To ensure that these checks pass, verify the requirements before you start Oracle Universal Installer.To ensure that the system meets these requirements:
To determine which distribution and version of Linux is installed, enter the following command:
# cat /proc/version
Note:
Only the distributions and versions listed in the previous table are supported. Do not install the software on other versions of Linux.To determine whether the required kernel is installed, enter the following command:
# uname -r
The following is sample output obtained by running this command on a Red Hat Enterprise Linux 3.0 system:
2.4.21-15.EL
In this example, the output shows the kernel version (2.4.27
) and errata level (27.EL
) on the system.
If the kernel version does not meet the requirement specified earlier in this section, then contact your operating system vendor for information about obtaining and installing kernel updates.
To determine whether the required packages are installed, enter commands similar to the following:
# rpm -q package_name
If a package is not installed, then install it from your Linux distribution media or download the required package version from your Linux vendor's Web site.
If you require a CSD for WebSphere MQ, then refer to the following Web site for download and installation information:
http://www-947.ibm.com/support/entry/portal/overview//software/websphere/websphere_mq
Note:
The kernel parameter and shell limit values shown in the following section are recommended values only. For production database systems, Oracle recommends that you tune these values to optimize the performance of the system. Refer to your operating system documentation for more information about tuning kernel parameters.Verify that the kernel parameters shown in the following table are set to values greater than or equal to the recommended value shown. The procedure following the table describes how to verify and set the values.
Note:
If the current value for any parameter is higher than the value listed in this table, then do not change the value of that parameter.To view the current value specified for these kernel parameters, and to change them if necessary:
Enter the commands shown in the following table to view the current values of the kernel parameters:
Note:
Make a note of the current values and identify any values that you must change.Parameter | Command |
---|---|
semmsl, semmns, semopm, and semmni | # /sbin/sysctl -a | grep sem
This command displays the value of the semaphore parameters in the order listed. |
shmall, shmmax, and shmmni | # /sbin/sysctl -a | grep shm
This command displays the details of the shared memory segment sizes. |
file-max | # /sbin/sysctl -a | grep file-max
This command displays the maximum number of file handles. |
ip_local_port_range | # /sbin/sysctl -a | grep ip_local_port_range
This command displays a range of port numbers. |
rmem_default | # /sbin/sysctl -a | grep rmem_default |
rmem_max | # /sbin/sysctl -a | grep rmem_max |
wmem_default | # /sbin/sysctl -a | grep wmem_default |
wmem_max | # /sbin/sysctl -a | grep wmem_max |
If the value of any kernel parameter is different from the recommended value, then complete the following procedure:
Using any text editor, create or edit the /etc/sysctl.conf
file, and add or edit lines similar to the following:
Note:
Include lines only for the kernel parameter values you must change. For the semaphore parameters (kernel.sem
), you must specify all four values. However, if any of the current values are larger than the recommended value, then specify the larger value.kernel.shmall = 2097152 kernel.shmmax = 2147483648 kernel.shmmni = 4096 kernel.sem = 250 32000 100 128 fs.file-max = 327679 net.ipv4.ip_local_port_range = 9000 65000 net.core.rmem_default = 262144 net.core.rmem_max = 2097152 net.core.wmem_default = 262144 net.core.wmem_max = 1048576
By specifying the values in the /etc/sysctl.conf
file, they persist when you restart the system.
On SUSE systems only, enter the following command to ensure that the system reads the /etc/sysctl.conf
file when it restarts:
# /sbin/chkconfig boot.sysctl on
Setting Shell Limits for the oracle User
To improve the performance of the software on Linux systems, you must increase the following shell limits for the oracle
user:
Shell Limit | Item in limits.conf | Hard Limit |
---|---|---|
Maximum number of open file descriptors | nofile |
65536 |
Maximum number of processes available to a single user | nproc |
16384 |
Add the following lines to the /etc/security/limits.conf
file:
oracle soft nproc 2047 oracle hard nproc 16384 oracle soft nofile 1024 oracle hard nofile 65536
Add or edit the following line in the /etc/pam.d/login
file, if it does not exist:
session required pam_limits.so
Depending on the oracle
user's default shell, make the following changes to the default shell startup file:
For the Bourne, Bash, or Korn shell, add the following lines to the /etc/profile
file (or the /etc/profile.local
file on SUSE systems):
if [ $USER = "oracle" ]; then if [ $SHELL = "/bin/ksh" ]; then ulimit -p 16384 ulimit -n 65536 else ulimit -u 16384 -n 65536 fi fi
For the C shell (csh
or tcsh
), add the following lines to the /etc/csh.login
file (or the file on SUSE systems)/etc/csh.login.local
:
if ( $USER == "oracle" ) then limit maxproc 16384 limit descriptors 65536 endif
In order to install Oracle Database Vault, you must be running the Enterprise Edition of Oracle Database 10g Release 2 (10.2.0.5). The database should also have Oracle Enterprise Manager Console DB 10.2.0.5.0 installed. In addition, the Database Vault installer requires write access to the files, oratab
and oraInst.loc
.
A listener must have been configured for the existing database. Oracle Net Configuration Assistant configures the listener when you first install the database. You can also use Oracle Enterprise Manager to administer listeners.
You must have an existing password file for the database. The password file authentication parameter, REMOTE_LOGIN_PASSWORDFILE
must have been set to EXCLUSIVE
or SHARED
.
You can set the REMOTE_LOGIN_PASSWORDFILE
parameter in the init.ora
file. Use the orapwd
utility to create and manage password files.
See Also:
Oracle Database Administrator's Guide for more information about creating and maintaining a password fileThe following topics discuss applying the 10.2.0.5 patch set and installing the required components:
Before installing Oracle Database Vault, you should ensure that Oracle Enterprise Manager Console DB 10.2.0.5.0 is installed. Oracle Enterprise Manager Console DB is installed using the Oracle Universal Installer (OUI). The following steps summarize installing Oracle Enterprise Manager Console DB:
Run Oracle Universal Installer (OUI) and perform a custom installation to install Oracle Enterprise Manager Console DB 10.2.0.1.0. Add Oracle Enterprise Manager Console DB from the list of available product components.
Apply the Oracle Database release 10.2.0.5 patch set.
Note:
You can configure the database to use Enterprise Manager Database Control by using Database Configuration Assistant (DBCA). However, configuring Enterprise Manager Database Control is not a prerequisite for installing Oracle Database Vault.To install Oracle Database Vault, you must upgrade the database to Oracle Database release 10.2.0.5. Oracle strongly recommends that you back up your database before performing any upgrade or installation.
See Also:
Oracle Database Backup and Recovery Advanced User's Guide for information about database backupsThis section covers the following topics:
You can apply the Oracle Database release 10.2.0.5 patch set to the following Oracle Database 10g Release 2 installations:
Oracle Database
Oracle Real Application Clusters
Oracle Database Client
Oracle Database Companion CD
Oracle Clusterware
Oracle Database Vault
Oracle Universal Installer Version Requirements
This patch set includes Oracle Universal Installer release 10.2.0.5, which is also installed when you install this patch set. This is to ensure that your Oracle home can be patched in the future. You should not use the Installer from the earlier maintenance release media or Oracle home.
This is not a complete software distribution. You must install it in an existing Oracle Database 10g Release 2 installation.
There are two documents related to this release of the Oracle Database patch set:
Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.5) Patch Set 3 for Linux Itanium
Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.5) Patch Set 3
Both of these documents are included with the patch set. In addition, they are available on the My Oracle Support (formerly OracleMetalink) Web site:
https://support.oracle.com
The following sections describe the contents of the Oracle Database Patch Set Notes and the Oracle Database List of Bugs Fixed documents.
Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.5) Patch Set 3 for Linux Itanium
This document provides:
System requirements and information about how to install, reinstall or remove the patch set
A list of all bugs fixed to date that are specific to Oracle Database for Linux Itanium
A list of known issues relating to Oracle Database on Linux Itanium
Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.5) Patch Set 3
The List of Bugs Fixed is a list of all generic bugs related to Oracle Database that have been fixed to date.
Oracle strongly recommends that you back up your database before performing any upgrade or installation. The ultimate success of your upgrade depends heavily on the design and execution of an appropriate backup strategy. To develop a backup strategy, consider the following questions:
How long can the production database remain inoperable before business consequences become intolerable?
What backup strategy is necessary to meet your availability requirements?
Are backups archived in a safe, offsite location?
How quickly can backups be restored (including backups in offsite storage)?
Have recovery procedures been tested successfully?
Your backup strategy should answer all of these questions and include procedures for successfully backing up and recovering your database.
See Also:
Oracle Database Backup and Recovery Advanced User's Guide for information about database backupsIf you have created custom profiles and password complexity checks in your existing database, then you must disable these before performing the installation. You can reenable these after the installation is complete. Use the following steps to achieve this:
Extract the profile names and associated settings for each profile that is being used. You can use a script to accomplish this.
Example 2-1 shows a sample script that extracts the profile names and settings to create an output script called, myprofiles.sql
. After the installation is complete, you can run myprofiles.sql
to restore the profile settings.
Example 2-1 Extracting Profiles
set serverout on size 100000 spool myprofiles.sql . declare l_last varchar2(30) := 'X'; l_count number := 0; begin for c in ( select profile, resource_name , limit from dba_profiles order by profile, resource_name ) loop if l_last <> c.profile then l_last := c.profile; if l_count > 0 then dbms_output.put_line(';'); end if; l_count := l_count + 1; dbms_output.put_line('create profile ' || c.profile || ' limit '); else dbms_output.put_line(' ' || c.resource_name || ' ' || c.limit); end if; end loop; dbms_output.put_line(';'); end; / . spool off
Disable the custom profiles and password complexity settings. For example:
SQL> ALTER PROFILE SomeCustomProfile LIMIT PASSWORD_REUSE_MAX UNLIMITED -- The number of times a password can be reused PASSWORD_REUSE_TIME UNLIMITED -- The number of days between reuses of a password PASSWORD_VERIFY_FUNCTION NULL /
After the Oracle Database Vault installation is complete, reenable the profiles by running the script created in Step 1.
SQL>@myprofiles.sql
Oracle Clusterware should be running for the Database Vault installer to find the existing Oracle Real Application Clusters (Oracle RAC) instances. If you have stopped Oracle Clusterware, then you should restart it before running Oracle Universal Installer. Use the following command to start Oracle Clusterware:
$CRS_HOME/bin/crsctl start crs
Note:
You must run the crsctl
command as the root
user. You must run this command on all cluster nodes.
The crsctl start crs
command also starts the database. You must shut down the database before running Oracle Universal Installer.
Stop all processes running in the Oracle home, except the database listener. You must complete this task to enable Oracle Universal Installer to relink certain executables and libraries. For Oracle RAC databases, you must stop the processes on all nodes.
Stop the processes in the following order:
Stop the Enterprise Manager Database Control process, if it is running. Use the following command:
$ORACLE_HOME/bin/emctl stop dbconsole
Note:
If you are installing Database Vault for Oracle Real Application Clusters (Oracle RAC), then you must shut down all Oracle processes on all cluster nodes. See Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database" for more details.Stop the iSQL*Plus process, using the following command:
$ORACLE_HOME/bin/isqlplusctl stop
Shut down all database instances running from the Oracle home directory into which Oracle Database Vault is to be installed.
sqlplus SYS "AS SYSDBA" Enter password: SQL> shutdown immediate
Note:
Do not use SQL*Plus to start and stop Oracle RAC instances. See Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database" for more details.Run Oracle Universal Installer (OUI) using the account that owns the Oracle software. This is usually the oracle
account.
However, before you start Oracle Universal Installer you must configure the environment of the oracle
user. To configure the environment, you must:
Note:
Ensure that thePATH
variable contains $ORACLE_HOME/bin
before /usr/X11R6/bin
.To set the oracle
user's environment:
Start a new terminal session, for example, an X terminal (xterm
).
Enter the following command to ensure that X Window applications can display on this system:
$ xhost fully_qualified_remote_host_name
For example:
$ xhost somehost.us.acme.com
If you are not logged in to the system where you want to install the software, then log in to that system as the oracle
user.
If you are not logged in as the oracle
user, then switch user to oracle
:
$ su - oracle
To determine the default shell for the oracle
user, enter the following command:
$ echo $SHELL
Open the oracle
user's shell startup file in any text editor:
Note:
On Red Hat Linux,.bash_profile
is the user startup file for the Bash shell.Bourne shell (sh
), Bash shell (bash
), or Korn shell (ksh
):
$ vi .bash_profile
C shell (csh
or tcsh
):
% vi .login
Enter or edit the following line, specifying a value of 022 for the default file mode creation mask:
umask 022
If the ORACLE_SID
, ORACLE_HOME
, or ORACLE_BASE
environment variable is set in the file, then remove the corresponding lines from the file.
Save the file, and exit from the editor.
To run the shell startup script, enter one of the following commands:
Bash shell on Red Hat Enterprise Linux:
$ . ./.bash_profile
Bourne, Bash, or Korn shell:
$ . ./.profile
C shell:
% source ./.login
If you are not installing the software on the local system, then enter a command similar to the following to direct X applications to display on the local system:
Bourne, Bash, or Korn shell:
$ DISPLAY=local_host:0.0 ; export DISPLAY
C shell:
% setenv DISPLAY local_host:0.0
In this example, local_host
is the host name or IP address of the system to display Oracle Universal Installer (your workstation or PC).
If you determined that the /tmp
directory has less than 400 MB of free disk space, then identify a file system with at least 400 MB of free space and set the TEMP
and TMPDIR
environment variables to specify a temporary directory on this file system:
Use the df -k
command to identify a suitable file system with sufficient free space.
If necessary, enter commands similar to the following to create a temporary directory on the file system that you identified, and set the appropriate permissions on the directory:
$ su - root # mkdir /mount_point/tmp # chmod a+wr /mount_point/tmp # exit
Enter commands similar to the following to set the TEMP
and TMPDIR
environment variables:
Bourne, Bash, or Korn shell:
$ TEMP=/mount_point/tmp $ TMPDIR=/mount_point/tmp $ export TEMP TMPDIR
C shell:
% setenv TEMP /mount_point/tmp % setenv TMPDIR /mount_point/tmp
Enter commands similar to the following to set the ORACLE_BASE
and ORACLE_SID environment variables:
Bourne, Bash, or Korn shell:
$ ORACLE_BASE=/u01/app/oracle $ ORACLE_SID=sales $ export ORACLE_BASE ORACLE_SID
C shell:
% setenv ORACLE_BASE /u01/app/oracle % setenv ORACLE_SID sales
In these examples, /u01/app/oracle
is the Oracle base directory that you created or identified earlier and sales
is the name to call the database (typically not more than five characters).
Enter the following commands to ensure that the ORACLE_HOME
and TNS_ADMIN
environment variables are not set:
Bourne, Bash, or Korn shell:
$ unset ORACLE_HOME $ unset TNS_ADMIN
C shell:
% unsetenv ORACLE_HOME % unsetenv TNS_ADMIN
To verify that the environment has been set correctly, enter the following commands:
$ umask $ env | more
Verify that the umask
command displays a value of 22
, 022
, or 0022
and the environment variables that you set in this section have the correct values.
This section contains:
You can download the Oracle Database Vault software from the following web site:
http://www.oracle.com/technetwork/database/options/database-vault/index-090593.html
After you download and extract the Oracle Database Vault software, you can use Oracle Universal Installer (OUI), which is provided in the download, to install Oracle Database Vault into an existing Oracle Database 10g Release 2 (10.2.0.5) database.
To install Oracle Database Vault:
Log on as a member of the Administrators group.
If you are installing on a Primary Domain Controller (PDC) or a Backup Domain Controller (BDC), log on as a member of the Domain Administrators group.
Insert Oracle Database Vault installation media and navigate to the database directory. Alternatively, navigate to the directory where you downloaded or copied the installation files.
Use the same installation media to install Oracle Database Vault on all supported Windows platforms.
In the Specify Installation Details screen, you need to specify the path to the Oracle home that contains the existing Oracle Database. The Destination Path box lists the Oracle home paths of all Oracle Database 10g Release 2 (10.2.0.5) Enterprise Edition databases registered with the system.
Select the Oracle home corresponding to the database into which you want to install Oracle Database Vault.
Note:
If an Oracle home does not have an Enterprise Edition of Oracle Database 10g Release 2 (10.2.0.5) installed, then it is not displayed. You must ensure that the Oracle home has an Enterprise Edition of Oracle Database 10g Release 2 (10.2.0.5) installed.
If an Oracle home does not have Oracle Enterprise Manager Console DB 10.2.0.5.0 installed, then it is not displayed. You must ensure that the Oracle home has Oracle Enterprise Manager Console DB 10.2.0.5.0 installed.
If an Oracle home contains an Automatic Storage Management (ASM) instance, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home that also contains an ASM instance.
If an Oracle home already contains Oracle Database Vault, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home more than once.
Oracle Clusterware should be running for the Database Vault installer to find the existing Oracle Real Application Clusters (Oracle RAC) databases. Ensure that Oracle Clusterware is running before installing Oracle Database Vault. You can use the crsctl
command to start Oracle Clusterware.
Enter a user name for the Database Vault Owner account in the Database Vault Owner field. The user name can be a minimum of 2 and maximum of 30 characters long.
Enter a password for the Database Vault Owner account in the Database Vault Owner Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.
Reenter the password in the Confirm Password field.
Select Create a Separate Account Manager if you want to create a separate Account Manager to manage Oracle Database Vault accounts.
In the Database Vault Account Manager field, enter a user name for the Database Vault Account Manager if you have chosen to select the Create a Separate Account Manager check box. The user name can be a minimum of 2 and a maximum of 30 characters.
Enter a password for the Database Vault Account Manager account in the Account Manager Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.
Reenter the password in the Confirm Password field. Click Next.
The Select Existing Database screen is displayed. A list of all databases running from the selected Oracle home is displayed. Select the database into which you wish to install Oracle Database Vault.
Note:
Oracle recommends that you install Oracle Database Vault into an Oracle home containing only a single database.
If there are multiple databases in an Oracle home, you must enable Database Vault for all the databases. You cannot have Database Vault enabled databases coexist with non-Database Vault enabled databases in the same Oracle home. In order to enable Database Vault for addtional databases in the same Oracle home, refer to Appendix C, "Running DVCA After Creating a Database Vault Database"
If a database is not listed, then check to make sure that you have followed the instructions under "Check the Database Requirements".
Enter the existing SYS
user password for the selected database in the Existing Database SYS Password field.
Reenter the SYS password in the Confirm Password field. Click Next.
Note:
At this point, the database requirements are validated.You are prompted to shut down all Oracle processes running from the Oracle home before proceeding. Shut down the Oracle processes, if you have not already done so.
See Also:
"Stop Existing Oracle Processes" for more information on stopping existing Oracle processesProduct-specific prerequisite checks are performed. Confirm that all tests have passed. Click Next to continue.
The Summary screen is displayed with the installation details. Verify the details and click Install.
The Installation screen is displayed. After the installation completes, the Database Vault Configuration Assistant (DVCA) is run automatically. DVCA helps configure the Database Vault installation.
This section lists the tasks to perform after you have completed an upgrade of your database. The following topics are discussed:
Update Environment Variables After the Upgrade (UNIX Systems Only)
Configure Oracle Database Vault on Oracle RAC Nodes (Oracle RAC Only)
Manually Deploy Oracle Database Vault Administrator (Special Cases)
Make sure you perform a full backup of the production database. See Oracle Database Backup and Recovery Advanced User's Guide for details about backing up a database.
Ensure that the following environment variables point to the correct Oracle Database Vault directories:
ORACLE_HOME
PATH
ORA_NLS10
Note:
TheORA_NLS10
environment variable replaces the ORA_NLS33
environment variable, so you may unset ORA_NLS33
and set ORA_NLS10
.LD_LIBRARY_PATH
Oracle strongly recommends that you change the password for each account after installation, to effectively implement the strong security provided by Oracle Database Vault.
Note:
If you are creating a database using Database Configuration Assistant, you can unlock accounts after the database is created by clicking Password Management before you exit from Database Configuration Assistant.To unlock and reset user account passwords using SQL*Plus:
Start SQL*Plus and log in using the Database Vault Account Manager account. If you did not create the Database Vault Account Manager account during installation, then you must log in using the Database Vault Owner account.
Enter a command similar to the following, where account
is the user account to unlock and password
is the new password:
SQL> ALTER USER account [ IDENTIFIED BY password ] ACCOUNT UNLOCK;
In this example:
The ACCOUNT UNLOCK
clause unlocks the account.
The IDENTIFED BY
password
clause resets the password.
Note:
If you unlock an account but do not reset the password, then the password remains expired. The first time someone connects as that user, they must change the user's password.To permit unauthenticated access to your data through HTTP, unlock the ANONYMOUS
user account.
See Also:
Oracle Database Administrator's Guide for more information about:Unlocking and changing passwords after installation
Oracle security procedures
Best security practices
Oracle Database Vault enables you to disable remote logins with SYSDBA
privileges, for enhanced security for your database.
To disable remote SYSDBA
connections, re-create the password file with the nosysdba
flag set to y
(Yes). A user can still log in AS
SYSDBA
locally using Operating System (OS) authentication. However, remote connections AS SYSDBA
fails.
Use the following syntax to re-create the password file:
orapwd file=filename password=password [entries=users] force=y nosysdba=y
Where:
file
: Name of password file (mandatory)
password
: Password for SYS
(mandatory). Enter at least six alphanumeric characters.
entries
: Maximum number of distinct DBA users
force
: Whether to overwrite the existing file
nosysdba
: Whether to enable or disable the SYS
logon
The default is no, so if you omit this flag, the password file is created enabling SYSDBA
access for Oracle Database Vault instances.
For example:
orapwd file=$ORACLE_HOME/dbs/orapworcl password=5hjk99 force=y nosysdba=y
Note:
Do not insert spaces around the equal (=) character.When you re-create the password file, any accounts other than SYS
that were granted the SYSDBA
or SYSOPER
privileges have those privileges removed. You must regrant the privileges for these accounts after you have re-created the password file.
You can reenable the ability to connect with the SYSDBA
privilege by re-creating the password file with the nosysdba
flag set to n
(No). You might reenable the ability to connect with SYSDBA
privileges, if certain products or utilities require it's use.
Enabling or Disabling Connecting with SYSDBA on Oracle Real Application Clusters Systems
Under a cluster file system and raw devices, the password file under $ORACLE_HOME
is in a symbolic link that points to the shared storage location in the default configuration. In this case, the orapwd
command you issue affects all nodes.
Enabling or Disabling Connecting with SYSDBA on Automatic Storage Management Systems
For Automatic Storage Management systems, you must update each node to enable or disable the SYSDBA
connection privilege by using the orapwd
utility.
You must start the database on all Oracle RAC nodes other than the one on which the installation is performed. Use the following command to start the database:
Note:
You needSYSDBA
privileges to run these commands.srvctl start instance -d sid -i instance_name
After you install Oracle Database Vault for an Oracle Real Application Clusters (Oracle RAC) instance, complete the following procedure for each Oracle RAC node. This procedure assumes that you have a separate Oracle home for each node.
Note:
The dvca -action optionrac option has been deprecated and can no longer be used to configure Oracle RAC nodes.Log in to SQL*Plus as user SYS
with the SYSDBA
privilege.
sqlplus sys as sysdba
Enter password: password
Run the following ALTER SYSTEM
statements:
ALTER SYSTEM SET AUDIT_SYS_OPERATIONS=TRUE SCOPE=SPFILE; ALTER SYSTEM SET OS_ROLES=FALSE SCOPE=SPFILE; ALTER SYSTEM SET RECYCLEBIN='OFF' SCOPE=SPFILE; ALTER SYSTEM SET REMOTE_LOGIN_PASSWORDFILE='EXCLUSIVE' SCOPE=SPFILE; ALTER SYSTEM SET SQL92_SECURITY=TRUE SCOPE=SPFILE; ALTER SYSTEM SET OS_AUTHENT_PREFIX='' SCOPE=SPFILE;
Restart Oracle Database.
$ORACLE_HOME/bin/srvctl stop database -d db_name $ORACLE_HOME/bin/srvctl start database -d db_name
Oracle Database Vault Administrator (DVA) is a browser-based graphical user interface console that you can use to manage Oracle Database Vault.
You can modify the length of time that DVA stays connected while inactive. By default, the connection duration is 35 minutes. Your session automatically gets expired after 35 minutes of inactivity.
To set the session time for Oracle Database Vault Administrator:
Back up the web.xml
file, which by default is in the $ORACLE_HOME/dv/jlib/dva_webapp/dva_webapp/WEB-INF
directory.
In a text editor, open the web.xml
file .
Search for the following setting:
<session-config> <session-timeout>35</session-timeout> </session-config>
Change the <session-timeout>
setting to the amount of time in minutes that you prefer.
Save and close the web.xml
file.
Stop and restart the DVA application.
You can use the following command to restart DVA:
emctl stop dbconsole emctl start dbconsole
If you have created an Oracle database manually, and have configured Oracle Enterprise Manager Database Control by using Enterprise Manager Configuration Assistant, you must manually deploy Oracle Database Vault Administrator. This procedure deploys Database Vault Administrator in the same OC4J container as the current Enterprise Manager, rather than creating a new application.
This section contains:
Deploying Database Vault Administrator to a Standalone OC4J Container
Deploying Database Vault Administrator to the Database Console OC4J Container
You can manually deploy Database Vault Administrator to the Oracle Application Server Containers for J2EE (OC4J) home, which by default is in the $ORACLE_HOME/oc4j/j2ee/home
directory.
To manually deploy Database Vault Administrator:
Edit the file $ORACLE_HOME/oc4j/j2ee/home/config/server.xml
. Enter the following line just before the last line that reads, </application-server>
:
<application name="dva" path="$ORACLE_HOME/dv/jlib/dva_webapp.ear" auto-start="true" />
For example:
<application name="dva" path="/u00/app/oracle/oracle/product/dv12/dv/jlib/dva_webapp.ear" auto-start="true" />
Edit the file $ORACLE_HOME/oc4j/j2ee/home/config/http-web-site.xml
. Enter the following line just above the last line that reads, </web-site>
:
<web-app application="dva" name="dva_webapp" root="/dva" />
Edit the file $ORACLE_HOME/oc4j/j2ee/home/config/global-web-application.xml
. Search for <servlet-class>oracle.jsp.runtimev2.JspServlet</servlet-class>
. Uncomment the following lines after this:
<init-param> <param-name>main_mode</param-name> <param-value>justrun</param-value> </init-param>
Create the following directory:
mkdir -p $ORACLE_HOME/dv/jlib/sysman/config
Create the database connection configuration file, emoms.properties, in the configuration directory that you just created. Add the following lines to the file:
oracle.sysman.emSDK.svlt.ConsoleMode=standalone oracle.sysman.eml.mntr.emdRepRAC=FALSE oracle.sysman.eml.mntr.emdRepDBName=oracle_sid oracle.system.eml.mntr.emdRepConnectDescriptor=TNS_connection_string
Follow these instructions:
For an Oracle RAC environment, set oracle.sysman.eml.mntr.emdRepRAC
to TRUE
.
For oracle.sysman.eml.mntr.emdRepConnectDescriptor
, you can use an alias from $ORACLE_HOME/network/admin/tnsnames.ora
. Alternatively, you can use the following syntax:
oracle.sysman.eml.mntr.emdRepConnectDescriptor= (DESCRIPTION\= (ADDRESS_LIST\=(ADDRESS\=(PROTOCOL\=TCP) (HOST\=HOSTNAME)(PORT\=PORT))) (CONNECT_DATA\= (SERVICE_NAME\=ORACLE_SID))
Ensure that the correct environment variables are set.
For example:
ORACLE_SID=orcl export ORACLE_SID ORACLE_HOME=/u00/app/oracle/product/11.1/dv export ORACLE_HOME LD_LIBRARY_PATH=$ORACLE_HOME/bin:$ORACLE_HOME/lib32:$ORACLE_HOME/lib:$ORACLE_HOME/jdbc/lib export LD_LIBRARY_PATH PATH=$ORACLE_HOME/bin:$ORACLE_HOME/jdk/bin:$PATH export PATH
Ensure that you set the LD_LIBRARY_PATH
variable to use the OCI-based JDBC libraries.
Start OC4J using the following syntax:
$ORACLE_HOME/jdk/bin/java -Djava.awt.headless=true -DEMDROOT=$ORACLE_HOME/dv/jlib -jar $ORACLE_HOME/oc4j/j2ee/home/oc4j.jar -userThreads -config $ORACLE_HOME/oc4j/j2ee/home/config/server.xml
After you complete these steps, you can start Database Vault Administrator. The HTTP port defaults to 8888 for this environment. Use the following syntax for the URL:
http://hostname:8888/dva
To manually deploy Database Vault Administrator to the Database Console OC4J container:
Stop Oracle Database Console.
UNIX: Go to the $ORACLE_HOME/bin
directory and run the following command:
./emctl stop dbconsole
Microsoft Windows: In the Administrative Services, select the Services utility, and then right-click the OracleDBConsolesid service. Select Stop from the menu.
Create a backup copy and then open the $ORACLE_HOME/oc4j/j2ee/OC4J_DBConsole_
service_name
/config/server.xml
file.
Add the following line before the </application-server>
element:
<application name="dva" path="$ORACLE_HOME/dv/jlib/dva_webapp.ear" parent="default" start="true" />
On Windows systems, replace $ORACLE_HOME
with the absolute path to your Oracle Database home.
Create a backup copy and then open the $ORACLE_HOME/oc4j/j2ee/OC4J_DBConsole_
service_name
/config/http-web-site.xml
file.
Add the following line before the </web-site> element:
<web-app application="dva" name="dva_webapp" load-on-startup="true" root="/dva" shared="true"/>
Restart Oracle Database Console.
UNIX: Go to the $ORACLE_HOME/bin
directory and run the following command:
./emctl start dbconsole
Windows: In the Administrative Services, select the Services utility, and then right-click the OracleDBConsolesid service. Select Start from the menu.
After you complete these steps, you can start Oracle Database Vault Administrator by using the following URL:
https://hostname:port/dva
For example:
https://myserver:1158/dva
If you are unsure of the port number, open the ORACLE_HOME
/
host_sid
/sysman/config/emd.properties
file and search for REPOSITORY_URL
. In most cases, the host name and port number are the same as Oracle Enterprise Manager Database Control.
The following procedures uninstall Oracle Database Vault from an Oracle Database installation. They apply to both single-instance and Oracle RAC installations.
Disable Oracle Database Vault, as described under "Step 1: Disable Oracle Database Vault" in Oracle Database Vault Administrator's Guide.
In SQL*Plus, connect as user SYS
with the SYSDBA
privilege.
CONNECT SYS/AS SYSDBA
Enter password: password
Disable the recycle bin.
To check if the recycle bin is enabled, enter the following command:
SHOW PARAMETER RECYCLEBIN
If it is enabled, then run the following SQL statement:
ALTER SYSTEM SET RECYCLEBIN = OFF SCOPE=SPFILE;
Disabling the recycle bin does not purge or otherwise affect objects that are in the recycle bin.
Run the following SQL script:
@$ORACLE_HOME/rdbms/admin/dvremov.sql
Manually drop the DV_OWNER
and DV_ACCTMGR
user accounts.
For example:
DROP USER dbv_owner CASCADE; DROP USER dbv_acctmgr CASCADE;
Restart the database.
For example:
SHUTDOWN IMMEDIATE STARTUP
Start OUI by invoking runInstaller
from the $ORACLE_HOME/oui/bin
directory.
In the Welcome window, select Deinstall Products.
Navigate to the correct directory and then select Database Vault 10.2.0.5 from the list.
In the confirmation window, select Yes.
Exit OUI.
Afterward, you can double-check that Oracle Database Vault is truly deinstalled by logging in to SQL*Plus and entering the following statement:
SELECT * FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';
If Oracle Database Vault is deinstalled, the following output appears:
PARAMETER VALUE ----------------------------- ----------------------- Oracle Database Vault FALSE