Configuring Hybrid Cloud Target Using TCPS

Learn how to configure cloud targets for DBCS instances in TCPS mode. The Audit Vault server and Audit Vault agent are installed on-premises.

Step 1: Registering On-premises Host on Oracle Audit Vault Server

Follow this configuration procedure to register on-premises hosts on Oracle Audit Vault Server.

This step registers the on-premises host on the Audit Vault server.

Note: If there is already a registered on-premises host in the Audit Vault Server installed on the Agent for monitoring DBCS instances, then skip this procedure. Otherwise, the steps are similar for all target databases that are on-premises. See Registering Hosts on the Audit Vault Server for detailed steps.

Step 2: Installing Oracle Audit Vault Agent on Registered On-premises Hosts and Configuring TCPS

This configuration procedure installs Oracle Audit Vault Agent on registered on-premises hosts and configures TCPS.

Note:

If there is already an Audit Vault agent installed on an on-premises host that is planned for monitoring DBCS instances then ignore this step. In case there are no agents installed, there are specific requirements for the Audit Vault agents that monitor DBCS instances. The requirements or features are as follows:

1. The agent has to run on-premise.

2. A minimum of one agent must be dedicated to monitor only DBCS instances. There may be multiple agents dedicated to monitor only DBCS instances.

3. The agent should not run on the Audit Vault server.

1. Install the Audit Vault agent on the on-premises host. See Deploying the Audit Vault Agent on Host Computers for detailed steps on installing on-premises host.

2. Start the Audit Vault agent.

Step 3: Creating User Accounts on Oracle Database Cloud Service Target Instances

This step creates a user account on the Oracle Database Cloud Service instance.

Note: The connection methodology and scripts utilized are different in case on-premises deployment.

Prerequisite

• Port 1522 has to be opened up on the DBCS instance for TCP connection so that later SQL*Plus and SQL*Developer can be used. TCP connection is encrypted by default. It utilizes the native encryption. See Opening Ports on Oracle Database Cloud Service for detailed steps.

Procedure:

1. Ensure that the connection has been established to the DBCS instances through TCPS as user with SYSDBA administrative privilege.

2. Create Server Wallet and certificate.

3. Create Client Wallet and certificate.

4. Exchange Client and Server certificates.

5. Configure Server network.

   Note: See Configuring TCPS Connections for DBCS Instances for creating Server Wallet, Client Wallet, certificates, and exchanging certificates.

6. Once the above steps are complete, the user can now connect to the DBCS instances in TCPS using the Audit Vault Agent or tools like SQLPlus and SQLDeveloper.

7. Run the following commands to create audit retrieval user account creation scripts:

   1. oracle_AVDF_dbcs_user_setup.sql

   2. oracle_AVDF_dbcs_drop_db_permissions.sql

Note: These scripts are different from those of the on-premises database instances.

Step 4: Setting Up or Reviewing Audit Policies on Target Oracle Database Cloud Service Instances

Use this procedure to set up and review audit policies on target Oracle Database Cloud Service instances. Check the audit polices that are enabled and change them as needed.

Note:

• Understand the audit settings on the DBCS instances, before starting the audit data collection process. Currently one Audit Vault Agent supports up to a maximum of 10 cloud target audit trails. The collection speed is up to 25 million audit records per target audit trail, in a day. The recommended Audit Vault Agent configuration can be found in the Oracle Database Security Central Installation Guide.

• Run the DBMS_AUDIT_MGMT package on the DBCS instances for audit clean up, once the data is collected by the on-premises Audit Vault Server. The Audit Vault Server supports data retention policies for every target and meets compliance requirements. It allows configuring different retention policies for on-premises and DBCS instances.

Step 5: Creating Targets on Audit Vault Server for Oracle Database Cloud Service Instances

This configuration step creates target on Oracle Audit Vault Servers for Oracle Database Cloud Service instances.

The user must define these specific settings on the target configuration page. Use the following procedure:

1. Log in to Audit Vault console as an administrator.

2. Select Targets.

3. Select Register on the right.

4. Enter a Name for the target and select from the Type menu.

5. Optionally fill in the Description field.

6. Under the Audit Connection Details sub, choose the Advanced option.

7. In the Protocol menu, select TCPS.

8. Enter the following TCPS connection string in the Target Location field:

   jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=<Host IP>)(PORT=<Port Number>))(CONNECT_DATA=(SERVICE_NAME=<service name>)(SERVER=DEDICATED))(SECURITY= (SSL_SERVER_CERT_DN="DN")))

   This can also be accomplished in the Basic option. Enter the details in Host Name/IP Address, Server DN, and the Wallet fields.

9. Enter the User Name and Password.

10. Select Save to save the configuration changes.

    See Also: Configuring TCPS Connections for DBCS Instances for information on creating a wallet.

Step 6: Starting Audit Trail on Audit Vault Server for Oracle Database Cloud Services Instances

This configuration step starts an audit trail on Oracle Audit Vault Server for Oracle Database Cloud Service instances.

Use this procedure to start audit trail on the Audit Vault Server for the DBCS instance:

1. Log in to the Audit Vault console as an administrator.

2. In the Targets, select the newly registered target.

3. Under Audit Data Collection section, select Add. The Add Audit Trail dialog is displayed.

4. Select Audit Trail Type as TABLE.

   Note: Other trail types are not supported for the DBCS target instance.

5. Select the appropriate values in the Trail Location from the drop down menu. The supported table trails for Oracle DBCS target are:

   1. UNIFIED_AUDIT_TRAIL

   2. SYS.AUD$

   3. SYS.FGA_LOG$

   4. DVSYS.AUDIT_TRAIL$

6. Select the Agent Host.

7. Select Save to add the audit trail.