Configuring Advanced Settings for Database Firewall

Learn about configuring database connection details under advanced options.

About Native Network Encryption for Oracle Databases

Learn about using native network encryption for Oracle Databases.

If you are using the Database Firewall to monitor an Oracle Database target that uses network encryption, then you must use native network encryption monitoring in order to decrypt statements sent to, and responses received from, that database so they can be analyzed.

Limitations on Decryption of Oracle Database Statements

Configuring Oracle Database Security Central to decrypt traffic with Network Encryption has the following limitations:

• There is no statement substitution in Oracle Database Security Central when Network Encryption checksum is used.

• There is no support for Network Encryption RC4 cipher.

• Supported versions of Oracle Database.

• Database Firewall doesn’t support running the Oracle Advanced Security Integration Script on root container databases (CDB$ROOT). It also doesn’t monitor and apply policies on traffic with native network encryption for root container databases (CDB$ROOT).

Note: When dealing with encrypted connections from tools like Microsoft OSTRESS, it is advised to use the -T146 flag to prevent the interference of Microsoft’s encryption with the Oracle Database Security Central’s examination of the data traffic. Additionally, it is suggested to use database interrogation to extract information such as the name of the database user, operating system, and client program that initiated a SQL statement from monitored Microsoft SQL Server databases.

See Also: Configuring Database Firewall for Databases That Use Native Network Encryption

Monitor Native Network Encrypted Traffic Through Database Firewall for Oracle Databases

Learn how to enable monitoring of native network encrypted traffic through Database Firewall for Oracle Databases.

This functionality enables Database Firewall to monitor native network encrypted traffic for supported Oracle Database targets.

Prerequisite

Log in to the Oracle Database Security Central console as an administrator. See Using Oracle Database Security Central Console for more information.

To enable this functionality for a Database Firewall monitoring point:

1. Select Targets. The Targets in the left navigation menu is selected.

2. Select specific target. The details of the target are displayed on the main page.

3. Under Database Firewall Monitoring section, select the monitoring point for which native network encrypted traffic monitoring needs to be enabled.

4. In the Advanced, select the checkbox Decrypt With Native Network Encryption Key, for enabling decryption of traffic if Oracle Database is using Native Network Encryption. Decrypt with native network encryption key option also supports retrieval of session information for Oracle Database. Fill in the remaining fields as applicable.

   For an Oracle RAC target (if the RAC Instance/Autonomous DB checkbox is selected on the Core), enter the SCAN Listener IP address.

   For Oracle standalone database targets, enter the IP address of the database listener.

   Note: Ensure the Database Firewall is allowed to make a network connection to the above mentioned database listener.

5. Once the above mentioned field is checked, the following fields are populated. Enter the values in the appropriate fields.

   • Host Name / IP Address - Enter the host name or the IP address of the target database. For Oracle standalone Database targets, enter the IP address of the database host machine. For Oracle RAC target, enter the SCAN Listener IP address.

   • Port - Enter the port number of the target database.

   • Service Name - Enter the service name of the database or database instance.

   • User Name - Enter the user name that was set up for this target.

   • Password - Enter the password for the user name.

6. Select Save.

Disabling Encrypted Traffic Monitoring for Oracle Databases

Learn about disabling encrypted traffic monitoring for Oracle Databases.

You can temporarily disable encrypted traffic monitoring. Oracle Oracle Database Security Central saves the configuration information that you have created for the next time that you want to enable it.

To disable encrypted traffic monitoring:

1. Log in to the Oracle Database Security Central console as an administrator.

2. Select Targets. The Targets in the left navigation menu is selected.

3. Select specific target. The details of the target are displayed on the main page.

4. Under Database Firewall Monitoring section, select the monitoring point for which native network encrypted traffic monitoring needs to be disabled.

   Alternatively, navigate to Database Firewalls and then select Database Firewall Monitoring in the left navigation menu. A list of monitoring points are displayed on the page. The list can be sorted or filtered. Select the monitoring point for which native network encrypted traffic monitoring needs to be disabled.

5. In the Advanced, uncheck the box against Decrypt With Native Network Encryption Key for disabling decryption of traffic if Oracle Database is using Native Network Encryption. Upon deselection the remaining fields disappear.

6. Select Save.

   See Also: Changing the Database Firewall Host Name

Retrieve Session Information for Microsoft SQL Server

Learn how to obtain session information for non Oracle databases.

You can retrieve session information for Microsoft SQL Server databases to obtain the name of the database user, operating system, and client program that originated a SQL statement. Enable this functionality only if this information is not available from the network traffic. This information is then made available in the reports.

While configuring this functionality choose the field Retrieve session information from target DB in the Advanced tab. You can either use a script or manually retrieve session information in Microsoft SQL Server.

Use a script to retrieve session information in Microsoft SQL Server

1. Create a user account for Oracle DBSecCentral for querying session information on the master database. This database should be registered as a target in the Audit Vault Server console.

   Make a note of the user name and password for this account.

2. Download the setup script from the utilities V<part_number>.zip file available as part of the Oracle DBSecCentral install files from Oracle Software Delivery Cloud.

   1. Log in to Audit Vault Server Console as an administrator.

   2. Select Targets.

   3. Select Target Setup Script to download the integration script.

   4. There are two setup scripts available. Select one of the following:

      • mssql_ddi_script.sql: To configure the Logon Trigger method
      • mssql_ddi_xe_script.sql: To configure the Extended Events method

      Both scripts are located in the mssql_user_privilege_scripts directory.

Configure DDI using a logon trigger

1. Run the following command as a user with privileges to create schemas, logon triggers and jobs, and grant privileges:

   Caution: This script creates a logon trigger and supporting database objects that Database Firewall uses to retrieve session information.

   sqlcmd -S tcp:<IP>,<PORT> -U sa -P <Password> -i mssql_ddi_script.sql -v DBSC_DDI_USER="<username>"

   Ensure that you use the same password for the sa user and username from step 1.

2. Enable retrieving session information for the Database Firewall monitoring point that is associated with this target database, using the credentials created in the earlier step. Ensure the following steps are accurate while registering Microsoft SQL Server as a target.

   1. Log in to Audit Vault Server Console as an administrator.

   2. Select Targets.

   3. Select the Microsoft SQL Server database from the list.

   4. Select the monitoring point from the Database Firewall Monitoring section.

   5. Select Advanced.

   6. Select Retrieve session information from target DB.

   7. In the User Name field, enter the user name of the user created in the earlier step.

   8. In the Password field, enter the password of the user.

   9. In the Host Name / IP Address field, enter the IP address of the SQL Server.

   10. In the Port field, enter the port of the SQL server listening port.

   11. In the Database Name field, enter a valid database service name on SQL Server. In case the database service name is not correct, then SQL server DDI requests fail on the SQL Server with invalid request error.

Configure DDI using Extended Events

1. Run the following command as user with privileges to create schemas, sessions, procedures and grant privileges:

   sqlcmd -S tcp:<IP>,<PORT> -U sa -P <Password> -i mssql_ddi_xe_script.sql -v DBSC_DDI_USER="<username>"

   This script does the following:

   • Creates and starts an Extended Events session named DBFW_Login_Tracker
   • Creates the procedure required to retrieve the captured session information
   • Grants the required permissions to the DBSecCentral DDI user, including VIEW SERVER STATE

2. Enable retrieving session information for the Database Firewall monitoring point that is associated with this target database, using the credentials created in the earlier step. Ensure the following steps are accurate while registering Microsoft SQL Server as a target.

   1. Log in to Audit Vault Server Console as an administrator.

   2. Select Targets.

   3. Select the Microsoft SQL Server database from the list.

   4. Select the monitoring point from the Database Firewall Monitoring section.

   5. Select Advanced.

   6. Select Retrieve session information from target DB.

   7. In the User Name field, enter the user name of the user created in the earlier step.

   8. In the Password field, enter the password of the user.

   9. In the Host Name / IP Address field, enter the IP address of the SQL Server.

   10. In the Port field, enter the port of the SQL server listening port.

   11. In the Database Name field, enter a valid database service name on SQL Server. In case the database service name is not correct, then SQL server DDI requests fail on the SQL Server with invalid request error.

Manually retrieve session information in Microsoft SQL Server

Note: It is possible for direct database interrogation (DDI) to fail to fetch information for shorter sessions using this method. Follow the alternate steps that involve running a script to avoid this.

1. Create a user account for Oracle DBSecCentral for querying session information on the master database. This database should be registered as a target in the Audit Vault Server console.

   Make a note of the user name and password for this account.

2. Grant the following permissions to the user account you created in the previous step:

   • VIEW ANY DEFINITION and VIEW SERVER STATE for SQL Server

   • SELECT on the master.dbo.sysdatabases table

3. Enable retrieving session information for the Database Firewall monitoring point that is associated with this target database, using the credentials created in the earlier step. Ensure the following steps are accurate while registering Microsoft SQL Server as a target.

   1. Log in to Audit Vault Server Console as an administrator.

   2. Select Targets.

   3. Select the Microsoft SQL Server database from the list.

   4. Select the monitoring point from the Database Firewall Monitoring section.

   5. Select Advanced.

   6. Select Retrieve session information from target DB.

   7. In the User Name field, enter the user name of the user created in the earlier step.

   8. In the Password field, enter the password of the user.

   9. In the Host Name / IP Address field, enter the IP address of the SQL Server.

   10. In the Port field, enter the port of the SQL server listening port.

   11. In the Database Name field, enter a valid database service name on SQL Server. In case the database service name is not correct, then SQL server DDI requests fail on the SQL Server with invalid request error.

Related Topics

• Monitor Native Network Encrypted Traffic Through Database Firewall for Oracle Databases

Disable Retrieving Session Information in Microsoft SQL Server

To disable DDI, following the appropriate instructions for the set up method you chose.

Disable Logon Trigger configuration

The mssql_ddi_script.sql script created a logon trigger and a database tables to configure direct database interrogation (DDI). You can use the mssql_ddi_removal_script.sql script to disable DDI.

1. Run the following command as a user with privileges to remove the logon trigger and the supporting objects:

   sqlcmd -S tcp:<IP>,<PORT> -U sa -P <Password> -i mssql_ddi_removal_script.sql -v DBSC_DDI_USER="<username>"

   The sa user password and the username is that of the Oracle DBSecCentral user account on the master database.

2. On the Audit Vault Server console, disable DDI for the Microsoft SQL Server:

   1. Log in to Audit Vault Server Console as an administrator.

   2. Select Targets.

   3. Select the Microsoft SQL Server database from the list.

   4. Select the monitoring point from the Database Firewall Monitoring section.

   5. Select Advanced.

   6. Deselect Retrieve session information from target DB.

Disable Extended Events configuration

To disable the Extended Events configuration:

1. Run the following command as a user with privileges to remove Extended Events and its supporting objects:

   sqlcmd -S tcp:<IP>,<PORT> -U sa -P <Password> -i mssql_ddi_xe_removal_script.sql -v DBSC_DDI_USER="<username>"

   The sa user password and the username is that of the Oracle DBSecCentral user account on the master database.

   This script:

   • Stops the DBFW_Login_Tracker Extended Events session
   • Drops the DBFW_Login_Tracker Extended Events session
   • Drops the procedure created by the Extended Events setup script
   • Revokes VIEW SERVER STATE from the DDI user. Dropping the procedure also removes the associated EXECUTE permission.

2. On the Audit Vault Server console, disable DDI for the Microsoft SQL Server:

   1. Log in to Audit Vault Server Console as an administrator.

   2. Select Targets.

   3. Select the Microsoft SQL Server database from the list.

   4. Select the monitoring point from the Database Firewall Monitoring section.

   5. Select Advanced.

   6. Deselect Retrieve session information from target DB.

Related Topics

• Behavior Changes, Deprecated, and Desupported Platforms and Features