Oracle® Database Vault

Installation Guide

10g Release 2 (10.2) for Microsoft Windows Itanium (64-Bit)

B32486-05

May 2013

Oracle Database Vault Installation Guide, 10g Release 2 (10.2) for Microsoft Windows Itanium (64-Bit)

B32486-05

Copyright © 2006, 2013, Oracle and/or its affiliates. All rights reserved.

Primary Author: Tanaya Bhattacharjee

Contributing Author: Pat Huey, Prakash Jashnani, Sumit Jeloka, Reema Khosla

Contributors: Scott Gaetjen, Xiaofang Wang, Jack Brinson, Chi Ching Chui, Kamal Tbeileh, Trivikrama Samudrala, Madhu Velukur, Rahul Joshi, Mohammed Shahnawaz Quadri

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Contents

Preface

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

Part I Oracle Database Vault Installation

1 Oracle Database Vault Installation Overview

- 1.1 Database Vault Installation Environment

- 1.2 Database Vault Accounts

- 1.2.1 Database Vault Owner

- 1.2.2 Database Vault Account Manager

- 1.3 Default Audit Policy and Initialization Parameters

- 1.4 Installation Considerations

- 1.4.1 Hardware and Software Certification

- 1.4.2 Multiple Oracle Homes

2 Installing Oracle Database Vault

- 2.1 Preinstallation and Installation Tasks

- 2.1.1 Become Familiar with the Features of Oracle Database Vault

- 2.1.2 Check the Hardware Requirements

- 2.1.2.1 Hardware Component Requirements

- 2.1.2.2 Hard Disk Space Requirements

- 2.1.2.3 Verifying Hardware Requirements

- 2.1.3 Check the Software Requirements

- 2.1.4 Check the Database Requirements

- 2.1.4.1 Install Oracle Enterprise Manager Console DB

- 2.1.4.2 Apply Oracle Database Release 10.2.0.5 Patch Set

- 2.1.5 Prepare a Backup Strategy

- 2.1.6 Disable Custom Profiles (If Any)

- 2.1.7 Verify That Oracle Clusterware Is Running (Oracle RAC Only)

- 2.1.8 Stop Existing Oracle Processes

- 2.1.8.1 Stop the Enterprise Manager Database Control Process

- 2.1.8.2 Stop the iSQL*Plus Process

- 2.1.8.3 Shut Down All Database Instances

- 2.1.8.4 Stop Oracle Services

- 2.1.9 Run Oracle Universal Installer to Install Oracle Database Vault

- 2.1.9.1 Downloading the Oracle Database Vault Software

- 2.1.9.2 Installing Oracle Database Vault with Oracle Universal Installer

- 2.2 Postinstallation Tasks

- 2.2.1 Back Up the Database

- 2.2.2 Change Passwords for Oracle-Supplied Accounts

- 2.2.2.1 Using SQL*Plus to Unlock Accounts and Reset Passwords

- 2.2.3 Disable Remote SYSDBA Connections (Optional)

- 2.2.4 Start the Database on Other Nodes (Oracle RAC Only)

- 2.2.5 Configure Oracle Database Vault on Oracle RAC Nodes (Oracle RAC Only)

- 2.2.6 Manually Deploy Oracle Database Vault Administrator (Special Cases)

- 2.2.6.1 Deploying Database Vault Administrator to a Standalone OC4J Container

- 2.2.6.2 Deploying Database Vault Administrator to the Database Console OC4J Container

- 2.2.7 Restart Enterprise Manager Database Control

- 2.2.8 Setting the Timeout Value for DVA (Optional)

- 2.3 Removing Oracle Database Vault

- 2.3.1 Step 1: Deconfigure Oracle Database Vault

- 2.3.2 Step 2: Deinstall Oracle Database Vault

Part II Appendixes

A How to Stop Processes in an Existing Oracle Real Application Clusters Database

B Using Response Files

- B.1 How Response Files Work

- B.1.1 General Procedure for Using Response Files

- B.2 Installing Database Vault Using a Response File

- B.2.1 Prepare the Response File

- B.2.2 Run Oracle Universal Installer Using the Response File

- B.3 Troubleshooting Silent Mode Installation

C Running DVCA After Creating a Database Vault Database

D Upgrading from a Previous Version of Database Vault

- D.1 Upgrading from a 10.2.0.x Version

E Database Listener Security Recommendations

- E.1 Security Checklist for the Database Listener

F Initialization Parameters

G Enabling Oracle Database Vault Administrator Accessibility

- G.1 Enabling Oracle Database Vault Administrator Accessibility Mode

- G.2 Providing Textual Descriptions of Database Vault Administrator Charts

Index

Preface

The Oracle Database Vault Installation Guide explains how to prepare for, install, and configure Oracle Database Vault with specific instructions for the operating system and Oracle software technology components that Database Vault requires.

Audience

This document is intended for Oracle DBAs as well as System Administrators who are involved in the installation of Oracle Database Vault and its related components.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Related Documents

For more information, refer to the following documents:

- Oracle Database Vault Release Notes for Microsoft Windows Itanium (64-Bit)

- Oracle Database Vault Administrator's Guide

- Oracle Database Installation Guide for Microsoft Windows Itanium (64-Bit)

- Oracle Database Oracle Clusterware and Oracle Real Application Clusters Installation Guide for Microsoft Windows

- Oracle Database Oracle Clusterware and Oracle Real Application Clusters Administration and Deployment Guide

Conventions

The following text conventions are used in this document:

Convention

Meaning

boldface

Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary.

italic

Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.

monospace

Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

Part I

Oracle Database Vault Installation

Part I introduces you to Oracle Database Vault installation concepts, requirements, and steps. This part contains the following chapters:

- Chapter 1, "Oracle Database Vault Installation Overview"

- Chapter 2, "Installing Oracle Database Vault"

1 Oracle Database Vault Installation Overview

Oracle Database Vault enables you to secure business data in ways that were not possible before. Database Vault uses a multifactored and multilayered approach to implementing database security.

This chapter provides an overview of the Database Vault installation process. This chapter includes the following sections:

- Database Vault Installation Environment

- Database Vault Accounts

- Installation Considerations

1.1 Database Vault Installation Environment

Oracle Database Vault can be installed as an option to the following:

- Oracle Database 10g Release 2 (10.2.0.5) standalone installation

- Oracle Database 10g Release 2 (10.2.0.5) with Oracle Real Application Clusters (Oracle RAC)

1.2 Database Vault Accounts

Database Vault prompts for two accounts that you can create during installation. These are the Database Vault Owner and the Database Vault Account Manager accounts. You must supply an account name and password for the Database Vault Owner during installation. Creating a Database Vault Account Manager is optional.

1.2.1 Database Vault Owner

The Database Vault Owner account is granted the DV_OWNER role. This account can manage Database Vault roles and configuration.

The Database Vault Owner user name can be a minimum of 2, and a maximum of 30 characters long. The account password can be a minimum of 8, and a maximum of 30 characters.

The password that you choose for the Database Vault Owner account must be a secure one. The following password restrictions are enforced:

- The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol).

- The password cannot be the same as the account name.

- The password cannot contain any consecutive repeating characters.

1.2.2 Database Vault Account Manager

The Database Vault Account Manager is granted the DV_ACCTMGR role. This account is used to manage database user accounts. The Database Vault Account Manager is created to facilitate separation of duties. If you do not opt to create the Database Vault Account Manager account, then the DV_ACCTMGR role is granted to the Database Vault Owner account by default.

The Database Vault Account Manager user name can be a minimum of 2, and a maximum of 30 characters long. The account password can be a minimum of 8, and a maximum of 30 characters.

The same password restrictions that apply to Database Vault Owner are applicable to Database Vault Account Manager as well.

1.3 Default Audit Policy and Initialization Parameters

Oracle Database Vault installs a baseline database auditing policy. This policy covers the access control configuration information stored in Database Vault database tables, information stored in Oracle Catalog (rollback segments, tablespaces, and so on), the use of system privileges, and Oracle Label Security configuration.

See Also:
Oracle Database Vault Administrator's Guide for more information about the database audit policy

When you install Oracle Database Vault, the security specific database initialization parameters are initialized with default values. These security specific initialization parameters are listed in Appendix F.

1.4 Installation Considerations

This section contains information that you should consider before deciding how to install this product. It contains the following sections:

- Hardware and Software Certification

- Multiple Oracle Homes

1.4.1 Hardware and Software Certification

The platform-specific hardware and software requirements included in this installation guide were current at the time this guide was published. However, because new platforms and operating system software versions might be certified after this guide is published, review the certification matrix on the My Oracle Support (formerly OracleMetaLink) Web site for the most up-to-date list of certified hardware platforms and operating system versions. My Oracle Support Web site is available at the following URL:

https://support.oracle.com

1.4.2 Multiple Oracle Homes

This product supports multiple Oracle homes. This means that you can install this release or previous releases of the software more than once on the same system, in different Oracle home directories.

2 Installing Oracle Database Vault

This chapter includes an overview of the major steps required to install Oracle Database Vault into an existing Oracle Database 10g Release 2 (10.2.0.5) database. These procedures transform an existing Oracle Database system (including associated applications) into an Oracle Database Vault system. Databases upgraded using the procedures described in this chapter can work almost in the same manner as in earlier releases and, optionally, can leverage new Oracle Database Vault functionality. For a list of changes that Database Vault makes, refer to Appendix F, "Initialization Parameters" and Oracle Database Vault Administrator's Guide.

Note:
In order to upgrade a pre-10g Release 2 Oracle Database to Oracle Database Vault, you first need to upgrade the database to a 10g Release 2 (10.2.0.5) database.

See Also:
Oracle Database Upgrade Guide for information about upgrading your Oracle Database to Oracle Database 10g Release 2

This chapter covers the following topics:

- Preinstallation and Installation Tasks

- Postinstallation Tasks

- Removing Oracle Database Vault

2.1 Preinstallation and Installation Tasks

This section covers the following topics:

- Become Familiar with the Features of Oracle Database Vault

- Check the Hardware Requirements

- Check the Software Requirements

- Check the Database Requirements

- Prepare a Backup Strategy

- Disable Custom Profiles (If Any)

- Verify That Oracle Clusterware Is Running (Oracle RAC Only)

- Stop Existing Oracle Processes

- Run Oracle Universal Installer to Install Oracle Database Vault

2.1.1 Become Familiar with the Features of Oracle Database Vault

Before you plan the upgrade process, become familiar with the features of Oracle Database Vault. Oracle Database Vault Administrator's Guide discusses the basic features of Oracle Database Vault.

2.1.2 Check the Hardware Requirements

This section describes hardware component and hard disk space requirements.

- Hardware Component Requirements

- Hard Disk Space Requirements

- Verifying Hardware Requirements

2.1.2.1 Hardware Component Requirements

Table 2-1 discusses the hardware requirements for Oracle Database Vault:

Table 2-1 Hardware Requirements

Requirement

Value

Physical memory (RAM)

1 GB minimum, 4 GB recommended

Virtual memory

Double the amount of RAM

Disk space

Total: 100 MB

Video adapter

256 colors

Processor

Intel Itanium 2 or later

2.1.2.2 Hard Disk Space Requirements

This section lists system requirements for Windows platforms that use the NT File System (NTFS) file systems. Oracle recommends installing Oracle components on NTFS.

The NTFS system requirements listed in this section are more accurate than the hard disk values reported by the Oracle Universal Installer Summary window. The Summary window does not include accurate values for disk space, the space required to create a database, or the size of compressed files that are expanded on the hard drive.

The hard disk requirements for Oracle Database Vault components include 32 MB required to install Java Runtime Environment (JRE) and Oracle Universal Installer on the partition where the operating system is installed. If sufficient space is not detected, installation fails and an error message appears.

* Refers to the contents of the admin, flash_recovery_area, and oradata directories in the ORACLE_BASE directory.

** This size can be higher depending on the installation options selected, such as languages or additional components. If you choose to install Oracle Database with automated backups enabled, include at least 2 GB extra for data file disk space.

See Also:
"NTFS File System and Windows Registry Permissions" in Oracle Database Platform Guide for Microsoft Windows Itanium (64-Bit)

2.1.2.3 Verifying Hardware Requirements

To ensure that the system meets these requirements, follow these steps:

1. Determine the physical RAM size. For a computer using Windows 2003, for example, double-click System in the Windows Control Panel and click the General tab. If the size of the physical RAM installed in the system is less than the required size, then you must install more memory before continuing.

2. Determine the size of the configured virtual memory (also known as paging file size). For a computer using Windows 2003, for example, double-click System in the Control Panel, click the Advanced tab, and click Settings in the Performance section. Then click the Advanced tab. The virtual memory is listed in the Virtual Memory section.
If necessary, see your operating system documentation for information about how to configure additional virtual memory.

3. Determine the amount of free disk space on the system. For a computer using Windows 2003, for example, double-click My Computer, right-click the drive where the Oracle software is to be installed, and select Properties.

4. Determine the amount of disk space available in the temp directory. This is equivalent to the total amount of free disk space, minus what is needed for the Oracle software to be installed.
If there is less than 125 MB of disk space available in the temp directory, then first delete all unnecessary files. If the temp disk space is still less than 125 MB, then set the TEMP or TMP environment variable to point to a different hard drive. For a computer using Windows 2003, for example, double-click System in the Control Panel, click the Advanced tab, and click Environment Variables.

2.1.3 Check the Software Requirements

Oracle Database Vault is installed in an existing Oracle home. All software requirements that were met while installing Oracle Database 10g Release 2 are sufficient for Oracle Database Vault.

See Also:
Oracle Database Installation Guide for Microsoft Windows Itanium (64-Bit) for detailed information about the software requirements for installing Oracle Database

Table 2-2 lists the software requirements for Oracle Database Vault.

Table 2-2 Software Requirements

Requirement

Value

System Architecture

Processor: Intel Itanium 2 or later

Note: Oracle provides 32-bit (x86), 64-bit (Itanium), and 64-bit (x64) versions of Oracle Database for Microsoft Windows. The 64-bit (Itanium) database version, which this installation guide describes, runs on the 64-bit version of Windows on Itanium hardware. For additional information, visit My Oracle Support (formerly OracleMetaLink) at:

https://support.oracle.com

Operating System

Oracle Database for 64-bit Windows is supported on the following operating systems:

- Windows Server 2003 Datacenter Edition for 64-bit Itanium 2 Systems

- Windows Server 2003 Enterprise Edition for 64-bit Itanium 2 Systems

- Windows Server 2008 for Itanium-based Systems

- Windows Server 2008 R2 for Itanium-based Systems

Windows Multilingual User Interface Pack is supported on Windows 2003.

Windows XP is not supported.

Compiler

The following components are supported with the Windows 2003 Microsoft Platform SDK or later compiler and Intel compiler versions 7.1 and 8.1:

- Oracle C++ Call Interface

- Oracle Call Interface

- External callouts

- PL/SQL native compilation

- Pro*C

- XDK

GNU Compiler Collection (GCC), Object Oriented COBOL (OOCOBOL) specifications, and Pro*COBOL are not supported.

Network Protocol

The Oracle Net foundation layer uses Oracle protocol support to communicate with the following industry-standard network protocols:

- TCP/IP

- TCP/IP with SSL

- Named Pipes

Oracle Database Client

If you plan to connect to Oracle Database 10g release 2 (10.2) from a release of Oracle Database Client that is earlier than 10g release 2 (10.2), you will not be able to do so if the following conditions exist:

- Oracle Database Client is running on the same computer as Oracle Database 10g release 2 (10.2).

- Microsoft Windows Terminal Services is not running on the same computer as Oracle Database Client. Typically, Terminal Services is installed and configured with Microsoft Windows 2003.

- Oracle Database Client is version 9.2.0.6, or 10.1–10.1.0.3.

- Oracle Database Client is not running as Administrator.

To remedy this problem, upgrade Oracle Database Client by using the latest Oracle Database Family patchset (9.2.0.7, or 10.1.0.4 or later). You can download the patchset from the Patches and Updates section of My Oracle Support (formerly OracleMetaLink) at:

https://support.oracle.com

2.1.4 Check the Database Requirements

In order to install Oracle Database Vault, you must be running the Enterprise Edition of Oracle Database 10g Release 2 (10.2.0.5). The database should also have Oracle Enterprise Manager Console DB 10.2.0.5.0 installed. In addition, the Database Vault installer requires write access to the files, oratab and oraInst.loc.

A listener must have been configured for the existing database. Oracle Net Configuration Assistant configures the listener when you first install the database. You can also use Oracle Enterprise Manager to administer listeners.

You must have an existing password file for the database. The password file authentication parameter, REMOTE_LOGIN_PASSWORDFILE must have been set to EXCLUSIVE or SHARED.

You can set the REMOTE_LOGIN_PASSWORDFILE parameter in the init.ora file. Use the orapwd utility to create and manage password files.

See Also:
Oracle Database Administrator's Guide for more information about creating and maintaining a password file

The following topics discuss applying the 10.2.0.5 patch set and installing the required components:

- Install Oracle Enterprise Manager Console DB

- Apply Oracle Database Release 10.2.0.5 Patch Set

2.1.4.1 Install Oracle Enterprise Manager Console DB

Before installing Oracle Database Vault, you should ensure that Oracle Enterprise Manager Console DB 10.2.0.5.0 is installed. Oracle Enterprise Manager Console DB is installed using the Oracle Universal Installer (OUI). The following steps summarize installing Oracle Enterprise Manager Console DB:

1. Run Oracle Universal Installer (OUI) and perform a custom installation to install Oracle Enterprise Manager Console DB 10.2.0.1.0. Add Oracle Enterprise Manager Console DB from the list of available product components.

2. Apply the Oracle Database release 10.2.0.5 patch set.

Note:
You can configure the database to use Enterprise Manager Database Control by using Database Configuration Assistant (DBCA). However, configuring Enterprise Manager Database Control is not a prerequisite for installing Oracle Database Vault.

2.1.4.2 Apply Oracle Database Release 10.2.0.5 Patch Set

To install Oracle Database Vault, you must upgrade the database to Oracle Database release 10.2.0.5. Oracle strongly recommends that you back up your database before performing any upgrade or installation.

See Also:
Oracle Database Backup and Recovery Advanced User's Guide for information about database backups

This section covers the following topics:

Patch Set Overview

The patch set is not a complete software distribution. You must install it in an existing Oracle Database 10g Release 2 installation. You can apply the Oracle Database Release 10.2.0.5 patch set to the following Oracle Database 10g Release 2 installations:

- Oracle Database

- Oracle Real Application Clusters

- Oracle Database Client

- Oracle Database Companion CD

- Oracle Clusterware

- Oracle Database Vault

Oracle Universal Installer Version Requirements

This patch set includes Oracle Universal Installer release 10.2.0.5, which is also installed when you install this patch set. This is to ensure that your Oracle home can be patched in the future. You should not use the Installer from the earlier maintenance release media or Oracle home.

Patch Set Documentation

There are two documents related to this release of the Oracle Database patch set:

- Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.5) Patch Set 2 for Microsoft Windows (64-Bit) on Intel Itanium

- Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.5) Patch Set

Both of these documents are included with the patch set. In addition, they are available on the My Oracle Support (formerly OracleMetalink) Web site:

https://support.oracle.com

2.1.5 Prepare a Backup Strategy

Oracle strongly recommends that you back up your database before performing any upgrade or installation. The ultimate success of your upgrade depends heavily on the design and execution of an appropriate backup strategy. To develop a backup strategy, consider the following questions:

- How long can the production database remain inoperable before business consequences become intolerable?

- What backup strategy should be used to meet your availability requirements?

- Are backups archived in a safe, offsite location?

- How quickly can backups be restored (including backups in offsite storage)?

- Have recovery procedures been tested successfully?

Your backup strategy should answer all of these questions and include procedures for successfully backing up and recovering your database.

See Also:
Oracle Database Backup and Recovery Advanced User's Guide for information about database backups

2.1.6 Disable Custom Profiles (If Any)

If you have created custom profiles and password complexity checks in your existing database, then you must disable these before performing the installation. You can reenable these after the installation is complete. Use the following steps to achieve this:

1. Extract the profile names and associated settings for each profile that is being used. You can use a script to accomplish this.

Example 2-1 shows a sample script that extracts the profile names and settings to create an output script called, myprofiles.sql. After the installation is complete, you can run myprofiles.sql to restore the profile settings.

Example 2-1 Extracting Profiles

set serverout on size 100000
spool myprofiles.sql
.
declare
l_last varchar2(30) := 'X';
l_count number := 0;
begin
for c in (
select profile, resource_name , limit
from dba_profiles
order by profile, resource_name
) loop
if l_last <> c.profile then
l_last := c.profile;
if l_count > 0 then
dbms_output.put_line(';');
end if;
l_count := l_count + 1;
dbms_output.put_line('create profile ' || c.profile || ' limit ');
else
dbms_output.put_line('    ' || c.resource_name || ' ' || c.limit);
end if;
end loop;
dbms_output.put_line(';');
end;
/
.
spool off

2. Disable the custom profiles and password complexity settings. For example:

SQL> ALTER PROFILE SomeCustomProfile LIMIT
PASSWORD_REUSE_MAX UNLIMITED -- The number of times a password can be reused
PASSWORD_REUSE_TIME UNLIMITED -- The number of days between reuses of a password
PASSWORD_VERIFY_FUNCTION NULL
/

3. After the Oracle Database Vault installation is complete, reenable the profiles by running the script created in Step 1.
SQL>@myprofiles.sql

2.1.7 Verify That Oracle Clusterware Is Running (Oracle RAC Only)

Oracle Clusterware should be running for the Database Vault installer to find the existing Oracle Real Application Clusters (Oracle RAC) databases. If you have stopped Oracle Clusterware, then you should restart it before running Oracle Universal Installer. Use the following command to start Oracle Clusterware:

C:/> CRS_HOME/bin/crsctl start crs

Note:

- You must run the crsctl start crs command on all nodes of the cluster.

- The crsctl start crs command also starts the database. You need to shut down the database before running Oracle Universal Installer.

2.1.8 Stop Existing Oracle Processes

Stop all processes running in the Oracle home, except the database listener. You must complete this task to enable Oracle Universal Installer to relink certain executables and libraries. For Oracle RAC databases, you must stop the processes on all nodes.

Note:
The database listener process must be running before you run the installer.

Stop the processes in the following order:

1. Stop the Enterprise Manager Database Control Process

2. Stop the iSQL*Plus Process

3. Shut Down All Database Instances

4. Stop Oracle Services

2.1.8.1 Stop the Enterprise Manager Database Control Process

Stop the Enterprise Manager Database Control process, if it is running. Use the following command:

C:\> ORACLE_HOME\bin\emctl stop dbconsole

Here, ORACLE_HOME must be replaced by the path to your Oracle home directory.

2.1.8.2 Stop the iSQL*Plus Process

Stop the iSQL*Plus process, using the following command:

C:\> ORACLE_HOME\bin\isqlplusctl stop

Here, ORACLE_HOME must be replaced by the path to your Oracle home directory.

2.1.8.3 Shut Down All Database Instances

Shut down all database instances running from the Oracle home directory into which Oracle Database Vault is to be installed.

sqlplus SYS "AS SYSOPER"
Enter password:
SQL> shutdown immediate

Note:
Do not use SQL*Plus to start and stop Oracle RAC instances. See Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database" for more details.

2.1.8.4 Stop Oracle Services

Use the following steps to stop Oracle Database services from the Control Panel:

1. Access your Windows Services window.

See Also:
Your operating system documentation for instructions

2. Select OracleServiceSID and click Stop.

Note:
If you are installing Database Vault for Oracle Real Application Clusters (Oracle RAC), then you must shut down all Oracle processes on all cluster nodes. See Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database"for more details.

2.1.9 Run Oracle Universal Installer to Install Oracle Database Vault

This section contains:

- Downloading the Oracle Database Vault Software

- Installing Oracle Database Vault with Oracle Universal Installer

2.1.9.1 Downloading the Oracle Database Vault Software

You can download the Oracle Database Vault software from the following web site:

http://www.oracle.com/technetwork/database/options/database-vault/index-090593.html

2.1.9.2 Installing Oracle Database Vault with Oracle Universal Installer

After you download and extract the Oracle Database Vault software, you can use Oracle Universal Installer (OUI), which is provided in the download, to install Oracle Database Vault into an existing Oracle Database 10g Release 2 (10.2.0.5) database.

To install Oracle Database Vault:

1. Log on as a member of the Administrators group.
If you are installing on a Primary Domain Controller (PDC) or a Backup Domain Controller (BDC), log on as a member of the Domain Administrators group.

2. Insert Oracle Database Vault installation media and navigate to the database directory. Alternatively, navigate to the directory where you downloaded or copied the installation files.
Use the same installation media to install Oracle Database Vault on all supported Windows platforms.

3. Double-click setup.exe to start Oracle Universal Installer.

4. In the Specify Installation Details screen, you need to specify the path to the Oracle home that contains the existing Oracle Database. The Destination Path box lists the Oracle home paths of all Oracle Database 10g Release 2 (10.2.0.5) Enterprise Edition databases registered with the system.
Select the Oracle home corresponding to the database into which you want to install Oracle Database Vault.

Note:

- If an Oracle home does not have an Enterprise Edition of Oracle Database 10g Release 2 (10.2.0.5) installed, then it is not displayed. You must ensure that the Oracle home has an Enterprise Edition of Oracle Database 10g Release 2 (10.2.0.5) installed.

- If an Oracle home does not have Oracle Enterprise Manager Console DB 10.2.0.5.0 installed, then it is not displayed. You must ensure that the Oracle home has Oracle Enterprise Manager Console DB 10.2.0.5.0 installed.

- If an Oracle home contains an Automatic Storage Management (ASM) instance, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home that also contains an ASM instance.

- If an Oracle home already contains Oracle Database Vault, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home more than once.

- Oracle Clusterware should be running for the Database Vault installer to find the existing Oracle Real Application Clusters (Oracle RAC) databases. Ensure that Oracle Clusterware is running before installing Oracle Database Vault. You can use the crsctl command to start Oracle Clusterware.

5. Enter a user name for the Database Vault Owner account in the Database Vault Owner field. The user name can be a minimum of 2 and maximum of 30 characters long.

6. Enter a password for the Database Vault Owner account in the Database Vault Owner Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

7. Reenter the password in the Confirm Password field.

8. Select Create a Separate Account Manager if you want to create a separate Account Manager to manage Oracle Database Vault accounts.

9. In the Database Vault Account Manager field, enter a user name for the Database Vault Account Manager if you have chosen to select the Create a Separate Account Manager check box. The user name can be a minimum of 2 and a maximum of 30 characters.

10. Enter a password for the Database Vault Account Manager account in the Account Manager Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

11. Reenter the password in the Confirm Password field. Click Next.

12. The Select Existing Database screen is displayed. A list of all databases running from the selected Oracle home is displayed. Select the database into which you wish to install Oracle Database Vault.

Note:

- Oracle recommends that you install Oracle Database Vault into an Oracle home containing only a single database.
If there are multiple databases in an Oracle home, you must enable Database Vault for all the databases. You cannot have Database Vault enabled databases coexist with non-Database Vault enabled databases in the same Oracle home. In order to enable Database Vault for addtional databases in the same Oracle home, refer to Appendix C, "Running DVCA After Creating a Database Vault Database"

- If a database is not listed, then check to make sure that you have followed the instructions under "Check the Database Requirements".

13. Enter the existing SYS user password for the selected database in the Existing Database SYS Password field.

14. Reenter the SYS password in the Confirm Password field. Click Next.

Note:
At this point, the database requirements are validated.

15. You are prompted to shut down all Oracle processes running from the Oracle home before proceeding. Shut down the Oracle processes, if you have not already done so.

See Also:
"Stop Existing Oracle Processes" for more information on stopping existing Oracle processes

16. Product-specific prerequisite checks are performed. Confirm that all tests have passed. Click Next to continue.

17. The Summary screen is displayed with the installation details. Verify the details and click Install.

18. The Installation screen is displayed. After the installation completes, the Database Vault Configuration Assistant (DVCA) is run automatically. DVCA helps configure the Database Vault installation.

2.2 Postinstallation Tasks

This section lists the tasks to perform after you have completed an upgrade of your database. The following topics are discussed:

- Back Up the Database

- Change Passwords for Oracle-Supplied Accounts

- Disable Remote SYSDBA Connections (Optional)

- Start the Database on Other Nodes (Oracle RAC Only)

- Configure Oracle Database Vault on Oracle RAC Nodes (Oracle RAC Only)

- Manually Deploy Oracle Database Vault Administrator (Special Cases)

- Restart Enterprise Manager Database Control

- Setting the Timeout Value for DVA (Optional)

2.2.1 Back Up the Database

Make sure you perform a full backup of the production database. Refer to Oracle Database Backup and Recovery Advanced User's Guide for details about backing up a database.

2.2.2 Change Passwords for Oracle-Supplied Accounts

Oracle strongly recommends that you change the password for each account after installation. This enables you to effectively implement the strong security provided by Oracle Database Vault.

Note:
If you are creating a database using Database Configuration Assistant, you can unlock accounts after the database is created by clicking Password Management before you exit from Database Configuration Assistant.

2.2.2.1 Using SQL*Plus to Unlock Accounts and Reset Passwords

To unlock and reset user account passwords using SQL*Plus:

1. Start SQL*Plus and log in using the Database Vault Account Manager account. If you did not create the Database Vault Account Manager account during installation, then you need to log in using the Database Vault Owner account.

2. Enter a command similar to the following, where account is the user account that you want to unlock and password is the new password:

SQL> ALTER USER account [ IDENTIFIED BY password ] ACCOUNT UNLOCK;

In this example:

- The ACCOUNT UNLOCK clause unlocks the account.

- The IDENTIFED BY password clause resets the password.

Note:
If you unlock an account but do not reset the password, then the password remains expired. The first time someone connects as that user, they must change the user's password.
To permit unauthenticated access to your data through HTTP, unlock the ANONYMOUS user account.

See Also:
Oracle Database Administrator's Guide for more information about:

- Unlocking and changing passwords after installation

- Oracle security procedures

- Best security practices

2.2.3 Disable Remote SYSDBA Connections (Optional)

Oracle Database Vault enables you to disable remote logins with SYSDBA privileges. This enables enhanced security for your database.

To disable remote SYSDBA connections, re-create the password file with the nosysdba flag set to y (Yes). A user can still log in AS SYSDBA locally using Operating System (OS) authentication. However, remote connections AS SYSDBA fail.

Use the following syntax to re-create the password file:

C:\> ORACLE_HOME\bin\orapwd file=filename password=password [entries=users] force=y nosysdba=y

Where:

- file: Name of password file (mandatory)

- password: Password for SYS (mandatory). Enter at least six alphanumeric characters.

- entries: Maximum number of distinct DBA users

- force: Whether to overwrite the existing file

- nosysdba: Whether to enable or disable the SYS logon
The default is no, so if you omit this flag, the password file will be created enabling SYSDBA access for Oracle Database Vault instances.

For example:

C:\> oracle\product\10.2.0\db_1\bin\orapwd
file=C:\oracle\product\10.2.0\db_1\dbs\orapwORCL password=5hjk99 force=y
nosysdba=y

Note:
Do not insert spaces around the equal (=) character.

See Also:
Oracle Database Administrator's Guide for more information about using the orapwd utility

When you re-create the password file, any accounts other than SYS that were granted the SYSDBA or SYSOPER privileges will have those privileges removed. You need to regrant the privileges for these accounts after you have re-created the password file.

You can reenable the ability to connect with the SYSDBA privilege by re-creating the password file with the nosysdba flag set to n (No). You might need to reenable the ability to connect with SYSDBA privileges, if certain products or utilities require it's use.

2.2.4 Start the Database on Other Nodes (Oracle RAC Only)

You must start the database on all Oracle RAC nodes other than the one on which the installation is performed. Use the following command to start the listener and the database:

Note:
You must connect AS SYSDBA to run the command.

C:\> ORACLE_HOME\bin\srvctl start instance -d sid -i InstanceName

Note:
You must use the Server Control (srvctl) utility to start and stop Oracle RAC instances. Do not use SQL*Plus to start and stop Oracle RAC instances. You must enable SYSDBA connections before you can use the srvctl command.

2.2.5 Configure Oracle Database Vault on Oracle RAC Nodes (Oracle RAC Only)

After you install Oracle Database Vault for an Oracle Real Application Clusters (Oracle RAC) instance, complete the following procedure for each Oracle RAC node. This procedure assumes that you have a separate Oracle home for each node.

Note:
The dvca -action optionrac option has been deprecated and can no longer be used to configure Oracle RAC nodes.

1. Log in to SQL*Plus as user SYS with the SYSDBA privilege.

sqlplus SYS "AS SYSDBA"
Enter password:

2. Run the following ALTER SYSTEM statements:

SQL> ALTER SYSTEM SET AUDIT_SYS_OPERATIONS=TRUE SCOPE=SPFILE;
SQL> ALTER SYSTEM SET OS_ROLES=FALSE SCOPE=SPFILE;
SQL> ALTER SYSTEM SET RECYCLEBIN='OFF' SCOPE=SPFILE;
SQL> ALTER SYSTEM SET REMOTE_LOGIN_PASSWORDFILE='EXCLUSIVE' SCOPE=SPFILE;
SQL> ALTER SYSTEM SET SQL92_SECURITY=TRUE SCOPE=SPFILE;
SQL> ALTER SYSTEM SET OS_AUTHENT_PREFIX='' SCOPE=SPFILE;

3. Restart Oracle Database.

C:\> ORACLE_HOME\bin\srvctl stop database -d db_name
C:\> ORACLE_HOME\bin\srvctl start database -d db_name

2.2.6 Manually Deploy Oracle Database Vault Administrator (Special Cases)

If you have created an Oracle database manually, and have configured Oracle Enterprise Manager Database Control by using Enterprise Manager Configuration Assistant, you must manually deploy Oracle Database Vault Administrator. This procedure deploys Database Vault Administrator in the same OC4J container as the current Enterprise Manager, rather than creating a new application.

This section contains:

- Deploying Database Vault Administrator to a Standalone OC4J Container

- Deploying Database Vault Administrator to the Database Console OC4J Container

2.2.6.1 Deploying Database Vault Administrator to a Standalone OC4J Container

You can manually deploy Database Vault Administrator to the Oracle Application Server Containers for J2EE (OC4J) home, which by default is in the ORACLE_HOME\oc4j\j2ee\home directory.

To manually deploy Database Vault Administrator:

1. Edit the file ORACLE_HOME\oc4j\j2ee\home\config\server.xml. Enter the following line just before the last line that reads, </application-server>:

<application name="dva" path="ORACLE_HOME\dv\jlib\dva_webapp.ear" auto-start="true" />

For example:

<application name="dva" path="C:\oracle\product\10.2.0\db1\dv\jlib\dva_webapp.ear"
auto-start="true" />

2. Edit the file ORACLE_HOME\oc4j\j2ee\home\config\http-web-site.xml. Enter the following line just above the last line that reads, </web-site>:

<web-app application="dva" name="dva_webapp" root="/dva" />

3. Edit the file ORACLE_HOME\oc4j\j2ee\home\config\global-web-application.xml. Search for <servlet-class>oracle.jsp.runtimev2.JspServlet</servlet-class>. Uncomment the following lines after this:

<init-param>
<param-name>main_mode</param-name>
<param-value>justrun</param-value>
</init-param>

4. Create the following directory:

ORACLE_HOME\dv\jlib\sysman\config

5. Create the database connection configuration file, emoms.properties, in the configuration directory that you just created. Add the following lines to the file:

oracle.sysman.emSDK.svlt.ConsoleMode=standalone
oracle.sysman.eml.mntr.emdRepRAC=FALSE
oracle.sysman.eml.mntr.emdRepDBName=ORACLE_SID
oracle.sysman.eml.mntr.emdRepConnectDescriptor=TNS_connection_string

Follow these instructions:

- For an Oracle RAC environment, set oracle.sysman.eml.mntr.emdRepRAC to TRUE.

- For oracle.sysman.eml.mntr.emdRepConnectDescriptor, you can use an alias from ORACLE_HOME\network\admin\tnsnames.ora. Alternatively, you can use the following syntax:

oracle.sysman.eml.mntr.emdRepConnectDescriptor=
(DESCRIPTION\=
(ADDRESS_LIST\=(ADDRESS\=(PROTOCOL\=TCP) (HOST\=HOSTNAME)(PORT\=PORT)))
(CONNECT_DATA\=
(SERVICE_NAME\=ORACLE_SID))

6. Ensure that the correct environment variables are set.
For example:

ORACLE_SID=orcl
ORACLE_HOME=C:\oracle\product\10.2.0\dv
LD_LIBRARY_PATH=C:\oracle\product\10.2.0\dv\BIN;C:\oracle\product\10.2.0\dv\LIB
;C:\oracle\product\10.2.0\dv\jdbc\lib
PATH=ORACLE_HOME\bin;ORACLE_HOME\jdk\bin;%PATH%

Ensure that you set the LD_LIBRARY_PATH variable to use the OCI-based JDBC libraries.

7. Start OC4J using the following syntax:

C:\> ORACLE_HOME\jdk\bin\java -Djava.awt.headless=true
-DEMDROOT=ORACLE_HOME\dv\jlib -jar ORACLE_HOME\oc4j\j2ee\home\oc4j.jar
-userThreads -config ORACLE_HOME\oc4j\j2ee\home\config\server.xml

After you complete these steps, you can start Database Vault Administrator. The HTTP port defaults to 8888 for this environment. Use the following syntax for the URL:

http://hostname:8888/dva

2.2.6.2 Deploying Database Vault Administrator to the Database Console OC4J Container

To manually deploy Database Vault Administrator to the Database Console OC4J container:

1. Stop Oracle Database Console.
Under Administrative Services, select the Services utility, and then right-click the OracleDBConsolesid service. Select Stop from the context menu.

2. Create a backup copy and then open the ORACLE_HOME\oc4j\j2ee\OC4J_DBConsole_service_name\config\server.xml file.

3. Add the following line before the </application-server> element:

<application name="dva" path="ORACLE_HOME\dv\jlib\dva_webapp.ear" parent="default" start="true" />

4. Create a backup copy and then open the ORACLE_HOME\oc4j\j2ee\OC4J_DBConsole_service_name\config\http-web-site.xml file.

5. Add the following line before the </web-site> element:

<web-app application="dva" name="dva_webapp" load-on-startup="true" root="/dva" shared="true"/>

6. Restart Oracle Database Console.
Under Administrative Services, select the Services utility, and then right-click the OracleDBConsolesid service. Select Start from the menu.

After you complete these steps, you can start Oracle Database Vault Administrator by using the following URL:

https://hostname:port/dva

For example:

https://myserver:1158/dva

If you are unsure of the port number, open the ORACLE_HOME\host_sid\sysman\config\emd.properties file and search for REPOSITORY_URL. In most cases, the host name and port number are the same as Oracle Enterprise Manager Database Control.

2.2.7 Restart Enterprise Manager Database Control

Restart Enterprise Manager Database Control by using the following commands:

C:\> ORACLE_HOME\bin\emctl stop dbconsole
C:\> ORACLE_HOME\bin\emctl start dbconsole

Note:
Run the above commands on all cluster nodes for an Oracle RAC database.

2.2.8 Setting the Timeout Value for DVA (Optional)

Oracle Database Vault Administrator (DVA) is a browser-based graphical user interface console that you can use to manage Oracle Database Vault.

You can modify the length of time that DVA stays connected while inactive. By default, the connection duration is 35 minutes. Your session automatically gets expired after 35 minutes of inactivity.

To set the session time for Oracle Database Vault Administrator:

1. Back up the web.xml file, which by default is in the ORACLE_HOME\dv\jlib\dva_webapp\dva_webapp\WEB-INF directory.

2. In a text editor, open the web.xml file .

3. Search for the following setting:

<session-config>
<session-timeout>35</session-timeout>
</session-config>

4. Change the <session-timeout> setting to the amount of time in minutes that you prefer.

5. Save and close the web.xml file.

6. Stop and restart the DVA application.
You can use the following command to restart DVA:

emctl stop dbconsole
emctl start dbconsole

2.3 Removing Oracle Database Vault

The following procedures uninstall Oracle Database Vault from an Oracle Database installation. They apply to both single-instance and Oracle RAC installations.

- Step 1: Deconfigure Oracle Database Vault

- Step 2: Deinstall Oracle Database Vault

2.3.1 Step 1: Deconfigure Oracle Database Vault

1. Disable Oracle Database Vault, as described under "Step 1: Disable Oracle Database Vault" in Oracle Database Vault Administrator's Guide.

2. In SQL*Plus, connect as user SYS with the SYSDBA privilege.

CONNECT SYS/AS SYSDBA
Enter password: password

3. Disable the recycle bin.
To check if the recycle bin is enabled, enter the following command:

SHOW PARAMETER RECYCLEBIN

If it is enabled, then run the following SQL statement:

ALTER SYSTEM SET RECYCLEBIN = OFF SCOPE=SPFILE;

Disabling the recycle bin does not purge or otherwise affect objects that are in the recycle bin.

4. Run the following SQL script:

ORACLE_HOME\rdbms\admin\dvremov.sql

5. Manually drop the DV_OWNER and DV_ACCTMGR user accounts.
For example:

DROP USER dbv_owner CASCADE;
DROP USER dbv_acctmgr CASCADE;

6. Restart the database.
For example:

SHUTDOWN IMMEDIATE
STARTUP

2.3.2 Step 2: Deinstall Oracle Database Vault

1. Start OUI by invoking setup.exe from the ORACLE_HOME\oui\bin directory.

2. In the Welcome window, select Deinstall Products.

3. Navigate to the correct directory and then select Database Vault 10.2.0.5 from the list.

4. In the confirmation window, select Yes.

5. Exit OUI.

Afterward, you can double-check that Oracle Database Vault is truly deinstalled by logging in to SQL*Plus and entering the following statement:

SELECT * FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';

If Oracle Database Vault is deinstalled, the following output appears:

PARAMETER                     VALUE
----------------------------- -----------------------
Oracle Database Vault         FALSE

Part II

Appendixes

Part II includes the appendixes. The contents of this part are:

- Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database"

- Appendix B, "Using Response Files"

- Appendix C, "Running DVCA After Creating a Database Vault Database"

- Appendix E, "Database Listener Security Recommendations"

- Appendix F, "Initialization Parameters"

- Appendix G, "Enabling Oracle Database Vault Administrator Accessibility"

A How to Stop Processes in an Existing Oracle Real Application Clusters Database

This appendix describes how to stop all processes in an Oracle Real Application Clusters (Oracle RAC) database, in preparation for installing Database Vault.

Note:
Before you make any changes to the Oracle software, Oracle recommends that you create a backup of the Oracle Database installation.

To stop all processes in an Oracle Real Application Clusters (Oracle RAC) database, use the following steps:

Note:
You must perform these steps in the order listed.

1. Make sure that the environment variables, ORACLE_HOME, ORACLE_SID, and PATH are correctly set.

2. Shut down any processes in the Oracle home on each node that can access a database. For example, you must shut down Oracle Enterprise Manager Database Control.

C:\> ORACLE_HOME\bin\emctl stop dbconsole

Note:
Before you shut down any processes that are monitored by Enterprise Manager Grid Control, set a blackout in Grid Control for the processes that you intend to . This is necessary so that the availability records for these processes indicate that the shutdown was planned downtime, rather than an unplanned system outage.

3. Shut down all Oracle RAC instances on all nodes. To shut down all Oracle RAC instances for a database, enter the following command, where db_name is the name of the database:

C:\> ORACLE_HOME\bin\srvctl stop database -d db_name

4. Stop the OracleServiceSID service on all nodes. You can access the Services window from the Control Panel.

B Using Response Files

This appendix describes how to install Oracle Database Vault using a response file. It includes the following topics:

- How Response Files Work

- Installing Database Vault Using a Response File

- Troubleshooting Silent Mode Installation

B.1 How Response Files Work

You can automate the installation and configuration of Oracle software by specifying a response file when you start Oracle Universal Installer. Oracle Universal Installer uses the values contained in the response file to provide answers to some or all of Oracle Universal Installer prompts.

Typically, Oracle Universal Installer runs in interactive mode, which means that it prompts you to provide information in graphical user interface (GUI) screens. When you use response files to provide this information, you run Oracle Universal Installer at a command prompt using the silent mode.

During a silent mode installation, Oracle Universal Installer does not display any screens. Instead, it displays progress information in the terminal that you used to start it.

You define the settings for a silent mode installation by entering values for the variables listed in the response file. For instance, to specify the Oracle home, you would supply the appropriate value for the ORACLE_HOME variable, as in the following example:

ORACLE_HOME = "C:\oracle\product\10.2.0\OraDBHome1"

Another way of specifying the response file's variable settings is to pass them as command line arguments when you run Oracle Universal Installer. For example:

SYSTEM_DRIVE:\setup.exe_location> setup -silent "ORACLE_HOME=C:\oracle\product\10.2.0\OraDBHome1" ...

This method is particularly useful if you do not want to embed sensitive information, such as passwords, in the response file. For example:

SYSTEM_DRIVE:\setup.exe_location> setup -silent "s_ownerPasswd=binks342" ...

Ensure that you enclose the variable and its setting in double quotation marks (" ").

See Also:
Oracle Universal Installer and OPatch User's Guide for Windows and UNIX for more information about response file formats

B.1.1 General Procedure for Using Response Files

The following are the general steps to install and configure Oracle products using Oracle Universal Installer in silent mode:

Note:
You must complete all required preinstallation tasks on a system before running Oracle Universal Installer in silent mode.

1. Prepare a response file.

2. Run Oracle Universal Installer in silent mode.

B.2 Installing Database Vault Using a Response File

Use the following steps to install Database Vault using a response file:

1. Prepare the Response File

2. Run Oracle Universal Installer Using the Response File

B.2.1 Prepare the Response File

Oracle Database Vault comes with a response file template (dv.rsp) that you can edit to customize your installation. You can use this response file for silent mode installations.

The dv.rsp file is located in the response directory on the installation media. Use the following steps to copy and modify the response file:

1. Copy the response file from the Disk1\response directory to a directory on your system.

2. Open the response file in a text editor.
The response file contains variables that store information required by Oracle Universal Installer. You must set these variable values in the file. For example, you must specify values for the Oracle home location, Database Vault owner name, and other such information required by Oracle Universal Installer.

The response file contains two parts. You should edit the variables only in the first part. The second part of the file contains preset variables, which must not be edited. This instruction is also provided in the response file.

Some of the variables are mandatory while others are optional. The mandatory variables must be supplied for a successful installation. Each variable is explained within the response file. Examples are also provided within the response file.

The following excerpt from the response file shows instructions related to setting the Oracle home variable:

#-----------------------------------------------------------------------------
--
#Name       : ORACLE_HOME
#Datatype   : String
#Description: Complete path of the existing 10.2.0.4.0 database Oracle
#             Home into which Oracle Database Vault will be installed.
#
#Requirement: 1) Must have Oracle Database Enterprise Edition release
#                10.2.0.5.0 installed.
#             2) Must have Oracle Enterprise Manager Console DB version
#                10.2.0.5.0 installed.
#             3) Cannot contain an Automatic Storage Management(ASM) instance.
#             4) Cannot contain Oracle Database Vault.
#
#Example: ORACLE_HOME = "C:\OHOME1"
#-----------------------------------------------------------------------------
--
ORACLE_HOME=Value Required

Lines starting with a pound sign (#) are comment entries. If you want to omit an optional variable, you can comment it by adding a pound sign (#) at the beginning of the line. You cannot comment lines containing mandatory variables, like ORACLE_HOME.

Remember that you can specify sensitive information, such as passwords, at the command line rather than within the response file. "How Response Files Work" explains this method.

See Also:
Oracle Universal Installer and OPatch User's Guide for Windows and UNIX for detailed information about creating response files

3. Follow the instructions in the file to edit it. Save and close the file.

Note:
Oracle Universal Installer fails if you do not correctly configure the response file. Refer to the "Troubleshooting Silent Mode Installation" section for more information about troubleshooting a failed silent mode installation.

B.2.2 Run Oracle Universal Installer Using the Response File

Now, you are ready to run Oracle Universal Installer at the command line, specifying the response file you created, to perform the installation. The Oracle Universal Installer executable, setup.exe, provides several options. For help information on the full set of these options, run setup.exe with the -help option. For example:

SYSTEM_DRIVE:\setup.exe_location> setup -help

To run Oracle Universal using a response file:

1. Complete the preinstallation tasks listed in Chapter 2, "Installing Oracle Database Vault".

See Also:
Frequently Asked Questions in the Oracle Database Vault Release Notes for Microsoft Windows Itanium (64-Bit) for a checklist of the preinstallation requirements

2. Log on as a member of the Administrators group.

3. To start Oracle Universal Installer in silent mode, enter a command similar to the following:

Note:
Do not specify a relative path to the response file. If you specify a relative path, Oracle Universal Installer fails.

- SYSTEM_DRIVE:\setup.exe_location> setup -silent -responseFile responsefilename

In this example:

- -silent indicates that you want to run Oracle Universal Installer in silent mode.

- responsefilename is the full path and file name of the installation response file that you configured.

B.3 Troubleshooting Silent Mode Installation

A silent installation fails in the following conditions:

- You do not specify a response file

- You specify an incorrect or incomplete response file

- Oracle Universal Installer encounters an error, such as insufficient disk space

- The Database Vault installation prerequisites have not been met

Oracle Universal Installer or configuration assistant validates the response file at run time. If the validation fails, the silent mode installation or configuration process ends. Oracle Universal Installer treats values for parameters that are of the wrong context, format, or type as if no value was specified in the file.

C Running DVCA After Creating a Database Vault Database

You should run Database Vault Configuration Assistant (DVCA) after creating a new Oracle Database Vault database, if any of the following conditions is true:

- Database Vault is installed into an Oracle home that has more than one database. You must run DVCA on the other databases in the Oracle home. This enables Database Vault security for those databases. The databases should meet the prerequisites for installing Oracle Database Vault, as discussed in "Preinstallation and Installation Tasks" .

- Database Configuration Assistant (DBCA) is used to create a new Database Vault database in an Oracle home that has a Database Vault database. DVCA loads the Database Vault schema objects into the new database, creates the DV_OWNER and optional DV_ACCTMGR accounts, and deploys the Database Vault Administrator application for the database.

Use the following syntax to run the DVCA utility:

Note:
Make sure that the database is up and running before executing this command.

C:\> ORACLE_HOME\bin\dvca -action option -oh oracle_home
-hostname host_name -owner_account DV_owner_account_name
-owner_passwd DV_owner_account_password
-jdbc_str jdbc_connection_string
-sys_passwd SYS_password [-dvsys_passwd DVSYS_passwd][-acctmgr_account DV_account_manager_account_name]
[-acctmgr_passwd DV_account_manager_password]
[-logfile .\dvca.log] [-nodecrypt] [-racnode host_name]
[-listener listener_name]
[-languages {"[en],[de],[es],[fr],[it],[ja],[ko],[pt_BR],[zh_CN],[zh_TW]"}]

Where:

- action: The action to perform. option creates the Database Vault schema objects, creates the DV_OWNER account and the optional DV_ACCTMGR account, and deploys the Database Vault Administrator application.

- oh: The Oracle home for the database.

- hostname: The physical or virtual host name of the host on which the action is performed.

- owner_account: Oracle Database Vault Owner account name

- owner_passwd: Oracle Database Vault owner account password. The command prompts you for a password if you do not enter one on the command line.

- jdbc_str: The JDBC connection string used to connect to the database. For example, jdbc:oracle:oci:@orcl1, where orcl1 is the net service name in the tnsnames.ora file (ORACLE_HOME\network\admin\tnsnames.ora).

- sys_passwd: Password for user SYS. The command prompts for the password, if you do not enter it on the command line.

- dvsys_passwd: (Optional) Password for user DVSYS.

- acctmgr_account: (Optional) Oracle Database Vault Account Manager user

- acctmgr_passwd: Oracle Database Vault Account Manager password (if a user name has been specified). The command prompts for the password, if you do not enter it on the command line.

- logfile: Optionally, specify a log file name and location. You can enter an absolute path or a path that is relative to the location of the ORACLE_HOME\bin directory

- nodecrypt: Reads plaintext passwords as passed on the command line. You must use this option if you are passing plaintext passwords to the command.

- racnode: The host name of the Oracle Real Application Clusters (Oracle RAC) node on which the action is being performed. Do not include the domain name with the host name.Use this option if this is an Oracle RAC database.
After running dvca -action on the first node, you would also need to configure Oracle Database Vault on the other Oracle RAC nodes. Refer to "Configure Oracle Database Vault on Oracle RAC Nodes (Oracle RAC Only)" for more information.

- listener: The name of the listener to be started. If no listener is specified, then none is started. Any listener that is running, including the default listener, is not stopped.

- languages: Declares the language content to load, defaults to "en" (English). You can specify multiple languages. Include each language in quotation marks with commas separating different languages. Enclose the list of languages in braces. For example, -languages {"en","fr","ja"}.
The following lists the language key:

- de: German

- en: English

- es: Spanish

- fr: French

- it: Italian

- ja: Japanese

- ko: Korean

- pt_BR: Brazilian Portuguese

- zh_CN: Simplified Chinese

- zh_TW: Traditional Chinese

Note:

- If the Oracle system identifier (SID) of the database is more than 8 characters, then you would need to update the Net service name in the tnsnames.ora file before running DVCA. Refer to Oracle Database Vault Release Notes for Microsoft Windows Itanium (64-Bit) for more information.

D Upgrading from a Previous Version of Database Vault

If you have Oracle Database Vault 10g Release 2 (10.2.0.2), 10g Release 2 (10.2.0.3), or 10g Release 2 (10.2.0.5) installed, then you can upgrade it to Oracle Database Vault 10g Release 2 (10.2.0.5) without uninstalling the existing instance.

Note:
If you are upgrading Oracle Clusterware only, then you should ensure that you disable Oracle Database Vault before upgrading Oracle Clusterware. You should reenable Oracle Database Vault after the upgrade.

D.1 Upgrading from a 10.2.0.x Version

Use the following steps to upgrade an Oracle Database Vault 10.2.0.x installation to Oracle Database Vault 10g Release 2 (10.2.0.5):

1. Re-create the password file with the nosysdba=n and force=y flags, to allow the SYS user to connect AS SYSDBA. Use the following syntax:

C:\> ORACLE_HOME\bin\orapwd file=ORACLE_HOME\dbs\orapwSID password=password force=y nosysdba=n

Here SID is the Oracle system identifier (SID) of the database and password is the password for the SYS account.

2. Stop the database service from the Services window.
For an Oracle Real Application Clusters (Oracle RAC) database, use the following command to stop the database from any one node before stopping the database service:

C:\> ORACLE_HOME\bin\srvctl stop database -d db_name

Note:
You must use the Server Control (srvctl) utility to start and stop Oracle RAC instances. Do not use SQL*Plus to start and stop Oracle RAC instances. You must enable SYSDBA connections before you can use the srvctl command.

To stop the database service:

In the Control Panel, under Administrative Services, select the Services utility. Select the Standard tab, right-click the following services, and from the menu, select Stop:

- OracleServiceSID

- OracleHOMETNSListener

Note:
For an Oracle RAC database, you must stop the OracleServiceSID and OracleHOMETNSListener services on each Oracle RAC instance.

3. Disable Oracle Database Vault. Under ORACLE_HOME\bin, rename the oradv10.dll file to another name.

For example, you could rename oradv10.dll to oradv10_backup.dll.

Note:

- Ensure that Oracle services are not running before you try to rename the file.

- Remember the name that you use, as you would be required to restore the file in a subsequent step.

- For an Oracle Real Application Clusters (Oracle RAC) database, you must repeat this step on all nodes.

4. Start the database service from the Services window.
For an Oracle Real Application Clusters (Oracle RAC) database, use the following command to start the database:

C:\> ORACLE_HOME\bin\srvctl start database -d db_name

Note:
You must use the Server Control (srvctl) utility to start and stop Oracle RAC instances. Do not use SQL*Plus to start and stop Oracle RAC instances. You must enable SYSDBA connections before you can use the srvctl command.

To start the database service:

In the Control Panel, under Administrative Services, select the Services utility. Select the Standard tab, right-click the following services, and from the menu, select Start:

- OracleServiceSID

- OracleHOMETNSListener

Note:
For an Oracle RAC database, you must start the OracleServiceSID and OracleHOMETNSListener service on each Oracle RAC instance.

5. Unlock the DVSYS account as the SYS user:

C:\> sqlplus "SYS / AS SYSDBA"
Enter password:
SQL>ALTER USER DVSYS ACCOUNT UNLOCK;

6. Disable the Oracle Database Vault triggers. Log into SQL*Plus as SYS using the SYSDBA privilege, and then run the following ALTER TRIGGER statements:

C:\> sqlplus "SYS / AS SYSDBA"
Enter password: password
Connected.
SQL> ALTER TRIGGER DVSYS.DV_BEFORE_DDL_TRG DISABLE;
SQL> ALTER TRIGGER DVSYS.DV_AFTER_DDL_TRG DISABLE;

7. Stop the database service from the Services window.
For an Oracle Real Application Clusters (Oracle RAC) database, use the following command to stop the database from any one node before stopping the database service:

C:\> ORACLE_HOME\bin\srvctl stop database -d db_name

Note:
You must use the Server Control (srvctl) utility to start and stop Oracle RAC instances. Do not use SQL*Plus to start and stop Oracle RAC instances. You must enable SYSDBA connections before you can use the srvctl command.

To stop the database service:

In the Control Panel, under Administrative Services, select the Services utility. Select the Standard tab, right-click the following services, and from the menu, select Stop:

- OracleServiceSID

- OracleHOMETNSListener

Note:
For an Oracle RAC database, you must stop the OracleServiceSID and OracleHOMETNSListener services on each Oracle RAC instance.

8. Install the Oracle Database Release 10.2.0.5 Patch Set and run DBUA to upgrade the database.

See Also:
"Apply Oracle Database Release 10.2.0.5 Patch Set" for more information about installing the patch set

9. Stop the database service if it is running.
For an Oracle Real Application Clusters (Oracle RAC) database, use the following command to stop the database from any one node before stopping the database service:

C:\> ORACLE_HOME\bin\srvctl stop database -d db_name

Note:
You must use the Server Control (srvctl) utility to start and stop Oracle RAC instances. Do not use SQL*Plus to start and stop Oracle RAC instances. You must enable SYSDBA connections before you can use the srvctl command.

To stop the database service:

In the Control Panel, under Administrative Services, select the Services utility. Select the Standard tab, right-click the following services, and from the menu, select Stop:

- OracleServiceSID

- OracleHOMETNSListener

Note:
For an Oracle RAC database, you must stop the OracleServiceSID and OracleHOMETNSListener services on each Oracle RAC instance.

10. Enable Oracle Database Vault. Under ORACLE_HOME\bin, rename the backup of the oradv10.dll file to its original name. You had renamed this file in Step 3.
For example, if you renamed it oradv10_backup.dll, then rename it back to oradv10.dll.

Note:
For an Oracle Real Application Clusters (Oracle RAC) database, you must repeat this step on all nodes.

11. Start the database service from the Services window.
For an Oracle Real Application Clusters (Oracle RAC) database, use the following command to start the database:

C:\> ORACLE_HOME\bin\srvctl start database -d db_name

Note:
You must use the Server Control (srvctl) utility to start and stop Oracle RAC instances. Do not use SQL*Plus to start and stop Oracle RAC instances. You must enable SYSDBA connections before you can use the srvctl command.

To start the database service:

In the Control Panel, under Administrative Services, select the Services utility. Select the Standard tab, right-click the following services, and from the menu, select Start:

- OracleServiceSID

- OracleHOMETNSListener

Note:
For an Oracle RAC database, you must start only the OracleHOMETNSListener service, as you have used srvctl to start the database.
You must start the OracleHOMETNSListener on each Oracle RAC instance.

12. Create the DV_PATCH_ADMIN and DV_MONITOR roles. This is a one-time task. Use the following statements:

SQL> CONNECT DVSYS
Enter password:
SQL> CREATE ROLE DV_PATCH_ADMIN;
SQL> GRANT DV_PATCH_ADMIN TO DV_OWNER WITH ADMIN OPTION;
SQL> GRANT DV_PATCH_ADMIN TO SYS;
SQL> CREATE ROLE DV_MONITOR;

13. Connect AS SYSDBA and run the following SQL statements:

SQL> CONNECT SYS/ as SYSDBA
Enter password:
SQL> @?\rdbms\admin\prvtstas.plb
SQL> @?\rdbms\admin\prvtstat.plb
SQL> @?\rdbms\admin\catols.sql -- Ignore any errors generated by this script
SQL> STARTUP
SQL> CONNECT SYS/ as SYSDBA
Enter password:
SQL> DECLARE
CURSOR stmt IS
select u.name, o.name, r.pname
from user$ u, obj$ o, rls$ r
where u.user# = o.owner#
and r.obj# = o.obj#
and bitand(r.stmt_type,65536) > 0;

object_schema VARCHAR2(32) := NULL;
object_name VARCHAR2(32) := NULL;
policy_name VARCHAR2(32) := NULL;

BEGIN
OPEN stmt;
LOOP
FETCH stmt INTO object_schema, object_name, policy_name;
EXIT WHEN stmt%NOTFOUND;
dbms_rls.drop_policy('"'||object_schema||'"',
'"'||object_name||'"',
'"'||policy_name||'"');
END LOOP;
Close stmt;
END;
/
SQL> spool catmac.log -- please check catmac.log for errors
SQL> @?\rdbms\admin\catmac.sql DVSYS_user_tablespace TEMP_TABLESPACE
SYS_PASSWORD DVSYS_PASSWORD
SQL> INSERT INTO DVSYS.RULE_SET_T$ VALUES (8,
'Allow Datapump Operation',
'Rule set that controls the objects that can be exported or imported by the datapump user.',
' ', 'us');
SQL> COMMIT;
SQL> EXEC DVSYS.DBMS_MACADM.SYNC_RULES;

14. Run the following script as SYSDBA:

SQL> CONNECT SYS/ as SYSDBA
Enter password:
SQL> @?\rdbms\admin\utlrp.sql

15. Enable the Oracle Database Vault triggers:

SQL> CONNECT SYS/ as SYSDBA
Enter password:
SQL> ALTER TRIGGER DVSYS.DV_BEFORE_DDL_TRG ENABLE;
SQL> ALTER TRIGGER DVSYS.DV_AFTER_DDL_TRG ENABLE;

16. Lock the DVSYS account. Use the following SQL statements:

SQL> CONNECT "SYS / AS SYSDBA"
Enter password:
SQL> ALTER USER DVSYS ACCOUNT LOCK;

17. Revoke the DV_PATCH_ADMIN role from SYS as the DV_OWNER user:

SQL> CONNECT DV_OWNER
Enter password:
SQL> REVOKE DV_PATCH_ADMIN FROM SYS;
SQL> QUIT

E Database Listener Security Recommendations

This appendix lists the security recommendations for protecting the database listener.

E.1 Security Checklist for the Database Listener

The following configuration guidelines help enhance the security for your database listener:

- The database listener configuration file, listener.ora, and the supporting OracleNet configuration file, tnsnames.ora, should have the ADMIN_RESTRICTIONS_LISTENER_SID=ON protection enabled.

- The database listener configuration file, listener.ora, and the supporting OracleNet configuration file, tnsnames.ora, should have the PLSExtProc listener disabled.

- The listener should be configured to listen on a non-standard port. This means that the default port (1521) should be changed.

- The listener should be password protected or leverage operating system (OS) authentication based on the organizational security policy.

- The listener should use a unique name, which should be different from the default name.

- The listener.ora file should have the following parameter set:

INBOUND_CONNECT_TIMEOUT_ListenerName = 10

- The sqlnet.ora file should have the following parameters set:

SQLNET.INBOUND_CONNECT_TIMEOUT  = 12
SQLNET.EXPIRE_TIME = 10

- The listener should have logging enabled as follows:

LOGGING_LISTENER = ON
LOG_STATUS = ON
LOG_DIRECTORY_ListenerName = Directory_owned_by_Administrator
LOG_FILE_ListenerName = File_owned_by_Administrator

Note:
Only the Administrators group should have permissions over the LOG_DIRECTORY.
Only the Administrators group should have read and write permissions over the LOG_FILE.

- The listener should have tracing enabled as follows:

TRACE_DIRECTORY_ListenerName = Directory_owned_by_Oracle_account
TRACE_FILE_ListenerName = File_owned_by_Oracle_account
TRACE_LEVEL = user
TRACE_FILELEN_ListenerName = 512
TRACE_FILENO_ListenerName = 1000
TRACE_TIMESTAMP_ListenerName = dd-mon-yyyy hh:mi:ss:mil

Note:
Only the Administrators group should have read and write permissions over the TRACE_DIRECTORY.
Only the Administrators group should have read and write permissions over the TRACE_FILE.

F Initialization Parameters

When you install Oracle Database Vault, the security specific database initialization parameters are initialized with default values. The following list shows the default values for these security specific initialization parameters:

REMOTE_LOGIN_PASSWORDFILE = default, EXCLUSIVE
AUDIT_SYS_OPERATIONS = TRUE
REMOTE_OS_AUTHENT = FALSE
REMOTE_OS_ROLES = FALSE
OS_ROLES = FALSE
OS_AUTHENT_PREFIX = ''
SQL92_SECURITY = TRUE
O7_DICTIONARY_ACCESSIBILITY = FALSE

G Enabling Oracle Database Vault Administrator Accessibility

As part of the effort to make Oracle products, services, and supporting documentation accessible and usable to the disabled community, Oracle Database Vault Administrator offers several features that make management data available to users of assistive technology. To enable these features and provide for full accessibility, you must modify two configuration settings, which are described in the following sections:

- Enabling Oracle Database Vault Administrator Accessibility Mode

- Providing Textual Descriptions of Database Vault Administrator Charts

G.1 Enabling Oracle Database Vault Administrator Accessibility Mode

Oracle Database Vault Administrator takes advantage of user interface development technologies that improve the responsiveness of some user operations. For example, when you navigate to a new record set in a table, Oracle Database Vault Administrator does not redisplay the entire HTML page. However, this performance-improving technology is generally not supported by screen readers. To disable this feature, and therefore, make the Database Vault Administrator HTML pages more accessible for disabled users, use the following procedure.

To enable the display of an entire HTML page:

1. Locate the uix-config.xml configuration file.
To locate the uix-config.xml file in an Oracle Database 10g installation, change directory to the following location in the Oracle home:

ORACLE_HOME\dv\jlib\dva_webapp\dva_webapp\WEB-INF

2. Open the uix-config.xml file using a text editor and locate the following entry:

<!-- An alternate configuration that disables accessibility features  -->
<default-configuration>
<accessibility-mode>inaccessible</accessibility-mode>
</default-configuration>

3. Change the value of the accessibility-mode property from inaccessible to accessible.

4. Save and close the uix-config.xml file.

5. Restart Database Vault Administrator.

See Also:
For more information on starting Oracle Database Vault Administrator, refer to Oracle Database Vault Administrator's Guide

G.2 Providing Textual Descriptions of Database Vault Administrator Charts

In the Monitor page of the Database Vault Administrator, a chart is used to display security policy data. However, charts do not convey information in a manner that can be read by a screen reader. To remedy this problem, you can configure Database Vault Administrator to provide a complete textual representation of each chart. By default, support for the textual representation of charts is disabled. When textual description for charts is enabled, Database Vault Administrator displays a textual representation of the chart data.

To enable the textual representation of charts:

1. Locate the web.xml configuration file.
To locate the web.xml file in a Oracle Database 10g installation, change directory to the following location in the Oracle home:

ORACLE_HOME\dv\jlib\dva_webapp\dva_webapp\WEB-INF

2. Open the web.xml file with your favorite text editor and locate the following six lines of the file:

<!-- Uncomment this to enable textual chart descriptions
<context-param>
<param-name>enableChartDescription</param-name>
<param-value>true</param-value>
</context-param>
-->

3. Remove comments from this section by deleting the first line and the last line of this section so that the section consists of only these four lines:

<context-param>
<param-name>enableChartDescription</param-name>
<param-value>true</param-value>
</context-param>

4. Save and exit the web.xml file.

5. Restart Database Vault Administrator.

See Also:
For more information on starting Oracle Database Vault Administrator, refer to Oracle Database Vault Administrator's Guide

Index
A  B  C  D  E  F  H  I  J  L  M  N  O  P  R  S  T  U  W

Numerics

10.2.0.4 patch set, 2.1.4.2

A

accessibility features, G

Account Manager, 2.1.9.2

accounts

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

unauthenticated access to, 2.2.2.1

Administrators group, 2.1.9.2 ANONYMOUS user

unauthenticated account access with, 2.2.2.1

applying 10.2.0.4 patch set, 2.1.4.2 assistive technology, G audit policy, 1.3

B

backups

after upgrading, 2.2.1

importance, 2.1.5

preparing a strategy, 2.1.5

C

certification, hardware and software, 1.4.1

change passwords

for oracle-supplied accounts, 2.2.2

checking

database requirements, 2.1.4

hardware requirements, 2.1.2

software requirements,operating system requirements, 2.1.3

compilers

supported, 2.1.3, 2.1.3

custom profiles, disable, 2.1.6

D

database (Oracle RAC)

stopping processes, A

database (RAC)

starting, 2.2.4

database requirements, 2.1.4 Database Vault

accounts, 1.2

audit policy, 1.3

initialization parameters, 1.3

Database Vault Account Manager account, 1.2.2

password, 1.2.2

user name, 1.2.2

Database Vault Administrator (DVA) application

timeout value, 2.2.8

Database Vault Owner, 2.1.9.2 Database Vault Owner account, 1.2.1

password, 1.2.1

user name, 1.2.1

deinstalling Oracle Database Vault, 2.3 disk space

checking, 2.1.2.3

requirements, 2.1.2

DV_ACCTMGR role, 1.2.2 DV_OWNER role, 1.2.1 dvca command, C, C

E

Enterprise Manager Console DB

installing, 2.1.4.1

environment variables

TEMP and TMP, hardware requirements, 2.1.2.3

errors

silent mode, B.3

F

file systems

system requirements, 2.1.2.2

files

response files, B.2.1

H

hardware and software certifications, 1.4.1

hardware certification, 1.4.1

hardware requirements, 2.1.2

I

initialization parameters, 1.3, F

installation, 2.1

considerations, 1.4

errors

silent mode, B.3

response files, B, B.2.1

preparing, B.2.1

silent mode, B.3

templates, B.2.1

silent mode, B.2.2

error handling, B.3

tasks, 2.1 installing

Enterprise Manager Console DB, 2.1.4.1

Oracle Universal Installer, using, 2.1.9

J

JRE (Java Runtime Environment)

requirements, 2.1.2.2

L

listener, 2.1.4

security checklist, E.1

logging on

SYSDBA privilege connections, disabling, 2.2.3

M

memory requirements, 2.1.2

monitoring

accessibility features, enabling, G.2

textual representation in charts, enabling, G.2

multiple Oracle homes, 1.4.2

N

network protocols, supported, 2.1.3

NTFS system requirements, 2.1.2.2

O

operating system requirements, 2.1.3

operating systems, supported, 2.1.3

Oracle Clusterware

starting, 2.1.7

Oracle Database Client

requirements, 2.1.3

Oracle Database Vault

audit policy, 1.3

deconfiguring, 2.3.1

deinstalling, 2.3

initialization parameters, 1.3, F

remove, 2.3

uninstalling, 2.3

Oracle Database Vault Administrator

accessibility features, enabling, G

Oracle Database Vault Administrator (DVA)

deploying manually

to Database Console OC4J container, 2.2.6.2

to standalone OC4J container, 2.2.6.1

Oracle homes,multiple, 1.4.2 Oracle Real Applications Clusters

configuring Database Vault on Oracle RAC nodes, 2.2.5

Oracle services

stopping, 2.1.8.4

Oracle Universal Installer, 2.1.4.1, 2.1.4.2, 2.1.9

response files, B

oracle-supplied accounts

change passwords, 2.2.2

orapwd utility, 2.2.3 OUI, 2.1.4.2

P

password file, 2.1.4

passwords

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

password files, 2.2.3

resetting

with SQL*Plus, 2.2.2.1

specifying for response files, B.1 unlocking

with SQL*Plus, 2.2.2.1

See alsosecurity patch set

applying, 2.1.4.2

documentation, 2.1.4.2

preinstallation, 2.1

tasks, 2.1

process

stopping existing, 2.1.8

R

RAM requirements, 2.1.2

REMOTE_LOGIN_PASSWORDFILE parameter, 2.1.4

requirements

database, 2.1.4

for JRE, 2.1.2.2

hard disk space, 2.1.2.2

hardware, 2.1.2

hardware, verifying, 2.1.2.3

listener, 2.1.4

Oracle Database 10.2.0.4 patch set, 2.1.4.2

Oracle Database Client, 2.1.3

Oracle Enterprise Manager Console DB 10.2.0.4, 2.1.4

password file, 2.1.4

service packs, 2.1.3

software, operating system, 2.1.3

response files

about, B.1

general procedure, B.1.1

passing values at command line, B.1

passwords, B.1

security, B.1

specifying with Oracle Universal Installer, B.2.2

See also silent mode, B.1

response files installation

about, B

roles

DV_ACCTMGR, 1.2.2

DV_OWNER, 1.2.1

S

screen

Specify Installation Details, 2.1.9.2

security

See alsopasswords

security checklist

database listener, E.1

service pack requirements, 2.1.3 services

stopping, 2.1.8.4

setup.exe file, 2.1.9.2 silent mode installation, B.2.2 software and hardware certifications, 1.4.1 software certification, 1.4.1 software requirements,operating system requirements, 2.1.3 specifying installation details, 2.1.9.2 srvctl command, 2.2.4, D.1, D.1, D.1, D.1, D.1 stopping

Oracle processes, 2.1.8

stopping Oracle services, 2.1.8.4 stopping RAC processes, A system architecture, supported, 2.1.3 system requirements

for NTFS file systems, 2.1.2.2

T

tasks

installation, 2.1

preinstallation, 2.1

TEMP

environment variable, hardware requirements, 2.1.2.3

temporary directory, 2.1.2.3 temporary disk space

checking, 2.1.2.3

freeing, 2.1.2.3

requirements, 2.1.2

tmp directory

checking space in, 2.1.2.3

freeing space in, 2.1.2.3

TMP environment variable, hardware requirements, 2.1.2.3

U

uninstalling Oracle Database Vault, 2.3

upgrading

after upgrading, 2.2

backup strategy, 2.1.5

post upgrade actions, 2.2

user names

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

users

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

W

Windows

Administrators group, 2.1.9.2

compilers, supported, 2.1.3

network protocol, supported, 2.1.3

operating systems, supported, 2.1.3

system architecture, supported, 2.1.3

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2014, Oracle and/or its affiliates. All rights reserved.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.