Oracle® DIVA Enterprise Connect

Security Guide

Release 1.0.1

E86795-03

June 2018

Oracle DIVA Enterprise Connect Security Guide, Release 1.0.1

E86795-03

Copyright © 2018, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Contents

Preface

- Audience

- Documentation Accessibility

1 Overview

- Product Overview

- Oracle DIVArchive and Oracle DIVAnet

- Oracle WebLogic

- Oracle DIVAnet ManagerAdapter

- General Security Principles

- Keeping Software Up To Date

- Restricting Network Access to Critical Services

- Use Principle of Least Privilege where Possible

- Monitoring System Activity

- Keeping Up To Date on Latest Security Information

2 Secure Installation

- Understand Your Environment

- Which resources need to be protected?

- DIVA Enterprise Connect Servers

- Configuration Files and Settings

- From whom are the resources being protected?

- What will happen if the protections on strategic resources fail?

- Recommended Deployment Topologies

- DIVA Enterprise Connect Installation

- Connecting to DIVArchive

- Oracle WebLogic Admin Console

- DIVA Web Services API

- Safeguarding Disk Systems

- Postinstallation Configuration

3 Security Features

- The Security Model

- Authentication

- WebLogic Features

- DIVAnet Features

- Access Control

A Secure Deployment Checklist

Preface

Oracle's DIVA Enterprise Connect Security Guide includes information about the DIVA Enterprise Connect product and explains the general principles of application security.

Audience

This guide is intended for anyone involved with using security features and secure installation and configuration of DIVA Enterprise Connect.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

1 Overview

This chapter provides an overview of the DIVA Enterprise Connect product and explains the general principles of application security.

Product Overview

Oracle DIVA Enterprise Connect is a standards based Web Service API implemented on the Oracle WebLogic Suite. DIVA Enterprise Connect interacts with the Oracle DIVArchive and Oracle DIVAnet systems, acting as a web service binding for the DIVArchive API. DIVA Enterprise Connect provides a client computer with a language and operating system independent method of submitting requests to archive, restore, copy, or delete content. It allows clients to gather information about archived objects and media, and manage archive devices (for example, tape libraries and disk arrays). The DIVA Enterprise Connect platform consists of Oracle WebLogic, installation and administration scripts, data files, and configuration. The installation scripts assist in installing and configuring the DIVA Enterprise Connect platform.

Oracle DIVArchive and Oracle DIVAnet

Oracle DIVArchive is a Content Management Solution specifically engineered for archiving, tracking, and restoring large amounts of rich media and broadcast digital assets. It integrates with a multitude of industry standard software, archive media, transfer protocols, hardware platforms, and the Cloud. Oracle DIVArchive enables organizations to manage the lifecycle of their digital assets through automated policies that move data to the appropriate tier of storage based on access patterns, age, and storage utilization.

Oracle DIVAnet provides a unified view of archived digital assets across multiple, distributed DIVArchive systems, and the Cloud. It facilitates moving content back and forth among DIVArchive sites, and to and from customer Source/Destination servers and disks. DIVAnet performs its tasks for disaster recovery, content distribution, access control, performance, and content availability. By connecting to multiple DIVArchive sites, DIVAnet creates a virtual archive system that spans geographical locations.

For more information about DIVArchive and DIVAnet, see the Oracle DIVArchive 7.5 documentation library, and the Oracle DIVAnet 2.2 documentation library.

Oracle WebLogic

Oracle WebLogic Server is an Application Server framework based on the Oracle Java 2 Platform, Enterprise Edition (J2EE) version technologies. J2EE is the standard platform for developing multitiered enterprise applications based on the Java programming language. WebLogic Server J2EE applications are based on standardized, modular components. WebLogic Server provides a complete set of services for those modules and handles many details of application behavior automatically, without requiring programming.

WebLogic Server includes a security architecture that provides a unique and secure foundation for applications that are available through the web. By taking advantage of the security features in WebLogic Server, enterprises benefit from a comprehensive, flexible security infrastructure designed to address the security challenges of making applications available on the web. You can use WebLogic security standalone to secure WebLogic Server applications, or as part of an enterprise-wide, security management system that represents a best in breed, security management solution. More information on standard WebLogic security features can be found at https://docs.oracle.com/middleware/12212/wls/wls-secure.htm.

Oracle DIVAnet ManagerAdapter

The DIVAnet ManagerAdapter Service serves as a bridge between remote servers and Oracle DIVArchive. Oracle recommends that it is installed and configured on the DIVArchive Manager platform. You can use the ManagerAdapter as a bridge to establish a secure connection between DIVA Enterprise Connect and DIVArchive.

General Security Principles

The following sections describe the fundamental principles that are required to use any application securely.

Keeping Software Up To Date

Stay current with the release of Oracle DIVA Enterprise Connect that you run. You can find current versions of the software for download on the Oracle Software Delivery Cloud at https://edelivery.oracle.com/.

Restricting Network Access to Critical Services

DIVA Enterprise Connect uses the following TCP/IP ports by default:

- tcp/7001 is the default HTTP WebLogic Admin Console UI port

- tcp/7002 is the default HTTPS (secure) WebLogic Admin Console UI port

- tcp/9443 is the default HTTP DIVA Web Services port

- tcp/9444 is the default HTTPs (secure) DIVA Web Services port

Note:
Not all of these ports must be exposed externally, and are based on configuration and usage. To avoid potential security risk, Oracle strongly recommends keeping port 7001 and 7002 blocked. If unencrypted HTTP access from remote sites is not needed, Oracle recommends blocking port 9443 as well.

Use Principle of Least Privilege where Possible

The DIVA Enterprise Connect installer requires a Linux admin user that is not root. WebLogic must always run as this Linux user. This Linux user must not be used for other applications or services (for example, DIVArchive). Updates to configuration files and scripts must not grant world privileges on files in the release. Firewalls must restrict ports to only those that are required. You can use both WebLogic and DIVAnet access control features (briefly described later in this chapter) to restrict API clients and systems to the least privilege possible.

Monitoring System Activity

You must monitor system activity to determine how well DIVA Enterprise Connect is operating, and whether it is logging any unusual activity. Check the log files located in the $DIVAS_HOME/logs folder. You should periodically monitor the access*.log files in the $DIVAS_HOME/logs directory for suspicious client activity.

Keeping Up To Date on Latest Security Information

You can access several sources of security information and alerts for a large variety of software products at http://www.us-cert.gov.

The primary method of keeping up to date on security matters is to run the most current release of the DIVA Enterprise Connect software.

2 Secure Installation

This chapter outlines the planning process for a secure installation and describes several recommended deployment topologies for the systems.

Understand Your Environment

To better understand security needs, the following questions must be asked:

Which resources need to be protected?

You can protect many of the resources in the production environment. Consider the type of resources that you want to protect when determining the level of security to provide.

When using DIVA Enterprise Connect, protect the following resources:

DIVA Enterprise Connect Servers

DIVA Enterprise Connect is installed on a server attached to one or more disks; either a local, or remote, disk directly connected to the DIVA Enterprise Connect system. Independent access to these disks presents a security risk. This type of external access might be from a rogue system that reads or writes to these disks, or from an internal system that accidentally provides access to these disk devices.

Configuration Files and Settings

You must protect DIVA Enterprise Connect system configuration settings from operating system level non-administrator users. In general, these settings are protected automatically by operating system level administrative users. Making the configuration files writable to non-administrative operating system users presents a security risk.

From whom are the resources being protected?

In general, the resources described in the previous section must be protected from all non-administrator access on a configured system, or from rogue external systems that can access these resources through the WAN or FC fabric.

What will happen if the protections on strategic resources fail?

Protection failures against strategic resources can range from inappropriate access (that is, access to data outside of normal DIVArchive operations) to data corruption (erroneously deleting assets, or writing to disk or tape outside of normal permissions).

Recommended Deployment Topologies

This section describes how to install and configure an infrastructure component securely.For information about installing DIVA Enterprise Connect, see the Oracle DIVA Enterprise Connect Installation, Configuration, and Operations Guide in the Oracle DIVA Enterprise Connect 1.0 documentation library.

Consider the following points when installing and configuring DIVArchive:

DIVA Enterprise Connect Installation

You must install DIVA Enterprise connect as a Linux user with admin privileges, but not as root. You must always run WebLogic as this user, and insure that the user is not used for other applications or services (for example, DIVArchive). The default DIVA Enterprise Connect installation directory permissions, and owners, should not be changed after installation without considering the security implications of the changes.

Connecting to DIVArchive

DIVA Enterprise Connect allows connections to DIVArchive using legacy DIVA tcp sockets, HTTP, or HTTPS. If you connect to a remote DIVArchive instance over a WAN, ensure that you connect over a trusted network. HTTP/HTTPS connections require that the Oracle DIVAnet ManagerAdapter component be installed and configured on the DIVArchive platform. If you use HTTP/HTTPS, Oracle recommends installing the ManagerAdapter component on the DIVArchive Manager system for increased system security.

Oracle WebLogic Admin Console

DIVA Enterprise Connect employs Oracle WebLogic in its implementation. Oracle WebLogic has a browser based admin console utility. If external access to the WebLogic Admin Console port is not needed, Oracle recommends blocking the port using firewall software. Often, it will not be necessary to allow both the HTTP and HTTPS admin console ports to both be active; you can block one or both using firewall software.

DIVA Web Services API

By default, DIVA Enterprise Connect provides both an HTTP web services port, and an HTTPS web services port. If external access to either the HTTP or HTTPS ports are not needed, Oracle recommends blocking the port using firewall software. Often, it will not be necessary to allow both the HTTP and HTTPS web services ports to both be active; you can block one or both using firewall software.

Safeguarding Disk Systems

Use FC Zoning to deny access to the DIVA Enterprise Connect disks connected through Fibre Channel from any server that does not require access to the disks. Preferably, use a separate FC switch to physically connect only to the servers requiring access.

Postinstallation Configuration

After installing any portion of DIVA Enterprise Connect, go through the security checklist in Appendix A.

3 Security Features

To avoid potential security threats, customers operating DIVA Enterprise Connect must be concerned about authentication and authorization of the system.

These security threats can be minimized by proper configuration and by following the postinstallation checklist in Appendix A.

The Security Model

The critical security features that provide protections against security threats are:

- Authentication - Ensures that only authorized individuals are granted access to the system and data.

- Authorization - Access control to system privileges and data. This feature builds on authentication to ensure that individuals get only appropriate access.

Authentication

Caution:
: DIVA Enterprise Connect uses passwords as part of the configuration. Passwords must be changed immediately after installation, and every 180 days (minimum) thereafter. After the change has been made, you must store the passwords in a safe location, offline, where they can be made available for Oracle Support if needed.

The following sections describe authentication security features for WebLogic and DIVAnet.

WebLogic Features

DIVA Enterprise Connect can perform authentication in a few different ways:

Basic Authentication Against API Key

API Clients are authenticated by looking up credentials in a directory configured in WebLogic. Oracle recommends using the DIVA Enterprise Connect Key Generator to generate a client ID (user name) and API Key (password), and automatically store the user in the Weblogic directory. For more information on the Key Generator, see the Oracle DIVA Enterprise Connect 1.0 Installation, Configuration, and Operations Guide, Chapter 4: Administering the Platform in the Oracle DIVA Enterprise Connect 1.0 documentation library. Oracle Weblogic has many features for storing users and passwords, changing passwords, unlocking users, deleting accounts, and adding users to groups. For more information on using the standard WebLogic directory features, see https://docs.oracle.com/middleware/12212/wls/SECMG/ldap.htm#SECMG327.

SSL / TLS Certificates

WebLogic has features that allow it to validate certificates that are stored in its truststore, both inbound and outbound. DIVA Enterprise Connect generates a new self-signed SSL certificate upon installation. you can then add this certificate to the DIVAnet ManagerAdapter truststore so that DIVAnet can authenticate DIVA Enterprise Connect. An overview of this process is presented in the Oracle DIVA Enterprise Connect 1.0 Installation, Configuration, and Operations Guide in the Oracle DIVA Enterprise Connect 1.0 documentation library. For more information on configuring SSL, keystores, and truststores in Weblogic, refer to https://docs.oracle.com/middleware/12212/wls/SECMG/identity_trust.htm#SECMG365.

DIVAnet Features

DIVA Enterprise Connect can connect to the DIVAnet ManagerAdapter. DIVAnet has security features that may be helpful in this scenario as follows:

SSL / TLS Certificates

DIVAnet consults a certificate truststore when DIVAnet creates an outbound connection to a remote DIVAnet service. This helps to ensure that DIVAnet is connecting to genuine DIVAnet services. You must connect through the ManagerAdapter using a ConnectionType identified as WebServices to create a secure connection from the DIVAnet ClientAdapter to a DIVArchive instance.

Access Rules

Access rules can filter inbound connections based on the inbound IP address, user name (Access Group), and other criteria. This feature is necessary to help ensure that only approved systems have appropriate access to DIVAnet services.

You can find more DIVAnet configuration details in the DIVAnet 2.2 Installation, Configuration, and Operations Guide, Chapter 4: Configuring DIVAnet Services in the Oracle DIVAnet 2.2 documentation library.

Access Control

Access control in DIVA Enterprise Connect employs the following access controls:

Access Groups In WebLogic and DIVAnet

DIVA Enterprise Connect indicates, on a per request basis, which access rules should be applied in the DIVAnet ManagerAdapter. This is accomplished using group assignment in WebLogic. For more information, see the DIVA Enterprise Connect 1.0 Installation, Configuration, and Operations Guide, Chapter 3: Configuring DIVA Enterprise Connect in the Oracle DIVA Enterprise Connect 1.0 documentation library.

DIVAnet ManagerAdapter Access Rules

You can define Access Rules in the DIVAnet ManagerAdapter for each group of API users after Access Groups are set up in WebLogic. For more information, see the DIVAnet 2.2 Installation, Configuration, and Operations Guide in the Oracle DIVAnet 2.2 documentation library.

Other WebLogic Features

Weblogic has too many security features to list in this guide. Instead, refer to the Weblogic documentation.

For a general overview of customizing WebLogic security, see https://docs.oracle.com/middleware/12212/wls/SECMG/realm.htm#SECMG127.

For information on how to configure policies in WebLogic see https://docs.oracle.com/middleware/1221/wls/WLDFC/config_watches.htm#WLDFC194.

A Secure Deployment Checklist

1. Set strong passwords for Administrator (or root) and any other operating system accounts that have any DIVA Enterprise Connect administrator or service roles assigned to them, including:

- diva, divanet, and Oracle User IDs (if being used)

- Any disk array administrative accounts

2. Do not install or run as the Linux root user, instead assign roles as needed to other user accounts.

3. Use site-specific certificates for each DIVA Enterprise Connect installation, and define a strong password for the Linux account running Weblogic.

4. Install firewall software on every DIVA Enterprise Connect system, and only expose the needed ports. Restrict access to the WebLogic admin console ports.

5. Install operating system and DIVA Enterprise Connect updates on a periodic basis because they include security patches.

6. Install antivirus and exclude the DIVAdirector processes and storage for performance reasons.

7. Best practices dictate segregation of FC disks and FC tape drives, either physically or through FC Zoning, so that disks and tape devices do not share the same HBA port. This security practice helps prevent loss of data accidents resulting from accidentally overwriting important data.

8. Configure an appropriate set of backups for the DIVA Enterprise Connect configuration files. Backups are part of security and provide a way of restoring data lost, either accidentally or through some breach. Your backup should include some type of policy while being transported to an off-site location. Backups need to be protected to the same degree as DIVA Enterprise Connect disks.

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2018, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Pre-General Availability Draft Documentation Notice

If this document is in public or private pre-General Availability status:

This documentation is in pre-General Availability status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Pre-General Availability Draft Documentation Notice

If this document is in private pre-General Availability status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your pre-General Availability trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.