Installing Oracle AVDF on Oracle Database Appliance (ODA)

B Installing Oracle AVDF on Oracle Database Appliance (ODA)

Learn how to install Audit Vault Server or Database Firewall on Oracle Database Appliance.

The Oracle Database Appliance (ODA) is a database server appliance. It is the easiest and most affordable way to run Oracle Databases and applications in remote and edge computing environments. It reduces Oracle Database deployment time and management workload using a pre-built integrated system with management automation.

Oracle AVDF comprises of Audit Vault Server and Database Firewall. They are delivered as software appliance images that can be deployed on physical machines or virtual machines (VM). Audit Vault Server and Database Firewall can be deployed on Oracle Database Appliance by creating a KVM (Kernel-based Virtual Machine) guest instance on ODA.

This appendix contains an overview for installing Audit Vault Server and Database Firewall on Oracle Database Appliance.

At the high level, below would be the flow of installation.

Figure B-1 Oracle AVDF on ODA

Description of "Figure B-1 Oracle AVDF on ODA"

Follow these steps at a high level:

Prerequisites
1. Create an ODA VM instance
2. Download Oracle AVDF ISO files within the ODA VM instance
Install KVM on ODA VM instance
Install Audit Vault Server
1. Create a storage pool for ISO files and Audit Vault Server installation
2. Create a KVM guest instance
3. Install Audit Vault Server or Database Firewall
Configure Audit Vault Server
1. Deploy Audit Vault Agents
2. Register the target database instance in the Audit Vault Server
3. Start the Audit Vault Agent
4. Configure the database instance as a target using the Audit Vault Server console
5. Configure Auditing
6. Provision Audit Policies
7. Monitor Database Activity in Audit Vault Server

B.1 Completing the Installation Prerequisites

Learn about the prerequisites before the installation of Oracle AVDF on ODA.

Create an ODA VM instance by referring to Oracle Database Appliance X8-2 Deployment and User’s Guide.

See Also:
Creating a Virtual Machine in a KVM Deployment

Note:
Oracle recommends to create a vdisk to accommodate the storage pools and attach the same to the VM.

This ODA VM instance is used as a hypervisor to host a nested VM for installing Oracle AVDF. The CPU mode in the ODA VM instance needs to be updated to support this nested virtualization.
Follow these steps to edit the CPU mode.
Note:
In these steps, vm_name is the ODA VM instance name and vmstorage_name is the vmstorage for this ODA VM instance.
1. Run the command:
```
virsh edit <vm_name>
```
2. Identify and spot the following lines in the XML file which need to be changed:
```
  <cpu mode='custom' match='exact' check='partial'>
```
3. Change the lines as follows:
```
<cpu mode='host-passthrough' check='none'/>
```
4. Save the XML file.
5. Copy the domain XML file (/etc/libvirt/qemu/<vm_name>.xml) to the ODA location /u05/app/sharedrepo/<vmstorage_name>/.ACFS/snaps/vm_<vm_name> by running the following command:
```
cp /etc/libvirt/qemu/<vm_name>.xml /u05/app/sharedrepo/<vmstorage_name>/.ACFS/snaps/vm_<vm_name>
```
6. Restart the VM using these commands:
```
odacli stop-vm -n <vm_name>
```
```
odacli start-vm -n <vm_name>
```
Download the Oracle AVDF ISO files.

B.2 Download the Oracle AVDF ISO Files

Learn about downloading and verifying the software to install Oracle AVDF on ODA.

Download Oracle AVDF ISO files using the VNC console for the ODA VM instance. Refer to Downloading and Verifying Oracle AVDF Software for detailed steps for complete information.

Here are high level steps to follow:

1 Open a web browser on the VNC console for ODA VM instance and go to the Oracle Software Delivery Cloud portal:
https://edelivery.oracle.com
Click Sign In, and if prompted, enter your User ID and Password.
In the All Categories menu, select Release. In the following field, enter Oracle Audit Vault and Database Firewall, and then click Search.
Select the Oracle Audit Vault and Database Firewall version you want to install from the displayed list. Or click the Select icon that appears against the specific release.
In the next page, verify the details of the installation package, and then click Continue.
Read the Oracle Standard Terms and Restrictions displayed on the page. Select I reviewed and accept the Oracle License Agreement check box, and then click Continue.
Note:
Oracle AVDF release 20.3 and earlier, the Audit Vault Server installable files are available in parts and must be concatenated before installation. Starting with Oracle AVDF release 20.4, there is a single Audit Vault Server ISO file, and there is no need to concatenate.

The download page appears and displays the list of ISO files for Oracle Audit Vault and Database Firewall.
1. Audit Vault Server install: Vpart_number.iso Oracle Audit Vault and Database Firewall 20.x.0.0.0 - Audit Vault Server
  
  Note:
  Starting Oracle AVDF 20.4, there is a single Audit Vault Server ISO file, and there is no need to concatenate.
2. Database Firewall install: Vpart_number.zip Oracle Audit Vault and Database Firewall 20.x.0.0.0 - Utilities.
Next to the Print button, click View Digest Details.

The ISO files list expands to display each ISO file's SHA-1 and SHA-256 checksum reference numbers.
Verify the checksum value for all the ISO files.
Click Download. The Download Manager Installation screen is displayed. The size of the combined ISO files exceeds 11 GB, and takes time to download, depending on the network speed. The estimated download time and speed are displayed in the File Download dialog box.
Click Download the installer, and then click Save File.
Create a directory in ODA VM instance to download the ISO files. Download the ISO files into the ODA VM instance sources directory.
Click Save.
After the download is complete, launch a terminal session.
Check the ISO files have been downloaded correctly.

B.3 Installing KVM on ODA VM Instance for Running Oracle AVDF

Learn how to install KVM on ODA VM instance for running Oracle AVDF appliances.

Follow these steps to install KVM on the ODA VM instance, refer to the OS documentation about installing KVM hypervisor:

Run the following command to install the latest qemu packages and virt-manager:

If ODA VM instance is OL7:

yum -y install qemu-kvm qemu-img virt-manager libvirt libvirt-python libvirt-client virt-install

If ODA VM instance is OL8:

# yum install qemu-kvm qemu-img virt-manager libvirt libvirt-client virt-install

Run the following commands to enable libvirtd:

systemctl enable libvirtd

systemctl start libvirtd

Run the following commands to enable tuned:

systemctl enable tuned

systemctl start tuned

tuned-adm profile virtual-host

Enable nested VM support. Prior to ODA X10-2, ODA is Intel based and nested VM support is enabled by default. Starting from ODA X10-2 and above, ODA is AMD based, nested KVM support needs to be enabled manually by commenting out options kvm_amd nested=0 on the ODA BM hosts. Make these changes in both BM hosts if using ODA high availabiliy model.
```
[root@ODABM root]# cat /etc/modprobe.d/kvm.conf
# Enable nested virtualization on Intel processorsoptions kvm_intel nested=1
# Nested virtualization support on AMD processors is not stable enough
# for production use, so disable it
# options kvm_amd nested=0  
```
Reboot BM host to make the changes effective.

B.4 Configuring the Network on ODA VM Instance

Learn how to configure a bridge network on ODA VM instance to be used by the Oracle AVDF VM instance.

The purpose of this section is to create a bridge network for ODA VM instance, attach the virtual interface to the bridge, and plumb IP to the bridge.

Refer to the Oracle Linux documentation for more details about how to configure the network.

Follow these steps:

From the bare metal host, access the ODA VM by using:
```
virsh <ODA VM name> --console
```

Create the bridge network:

< delete the existing ens3 configuration from network manager>
# nmcli connection down ens3
# nmcli connection delete ens3

<create a bridge br0 and add port ens3 to the bridge br0>
# nmcli connection add type bridge con-name br0 ifname br0
# nmcli connection add type ethernet slave-type bridge con-name br0-port1 ifname ens3 master br0

<configure IP, gateway, dns to the bridge>
# nmcli connection modify br0 ipv4.addresses 'x.x.x.x/xx'
# nmcli connection modify br0 ipv4.gateway 'y.y.y.y'
# nmcli connection modify br0 ipv4.dns 'x.x.x.x'
# nmcli connection modify br0 ipv4.dns-search 'example.com'
# nmcli connection modify br0 ipv4.method manual

B.5 Installing the Audit Vault Server on the ODA VM Instance

Learn how to install the Audit Vault Server or Database Firewall on the ODA VM instance.

The ODA VM instance was installed following the steps in the previous topic.

Follow these steps on a high level to install Audit Vault Server or Database Firewall on the ODA VM instance

Create a storage pool to upload ISO files.
Create a storage pool for installing Audit Vault Server
Create a KVM guest instance
Install the Audit Vault Server

Follow these steps to create a storage pool in the ODA VM instance to upload Oracle AVDF ISO files:

Connect to the Virtual Machine using the VNC Viewer as root user.
Open a terminal and launch the virt-manager.
Right click on QEMU/KVM. Choose Details, and then select the Storage tab.
In the Storage tab of the virt-manager, click the plus button in the bottom left corner.
Provide a Name from which you can quickly identify that it is for the installable ISO file.
Select the Type of the storage pool. For example: dir: Filesystem Directory.
Provide the Target Path. It is the directory where the Audit Vault Server ISO files will be stored. For example: /u01/source/av.
Click Finish.
The newly created storage pool appears on the left hand side. Select the pool.
Copy or move the ISO file to this storage pool.

Follow these steps to create a storage pool for installing Audit Vault Server or Database Firewall. The appliance is installed on the storage pool.

Connect to the Virtual Machine with VNC Viewer as the root user.
Open a terminal and launch virt-manager.
Right-click on QEMU/KVM. Then choose Details and select the Storage tab.
Click the plus button in the bottom left corner.
Provide a Name.
Select the Type of the storage pool. For example: dir: Filesystem Directory.
Provide the Target Path. It is the directory where Audit Vault Server files are stored. For example: /u01/kvm/av.
Click Finish.
The new directory created appears on the left-hand side. Select the directory and then click the plus button next to Volumes.
Enter the Name.
Select the Format as qcow2.
Specify the size in the Max Capacity field. This is for installing Audit Vault Server, which requires a minimum of 256 GB.
Click Finish.
The newly created entry appears in the table below the Volumes field. Verify the same.

Follow these steps to create a KVM guest instance. KVM can be managed through the command line or GUI tools. In this document, the focus is on using the GUI tools. Use VNC console to connect to the ODA VM instance. Open the gnome-terminal and follow the steps or commands.

Connect to the Virtual Machine with VNC Viewer as the root user.
Open a terminal and launch virt-manager.
Select File and select New Virtual Machine.
Select the Local install media (ISO image or CDROM) option.
In the next few steps, choose the options based on the configuration, which may differ. Select the Use ISO image option and click Browse to select the first ISO file.
Deselect the checkbox Automatically detect operating system based on install media.
Select Linux as the OS Type.
Choose the Version. For example, Oracle Linux 7.7.
Choose Memory and CPU settings based on the workload of the service used on this KVM guest virtual machine. For example, 16384 MB as Memory (RAM) and CPUs as 4.
Click Forward.
Select the radio button Select or create custom storage.
Enter the path of the storage pool created earlier. For example: /u01/kvm/av/av191.qcow2.
In the New VM dialog, enter the Name.
Select the Customize configuration before install field.
Expand the Network selection area, and select the previously created bridge.
Select virtio in the Device model field.
Add the MAC address of the vNIC, and click Apply.
Click VirtIO Disk1 on the left, and expand Advanced Options.
Select SATA in the Disk bus field.
Click IDE CDROM 1 on the left, and ensure the Source path has the correct ISO file.
Select SATA in the Disk bus field.21. Click VirtIO Disk1 on the left, and expand Advanced Options.
Click Begin Installation in the top left corner of the dialog.

The virtual machine starts the installation and detects the vNIC network device attached to the virtual machine. The installation takes approximately one hour to complete. See Installing Audit Vault Server or Database Firewall for more information.

The system boots, and the initial splash screen appears. This indicates the Oracle AVDF release is being installed.
Enter the new root user password when prompted for change. Enter the same password when prompted for confirmation.
See Post-Install Configuration Tasks for more information on the installation passphrase used for initial log in to the Audit Vault Server console.
When prompted to insert the installation ISO again to continue, go to the KVM console.
Click View and then Details.
Click IDE CDROM1 on the left. In the Source path field, click Connect to specify the ISO file path.
Select the Image Location option and click Browse to navigate and select the ISO file.
Click Choose Volume.
Click the terminal icon to switch to the installation console.
Log in as root user to continue with the installation.
Select the default network interface. Ensure the MAC address is correct.
Set up the network configuration by entering the following fields:
- IP address: Enter the IP address that is used for Audit Vault Server installation.
- Network mask
- Gateway: Enter the IP address of the network interface if a gateway is required. Else, clear the field before saving.
Press the Tab key to navigate to the OK button, and press the Enter button. The installation begins and may take up to two hours to complete.
A confirmation message is displayed on the screen after the installation is completed. Click OK.
In the host VM instance, open a web browser. Enter https://<VM Private IP address of the vNIC assigned to Oracle AVDF VM>/console.
Choose to accept and continue to connect to the Audit Vault Server console.
Enter the password chosen earlier to log in.
When prompted, enter the user name of the super administrator and super auditor. Set the repository encryption password, support user password (for SSH access to VM), root user password (for root privilege on the VM). See Accessing the Audit Vault Server Post-Install Configuration Page for more information.
Expand the Time Setup region, and select Use NTP. Enter Server 1 IP address and click Test Server.

Note: Time difference between the Audit Vault Server and target negatively impacts the audit collection.
Check the network connectivity between the Audit Vault Server and targets by using ICMP ping. If all the previous steps were correctly performed, the Audit Vault Server and targets will connect with each other.

B.6 Installing the Database Firewall on the ODA VM Instance

Learn how to install the Database Firewall on ODA (Oracle Database Appliance) VM instance.

Follow the same steps documented in the previous section Installing the Audit Vault Server on the ODA VM Instance pointing to the Database Firewall ISO.

After the Database Firewall VM is ready, you need to follow additional steps to register the Database Firewall.

Additionally, follow these steps:

Register the Database Firewall in the Audit Vault Server console. See Specifying the Audit Vault Server Certificate and IP Address for more information.
Log in to the Audit Vault Server console as an administrator.
Click the Settings tab.
Click the Security tab in the left navigation menu.
Click the Certificate tab on the main page, and then click the Server Certificate sub tab. The server's certificate is displayed.
Copy the server's certificate.
Connect to the Database Firewall server through SSH as a support user.
Switch to root user:
```
su – root
```
Copy the certificate of the Audit Vault Server into a file: vi /root/certif_avs.crt.

Run the following command to associate the primary Audit Vault Server to the Database Firewall:

cat /root/certif_avs.crt | /opt/avdf/config-utils/bin/config-avs set avs=primary address=<IP address of the primary AVS> certificate=<Path of the certificate>

Run the following command to synchronize the system clocks of Database Firewall Server with the Audit Vault Server:

/opt/avdf/config-utils/bin/config-ntp set servers=<Comma separated IP addresses or hostnames of NTP servers> sync_on_save=true enabled=true

In the Audit Vault Server console, navigate to the Database Firewalls tab.
Click Register.
Enter a Name and IP Address in the dialog.
Click Save. The Database Firewall instance is registered and is displayed in the list.