Oracle® Enterprise Manager System Monitoring Plug-In for Oracle Key Manager

Security Guide

E55301-02

December 2018

Oracle Enterprise Manager System Monitoring Plug-In for Oracle Key Manager Security Guide

E55301-02

Copyright © 2014, 2018, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Contents

Preface

- Documentation Accessibility

- Related Documentation

1 About Security for the Oracle Enterprise Manager

- Product Overview

- Basic Security Principles

2 Secure Installation and Configuration

- Installation Overview

- Resource Accounts

- Password Protection

- Certificate Protection

3 Security Features

Preface

This document describes the security feature of the Oracle Enterprise Manager System Monitoring Plug-in for Oracle Key Manager. This guide is intended for anyone involved with using security features and secure installation and configuration of Oracle Enterprise Manager System Monitoring Plug-in for Oracle Key Manager.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Related Documentation

The Oracle Key Manager Administration Guide and other Oracle Key Manager product documentation appear on the Oracle documentation website:

http://www.oracle.com/technetwork/documentation/tape-storage-curr-187744.html#crypto

Oracle Key Manager GUI installers, upgrade files, SNMP MIBs, and the OKM JCE Provider are available on the My Oracle Support site:

https://support.oracle.com

After logging into this site, click the Patches & Updates tab, search the ”Oracle Key Manager (OKM)” product family, and select the desired OKM version. Download the desired Oracle Key Manager file.

Additional product information can be found on the Oracle Key Manager wiki site:

http://wikis.oracle.com/display/OKM/Home

General information about Oracle Enterprise Manager plug-in modules can be found on the Oracle Technology Network:

http://www.oracle.com/technetwork/oem/extensions/index-100685.html

1 About Security for the Oracle Enterprise Manager

This guide provides an overview of the Oracle Enterprise Manager System Monitoring Plug-in for Oracle Key Manager and explains the general principles of application security.

Product Overview

The Oracle Enterprise Manager System Monitoring Plug-in for Oracle Key Manager extends Oracle Enterprise Manager Cloud Control to add support for monitoring Oracle Key Manager appliances. This plug-in provides the following primary features:

- Gathers and presents configuration and performance information for Oracle Key Manager appliances

- Raises alerts for pre-selected configuration and monitoring data

- Ties together Oracle ZFS storage appliances and Oracle databases integrated with Oracle Key Manager appliances

- Supports monitoring by remote agents in the Cloud Control environment

Basic Security Principles

The Plug-in follows these security principles:

Connections to Oracle Key Manager appliances are through SSL.

The Plug-in authenticates itself with an Oracle Key Manager (OKM) cluster and then establishes a Secure Sockets Layer (SSL) channel using Transfer Layer Sockets (TLS) v1.0 for further communication with the OKM cluster.

Certificates are encrypted.

The Plug-in uses X.509 certificates to authenticate itself with the OKM cluster. These certificates are stored in PKCS#12 files, and thus are encrypted.

2 Secure Installation and Configuration

This chapter outlines how the software is securely installed and configured.

- Installation Overview

- Resource Accounts

- Password Protection

- Certificate Protection

Installation Overview

The latest version of Oracle Enterprise Manager System Monitoring Plug-in for Oracle Key Manager is available for download from the Oracle Technology Network. The Plug-in distribution consists of a single package file for Oracle Enterprise Manager Cloud Control 12c. The package does not contain any utilities that allow it to be installed by itself. It must be imported and deployed into Oracle Enterprise Manager Cloud Control 12c by the administrator of Oracle Enterprise Manager Cloud Control 12c.

Resource Accounts

The Plug-in requires that the administrator of Oracle Enterprise Manager Cloud Control 12c obtain credentials for the Oracle Key Manager cluster from an Oracle Key Manager administrator to perform all required operations of the Plug-in. It is recommended that an Oracle Key Manager administrator follow the instructions in the Oracle Enterprise Manager System Monitoring Plug-in for Oracle Key Manager Installation Guide to generate the credentials and pass this information to the administrator of Oracle Enterprise Manager Cloud Control 12c.

Password Protection

The Plug-in does not store the credentials from Oracle Key Manager clusters. Credential management is handled by Oracle Enterprise Manager Cloud Control 12c, and the Plug-in simply consumes the credentials as provided by Oracle Enterprise Manager Cloud Control 12c.

Certificate Protection

The X.509 certificates that the Plug-in uses to authenticate itself with the OKM cluster are encrypted and are stored as PKCS#12 files. To further protect these certificates, the administrator of Oracle Enterprise Manager Cloud Control 12c should ensure that the permissions on these files are sufficiently restricted to prohibit access by unauthorized users.

3 Security Features

This chapter provides a high-level overview of the security features of the Plug-in.

The critical security features that provide protection are:

- Authentication – The Plug-in runs in Oracle Enterprise Manager Cloud Control 12c. The users must log in to Oracle Enterprise Manager before they can view any information from the Plug-in. Additionally, to access an Oracle Key Manager cluster, the Plug-in requires the credentials from the credentials stored in Oracle Enterprise Manager Cloud Control 12c.

- Authorization – The Plug-in requires that the users specified in the resource accounts have the appropriate privileges to gather configuration and performance information from the Oracle Key Manager cluster.

- Confidentiality – Credentials for the Oracle Key Manager cluster are stored in Oracle Enterprise Manager Cloud Control 12c in a secure database. Additionally, all interactions between the Plug-in and the Oracle Key Manager cluster are through secure communication channels.

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2019, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Pre-General Availability Draft Documentation Notice

If this document is in public or private pre-General Availability status:

This documentation is in pre-General Availability status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Pre-General Availability Draft Documentation Notice

If this document is in private pre-General Availability status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your pre-General Availability trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.