L Enabling FIPS 140-2 in Oracle DBSecCentral

Learn about enabling FIPS 140-2 in Oracle DBSecCentral.

About FIPS and Oracle DBSecCentral

FIPS (Federal Information Processing Standards) is a set of standards that describe document processing, encryption algorithms, and other information technology standards for use within non-military government agencies, by government contractors, and vendors who work with these agencies.

FIPS publications are issued by the National Institute of Standards and Technology (NIST). The publication entitled Security Requirements for Cryptographic Modules (FIPS 140-2) specifies the security requirements over several key areas that will be satisfied by a cryptographic module utilized within a security system protecting sensitive but unclassified information.

You can enable FIPS 140-2 for the following Oracle DBSecCentral components only:

Audit Vault Server: Enabling FIPS on the Audit Vault Server turns on FIPS mode in the embedded Oracle Linux operating system and Oracle Database.
Database Firewall: Enabling FIPS 140-2 on the Database Firewall turns on FIPS mode in the embedded Oracle Linux operating system.

Tip: Before enabling FIPS 140-2, ensure that your SSH keys are compliant with FIPS. If your SSH keys are not compliant with FIPS, the SSH connection with the appliance might be lost after enabling FIPS.

Related Topics

Enabling FIPS 140-2 on the Oracle Database Security Central console

Enable FIPS on the Oracle Database Security Central console to turn on FIPS mode in the embedded Oracle Linux operating system and Oracle Database.

Note: For Oracle Oracle Database Security Central on Oracle Cloud Infrastructure (OCI), before enabling FIPS mode, ensure that the opc user has FIPS-compliant keys registered to /home/opc/.ssh/authorized_keys.

Log in to Oracle Database Security Central console as a super administrator.
Select Settings.

The Security in the left navigation menu is selected by default.
Select FIPS on the main page.
Select toggle switch to enable FIPS 140-2. The toggle switch is green when it’s on.
Select Save.

A message says that the Oracle Database Security Central console will reboot and prompts you to continue or cancel.
Select OK to continue to enable FIPS 140-2 for Oracle Database Security Central console. Otherwise, select Cancel.

The Oracle Database Security Central console restarts and is unavailable for several minutes. Don’t attempt to access the Oracle Database Security Central console during this period. Close the browser and open a new tab or window to log in to the Oracle Database Security Central console.

Note:

To disable FIPS 140-2 mode for the Oracle Database Security Central console, select toggle switch on the FIPS.

For Oracle DBSecCentral on OCI, if SSH access becomes disabled after enabling FIPS mode, log into the Oracle Database Security Central console and disable FIPS mode. Then log back into the appliance through SSH and update the user keys for opc in /home/opc/.ssh/authorized_keys to be compliant with FIPS. It can take several minutes for the console to become available after enabling or disabling FIPS mode.

In a high availability configuration, enabling FIPS 140-2 mode for the primary Oracle Database Security Central console also enables FIPS 140-2 mode for the standby Oracle Database Security Central console. Similarly, disabling FIPS mode for the primary Oracle DBSecCentral also disables it for the standby Oracle Database Security Central console.

Enabling FIPS 140-2 in Database Firewall

Learn how to enable FIPS 140-2 in Database Firewall.

Log in to Oracle Database Security Central console as super administrator.
Select Database Firewalls. The Database Firewalls in the left navigation menu is selected by default.
Select name of the specific Database Firewall instance for which you want to enable FIPS 140-2.
Select FIPS under the Configuration section. A dialog is displayed.
In the dialog, turn on the toggle switch to enable FIPS 140-2. The toggle switch turns green when it is turned on.
Select Save. A message pops that Database Firewall will reboot and prompts you to continue or cancel.
Select OK to continue to enable FIPS 140-2 for the Database Firewall instance. Else, select Cancel.

The Database Firewall instance is restarted and is unavailable for some time.
Wait for a while, and navigate back to the Database Firewalls in the left navigation menu.
Check the status of FIPS 140-2 mode under the column FIPS Mode against the specific Database Firewall instance.

Enabling FIPS 140-2 for Database Firewall Instances in High Availability

Learn how to enable FIPS 140-2 for Database Firewall instances in high availability configuration.

Prerequisites

At least two instances of Database Firewall must be configured for high availability.
The FIPS 140-2 status of both the Database Firewall instances must either be Off or On. FIPS 140-2 mode can be disabled or enabled on both the Database Firewall instances. In case, these two instances have different FIPS mode, then an error message is displayed on the screen.

Log in to Oracle Database Security Central console as super administrator.
Select Database Firewalls. The Database Firewalls in the left navigation menu is selected by default.
Select High Availability in the left navigation menu. All the Database Firewall instances that are configured in high availability are listed in the main page.
The names of paired Database Firewall instances are listed under the Primary and Secondary columns on the main page. Select the specific pair of Database Firewall instances for which you want to enable FIPS.
Select FIPS in the top right corner of the page. A dialog is displayed.
Turn on the toggle switch to enable FIPS 140-2. The toggle switch turns green when it is turned on.
Select Save . A message pops that the Database Firewall instances will reboot and prompts you to continue or cancel.
Select OK to continue to enable FIPS 140-2 for the Database Firewall instances. Else, select Cancel.

The Database Firewall instances are restarted and are unavailable for some time.
Wait for a while and check the status of FIPS 140-2 mode under the column FIPS Mode against the paired Database Firewall instances.

Verify the Status After Enabling FIPS 140-2 for Database Firewall Instances in High Availability

Learn how to verify or check the status after enabling or disabling FIPS 140-2 for the Database Firewall instances configured in high availability.

Log in to Oracle Database Security Central console as super administrator.
Select Settings.
Select System in the left navigation menu.
Select Jobs under the Monitoring section. The Jobs dialog is displayed.
The recent jobs are listed on the top. Else, rearrange to locate the job that is specific to enabling or disabling the FIPS 140-2 mode for the Database Firewall instances configured in high availability.
Verify the status is Completed. Else, select Job Details icon to the extreme left of the specific job.
The Job Status Details dialog is displayed. It contains detailed information on the list of events pertaining to the job triggered.

Enabling FIPS 140-2 for Database Firewall Instances in High Availability Deployed in Proxy Mode

Learn how to enable FIPS 140-2 for Database Firewall instances in high availability deployed in proxy mode.

Prerequisite

At least two instances of Database Firewall must be configured for high availability in proxy mode.

Steps to be followed for enabling or disabling FIPS 140-2 for all Database Firewall instances that are part of high availability and deployed in Monitoring / Blocking (Proxy) mode:

All the Database Firewall instances that are part of high availability must have the same FIPS 140-2 mode. They should either be enabled for FIPS 140-2 or disabled (On or Off).
To enable or disable FIPS 140-2 for every Database Firewall instance follow the procedure in section Enabling FIPS 140-2 in Database Firewall.
After following the previous step, ensure all the Database Firewall instances that are part of high availability should have the same FIPS 140-2 mode (either On or Off).

Note: Inconsistent behavior is expected if Database Firewall instances are in different FIPS 140-2 modes (some of them having FIPS 140-2 enabled and some of them disabled).