Oracle® Database Vault

Installation Guide

Release 2 (9.2.0.8) for Solaris Operating System (SPARC 64-Bit)

E10093-02

April 2007

Oracle Database Vault Installation Guide, Release 2 (9.2.0.8) for Solaris Operating System (SPARC 64-Bit)

E10093-02

Copyright © 2007, Oracle. All rights reserved.

Primary Author: Sumit Jeloka

Contributing Author: Pat Huey, Vinisha Dharamshi

Contributors: Scott Gaetjen, Xiaofang Wang, Jack Brinson, Chi Ching Chui, Kamal Tbeileh, Trivikrama Samudrala, Madhu Velukur, Mayur Mundada

The Programs (which include both the software and documentation) contain proprietary information; they are provided under a license agreement containing restrictions on use and disclosure and are also protected by copyright, patent, and other intellectual and industrial property laws. Reverse engineering, disassembly, or decompilation of the Programs, except to the extent required to obtain interoperability with other independently created software or as specified by law, is prohibited.

The information contained in this document is subject to change without notice. If you find any problems in the documentation, please report them to us in writing. This document is not warranted to be error-free. Except as may be expressly permitted in your license agreement for these Programs, no part of these Programs may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose.

If the Programs are delivered to the United States Government or anyone licensing or using the Programs on behalf of the United States Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the Programs, including documentation and technical data, shall be subject to the licensing restrictions set forth in the applicable Oracle license agreement, and, to the extent applicable, the additional rights set forth in FAR 52.227-19, Commercial Computer Software--Restricted Rights (June 1987). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

The Programs are not intended for use in any nuclear, aviation, mass transit, medical, or other inherently dangerous applications. It shall be the licensee's responsibility to take all appropriate fail-safe, backup, redundancy and other measures to ensure the safe use of such applications if the Programs are used for such purposes, and we disclaim liability for any damages caused by such use of the Programs.

Oracle, JD Edwards, PeopleSoft, and Siebel are registered trademarks of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

The Programs may provide links to Web sites and access to content, products, and services from third parties. Oracle is not responsible for the availability of, or any content provided on, third-party Web sites. You bear all risks associated with the use of such content. If you choose to purchase any products or services from a third party, the relationship is directly between you and the third party. Oracle is not responsible for: (a) the quality of third-party products or services; or (b) fulfilling any of the terms of the agreement with the third party, including delivery of products or services and warranty obligations related to purchased products or services. Oracle is not responsible for any loss or damage of any sort that you may incur from dealing with any third party.

Contents

Preface

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

Part I Oracle Database Vault Installation

1 Oracle Database Vault Installation Overview

- 1.1 Database Vault Installation Environment

- 1.2 Database Vault Accounts

- 1.2.1 Database Vault Owner

- 1.2.2 Database Vault Account Manager

- 1.3 Default Audit Policy and Initialization Parameters

- 1.4 Installation Considerations

- 1.4.1 Hardware and Software Certification

- 1.4.2 Multiple Oracle Homes

2 Installing Oracle Database Vault as an Option

- 2.1 Preinstallation and Installation Tasks

- 2.1.1 Become Familiar with the Features of Oracle Database Vault

- 2.1.2 Check the Hardware Requirements

- 2.1.3 Check the Operating System Requirements

- 2.1.4 Check Kernel Parameters

- 2.1.5 Check the Database Requirements

- 2.1.5.1 Apply Oracle Database Release 9.2.0.8 Patch Set

- 2.1.6 Prepare a Backup Strategy

- 2.1.7 Verify that the Global Services Daemon Is Running (Oracle RAC Only)

- 2.1.8 Stop Existing Oracle Processes

- 2.1.8.1 Stop the apachectl and agentctl Processes

- 2.1.8.2 Shut Down All Database Instances

- 2.1.8.3 Stop Existing Listeners

- 2.1.9 Configure the Oracle User's Environment

- 2.1.10 Run Oracle Universal Installer to Install

- 2.2 Postinstallation Tasks

- 2.2.1 Back Up the Database

- 2.2.2 Update Environment Variables After the Upgrade (UNIX Systems Only)

- 2.2.3 Change Passwords for Oracle-Supplied Accounts

- 2.2.3.1 Using SQL*Plus to Unlock Accounts and Reset Passwords

- 2.2.4 Enable or Disable Connections with the SYSDBA Privilege

- 2.2.5 Start the Listener and Database on Other Nodes (Oracle RAC Only)

- 2.2.6 Run DVCA to Set Instance Parameters (Oracle RAC Only)

- 2.2.7 Deploy the DVA Application

- 2.2.7.1 Setting the Timeout Value for DVA

- 2.3 Removing Oracle Software

Part II Appendixes

A How to Stop Processes in an Existing Oracle Real Application Clusters Database

B Using Response Files

- B.1 How Response Files Work

- B.1.1 General Procedure for Using Response Files

- B.2 Installing Database Vault Using a Response File

- B.2.1 Prepare the Response File

- B.2.2 Run Oracle Universal Installer Using the Response File

- B.3 Troubleshooting Silent Mode Installation

C Enabling Database Vault for Additional Databases in a Shared Oracle Home

D Initialization Parameters

E Database Listener Security Recommendations

- E.1 Security Checklist for the Database Listener

Index

Preface

The Oracle Database Vault Installation Guide explains how to prepare for, install, and configure Oracle Database Vault with specific instructions for the operating system and Oracle software technology components that Database Vault requires.

Audience

This document is intended for Oracle DBAs as well as System Administrators who are involved in the installation of Oracle Database Vault and its related components.

Documentation Accessibility

Our goal is to make Oracle products, services, and supporting documentation accessible, with good usability, to the disabled community. To that end, our documentation includes features that make information available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at

http://www.oracle.com/accessibility/

Accessibility of Code Examples in Documentation

Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites.

TTY Access to Oracle Support Services

Oracle provides dedicated Text Telephone (TTY) access to Oracle Support Services within the United States of America 24 hours a day, seven days a week. For TTY support, call 800.446.2398.

Related Documents

For more information, refer to the following documents:

- Oracle Database Vault Release Notes for Solaris Operating System (SPARC 64-Bit)

- Oracle Database Vault Administrator's Guide

Conventions

The following text conventions are used in this document:

Convention

Meaning

boldface

Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary.

italic

Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.

monospace

Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

Part I

Oracle Database Vault Installation

Part I introduces you to Oracle Database Vault installation concepts, requirements, and steps. This part contains the following chapters:

- Chapter 1, "Oracle Database Vault Installation Overview"

- Chapter 2, "Installing Oracle Database Vault as an Option"

1 Oracle Database Vault Installation Overview

Oracle Database Vault enables you to secure business data in ways that were not possible before. Database Vault uses a multifactored and multilayered approach to implementing database security.

This chapter provides an overview of the Database Vault installation process. This chapter includes the following sections:

- Database Vault Installation Environment

- Database Vault Accounts

- Installation Considerations

1.1 Database Vault Installation Environment

Database Vault can be installed as an option to the following:

- Oracle9i Database release 2 (9.2.0.8) single instance installation

- Oracle9i Database release 2 (9.2.0.8) with Oracle Real Application Clusters (RAC)

1.2 Database Vault Accounts

Database Vault prompts for two accounts that you can create during installation. These are the Database Vault Owner (or Administrator) and the Database Vault Account Manager accounts. You must supply an account name and password for the Database Vault Owner during installation. Creating a Database Vault Account Manager is optional.

1.2.1 Database Vault Owner

The Database Vault Owner account is granted the DV_OWNER role. This account can manage Database Vault roles and configuration.

The Database Vault Owner user name can be a minimum of 2, and a maximum of 30 characters long. The account password can be a minimum of 8, and a maximum of 30 characters.

The password that you choose for the Database Vault Owner account must be a secure one. The following password restrictions are enforced:

- The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol).

- The password cannot be the same as the account name.

- The password cannot contain any consecutive repeating characters.

1.2.2 Database Vault Account Manager

The Database Vault Account Manager is granted the DV_ACCTMGR role. This account is used to manage database user accounts. The Database Vault Account Manager is created to facilitate separation of duties. If you do not opt to create the Database Vault Account Manager account, then the DV_ACCTMGR role is granted to the Database Vault Owner account by default.

The Database Vault Account Manager user name can be a minimum of 2, and a maximum of 30 characters long. The account password can be a minimum of 8, and a maximum of 30 characters.

Note:
If you opt to create a Database Vault Account Manager account, then you must not use the same user name that is used for the Database Vault Owner account.

The same password restrictions that apply to Database Vault Owner are applicable to Database Vault Account Manager as well.

1.3 Default Audit Policy and Initialization Parameters

Oracle Database Vault installs a baseline database auditing policy. This policy covers the access control configuration information stored in Database Vault database tables, information stored in Oracle Catalog (rollback segments, tablespaces, and so on), the use of system privileges, and Oracle Label Security configuration.

See Also:
Oracle Database Vault Administrator's Guide for more information on the database audit policy

When you install Database Vault, the security specific database initialization parameters are initialized with default values. These security specific initialization parameters are listed in Appendix D, "Initialization Parameters"

1.4 Installation Considerations

This section contains information that you should consider before deciding how to install this product. It contains the following sections:

- Hardware and Software Certification

- Multiple Oracle Homes

1.4.1 Hardware and Software Certification

The platform-specific hardware and software requirements included in this installation guide were current at the time this guide was published. However, because new platforms and operating system software versions might be certified after this guide is published, review the certification matrix on the OracleMetaLink Web site for the most up-to-date list of certified hardware platforms and operating system versions. The OracleMetaLink Web site is available at the following URL:

https://metalink.oracle.com

If you do not have a current Oracle Support Services contract, then you can access the same information at the following Web site:

http://www.oracle.com/technology/support/metalink/content.html

1.4.2 Multiple Oracle Homes

This product supports multiple Oracle homes. This means that you can install this release of the software more than once on the same system, in different Oracle home directories.

2 Installing Oracle Database Vault as an Option

This chapter includes an overview of the major steps required to install Oracle Database Vault into an existing Oracle9i Database release 2 (9.2.0.8) database. These procedures transform an existing Oracle Database system (including associated applications) into an Oracle Database Vault system. Databases upgraded using the procedures described in this chapter can work almost in the same manner as in earlier releases and, optionally, can leverage new Database Vault functionality. For a list of changes that Database Vault makes, refer to Appendix D, "Initialization Parameters" and the Oracle Database Vault Administrator's Guide.

Note:
In order to upgrade a pre-Oracle9i Database release 2 (9.2.0.8) database to Oracle Database Vault, you first need to upgrade the database to Oracle9i Database release 2 (9.2.0.8).

This chapter covers the following topics:

- Preinstallation and Installation Tasks

- Postinstallation Tasks

- Removing Oracle Software

2.1 Preinstallation and Installation Tasks

This section covers the following topics:

- Become Familiar with the Features of Oracle Database Vault

- Check the Hardware Requirements

- Check the Operating System Requirements

- Check Kernel Parameters

- Check the Database Requirements

- Prepare a Backup Strategy

- Verify that the Global Services Daemon Is Running (Oracle RAC Only)

- Stop Existing Oracle Processes

- Configure the Oracle User's Environment

- Run Oracle Universal Installer to Install

2.1.1 Become Familiar with the Features of Oracle Database Vault

Before you plan the upgrade process, become familiar with the features of Database Vault. The Oracle Database Vault Administrator's Guide discusses the basic features of Database Vault.

2.1.2 Check the Hardware Requirements

The system must meet the following minimum hardware requirements:

- At least 512 MB of available physical RAM

- Swap space on the disk equal to the system's physical memory, or 1GB, whichever is greater.

- 400 MB of disk space in the /tmp directory

- 270 MB of disk space for the Database Vault software

- 10 MB of additional disk space for the database files

To ensure that the system meets these requirements:

1. To determine the physical RAM size, enter the following command:

# /usr/sbin/prtconf | grep "Memory size"

If the size of the physical RAM installed in the system is less than the required size, then you must install more memory before continuing.

2. To determine the size of the configured swap space, enter the following command:

# /usr/sbin/swap -s

If necessary, refer to your operating system documentation for information about how to configure additional swap space.

3. To determine the amount of disk space available in the /tmp directory, enter the following command:

# df -k /tmp

Note:
On Solaris 10, use the df -h /tmp command.

If there is less than 400 MB of disk space available in the /tmp directory, then complete one of the following steps:

- Delete unnecessary files from the /tmp directory to meet the disk space requirement.

- Set the TEMP and TMPDIR environment variables when setting the oracle user's environment (described later).

- Extend the file system that contains the /tmp directory. If necessary, contact your system administrator for information about extending file systems.

4. To determine the amount of free disk space on the system, enter the following command:

# df -k

Note:
On Solaris 10, use the df -h command.

5. To determine whether the system architecture can run the software, enter the following command:

# /bin/isainfo -kv

Note:
This command displays the processor type. Verify that the processor architecture matches the Oracle software release that you want to install. If you do not see the expected output, then you cannot install the software on this system.

2.1.3 Check the Operating System Requirements

The system must meet the following minimum software requirements:

- The version of Solaris must be Solaris 8, Solaris 9, or Solaris 10.

- The following packages must be installed:

SUNWarc           SUNWlibms         SUNWi1of
SUNWbtool         SUNWsprot         SUNWi1cs
SUNWhea           SUNWsprox         SUNWi15cs
SUNWlibm          SUNWtoo           SUNWxwfnt

Note:
SUNWsprox package is not supported on Solaris 10.

- The following patches must be installed:

Patches for Solaris 8:

All of the patches included in the J2SE Patch Cluster for Solaris 8:

- 108528-23, SunOS 5.8: kernel update patch

- 108652-66, X11 6.4.1: Xsun patch

- 108773-18, SunOS 5.8: IIIM and X I/O Method patch

- 108921-16, CDE 1.4: dtwm patch

- 108940-53, Motif 1.2.7 and 2.1.1: Runtime lib. patch for Solaris 8

- 108987-13, SunOS 5.8: Patch for patchadd and patchrm

- 108989-02, /usr/kernel/sys/acctctl & /.../exacctsys patch

- 108993-18, SunOS 5.8: LDAP2 client, libc, libthread ... lib. patch

- 109147-24, SunOS 5.8: linker patch

- 110386-03, SunOS 5.8: RBAC Feature Patch

- 111023-02, SunOS 5.8: /kernel/fs/mntfs and ... sparcv9/mntfs

- 111111-03, SunOS 5.8: /usr/bin/nawk patch

- 111308-03, SunOS 5.8: /usr/lib/libmtmalloc.so.1 patch

- 111310-01, SunOS 5.8: /usr/lib/libdhcpagent.so.1 patch

- 112396-02, SunOS 5.8: /usr/bin/fgrep patch

The following additional patches:

- 111721-04, SunOS 5.8: Math Library (libm) patch

- 112003-03, SunOS 5.8: Unable to load fontset in 64-bit Solaris 8 iso-1 or iso-15

- 112138-01, SunOS 5.8: usr/bin/domainname patch

Patches for Solaris 9:

- 112233-11: SunOS 5.9: Kernel Patch

- 111722-04: SunOS 5.9: Math Library (libm) patch

To ensure that the system meets these requirements, follow these steps:

1. To determine which version of Solaris is installed, enter the following command:

# uname -r
5.8

In this example, the version shown is Solaris 8 (5.8). If necessary, see your operating system documentation for information about upgrading the operating system.

2. To determine whether the required packages are installed, enter a command similar to the following:

# pkginfo -i SUNWarc SUNWbtool SUNWhea SUNWlibm SUNWlibms \
SUNWsprot SUNWtoo SUNWi1of SUNWi1cs SUNWi15cs SUNWxwfnt

If a package is not installed, then install it. See your operating system or software documentation for information about installing packages.

3. To determine whether an operating system patch is installed, enter a command similar to the following:

# /usr/sbin/patchadd -p | grep patch_number

If an operating system patch is not installed, download it from the following Web site and install it:

http://sunsolve.sun.com

2.1.4 Check Kernel Parameters

Verify that the following kernel parameters are set to values greater than or equal to the recommended value shown:

Parameter

Recommended Value

noexec_user_stack (obsolete in Solaris 9)

1

semsys:seminfo_semmni

100

semsys:seminfo_semmns

1024

semsys:seminfo_semmsl

256

semsys:seminfo_semvmx

32767

shmsys:shminfo_shmmax

4294967295

shmsys:shminfo_shmmin (obsolete in Solaris 9)

1

shmsys:shminfo_shmmni

100

shmsys:shminfo_shmseg (obsolete in Solaris 9)

10

To view the current value specified for these kernel parameters, and to change them if necessary, follow these steps:

1. To view the current values of these parameters, enter the following commands:

# grep noexec_user_stack /etc/system
# /usr/sbin/sysdef | grep SEM
# /usr/sbin/sysdef | grep SHM

2. If you must change any of the current values, follow these steps:

a. Create a backup copy of the /etc/system file, for example:

# cp /etc/system /etc/system.orig

b. Open the /etc/system file in any text editor:

# vi /etc/system

c. To specify new values for the parameters, add lines similar to the following to the /etc/system file, or edit the lines if the file already contains them:

set noexec_user_stack=1
set semsys:seminfo_semmni=100
set semsys:seminfo_semmns=1024
set semsys:seminfo_semmsl=256
set semsys:seminfo_semvmx=32767
set shmsys:shminfo_shmmax=4294967295
set shmsys:shminfo_shmmin=1
set shmsys:shminfo_shmmni=100
set shmsys:shminfo_shmseg=10

d. Enter a command similar to the following to reboot the system:

# /usr/sbin/reboot

e. When the system restarts, log in and switch user to root.

2.1.5 Check the Database Requirements

In order to install Oracle Database Vault, you must be running the Enterprise Edition of Oracle9i Database release 2 (9.2.0.8). In addition, the Database Vault installer requires write access to the files, oratab and oraInst.loc.

Note:
The /var/opt/oracle/oratab file should have an entry for the database. For example:
DBDV:/oracle/product/9.2_VAULT:Y

A listener must have been configured for the existing database. Oracle Net Configuration Assistant configures the listener when you first install the database.

You must have an existing password file for the database. The password file authentication parameter, REMOTE_LOGIN_PASSWORDFILE must have been set to EXCLUSIVE or SHARED.

You can set the REMOTE_LOGIN_PASSWORDFILE parameter in the init.ora file. Use the orapwd utility to create and manage password files.

See Also:
Oracle9i Database Administrator's Guide for more information on creating and maintaining a password file

The following topic discusses applying the 9.2.0.8 patch set:

2.1.5.1 Apply Oracle Database Release 9.2.0.8 Patch Set

To install Oracle Database Vault, you need to upgrade the database to Oracle9i Database release 2 (9.2.0.8). Oracle strongly recommends that you back up your database before performing any upgrade or installation.

See Also:
Oracle9i Backup and Recovery Concepts for information on database backups

This section covers the following topics:

Patch Set Overview

Patch sets are cumulative. Patch set release 9.2.0.8 includes all fixes in patch sets 9.2.0.8 and earlier as well as new fixes for patch set 9.2.0.8. This means that unless the patch set documentation indicates otherwise, you can apply this patch set to any earlier release 9.2 installation. You do not have to install intermediate patch sets.

Patch sets contain generic fixes that apply to all platforms. Patch sets may also include additional platform-specific patches.

Note:
The 32-bit version of the patch set must be installed only on the 32-bit version of the database software, regardless of whether the operating system is 32-bit or 64-bit. The 64-bit version of the patch set must be installed only on the 64-bit version of the database software that runs on the 64-bit operating system.

Oracle Universal Installer Version Requirements

This patch set includes Oracle Universal Installer release 10.1.0.5. You must use this Oracle Universal Installer to install this patch set and not Oracle Universal Installer from the 9.2.0.x maintenance release media or Oracle home.

This is not a complete software distribution. You must install it in an existing Oracle9i release 2 (9.2.0.x.x) installation. Users applying this patch set must use Oracle Universal Installer release 10.1.0.5 (provided as part of this patch set) or later to ensure that their Oracle home can be patched in the future. Oracle Universal Installer release 10.1.0.5 is also installed when you install this patch set.

Patch Set Documentation

There are two documents related to this release of the Oracle9i release 2 patch set:

- Oracle9i Patch Set Notes, Release 2 (9.2.0.8) Patch Set 7 for Solaris Operating System (SPARC 64-Bit)

This document provides:

- System requirements and information about how to install or reinstall the patch set

- A list of all bugs fixed to date that are specific to Oracle9i release 2 for Solaris Operating System (SPARC 64-Bit)

- A list of known issues relating to Oracle9i release 2 for Solaris Operating System (SPARC 64-Bit)

- Oracle9i List of Bugs Fixed, Release 2 (9.2.0.8) Patch Set 7

The List of Bugs Fixed is a list of all generic bugs related to Oracle9i release 2 that have been fixed in this release.

Both of these documents are included with the patch set. The Oracle9i List of Bugs Fixed is also available on OracleMetalink, from document 189908.1, ALERT: Oracle9i Release 2 (9.2) Support Status and Alerts at:

https://metalink.oracle.com

2.1.6 Prepare a Backup Strategy

Oracle strongly recommends that you back up your database before performing any upgrade or installation. The ultimate success of your upgrade depends heavily on the design and execution of an appropriate backup strategy. To develop a backup strategy, consider the following questions:

- How long can the production database remain inoperable before business consequences become intolerable?

- What backup strategy should be used to meet your availability requirements?

- Are backups archived in a safe, offsite location?

- How quickly can backups be restored (including backups in offsite storage)?

- Have recovery procedures been tested successfully?

Your backup strategy should answer all of these questions and include procedures for successfully backing up and recovering your database.

See Also:
Oracle9i User-Managed Backup and Recovery Guide for information on database backups

2.1.7 Verify that the Global Services Daemon Is Running (Oracle RAC Only)

The Global Services Daemon (GSD) should be running for the Database Vault installer to find existing Oracle Real Application Clusters (RAC) databases. If you have stopped GSD, then you should restart it before running Oracle Universal Installer. Use the following command to start the GSD service:

$ORACLE_HOME/bin/gsdctl start

You need to run this command on each Oracle RAC node.

2.1.8 Stop Existing Oracle Processes

Stop all processes running in the Oracle home. You must complete this task to enable Oracle Universal Installer to relink certain executables and libraries. For Oracle RAC databases, you need to stop the processes on all nodes.

Stop the processes in the following order:

1. Stop the apachectl and agentctl Processes

2. Shut Down All Database Instances

3. Stop Existing Listeners

2.1.8.1 Stop the apachectl and agentctl Processes

Stop the apachectl process using the following command:

$ORACLE_HOME/Apache/Apache/bin/apachectl stop

Stop the agentctl process using the following command:

$ORACLE_HOME/bin/agentctl stop

2.1.8.2 Shut Down All Database Instances

Shut down all database instances running from the Oracle home directory into which Oracle Database Vault is to be installed.

sqlplus SYS "AS SYSDBA"
Enter password:
SQL> shutdown immediate

Use the Server Control (srvctl) utility, and not SQL*Plus, to stop an Oracle Real Application Clusters (RAC) Database instance.

srvctl stop database -d database_name

2.1.8.3 Stop Existing Listeners

Oracle Universal Installer configures and starts a default Oracle Net listener using TCP/IP port 1521. However, if an existing Oracle Net listener process is using the same port or key value, then Oracle Universal Installer can only configure the new listener, it cannot start it. To ensure that the new listener process starts during the installation, you must shut down any existing listeners before starting Oracle Universal Installer.

To determine whether an existing listener process is running and to shut it down if necessary:

1. Switch user to oracle:

# su - oracle

2. Enter the following command to determine whether a listener process is running and to identify its name and the Oracle home directory in which it is installed:

$ ps -ef | grep tnslsnr

This command displays information about the Oracle Net listeners running on the system:

... oracle_home1/bin/tnslsnr LISTENER -inherit

In this example, oracle_home1 is the Oracle home directory where the listener is installed and LISTENER is the listener name.

Note:
If no Oracle Net listeners are running, then refer to the "Configure the Oracle User's Environment" section to continue.

3. Set the ORACLE_HOME environment variable to specify the appropriate Oracle home directory for the listener:

- Bourne, Bash, or Korn shell:

$ ORACLE_HOME=oracle_home1
$ export ORACLE_HOME

- C or tcsh shell:

% setenv ORACLE_HOME oracle_home1

4. Enter the following command to identify the TCP/IP port number and IPC key value that the listener is using:

$ $ORACLE_HOME/bin/lsnrctl status listenername

Note:
If the listener uses the default name LISTENER, then you do not have to specify the listener name in this command.

5. Enter a command similar to the following to stop the listener process:

$ $ORACLE_HOME/bin/lsnrctl stop listenername

6. Repeat this procedure to stop all listeners running on this system.

Note:
If you are installing Database Vault for Oracle Real Application Clusters (RAC), then you need to shut down all Oracle processes on all cluster nodes. See Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database" for more details.

2.1.9 Configure the Oracle User's Environment

Run Oracle Universal Installer (OUI) using the account that owns the Oracle software. This is usually the oracle account.

However, before you start Oracle Universal Installer you must configure the environment of the oracle user. To configure the environment, you must:

- Set the default file mode creation mask (umask) to 022 in the shell startup file.

- Set the DISPLAY environment variable.

Note:
Ensure that the PATH variable contains $ORACLE_HOME/bin before /usr/X11R6/bin.

To set the oracle user's environment:

1. Start a new terminal session, for example, an X terminal (xterm).

2. Enter the following command to ensure that X Window applications can display on this system:

$ xhost fully_qualified_remote_host_name

For example:

$ xhost somehost.us.acme.com

3. If you are not already logged in to the system where you want to install the software, then log in to that system as the oracle user.

4. If you are not logged in as the oracle user, then switch user to oracle:

$ su - oracle

5. To determine the default shell for the oracle user, enter the following command:

$ echo $SHELL

6. Open the oracle user's shell startup file in any text editor:

- Bourne shell (sh), Bash shell (bash), or Korn shell (ksh):

$ vi .profile

- C shell (csh or tcsh):

% vi .login

7. Enter or edit the following line, specifying a value of 022 for the default file mode creation mask:

umask 022

8. Save the file, and exit from the editor.

9. To run the shell startup script, enter one of the following commands:

- Bourne, Bash, or Korn shell:

$ . ./.profile

- C shell:

% source ./.login

10. If you are not installing the software on the local system, then enter a command similar to the following to direct X applications to display on the local system:

- Bourne, Bash, or Korn shell:

$ DISPLAY=local_host:0.0 ; export DISPLAY

- C shell:

% setenv DISPLAY local_host:0.0

In this example, local_host is the host name or IP address of the system that you want to use to display Oracle Universal Installer (your workstation or PC).

11. If you determined that the /tmp directory has less than 400 MB of free disk space, then identify a file system with at least 400 MB of free space and set the TEMP and TMPDIR environment variables to specify a temporary directory on this file system:

a. Use the df -k command to identify a suitable file system with sufficient free space.

Note:
On Solaris 10, use the df -h command.

b. If necessary, enter commands similar to the following to create a temporary directory on the file system that you identified, and set the appropriate permissions on the directory:

$ su - root
# mkdir /mount_point/tmp
# chmod a+wr /mount_point/tmp
# exit

c. Enter commands similar to the following to set the TEMP and TMPDIR environment variables:

- Bourne, Bash, or Korn shell:

$ TEMP=/mount_point/tmp
$ TMPDIR=/mount_point/tmp
$ export TEMP TMPDIR

- C shell:

% setenv TEMP /mount_point/tmp
% setenv TMPDIR /mount_point/tmp

12. Enter commands similar to the following to set the ORACLE_BASE and ORACLE_SID environment variables:

- Bourne, Bash, or Korn shell:

$ ORACLE_BASE=/u01/app/oracle
$ ORACLE_SID=sales
$ export ORACLE_BASE ORACLE_SID

- C shell:

% setenv ORACLE_BASE /u01/app/oracle
% setenv ORACLE_SID sales

In these examples, /u01/app/oracle is the Oracle base directory that you created or identified earlier and sales is the name that you want to call the database (typically no more than five characters).

13. Enter the following commands to ensure that the ORACLE_HOME and TNS_ADMIN environment variables are not set:

- Bourne, Bash, or Korn shell:

$ unset ORACLE_HOME
$ unset TNS_ADMIN

- C shell:

% unsetenv ORACLE_HOME
% unsetenv TNS_ADMIN

14. To verify that the environment has been set correctly, enter the following commands:

$ umask
$ env | more

Verify that the umask command displays a value of 22, 022, or 0022 and the environment variables that you set in this section have the correct values.

2.1.10 Run Oracle Universal Installer to Install

Run Oracle Universal Installer (OUI) to install Oracle Database Vault into an existing Oracle9i Database release 2 (9.2.0.8) database. You should run the installer as the software owner account that owns the current ORACLE_HOME environment. This is normally the oracle account.

Log in as the oracle user. Alternatively, switch user to oracle using the su command. Change your current directory to the directory containing the installation files. Start Oracle Universal Installer.

./runInstaller

The following steps discuss the options you need to select:

1. In the Specify Installation Details screen, you need to specify the path to the Oracle home that contains the existing Oracle Database. The Destination Path box lists the Oracle home paths of all Oracle9i Database release 2 (9.2.0.8) Enterprise Edition databases registered with the system.
Select the Oracle home corresponding to the database into which you want to install Oracle Database Vault.

Note:

- If an Oracle home does not have an Enterprise Edition of Oracle9i Database release 2 (9.2.0.8) installed, then it is not displayed. You must ensure that the Oracle home has an Enterprise Edition of Oracle9i Database release 2 (9.2.0.8) installed.

- If an Oracle home already contains Oracle Database Vault, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home more than once.

2. Enter a user name for the Database Vault Owner account in the Database Vault Owner field. The user name can be a minimum of 2 and maximum of 30 characters long.

3. Enter a password for the Database Vault Owner account in the Database Vault Owner Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

4. Reenter the password in the Confirm Password field.

5. Select Create a Separate Account Manager if you want to create a separate Account Manager to manage Oracle Database Vault accounts.

6. In the Database Vault Account Manager field, enter a user name for the Database Vault Account Manager if you have chosen to select the Create a Separate Account Manager check box. The user name can be a minimum of 2 and a maximum of 30 characters.

7. Enter a password for the Database Vault Account Manager account in the Account Manager Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

8. Reenter the password in the Confirm Password field. Click Next.

9. The Select Existing Database screen is displayed. A list of all databases running from the selected Oracle home is displayed. Select the database into which you wish to install Oracle Database Vault.

Note:

- If the selected Oracle home contains more than one database, then Operating System (OS) authentication is turned off for all the databases in the Oracle home.

- If a database is not listed, then check to make sure that you have followed the instructions under "Check the Database Requirements".

- Install Oracle Database Vault into an Oracle home containing multiple databases only if you wish to enable Oracle Database Vault for all these databases. If this is not the case, then Oracle recommends that you install Oracle Database Vault into an Oracle home containing a single database.

10. Enter the existing SYS user password for the selected database in the Existing Database SYS Password field.

11. Reenter the SYS password in the Confirm Password field. Click Next.

Note:
At this point, the database requirements are validated.

12. You are prompted to shut down all Oracle processes running from the Oracle home before proceeding. Shut down the Oracle processes, if you have not already done so.

See Also:
"Stop Existing Oracle Processes" for more information on stopping existing Oracle processes

13. Product-specific prerequisite checks are performed. Confirm that all tests have passed. Click Next to continue.

14. The Summary screen is displayed with the installation details. Verify the details and click Install.

15. The Installation screen is displayed. After the installation completes, the Database Vault Configuration Assistant (DVCA) is run automatically. DVCA helps configure the Database Vault installation.

2.2 Postinstallation Tasks

This section lists the tasks to perform after you have completed an upgrade of your database. The following topics are discussed:

- Back Up the Database

- Update Environment Variables After the Upgrade (UNIX Systems Only)

- Change Passwords for Oracle-Supplied Accounts

- Enable or Disable Connections with the SYSDBA Privilege

- Start the Listener and Database on Other Nodes (Oracle RAC Only)

- Run DVCA to Set Instance Parameters (Oracle RAC Only)

- Deploy the DVA Application

2.2.1 Back Up the Database

Make sure you perform a full backup of the production database. See Oracle9i Backup and Recovery Concepts for details on backing up a database.

2.2.2 Update Environment Variables After the Upgrade (UNIX Systems Only)

Make sure that the following environment variables point to the correct Oracle Database Vault directories:

- ORACLE_HOME: Specifies the Oracle home directory. For example, /u01/app/oracle/product/9.2.0/db_1

- PATH: Specifies the directories searched by the shell to locate executable programs. For example, /bin:/usr/bin:/usr/local/bin:/usr/bin/X11:$ORACLE_HOME/bin:$HOME/bin

You may also need to set the following environment variables:

- ORA_NLS33: Specifies the directory where the language, territory, character set, and linguistic definition files are stored. For example, $ORACLE_HOME/ocommon/nls/admin/data

- LD_LIBRARY_PATH: Specifies the list of directories that the shared library loader searches to locate shared object libraries at run time. For example, /usr/dt/lib:$ORACLE_HOME/lib

Use the man ld command for more information about this environment variable.

2.2.3 Change Passwords for Oracle-Supplied Accounts

Oracle strongly recommends that you change the password for each account after installation. This enables you to effectively implement the strong security provided by Oracle Database Vault.

Note:
If you are creating a database using Database Configuration Assistant, you can unlock accounts after the database is created by clicking Password Management before you exit from Database Configuration Assistant.

2.2.3.1 Using SQL*Plus to Unlock Accounts and Reset Passwords

To unlock and reset user account passwords using SQL*Plus:

1. Start SQL*Plus and log in using the Database Vault Account Manager account. If you did not create the Database Vault Account Manager account during installation, then you will need to log in using the Database Vault Owner account.

2. Enter a command similar to the following, where account is the user account that you want to unlock and password is the new password:

SQL> ALTER USER account [ IDENTIFIED BY password ] ACCOUNT UNLOCK;

In this example:

- The ACCOUNT UNLOCK clause unlocks the account.

- The IDENTIFED BY password clause resets the password.

Note:
If you unlock an account but do not reset the password, then the password remains expired. The first time someone connects as that user, they must change the user's password.
To permit unauthenticated access to your data through HTTP, unlock the ANONYMOUS user account.

2.2.4 Enable or Disable Connections with the SYSDBA Privilege

If you are using password file authentication for administrative users, then you can choose to disable SYSDBA logins by creating the password file with the nosysdba flag set to y (Yes).

If a password file has been created using the orapwd utility with the nosysdba flag set to y (Yes) (the default action of a Database Vault installation), users will not be able to log in to an Oracle Database Vault instance using the SYS account or any account with SYSDBA privilege using the AS SYSDBA clause. You can reenable the ability to connect with the SYSDBA privilege by re-creating the password file with the nosysdba flag set to n (No). You might need to reenable the ability to connect with SYSDBA privileges, if certain products or utilities require it's use.

When you re-create the password file, any accounts other than SYS that were granted the SYSDBA or SYSOPER privileges will have those privileges removed. You will need to regrant the privileges for these accounts after you have re-created the password file.

In order to run the orapwd command, you need to shut down the database, run the orapwd command and then restart the database. Use the following syntax to run the orapwd command:

orapwd file=filename password=password [entries=users] nosysdba=y/n

Where:

- file: Name of password file (mandatory)

- password: Password for SYS (mandatory). Enter at least six alphanumeric characters.

- entries: Maximum number of distinct DBA users

- nosysdba: Whether to enable or disable the SYS logon (optional for Oracle Database Vault only). Enter y (for yes) or n (for no)

The default is no, so if you omit this flag, the password file will be created enabling SYSDBA access for Oracle Database Vault instances.

For example:

orapwd file=$ORACLE_HOME/dbs/orapworcl password=5hjk99 nosysdba=n
where the file name is of the format, orapwSID_Name

Note:
Do not insert spaces around the equal (=) character.

See Also:
Oracle9i Database Administrator's Guide for more information on using the orapwd utility.

Enabling or Disabling Connecting with SYSDBA on Oracle Real Application Clusters Systems

Under a cluster file system and raw devices, the password file under $ORACLE_HOME is in a symbolic link that points to the shared storage location in the default configuration. In this case, the orapwd command you issue affects all nodes.

2.2.5 Start the Listener and Database on Other Nodes (Oracle RAC Only)

You need to start the listener and database on all Oracle Real Application Clusters (RAC) nodes other than the one on which the installation is performed. Use the following commands to start the listener and the database:

Note:
You need to enable SYSDBA connections on all nodes before running these commands. See "Enable or Disable Connections with the SYSDBA Privilege" for more information on enabling SYSDBA connections.

$ORACLE_HOME/bin/lsnrctl start listener_name
srvctl start instance -d unique_database_name -i instance_name -c "SYS/password AS SYSDBA"

Note:
You must use the Server Control (srvctl) utility to start and stop Oracle Database Vault RAC instances. Do not use SQL*Plus to start and stop Oracle RAC instances. You need to enable SYSDBA connections before you can use the srvctl command.

2.2.6 Run DVCA to Set Instance Parameters (Oracle RAC Only)

After installing Database Vault for an Oracle Real Application Clusters (RAC) instance, you need to run Database Vault Configuration Assistant (DVCA) with the -action optionrac switch. You need to run this command for all Oracle RAC nodes other than the node on which the Database Vault installation is performed. This step is required to enable the enhanced security features provided by Oracle Database Vault.

The command itself needs to be run on the node on which the Database Vault installation is performed. You need to supply the name of the remote Oracle RAC node for which the action is being performed using the -racnode switch.

Note:
The listener and database instance should be running on the nodes for which you run DVCA.
You should also ensure that the Global Services Daemon (GSD) is running on the remote nodes. You can use the following command to start the GSD service on a node:

$ORACLE_HOME/bin/gsdctl start

Use the following syntax to run DVCA:

# dvca -action optionrac -racnode host_name -oh oracle_home -jdbc_str jdbc_connection_string -sys_passwd sys_password \
[-logfile ./dvca.log] [-silent] [-nodecrypt]

Where:

- action: The action to perform. optionrac performs the action of updating the instance parameters for the Oracle RAC instance and optionally disabling SYSDBA operating system access for the instance.

- racnode: The host name of the Oracle RAC node for which the action is being performed. Do not include the domain name with the host name.

- oh: The Oracle home for the Oracle RAC instance.

- jdbc_str: The JDBC connection string used to connect to the instance you are configuring. For example, "jdbc:oracle:oci:@orcl1".

- sys_password: The password for the SYS user.

- logfile: Optionally, specify a log file name and location. You can enter an absolute path or a path that is relative to the location of the $ORACLE_HOME/bin directory.

- silent: Required if you are not running DVCA in an xterm window.

- nodecrypt: Reads plaintext passwords as passed on the command line.

Note:
You can reenable SYSDBA access by re-creating the password file with the nosysdba flag set to n (No). The orapwd utility enables you to do this.

2.2.7 Deploy the DVA Application

Oracle Database Vault Administrator (DVA) is a browser-based graphical user interface console that you can use to manage Oracle Database Vault. You can deploy DVA in an existing Oracle Database 10g Release 2 (10.2) installation in order to manage an Oracle Database Vault Oracle9i Release2 (9.2.0.8.1) instance.

You should have the following directory structure on the host containing the Oracle Database 10g Release 2 (10.2) installation:

$ORACLE_HOME
|------> jlib
|
|------> lib
|
|------> sysman
|         |---> jlib
|
|------> rdbms
|         |---> jlib
|
|------> owm
|         |---> jlib
|
|------> oui
|         |---> jlib

Note:
The environment variable $ORACLE_HOME must be set to the directory containing the installed Oracle product.
For example, if the 10.2 installation directory is /u00/app/oracle/product/10.2/db_1, then:

ORACLE_HOME = /u00/app/oracle/product/10.2/db_1

Create the following directory structure under the ORACLE_HOME directory:

$ORACLE_HOME
|
|------> dv
|         |---> jlib

For example:

mkdir -p $ORACLE_HOME/dv/jlib/

The following files should already be present in the Oracle Database 10g Release 2 (10.2) installation:

$ORACLE_HOME/sysman/jlib/emCORE.jar
$ORACLE_HOME/sysman/jlib/emDB.jar
$ORACLE_HOME/sysman/jlib/emjsp.jar
$ORACLE_HOME/sysman/jlib/ems.jar
$ORACLE_HOME/sysman/jlib/log4j-core.jar
$ORACLE_HOME/sysman/jlib/jcb.jar
$ORACLE_HOME/rdbms/jlib/jmscommon.jar
$ORACLE_HOME/rdbms/jlib/qsma.jar
$ORACLE_HOME/oui/jlib/OraInstaller.jar
$ORACLE_HOME/jlib/regexp.jar
$ORACLE_HOME/jlib/providerutil.jar
$ORACLE_HOME/jlib/ojmisc.jar
$ORACLE_HOME/jlib/netcfg.jar
$ORACLE_HOME/jlib/orai18n-mapping.jar
$ORACLE_HOME/jlib/ldapjclnt10.jar
$ORACLE_HOME/lib/xschema.jar
$ORACLE_HOME/lib/xsu12.jar
$ORACLE_HOME/lib/oraclexsql.jar

You can manually deploy Database Vault Administrator (DVA) to the following Oracle Application Server Containers for J2EE (OC4J) home:

$ORACLE_HOME/oc4j/j2ee/home

Use the following steps to manually deploy the DVA application:

Note:
If you are redeploying the DVA application, then you need to remove the application before you can run the steps to deploy the application. Use the following commands to remove the DVA application:

cd $ORACLE_HOME/dv/jlib
rm -rf dv_webapp

1. The dva_webapp_jsp.jar and dva_webapp.ear files are shipped with the Oracle Database Vault Release 2 (9.2.0.8) installation media. Navigate to the Disk1 directory.

2. Extract the dva.zip file to the disk.

3. Copy the following extracted files to the $ORACLE_HOME/dv/jlib/ directory in your Oracle Database 10g Release 2 (10.2) installation:

- dva_webapp_jsp.jar

- dva_webapp.ear

4. Edit the file, $ORACLE_HOME/oc4j/j2ee/home/config/server.xml. Enter the following line just before the last line that reads, </application-server>:

<application name="dva" path="$ORACLE_HOME/dv/jlib/dva_webapp.ear" auto-start="true" />

For example:

<application name="dva" path="/u00/app/oracle/oracle/product/dv12/dv/jlib/dva_webapp.ear" auto-start="true" />

Note:
If there was a previous version of DVA installed, and if you are redeploying the new dva_webapp.ear file from Disk1, then steps 4 to 8 have been already performed. You can move to step 9.

5. Edit the file, $ORACLE_HOME/oc4j/j2ee/home/config/http-web-site.xml. Enter the following line just above the last line that reads, </web-site>:

<web-app application="dva" name="dva_webapp" root="/dva" />

6. Edit the file, $ORACLE_HOME/oc4j/j2ee/home/config/global-web-application.xml. Search for <servlet-class>oracle.jsp.runtimev2.JspServlet</servlet-class>. Uncomment the following lines after this:

<init-param>
<param-name>main_mode</param-name>
<param-value>justrun</param-value>
</init-param>

7. Create the directory, $ORACLE_HOME/dv/jlib/sysman/config.

mkdir -p $ORACLE_HOME/dv/jlib/sysman/config

8. Create the database connection configuration file, emoms.properties, in the configuration directory that you just created. Add the following lines to the file:

oracle.sysman.emSDK.svlt.ConsoleMode=standalone
oracle.sysman.eml.mntr.emdRepRAC=FALSE
oracle.sysman.eml.mntr.emdRepDBName=ORACLE_SID
oracle.sysman.eml.mntr.emdRepConnectDescriptor=TNS_connection_string

Note:

- oracle.sysman.eml.mntr.emdRepRAC should be set to TRUE for a Real Application Clusters (RAC) database.

- ORACLE_SID should be the SID of the Oracle Database Vault Release 2 (9.2.0.8) instance

- For oracle.sysman.eml.mntr.emdRepConnectDescriptor, you can use an alias from $ORACLE_HOME/network/admin/tnsnames.ora. Alternatively, you can use the following syntax:

oracle.sysman.eml.mntr.emdRepConnectDescriptor=(DESCRIPTION\=(ADDRESS_LIST\=(ADDRESS\=(PROTOCOL\=TCP)\
(HOST\=HOSTNAME)(PORT\=PORT)))(CONNECT_DATA\=(SERVICE_NAME\=ORACLE_SID)))

9. Start OC4J. Before starting OC4J, ensure that the correct environment variables are set. For example :

ORACLE_HOME=/u00/app/oracle/product/10.2/db_1
export ORACLE_HOME
LD_LIBRARY_PATH=$ORACLE_HOME/bin:$ORACLE_HOME/lib32:$ORACLE_HOME/jdbc/lib
export LD_LIBRARY_PATH
PATH=$ORACLE_HOME/bin:$ORACLE_HOME/jdk/bin:$PATH
export PATH

Note:
LD_LIBRARY_PATH must be set to use the OCI-based JDBC libraries.

Start OC4J using the following syntax:

$ORACLE_HOME/jdk/bin/java -Djava.awt.headless=true -DEMDROOT=$ORACLE_HOME/dv/jlib \
-jar $ORACLE_HOME/oc4j/j2ee/home/oc4j.jar -userThreads -config $ORACLE_HOME/oc4j/j2ee/home/config/server.xml

Tip:
You can create a shell script file, put the command to start OC4J in it, and grant appropriate execute permissions for the file. This allows you to easily reuse the command when required.
You can also create a shell script file to stop OC4J, if required. You will need to stop and start OC4J if you make DVA configuration changes. For example:

# script to stop and start OC4J
$ORACLE_HOME/jdk/bin/java -jar $ORACLE_HOME/oc4j/j2ee/home/admin.jar ormi://localhost admin welcome -stop
$ORACLE_HOME/jdk/bin/java -Djava.awt.headless=true -DEMDROOT=$ORACLE_HOME/dv/jlib \
-jar $ORACLE_HOME/oc4j/j2ee/home/oc4j.jar -userThreads -config $ORACLE_HOME/oc4j/j2ee/home/config/server.xml

10. You can now access the DVA application. The HTTP port defaults to 8888 for this environment. Use the following URL:

http://hostname:8888/dva

2.2.7.1 Setting the Timeout Value for DVA

You can modify the length of time that DVA stays connected while inactive. By default, the connection duration is 35 minutes. Your session automatically gets expired after 35 minutes of inactivity.

To set the session time for Oracle Database Vault Administrator:

1. Back up the web.xml file, which by default is in the $ORACLE_HOME/dv/jlib/dva_webapp/dva_webapp/WEB-INF directory.

2. In a text editor, open the web.xml file .

3. Search for the following setting:

<session-config>
<session-timeout>35</session-timeout>
</session-config>

4. Change the <session-timeout> setting to the amount of time in minutes that you prefer.

5. Save and close the web.xml file.

6. Stop and restart OC4J for the change to take effect.
You can use the following command to restart OC4J:

$ORACLE_HOME/jdk/bin/java -jar $ORACLE_HOME/oc4j/j2ee/home/admin.jar ormi://oc4jHost:oc4jOrmiPort adminId \
adminPassword -restart

For example:

$ORACLE_HOME/jdk/bin/java -jar $ORACLE_HOME/oc4j/j2ee/home/admin.jar ormi://localhost admin welcome -restart

Note:
If you have Oracle Enterprise Manager Console DB installed in your Oracle Database 10g Release 2 (10.2) installation, then you can also use the following commands to stop and start the DVA application:

emctl stop dbconsole
emctl start dbconsole

2.3 Removing Oracle Software

Use Oracle Universal Installer (OUI) to remove Oracle software from an Oracle home. The following list summarizes the steps involved:

1. Log in as the user that owns the Oracle software. This is usually the oracle user.

2. Shut down all processes running in the Oracle home.

3. Start Oracle Universal Installer as follows:

$ $ORACLE_HOME/oui/bin/runInstaller

4. In the Welcome screen, select Deinstall Products. The Inventory screen appears. This screen lists all the Oracle homes on the system.

5. Select the Oracle home and the products that you wish to remove. Click Remove.

See Also:
Refer to the Oracle Universal Installer Concepts Guide for Oracle Universal Installer (OUI) concepts

Note:
You cannot remove or uninstall the Database Vault option. However, you can disable Oracle Database Vault. Refer to Oracle Database Vault Administrator's Guide for more details.
You can also remove the entire Oracle home, as discussed earlier in this section.

Part II

Appendixes

Part II includes the appendixes. The contents of this part are:

- Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database"

- Appendix B, "Using Response Files"

- Appendix C, "Enabling Database Vault for Additional Databases in a Shared Oracle Home"

- Appendix E, "Database Listener Security Recommendations"

- Appendix D, "Initialization Parameters"

A How to Stop Processes in an Existing Oracle Real Application Clusters Database

This appendix describes how to stop all processes in an Oracle Real Application Clusters (RAC) database, in preparation for installing Database Vault.

Note:
Before you make any changes to the Oracle software, Oracle recommends that you create a backup of the Oracle Database installation.

Shut down the following Oracle Database services before modifying the Oracle Database software:

Note:
You must perform these steps in the order listed.

1. Shut down all Oracle RAC instances on all nodes. To shut down all Oracle RAC instances for a database, enter the following command, where db_name is the name of the database:

$ oracle_home/bin/srvctl stop database -d db_name -c "SYS/password AS SYSDBA"

2. Stop all node applications on all nodes. To stop node applications running on a node, enter the following command, where node is the name of the node where the applications are running:

$ oracle_home/bin/srvctl stop nodeapps -n node -c "SYS/password AS SYSDBA"

B Using Response Files

This appendix describes how to install Oracle Database Vault using a response file. It includes the following topics:

- How Response Files Work

- Installing Database Vault Using a Response File

- Troubleshooting Silent Mode Installation

B.1 How Response Files Work

You can automate the installation and configuration of Oracle software by specifying a response file when you start Oracle Universal Installer. Oracle Universal Installer uses the values contained in the response file to provide answers to some or all of Oracle Universal Installer prompts.

Typically, Oracle Universal Installer runs in interactive mode, which means that it prompts you to provide information in graphical user interface (GUI) screens. When you use response files to provide this information, you run Oracle Universal Installer at a command prompt using the silent mode.

During a silent mode installation, Oracle Universal Installer does not display any screens. Instead, it displays progress information in the terminal that you used to start it.

You define the settings for a silent mode installation by entering values for the variables listed in the response file. For instance, to specify the Oracle home, you would supply the appropriate value for the ORACLE_HOME variable, as in the following example:

ORACLE_HOME = "/home/Oracle/OraDBHome1"

Another way of specifying the response file's variable settings is to pass them as command line arguments when you run Oracle Universal Installer. For example:

$ /directory_path/runInstaller -silent "ORACLE_HOME=/home/Oracle/OraDBHome1" ...

In this command, directory_path is the path to the database directory on the DVD or the path to the Disk1 directory on the hard drive.

This method is particularly useful if you do not want to embed sensitive information, such as passwords, in the response file. For example:

$ /directory_path/runInstaller -silent "s_ownerPasswd=binks342" ...

Ensure that you enclose the variable and its setting in double quotation marks (" ").

See Also:
Oracle Universal Installer Concepts Guide for more information about response file formats

B.1.1 General Procedure for Using Response Files

The following are the general steps to install and configure Oracle products using Oracle Universal Installer in silent mode:

Note:
You must complete all required preinstallation tasks on a system before running Oracle Universal Installer in silent mode.

1. Verify that the oraInst.loc file exists in the /var/opt/oracle directory.

2. Prepare a response file.

3. Run Oracle Universal Installer in silent mode.

B.2 Installing Database Vault Using a Response File

Use the following steps to install Database Vault using a response file:

Note:
The oraInst.loc file should already be present in the /etc directory, by default. This is because Oracle Database Vault is installed into an existing Oracle Database installation.

1. Prepare the Response File

2. Run Oracle Universal Installer Using the Response File

B.2.1 Prepare the Response File

Oracle Database Vault comes with a response file template (dv.rsp) that you can edit to customize your installation. You can use this response file for silent mode installations.

The dv.rsp file is located in the response directory on the installation media. Use the following steps to copy and modify the response file:

1. Copy the response file from the response directory to a directory on your system.

$ cp /directory_path/response/dv.rsp local_directory

In this example, directory_path is the path to the database directory on the installation media. local_directory is the path to a directory on your disk.

2. Open the response file in a text editor:

$ vi local_directory/dv.rsp

The response file contains variables that store information required by Oracle Universal Installer. You need to set these variable values in the file. For example, you need to specify values for the Oracle home location, Database Vault owner name, and other such information required by Oracle Universal Installer.

The response file contains two parts. You should edit the variables only in the first part. The second part of the file contains preset variables, which must not be edited. This instruction is also provided in the response file.

Some of the variables are mandatory while others are optional. The mandatory variables must be supplied for a successful installation. Each variable is explained within the response file. Examples are also provided within the response file.

The following excerpt from the response file shows instructions related to setting the Oracle home variable:

#-----------------------------------------------------------------------------
--
#Name       : ORACLE_HOME
#Datatype   : String
#Description: Complete path of the existing 9.2.0.8 database Oracle
#             Home into which Oracle Database Vault will be installed.
#
#Requirement: 1) Must have Oracle Database Enterprise Edition release
#                9.2.0.8 installed.
#             2) Must have Oracle Enterprise Manager Console DB version
#                9.2.0.8 installed.
#             3) Cannot contain Oracle Database Vault.
#
#Example: ORACLE_HOME = "C:\OHOME1"
#-----------------------------------------------------------------------------
--
ORACLE_HOME=<Value Required>

Lines starting with a pound sign (#) are comment entries. If you wish to omit an optional variable, you can comment it by adding a pound sign (#) at the beginning of the line. You cannot comment lines containing mandatory variables, like ORACLE_HOME.

Remember that you can specify sensitive information, such as passwords, at the command line rather than within the response file. "How Response Files Work" explains this method.

See Also:
Oracle Universal Installer Concepts Guide for detailed information on creating response files.

3. Follow the instructions in the file to edit it. Save and close the file.

Note:
Oracle Universal Installer fails if you do not correctly configure the response file. Refer to the "Troubleshooting Silent Mode Installation" section for more information about troubleshooting a failed silent mode installation.

4. Change the permissions on the file to 700:

$ chmod 700 /local_dir/response_file.rsp

Caution:
A fully specified response file for an Oracle Database Vault installation contains the passwords for database administrative accounts. Ensure that only the Oracle software owner user can view or modify response files or consider deleting them after the installation succeeds.

B.2.2 Run Oracle Universal Installer Using the Response File

Now, you are ready to run Oracle Universal Installer at the command line, specifying the response file you created, to perform the installation. The Oracle Universal Installer executable, runInstaller, provides several options. For help information on the full set of these options, run runInstaller with the -help option. For example:

$ directory_path/runInstaller -help

To run Oracle Universal Installer using a response file:

1. Complete the preinstallation tasks listed in Chapter 2, "Installing Oracle Database Vault as an Option".

See Also:
Frequently Asked Questions in the Oracle Database Vault Release Notes for Solaris Operating System (SPARC 64-Bit) for a checklist of the preinstallation requirements

2. Log in as the Oracle software owner user (typically oracle).

3. To start Oracle Universal Installer in silent mode, enter a command similar to the following:

Note:
Do not specify a relative path to the response file. If you specify a relative path, Oracle Universal Installer fails.

- $ /directory_path/runInstaller -silent -responseFile responsefilename

In this example:

- directory_path is the path to the database directory on the DVD or the path to the Disk1 directory on the hard disk.

- -silent indicates that you want to run Oracle Universal Installer in silent mode.

- responsefilename is the full path and file name of the installation response file that you configured.

Note:
For more information about other options for the runInstaller command, enter the following command:

$ /directory_path/runInstaller -help

B.3 Troubleshooting Silent Mode Installation

To determine whether a silent mode installation succeeds or fails, refer to the following log file:

/oraInventory_location/logs/silentInstalldate_time.log

The oraInventory_location can be found in the /var/opt/oracle/oraInst.loc file. The inventory_loc parameter in the oraInst.loc file specifies the location of the oraInventory directory.

A silent installation fails in the following conditions:

- You do not specify a response file

- You specify an incorrect or incomplete response file

- Oracle Universal Installer encounters an error, such as insufficient disk space

- The Database Vault installation prerequisites have not been met

Oracle Universal Installer or configuration assistant validates the response file at run time. If the validation fails, the silent mode installation or configuration process ends. Oracle Universal Installer treats values for parameters that are of the wrong context, format, or type as if no value was specified in the file.

C Enabling Database Vault for Additional Databases in a Shared Oracle Home

You should run Database Vault Configuration Assistant (DVCA) after creating a new Oracle Database Vault database, if any of the following conditions is true:

- Database Vault is installed into an Oracle home that has more than one database. You need to run DVCA on the other databases in the Oracle home. This enables Database Vault security for those databases. The databases should meet the prerequisites for installing Oracle Database Vault, as discussed in "Preinstallation and Installation Tasks" .

- Database Configuration Assistant (DBCA) is used to create a new Database Vault database in an Oracle home that already has a Database Vault database. DVCA loads the Database Vault schema objects into the new database, creates the DV_OWNER and optional DV_ACCTMGR accounts, and deploys the Database Vault Administrator application for the database.

Use the following syntax to run the DVCA utility:

$ORACLE_HOME/bin/dvca -action option [-racnode host_name] -oh oracle_home -jdbc_str jdbc_connection_string \
-sys_passwd SYS_password -owner_account DV_owner_account_name -owner_passwd DV_owner_account_password \
[-acctmgr_account DV_account_manager_account_name] [-acctmgr_passwd DV_account_manager_password] \
[-logfile ./dvca.log] [-silent] [-nodecrypt][-lockout] [-languages {["en"],["de"],["es"],["fr"], \
["it"],["ja"],["ko"],["pt_BR"],["zh_CN"],["zh_TW"]}]

Where:

- action: The action to perform. option creates the Database Vault schema objects, creates the DV_OWNER account and the optional DV_ACCTMGR account, and deploys the Database Vault Administrator application.

- racnode: The host name of the Oracle Real Application Clusters (RAC) node on which the action is being performed. Do not include the domain name with the host name. Use this option if this is an Oracle RAC database.

- oh: The Oracle home for the database.

- jdbc_str: The JDBC connection string used to connect to the database. For example, jdbc:oracle:oci:@orcl1, where orcl1 is the net service name in the tnsnames.ora file ($ORACLE_HOME/network/admin/tnsnames.ora).

- sys_passwd: Password for user SYS

- owner_account: Oracle Database Vault Owner account name

- owner_passwd: Oracle Database Vault owner account password

- acctmgr_account: (Optional) Oracle Database Vault Account Manager user

- acctmgr_passwd: Oracle Database Vault Account Manager password (if a user name has been specified)

- logfile: Optionally, specify a log file name and location. You can enter an absolute path or a path that is relative to the location of the $ORACLE_HOME/bin directory

- silent: Required if you are not running DVCA in an xterm window

- nodecrypt: Reads plaintext passwords as passed on the command line. You must use this option if you are passing plaintext passwords to the command.

- languages: Declares the language content to load, defaults to "en" (English). You can specify multiple languages. Include each language in quotation marks with commas separating different languages. Enclose the list of languages in braces. For example, -languages {"en","fr","ja"}.

The following lists the language key:

- de: German

- en: English

- es: Spanish

- fr: French

- it: Italian

- ja: Japanese

- ko: Korean

- pt_BR: Brazilian Portuguese

- zh_CN: Simplified Chinese

- zh_TW: Traditional Chinese

Note:

- If the Oracle system identifier (SID) of the database is more than 8 characters, then you would need to update the Net service name in the tnsnames.ora file before running DVCA. See Oracle Database Vault Release Notes for Solaris Operating System (SPARC 64-Bit) for more information.

- DVCA should also be run before and after installing database options like Spatial, Java, and Intermedia. See Oracle Database Vault Administrator's Guide for more details.

D Initialization Parameters

When you install Oracle Database Vault, the security specific database initialization parameters are initialized with default values. The following list shows the default values for these security specific initialization parameters:

REMOTE_LISTENER=''
COMPATIBLE=9.2.0.0.0
_app_ctx_vers=FALSE
REMOTE_LOGIN_PASSWORDFILE = default, EXCLUSIVE
AUDIT_SYS_OPERATIONS = TRUE
REMOTE_OS_AUTHENT = FALSE
REMOTE_OS_ROLES = FALSE
OS_ROLES = FALSE
OS_AUTHENT_PREFIX = ''
SQL92_SECURITY = TRUE
O7_DICTIONARY_ACCESSIBILITY = FALSE

E Database Listener Security Recommendations

This appendix lists the security recommendations for protecting the database listener.

E.1 Security Checklist for the Database Listener

The following configuration guidelines help enhance the security for your database listener:

- The database listener configuration file, listener.ora, and the supporting OracleNet configuration file, tnsnames.ora, should have the ADMIN_RESTRICTIONS_LISTENER_SID=ON protection enabled.

- The database listener configuration file, listener.ora, and the supporting OracleNet configuration file, tnsnames.ora, should have the PLSExtProc listener disabled.

- The listener should be configured to listen on a non-standard port. This means that the default port (1521) should be changed.

- The listener should be password protected or leverage operating system (OS) authentication based on the organizational security policy.

- The listener should use a unique name, which should be different from the default name.

- The listener.ora file should have the following parameter set:

INBOUND_CONNECT_TIMEOUT_ListenerName = 10

- The sqlnet.ora file should have the following parameters set:

SQLNET.INBOUND_CONNECT_TIMEOUT  = 12
SQLNET.EXPIRE_TIME = 10

- The listener should have logging enabled as follows:

LOGGING_LISTENER = ON
LOG_STATUS = ON
LOG_DIRECTORY_ListenerName = Directory_owned_by_Oracle_account
LOG_FILE_ListenerName = File_owned_by_Oracle_account

Note:
Only the owner and the DBA group should have permissions over the LOG_DIRECTORY.The owner should have read and write access to the LOG_DIRECTORY and the DBA group should have read access to it.
Only the owner and the DBA group should have read and write permissions over the LOG_FILE.

- The listener should have tracing enabled as follows:

TRACE_DIRECTORY_ListenerName = Directory_owned_by_Oracle_account
TRACE_FILE_ListenerName = File_owned_by_Oracle_account
TRACE_LEVEL = user
TRACE_FILELEN_ListenerName = 512
TRACE_FILENO_ListenerName = 1000
TRACE_TIMESTAMP_ListenerName = dd-mon-yyyy hh:mi:ss:mil

Note:
Only the owner and the DBA group should have read and write permissions over the TRACE_DIRECTORY.
Only the owner and the DBA group should have read and write permissions over the TRACE_FILE.

Index
A  B  C  D  E  F  G  H  I  K  L  M  O  P  R  S  T  U  V

Numerics

9.2.0.8 patch set, 2.1.5.1

A

accounts

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

unauthenticated access to, 2.2.3.1

ANONYMOUS user

unauthenticated account access with, 2.2.3.1

applying 9.2.0.8 patch set, 2.1.5.1 architecture

checking system architecture, 2.1.2

audit policy, 1.3

B

backups

after upgrading, 2.2.1

importance, 2.1.6

preparing a strategy, 2.1.6

Bash shell

default user startup file, 2.1.9

.bash_profile file, 2.1.9 Bourne shell

default user startup file, 2.1.9

C

C shell

default user startup file, 2.1.9

certification, hardware and software, 1.4.1 change passwords

for oracle-supplied accounts, 2.2.3

checking

database requirements, 2.1.5

hardware requirements, 2.1.2

software requirements,operating system requirements, 2.1.3

configuring

kernel parameters, 2.1.4

oracle user environment, 2.1.9

D

database (RAC)

starting, 2.2.5

database requirements, 2.1.5 Database Vault

accounts, 1.2

audit policy, 1.3

initialization parameters, 1.3

Database Vault Account Manager account, 1.2.2

password, 1.2.2

user name, 1.2.2

Database Vault Administrator (DVA) application

deploying, 2.2.7

timeout value, 2.2.7.1

Database Vault Configuration Assistant, 2.2.6 Database Vault Owner account, 1.2.1

password, 1.2.1

user name, 1.2.1

default file mode creation mask

setting, 2.1.9

disk space

checking, 2.1.2

DISPLAY environment variable

setting, 2.1.9, 2.1.9

DV_ACCTMGR role, 1.2.2 DV_OWNER role, 1.2.1 DVCA

See Database Vault Configuration Assistant

dvca command, 2.2.6, 2.2.6, C

E

env command, 2.1.9

environment

checking settings, 2.1.9

configuring for oracle user, 2.1.9

environment variables

DISPLAY, 2.1.9, 2.1.9

ORACLE_BASE, 2.1.9

ORACLE_HOME, 2.1.8.3, 2.1.9, 2.1.9

ORACLE_SID, 2.1.9

PATH, 2.1.9

SHELL, 2.1.9

TEMP and TMPDIR, 2.1.2, 2.1.9

TNS_ADMIN, 2.1.9

errors

silent mode, B.3

F

file mode creation mask

setting, 2.1.9

files

.bash_profile, 2.1.9

editing shell startup file, 2.1.9

.login, 2.1.9

.profile, 2.1.9

response files, B.2.1

/var/opt/oracle/oraInst.loc, B.3

G

Global Services Daemon (GSD)

starting, 2.1.7

H

hardware and software certifications, 1.4.1

hardware certification, 1.4.1

hardware requirements, 2.1.2

I

initialization parameters, 1.3, D

installation

considerations, 1.4

errors

silent mode, B.3

response files, B, B.2.1

preparing, B.2.1

silent mode, B.3

templates, B.2.1

silent mode, B.2.2

error handling, B.3

installing

Oracle Universal Installer, using, 2.1.10

instance

instance identifier (SID), 2.1.9

K

kernel parameters

configuring, 2.1.4

Korn shell

default user startup file, 2.1.9

L

listener, 2.1.5

identifying Oracle home for, 2.1.8.3

lsnrctl command, 2.1.8.3

security checklist, E.1

stopping, 2.1.8.3, 2.1.8.3

stopping existing listener process, 2.1.8.3

listener (RAC)

starting, 2.2.5

logging on

SYSDBA privilege connections, enabling, 2.2.4

.login file, 2.1.9 lsnrctl command, 2.1.8.3

M

mask

setting default file mode creation mask, 2.1.9

memory requirements, 2.1.2 mode

setting default file mode creation mask, 2.1.9

multiple Oracle homes, 1.4.2

O

operating system requirements, 2.1.3

Oracle Database

setting ORACLE_SID environment variable, 2.1.9

Oracle Database Vault

audit policy, 1.3

initialization parameters, 1.3, D

Oracle home directory

identifying for listener, 2.1.8.3

Oracle homes,multiple, 1.4.2 Oracle Net

identifying Oracle home for listener, 2.1.8.3

lsnrctl command, 2.1.8.3

stopping existing listener, 2.1.8.3

stopping listener, 2.1.8.3

stopping the listener, 2.1.8.3

Oracle Real Application Clusters (RAC)

SYSDBA privilege, impact on, 2.2.4

Oracle software owner user

configuring environment for, 2.1.9

determining default shell, 2.1.9

Oracle Universal Installer, 2.1.5.1, 2.1.8.3, 2.1.10, 2.3

response files, B

oracle user

configuring environment for, 2.1.9

determining default shell, 2.1.9

ORACLE_BASE environment variable

setting, 2.1.9

ORACLE_HOME environment variable

setting, 2.1.8.3

unsetting, 2.1.9

ORACLE_SID environment variable

setting, 2.1.9

oracle-supplied accounts

change passwords, 2.2.3

orapwd utility, 2.2.4 OUI, 2.1.5.1

P

password file, 2.1.5

passwords

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

password files, 2.2.4

resetting

with SQL*Plus, 2.2.3.1

specifying for response files, B.1 unlocking

with SQL*Plus, 2.2.3.1

See alsosecurity patch set

applying, 2.1.5.1

documentation, 2.1.5.1

PATH environment variable

setting, 2.1.9

process

stopping existing, 2.1.8

stopping existing listener process, 2.1.8.3

stopping listener process, 2.1.8.3

processor

checking system architecture, 2.1.2

.profile file, 2.1.9 ps command, 2.1.8.3

R

RAM requirements, 2.1.2

Real Application Clusters

Instance Parameters, setting, 2.2.6

REMOTE_LOGIN_PASSWORDFILE parameter, 2.1.5 removing, Oracle Software, 2.3 requirements

database, 2.1.5

hardware, 2.1.2

listener, 2.1.5

Oracle Database 9.2.0.8 patch set, 2.1.5.1

password file, 2.1.5

software, operating system, 2.1.3

response files

about, B.1

general procedure, B.1.1

passing values at command line, B.1

passwords, B.1

security, B.1

specifying with Oracle Universal Installer, B.2.2

See also silent mode, B.1

response files installation

about, B

roles

DV_ACCTMGR, 1.2.2

DV_OWNER, 1.2.1

S

security

See alsopasswords

security checklist

database listener, E.1

shell

determining default shell for oracle user, 2.1.9

SHELL environment variable

checking value of, 2.1.9

shell startup file

editing, 2.1.9

SID

setting ORACLE_SID environment variable, 2.1.9

silent mode installation, B.2.2 software and hardware certifications, 1.4.1 software certification, 1.4.1 software requirements,operating system requirements, 2.1.3 srvctl command, 2.2.5 startup file

for shell, 2.1.9

stopping

Oracle processes, 2.1.8

swap space

checking, 2.1.2

requirements, 2.1.2

system architecture

checking, 2.1.2

T

TEMP environment variable, 2.1.2

setting, 2.1.9

temporary disk space

requirements, 2.1.2

TMPDIR environment variable, 2.1.2

setting, 2.1.9

TNS_ADMIN environment variable

unsetting, 2.1.9

U

umask, 2.1.9

umask command, 2.1.9, 2.1.9

UNIX commands, 2.1.9

env, 2.1.9

ps, 2.1.8.3

umask, 2.1.9

unset, 2.1.9

unsetenv, 2.1.9

unset command, 2.1.9 unsetenv command, 2.1.9 upgrading

after upgrading, 2.2

backup strategy, 2.1.6

post upgrade actions, 2.2

user names

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

users

Database Vault Account Manager, 1.2.2

Database Vault Owner, 1.2.1

V

/var/opt/oracle/oraInst.loc file, B.1.1, B.3

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2014, Oracle and/or its affiliates. All rights reserved.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.