This chapter includes an overview of the major steps required to install Oracle Database Vault into an existing Oracle Database 10g release 2 (10.2.0.4) database. These procedures transform an existing Oracle Database system (including associated applications) into an Oracle Database Vault system. Databases upgraded using the procedures described in this chapter can work almost in the same manner as in earlier releases and, optionally, can leverage new Oracle Database Vault functionality. For a list of changes that Database Vault makes, refer to Appendix E, "Initialization Parameters" and the Oracle Database Vault Administrator's Guide.
Note:
In order to upgrade a pre-10g release 2 Oracle Database to Oracle Database Vault, you first must upgrade the database to a 10g release 2 (10.2.0.4) database.See Also:
Oracle Database Upgrade Guide, 10g Release2 (10.2) for information about upgrading your Oracle Database to Oracle Database 10g release 2.
ora_root:[rdbms]readmemigvms.doc
, a text file in the Oracle Database Release 10.2 code tree. It is essential reading for Oracle software upgrades on hp OpenVMS.
OracleMetaLink Note 316889.1, "Complete Checklist for Manual Upgrades to 10gR2". You can access OracleMetaLink from the following URL:
This chapter covers the following topics:
This section covers the following topics:
Before you plan the upgrade process, become familiar with the features of Oracle Database Vault. The Oracle Database Vault Administrator's Guide discusses the basic features of Oracle Database Vault.
The following sections describe the minimum hardware requirements for installing Oracle Database Vault on an OpenVMS system.
The following are the minimum hardware requirements for installing Oracle Database Vault.
A minimum of one GB RAM is required to install Oracle Database Vault.
To determine the amount of RAM installed on the system as well as the amount of paging currently configured on the system, enter the following command:
$ SHOW MEMORY
To review memory reservations on the node, run the following command:
$ SHOW MEMORY/RESERVED System Memory Resources on 13-JUL-2002 09:57:11.72 Memory Reservations (pages): Group Reserved In Use Type ORA_PROD_SGA SYSGBL 5120 0 Allocated ORA_PROD_SGA SYSGBL 5 0 Page Table Total (40.04 Mbytes reserved) 5125 0
See Also:
Hewlett-Packard documentation for more information about reserving memory
Hp OpenVMS AlphaServer systems must have an EV56 or later generation CPU.
There are no restrictions on hp OpenVMS Itanium CPUs.
Depending on the products that you intend to install, verify that the following software is installed on the system. The procedure following the table describes how to verify whether these requirements are addressed.
Note:
Oracle Universal Installer performs checks on your system to verify that it meets the listed requirements. To ensure that these checks pass, verify the requirements before you start Oracle Universal Installer.To ensure that the system meets these requirements:
To determine which version of OpenVMS is installed, enter the following command:
For OpenVMS Alpha:
$ WRITE SYS$OUTPUT F$GETSYI("VERSION") V8.2
For OpenVMS Itanium:
$ WRITE SYS$OUTPUT F$GETSYI("VERSION") V8.2-1
If necessary, refer to the operating system documentation for information about upgrading the operating system.
To display additional information about the operating system, enter the following command:
$ SHOW SYSTEM /NOPROCESS /FULL
To view information about all nodes in a cluster, add the /CLUSTER
qualifier to this command.
To determine the version of TCP/IP installed, enter the following command:
For OpenVMS Alpha:
$ tcpip show version HP TCP/IP Services for OpenVMS Alpha Version V5.5 - ECO 1 on a AlphaServer GS160 6/731 running OpenVMS V8.2
For OpenVMS Itanium:
$ tcpip show version HP TCP/IP Services for OpenVMS Industry Standard 64 Version V5.5 - ECO 1 on an HP rx4640 (1.50GHz/6.0MB) running OpenVMS V8.2-1
Oracle Net Services OpenVMS Mailbox Driver
The Oracle Net Services OpenVMS Mailbox driver (protocol IPC) is included in NETWORK
. You do not need an Oracle Net Services license to use the OpenVMS Mailbox driver.
There are factors that can affect the installation or use of Oracle Database. This section discusses these factors:
For both single-instance and Oracle Real Application Clusters installations, you must install Oracle Database Vault into the root directory of an existing Oracle Database installation for release 10.2.0.4. Do not install Oracle Database Vault into a new Oracle home.
For Oracle Real Application Clusters, ensure that you install Oracle Database Vault from the same node that you used to install Oracle Database.
The JDK release that is shipped with Oracle Database is used by Oracle Java applications such as Oracle Universal Installer and is the only JDK that is supported to run with these applications. You must not modify this JDK, unless it is done through a patch provided by Oracle Support Services.
Oracle Database Vault Administrator is a graphical user interface for administering Oracle Database Vault. However, Database Vault Administrator is not available on the hp OpenVMS platform. It is only available in Oracle Database Release 11g Release 1 (11.1) as an installation option. If you have access to this release, you can remotely connect Database Vault Administrator to an Oracle Database Release 10g Release 2 (10.2.0.4) installation on hp OpenVMS. See Oracle Database Vault Administrator's Guide for information about making this remote connection.
If you do not have access to Oracle Database 11g, then you can use the DVSYS
PL/SQL packages and the PL/SQL interfaces described in Oracle Database Vault Administrator's Guide to manage Oracle Database Vault.
In order to install Oracle Database Vault, you must be running the Enterprise Edition of Oracle Database 10g release 2 (10.2.0.4).
A listener must have been configured for the existing database. Oracle Net Configuration Assistant configures the listener when you first install the database.
You must have an existing password file for the database. The password file authentication parameter, REMOTE_LOGIN_PASSWORDFILE
must have been set to EXCLUSIVE
or SHARED
.
You can set the REMOTE_LOGIN_PASSWORDFILE
parameter in the init.ora
file. Use the orapwd
utility to create and manage password files.
See Also:
Oracle Database Administrator's Guide for more information on creating and maintaining a password fileTo install Oracle Database Vault, you must upgrade the database to Oracle Database release 10.2.0.4. Oracle strongly recommends that you back up your database before performing any upgrade or installation.
See Also:
Oracle Database Backup and Recovery User's Guide for information on database backupsThis section covers the following topics:
Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.4) Patch Set 1 for hp OpenVMS
Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.4) Patch Set 1
You can apply the Oracle Database release 10.2.0.4 patch set to the following Oracle Database 10g release 2 installations:
Oracle Database
Oracle Real Application Clusters
Oracle Universal Installer Version Requirements
This patch set includes Oracle Universal Installer release 10.2.0.4, which is also installed when you install this patch set. This is to ensure that your Oracle home can be patched in the future. You should not use the Installer from the earlier maintenance release media or Oracle home.
This is not a complete software distribution. You must install it in an existing Oracle Database 10g release 2 patch set 10.2.0.4 installation.
There are two documents related to this release of the Oracle Database patch set:
Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.4) Patch Set 1 for hp OpenVMS
Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.4) Patch Set 1
Both of these documents are included with the patch set. In addition, they are available from document 316900.1, ALERT: Oracle 10g release 2 (10.2) Support Status and Alerts on the OracleMetaLink Web site:
To locate document 316900.1:
Log on to OracleMetaLink.
Click Advanced at the top of the OracleMetaLink page.
Enter 316900.1 in the Document ID field, then click Submit.
The following sections describe the contents of the Oracle Database Patch Set Notes and the Oracle Database List of Bugs Fixed documents.
Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.4) Patch Set 1 for hp OpenVMS
This document provides:
System requirements and information about how to install, reinstall or remove the patch set
A list of all bugs fixed to date that are specific to Oracle Database for hp OpenVMS
A list of known issues relating to Oracle Database on hp OpenVMS
Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.4) Patch Set 1
The List of Bugs Fixed is a list of all generic bugs related to Oracle Database that have been fixed to date.
Oracle strongly recommends that you back up your database before performing any upgrade or installation. The ultimate success of your upgrade depends heavily on the design and execution of an appropriate backup strategy. To develop a backup strategy, consider the following questions:
How long can the production database remain inoperable before business consequences become intolerable?
What backup strategy should be used to meet your availability requirements?
Are backups archived in a safe, offsite location?
How quickly can backups be restored (including backups in offsite storage)?
Have recovery procedures been tested successfully?
Your backup strategy should answer all of these questions and include procedures for successfully backing up and recovering your database.
See Also:
Oracle Database Backup and Recovery User's Guide for information on database backupsIf you have created custom profiles and password complexity checks in your existing database, then you must disable these before performing the installation. You can reenable these after the installation is complete. Use the following steps to achieve this:
Extract the profile names and associated settings for each profile that is being used. You can use a script to accomplish this.
Example 2-1 shows a sample script that extracts the profile names and settings to create an output script called, myprofiles.sql
. After the installation is complete, you can run myprofiles.sql
to restore the profile settings.
Example 2-1 Extracting Profiles
set serverout on size 100000 spool myprofiles.sql declare l_last varchar2(30) := 'X'; l_count number := 0; begin for c in ( select profile, resource_name , limit from dba_profiles order by profile, resource_name ) loop if l_last <> c.profile then l_last := c.profile; if l_count > 0 then dbms_output.put_line(';'); end if; l_count := l_count + 1; dbms_output.put_line('create profile ' || c.profile || ' limit '); else dbms_output.put_line(' ' || c.resource_name || ' ' || c.limit); end if; end loop; dbms_output.put_line(';'); end; / spool off
Disable the custom profiles and password complexity settings. For example:
SQL> ALTER PROFILE SomeCustomProfile LIMIT PASSWORD_REUSE_MAX UNLIMITED -- The number of times a password can be reused PASSWORD_REUSE_TIME UNLIMITED -- The number of days between reuses of a password PASSWORD_VERIFY_FUNCTION NULL /
After the Oracle Database Vault installation is complete, reenable the profiles by running the script created in Step 1.
SQL>@myprofiles.sql
Oracle Clusterware should be running for the Database Vault installer to find the existing Real Application Clusters (RAC) databases. If you have stopped Oracle Clusterware, then you should restart it before running Oracle Universal Installer. Use the following command to verify if Oracle Clusterware is running:
$ CRSCTL CHECK CRS
The output from this command should indicate the health of the Oracle Clusterware server processes of the current node. Run this command on each node of the RAC cluster. In the following example, the CSS, CRS, and EVM processes are healthy.
$ CRSCTL CHECK CRS CSS appears healthy CRS appears healthy EVM appears healthy
See Also:
Oracle Database Administrator's Reference for information about stopping existing Oracle processes on Oracle RACto stop the existing Oracle processes:
Log in as the owner of the Oracle installation.
For each database associated with the installation, perform these steps:
Run the orauser.com
script with the SID
of the database instance, for example, assuming the SID
is PROD
:
@DISK$ORACLE:[ORACLE10GR2]ORAUSER PROD
Shut the database down.
Shut down all listeners.
For example, to stop listeners LISTENER1
and LISTENER2
:
LSNRCTL STOP LISTENER1 LSNRCTL STOP LISTENER2
Shut down all other services.
Log out.
Before you start Oracle Universal Installer, you must configure the environment of the Oracle database account.
To configure the Oracle database account environment:
Start a new terminal session.
Set up the display by using the SET DISPLAY
command.
If you are not installing the software on the local system, then enter the following command to direct X applications to display on the local system:
$ SET DISPLAY/CREATE/TRANSPORT=TCPIP/NODE=ip_address
To confirm that the display is set correctly, run the following command:
$ RUN SYS$SYSTEM:DECW$CLOCK
If the database to be updated with this Oracle Database Vault installation is not an Oracle Real Applications Clusters (RAC) database, then define the ORA_DB_NONRAC_INSTALL
logical name as follows:
$ DEFINE ORA_DB_NONRAC_INSTALL "TRUE"
Ensure that the file oraInst.loc
file points to the inventory for the correct Oracle home.
By default, the oraInst.loc
file is in disk:[
login_dir
.
hostname
]
, where login_dir
is the equivalent of the SYS$LOGIN
logical name, and hostname
is the name of the network node where the databases have been created.
Ensure that the ORATAB
file exists and contains information about all Oracle databases created on the node.
The database entries in this file are of the following form:
ORACLE_SID:ORACLE_HOME:[N|Y]
By default, the ORATAB
file is in the same directory as oraInst.loc
discussed in Step 4.
Copy the DV.RSP
file from the [.response]
subdirectory of your Oracle Database Vault kit to any location where you can edit this file, for example, SYS$LOGIN
.
Edit the DV.RSP
file and provide all the required values, making sure to enclose them in double quotation marks (").
For more information about the response file, see Appendix B, "Using Response Files".
Enter the following command:
$ SET NOVERIFY
Enter the following command:
$ SET PROCESS/PRIV=ALL
Start Oracle Universal Installer.
See "Run Oracle Universal Installer to Install Oracle Database Vault".
Run Oracle Universal Installer (OUI) to install Oracle Database Vault into an existing Oracle Database 10g release 2 (10.2.0.4) database.
To start Oracle Universal Installer:
Ensure that you have created a response file.
You must use a response file to install Oracle Database Vault on an hp OpenVMS system. See Appendix B, "Using Response Files" for details about creating response files. Also, ensure that you have completed the instructions in "Configure the Oracle User's Environment".
Run the following command:
$ @kit_device:[Disk1]runInstaller.com -responseFile response_file
In this specification:
kit_device
is the disk that contains the Oracle Database Vault installation kit.
response_file
is the full specification in OpenVMS format of the DV.RSP
file that you edited in "Configure the Oracle User's Environment".
Optionally, you can use the -silent
parameter if you want to bypass the Graphical User Interface of Oracle Universal Installer. For example:
$ @kit_device:[Disk1]runInstaller.com -responseFile response_file -silent
For more information about other options that you can use with the runInstaller
utility, enter the following command:
$ @kit_device:[Disk1]runInstaller.com -HELP
If you omit the -silent
parameter, then Oracle Universal Installer loads the values you created in the response file. The following actions take place:
The Summary screen displays, showing the installation details. Verify these details and then click Install.
The Installation screen appears next. After the installation completes, Database Vault Configuration Assistant (DVCA) runs automatically to configure the Database Vault.
This section lists the tasks to perform after you have completed an upgrade of your database. The following topics are discussed:
The installation of the Oracle Database Vault triggers an automatic execution of the dvca.com
script. This Database Vault Configuration Assistant procedure uses a dvca.args
file that is generated by the installer. The script also creates and leaves behind the dvca.jinput
file. When the configuration phase completes, it renames the dvca.args
file to dvca.args_OLD
. Both, the dvca.jinput
and the dvca.args_OLD
files reside in your ORACLE_HOME
location. Even though the access to these files is limited to the SYSTEM
and the owner accounts, you may want to delete files, or otherwise secure these files because they contain sensitive database access information.
Make sure you perform a full backup of the production database. See Oracle Database Backup and Recovery User's Guide for details on backing up a database.
Oracle strongly recommends that you change the password for each account after installation. This enables you to effectively implement the strong security provided by Oracle Database Vault.
To unlock and reset user account passwords using SQL*Plus:
Start SQL*Plus and log in using the Database Vault Account Manager account. If you did not create the Database Vault Account Manager account during installation, then you must log in using the Database Vault Owner account.
Enter a command similar to the following, where account
is the user account that you want to unlock and password
is the new password:
SQL> ALTER USER account [ IDENTIFIED BY password ] ACCOUNT UNLOCK;
In this example:
The ACCOUNT UNLOCK
clause unlocks the account.
The IDENTIFED BY
password
clause resets the password.
Note:
If you unlock an account but do not reset the password, then the password remains expired. The first time someone connects as that user, they must change the user's password.To permit unauthenticated access to your data through HTTP, unlock the ANONYMOUS
user account.
See Also:
Oracle Database Administrator's Guide for more information about:Unlocking and changing passwords after installation
Oracle security procedures
Best security practices
Oracle Database Vault allows you to disable remote logins with SYSDBA
privileges. This enables enhanced security for your database.
To disable remote SYSDBA
connections, re-create the password file with the nosysdba
flag set to y
(Yes). A user can still log in AS
SYSDBA
locally using Operating System (OS) authentication. However, remote connections AS SYSDBA
will fail.
Use the following syntax to re-create the password file:
orapwd file=filename password=password [entries=users] force=y nosysdba=y
In this specification:
file
: Name of password file (mandatory)
password
: Password for SYS
(mandatory). Enter at least six alphanumeric characters.
entries
: Maximum number of distinct DBA users
force
: Whether to overwrite the existing file
nosysdba
: Whether to enable or disable the SYS
logon
The default is no, so if you omit this flag, the password file will be created enabling SYSDBA
access for Oracle Database Vault instances.
For example, to create a password file for an Oracle database named orcl
:
orapwd file=ORA_ROOT:[DBS]orapworcl.ora password=sys_password force=y nosysdba=y
Note:
Do not insert spaces around the equal (=) character.When you re-create the password file, any accounts other than SYS
that were granted the SYSDBA
or SYSOPER
privileges will have those privileges removed. You must regrant the privileges for these accounts after you have re-created the password file.
You can reenable the ability to connect with the SYSDBA
privilege by re-creating the password file with the nosysdba
flag set to n
(No). You might need to reenable the ability to connect with the SYSDBA
privilege, if certain products or utilities require it's use.
You must start the listener and database on all RAC nodes other than the one on which the installation is performed. Use the following commands to start the listener and the database:
Note:
You needSYSDBA
privileges to run these commands.$ SRVCTL start listener "-n" node_name $ SRVCTL start instance "-d" sid "-i" instance_name
For this release of Oracle Database Vault on the hp OpenVMS platform, you do not need to run DVCA on other nodes in a RAC installation.
See Oracle Database Vault Release Notes for hp OpenVMS for more information.
You cannot remove or uninstall the Database Vault option. However, you can disable Oracle Database Vault. Refer to the following documents for details:
Oracle Database Vault Release Notes for hp OpenVMS for information about enabling and disabling Oracle Database Vault on the hp OpenVMS platform
Oracle Database Vault Administrator's Guide for how to check if Database Vault is enabled or disabled, and reasons why you would need to disable it