Configuring Custom Ports on Network Interfaces

Learn how to configure custom ports on network interfaces in standalone and high availability environment.

Oracle Database Security Central requires TCP and TCPS based external SQL access. By default, the TCP and TCPS ports are 1521 and 1522 respectively. Oracle Database Security Central supports the configuration of more than one set of custom ports. User-defined ports are also used for SQL connections. As a super administrator user you can specify a custom TCP and TCPS port for SQL communication on Oracle Audit Vault Server. Custom ports can be configured for network interfaces in standalone and high availability environment. Upon configuring a custom port, SQL communication is enabled and added to the network configuration.

Follow these instructions while performing backup and restore operations. If you configured a custom port before performing the backup operation, then the port should remain as you configured it during the restore operation.

To configure custom ports on a primary network interface:

Note: The commands in the procedure below must be executed only on the primary Audit Vault Server in a high availability environment.

  1. Log in to the appliance as root user.

  2. Switch user to oracle.

  3. Use SQL*Plus and connect as super admin user by entering the ID and password as follows.

    <super-admin>/<password>

    Note:

    • Other users cannot configure custom ports. If this operation is attempted by another user, then a message is displayed on the SQL*Plus that there are insufficient privileges for the user.
    • Only root users can access error or debug logs.

  4. To configure custom ports and related operations, run the following commands:

    Operation Command
    To configure custom TCP and TCPS ports on the Audit Vault Server. 
    exec management.server.custom_listener_ports(<tcp_custom_port>, <tcps_custom_port>);
    To disable default ports (1521, 1522) on the Audit Vault Server. 
    exec management.server.disable_std_listener_port_access;

    After disabling the default listener ports:

    • The ports will not be disabled at the listener level.
    • Listener will listen on the custom ports in addition to the default ports. However, the default ports will only be accessible from the local DBSecCentral server and will be blocked for access from any remote clients.
    • The DBSecCentral database will only be accessible through the new custom ports from any remote clients.

    Upon configuring a new custom port, ensure all the Audit Vault Agents are updated with the new port. After all the Agents are updated, ensure the trails continue to run after the Agents are updated with the new custom ports. The standard ports must be disabled after this verification. If standard ports are disabled before the Agents are updated, then those Agents stop running and need to be manually updated. This can be done by updating the connect string in the av/conf/bootstrap.prop file of the Agent home directory.

    Tip:

    In a high availability environment:

    • The same ports are configured on the standby Audit Vault Server

    • The TCPS port configured on the standby is same as primary server during pairing. Else, pairing results in an error.

  5. To disable custom ports, run the following commands:

    Operation Command
    To rollback custom ports and restore ports 1521 and 1522 as the default ports 
    exec management.server.enable_std_listener_port_access;

    After the standard ports are enabled again, do not disable the custom ports in immediate succession as this may disrupt the communication between the Audit Vault Agent and the Audit Vault Server. In such an event, the Audit Vault Agents have to be reinstalled. Before disabling the custom port and changing back to default ports, ensure the Audit Vault Agents are updated and are in RUNNING state.
    To disable custom ports 
    exec management.server.disable_custom_listener_port_access;