Monitoring TLS Encrypted SQL Traffic

Learn how to enable monitoring of TLS encrypted SQL traffic between the database clients and Oracle Database.

Note:

This functionality does not support database clients using PKI authentication.
This functionality is supported for Oracle Real Application Cluster (RAC) as a target.
The Database Firewall acts as a proxy and terminates TLS session from the database clients. In all cases, Database Firewall becomes the client for the database server.
Native Network Encryption is disabled in case this functionality is enabled.

Using Default Self Signed Certificates Created During Monitoring Point Creation

Learn how to use self signed certificates created by default when creating a Database Firewall monitoring point.

Database Firewall supports monitoring of TLS encrypted SQL traffic between the database client and Oracle Database. Database Firewall acts a TLS proxy terminating the session from the database client and creating a new TLS outbound session to the database server. Different TLS levels can be set for:

Inbound connection from the database client to Database Firewall
Outbound connection from Database Firewall to Oracle Database

TLS Level-4 is the strictest and set by default. Mutual authentication is enabled by default for both inbound and outbound connections.

Database Firewall decrypts the network traffic from the database clients, extracts SQL traffic, and acts on the SQL statements based on the configured policies. It creates a new TLS session to the database server if the traffic needs to be passed on.

Note: For production instances it is recommended to use third party CA signed certificates than self signed certificates as per your organizational policy.

Follow these steps to enable TLS encrypted traffic monitoring capability for a target database:

Log in to the Oracle Database Security Central console as an administrator.
Select Targets. The Targets in the left navigation menu is selected.
Select specific target. The details of the target are displayed on the main page.
Under Database Firewall Monitoring section, select Add to create a new monitoring point. The Database Firewall Monitor dialog is displayed.
In the Core, select the Database Firewall instance from the list.
Select Monitoring / Blocking (Proxy) as the deployment mode from the list.
Enter the remaining details.
In the Advanced, select the check the box against Enable TLS Support field. All the necessary self signed certificates for this monitoring point are created. Mutual authentication is also enabled by default for inbound and outbound TLS connections.
Complete the configuration of mutual authentication for the monitoring point.
See Also:

Configuring Mutual Authentication for Inbound or Outbound TLS Communication

Learn how to configure mutual authentication for inbound or outbound TLS communication between the database clients and Oracle Database.

You can configure mutual authentication for TLS communication between:

Database client to Database Firewall (inbound connection)
Database Firewall to Oracle Database (outbound connection)

The configuration file for the Database Firewall monitoring point is /var/dbfw/va/x/etc/appliance.conf. In this case x is the Database Firewall monitoring point identifier. The database client always authenticates the associated Database Firewall it is connecting to.

Follow these steps:

Log in to the Database Firewall through SSH and switch to the root user.
Configure the mutual authentication of database client and Database Firewall by following these steps:
1. Import the monitoring point inbound certificate (/usr/local/dbfw/va/N/pki/in/in.crt) into the key store of the database client as a trusted CA certificate. In this case N refers to the monitoring point number. To find the monitoring point number:
  1. Log in to the Database Firewall through SSH and switch to the root user.
    
    See Logging In to Oracle DBSecCentral Appliances Through SSH.
  2. Change to /var/dbfw/va directory.
  3. Identify the Database Firewall monitoring point by searching for the target name configured in the Audit Vault Server. Run the following command:
```
grep -lr <TARGET NAME> *
```
  4. Find the monitoring point number from the output which contains the name and path of the configuration file. For example: 1/etc/appliance.conf. In this example, 1 is the monitoring point number.
  For Oracle Database clients, this involves importing the inbound certificate of the monitoring point into the client’s wallet. Refer to the SQLNET Administrator Guide for complete information.
  
  For other (non Oracle) database clients, refer to respective database documentation.
2. Copy the database client’s trusted CA certificate into the monitoring point’s inbound CA directory /usr/local/dbfw/va/xx/pki/in/ca.
  
  In this case xx refers to the monitoring point identifier. The permissions of the CA certificate for the clients must be 0440:dbfw:dbfw.
Configure the mutual authentication of Database Firewall and database server by following these steps:
1. Configure mutual authentication for outbound TLS connection. Copy the trusted CA certificate of the target database into the corresponding outbound CA directory of the monitoring point /usr/local/dbfw/va/xx/pki/out/ca.
  
  In this case xx refers to monitoring point identifier. The permissions of database CA certificate must be 0440:dbfw:dbfw.
2. Import the outbound certificate of the monitoring point /usr/local/dbfw/va/xx/pki/out/out.crt into the key store of the target database as trusted CA certificate.
  
  For Oracle Database target this involves importing the outbound CA certificate of the monitoring point into wallet of the target database. Refer to the SQLNET Administrator Guide for complete information.
  
  For other (non Oracle) database clients, refer to respective database documentation.
Restart the services. Run the following commands to restart the monitoring points which had changes to the configuration:
```
systemctl stop monitor
```
```
/usr/local/dbfw/bin/dbfwctl stop xx
```
```
systemctl start monitor
```
In this case xx refers to monitoring point identifier.
Test the connections. TLS connection initiated from the database client to the above monitoring point should result in a successful connection.
See Also:

Using External Certificates Signed by Certificate Authority

Learn how to use certificates signed by an external CA in Database Firewall.

You can use a certificate signed by an external Certification Authority (CA) based on your organization policy. Database Firewall supports external CA signed certificates for inbound and outbound TLS connections. Database Firewall provides a utility (config-pki_identity) to generate a CSR (Certificate Signing Request) which can be signed externally.

Follow these steps to use one pair of externally signed certificates for all Database Firewall monitoring points:

Log in to the Oracle Database Security Central console as an administrator.
Create Database Firewall monitoring points and enable TLS encrypted SQL traffic monitoring. Select the appropriate TLS levels in the Inbound TLS (From client to DBFW) and Outbound TLS (From DBFW to Database) sections. See Creating and Configuring a Database Firewall Monitoring Point for details.

Relevant self signed certificates are created for these Database Firewall monitoring points.
Connect to the Database Firewall through SSH as support user.
Switch user to root.
Delete the self signed certificates for above Database Firewall monitoring points using the /opt/avdf/config-utils/bin/config-pki_identity utility.

Create a CSR (Certificate Signing Request) to be signed externally.

Note:

Important aspects to be noted while creating a CSR:

The alt_* values are optional, depending on the certificate usage requirements.
The key_path and cert_path directories must exist.
The value of cert_uid/gid/mode must always be dbfw:dbfw:444.
The value of key_uid/gid/mode must always be root:arbitercerts:440.
Use the add command in /opt/avdf/config-utils/bin/config-pki_identity utility to create a CSR.

For example: To create a CSR (in.csr) for the key (in.key), then use the following:

/opt/avdf/config-utils/bin/config-pki_identity add \

key_path=/usr/local/dbfw/va/in.key \

cert_path=/usr/local/dbfw/va/in.csr \

cert_uid=dbfw \

cert_gid=dbfw \

cert_mode=444 \

key_uid=root \

key_gid=arbitercerts \

key_mode=440 \

common_name=test.certificate \

country=--- \

email=first.last@example.invalid \

locality=city \

organisation=company \

organisational_unit=group \

state=area \

alt_dns=subdomain.example.org,foobar2.example.org \

alt_email=first.last2@example.invalid,first.last3@example.invalid \

alt_ip='192.0.2.0,192.0.2.1' \

alt_uri=https://<exampleuri.1>,https://<exampleuri.2>

Use the example to create a /usr/local/dbfw/va/out.csr.
Get both the CSRs signed externally:
1. /usr/local/dbfw/va/in.csr
2. /usr/local/dbfw/va/out.csr
Copy both the externally signed certificates (in.crt and out.crt) to the /usr/local/dbfw/va directory.
Validate and import both the externally signed certificates using the following example command:
```
/opt/avdf/config-utils/bin/config-pki_identity set cert_path=/usr/local/dbfw/va/in.crt
```
Create a symbolic link for the in.crt from every Database Firewall monitoring point inbound directory to /usr/local/dbfw/va/in.crt.

Note: Add all the trusted certificates that constitute the certificate chain in the corresponding pki/in/ca path before adding externally signed certificate into pki/in path of a monitoring point.
Create a symbolic link for the in.key from every Database Firewall monitoring point inbound directory to /usr/local/dbfw/va/in.key.
Create a symbolic link for the out.crt from every Database Firewall monitoring point outbound directory to /usr/local/dbfw/va/out.crt.

Note: Add all the trusted certificates that constitute the certificate chain in the corresponding pki/out/ca path before adding externally signed certificate into pki/out path of a monitoring point.
Create a symbolic link for the out.key from every Database Firewall monitoring point outbound directory to /usr/local/dbfw/va/out.key.

For example:
```
ln -s /var/dbfw/va/in.crt /var/dbfw/va/xx/pki/in/in.crt ; ln -s /var/dbfw/va/out.crt /var/dbfw/va/xx/pki/out/out.crt
```
In this case xx refers to the Database Firewall monitoring point identifier.
Configure mutual authentication for the inbound TLS connection. The inbound connection is the connection from the database client to the Database Firewall.
Configure mutual authentication for the outbound TLS connection. The outbound connection is the connection from the Database Firewall to Oracle Database.
Restart all the modified Database Firewall monitoring points.
See Also:

Disabling Mutual Authentication for Inbound or Outbound TLS Communication

Learn how to disable mutual authentication for inbound or outbound TLS communication between the database clients and Oracle Database.

You can disable mutual authentication for TLS communication between:

Database client to Database Firewall (inbound connection)
Database Firewall to Oracle Database (outbound connection)

Mutual authentication can be optionally disabled for inbound or outbound TLS communication. The configuration file for the Database Firewall monitoring point is /var/dbfw/va/N/etc/appliance.conf. In this case N is the Database Firewall monitoring point number. The database client always authenticates the associated Database Firewall it is connecting to.

To find the monitoring point number:

Log in to the Database Firewall through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Change to /var/dbfw/va directory.
Identify the Database Firewall monitoring point by searching for the target name configured in the Audit Vault Server. Run the following command:
```
grep -lr <TARGET NAME> *
```
Find the monitoring point number from the output which contains the name and path of the configuration file. For example: 1/etc/appliance.conf. In this example, 1 is the monitoring point number.

Follow these steps to disable mutual authentication for inbound TLS communication:

Modify the following value in the configuration file /var/dbfw/va/N/etc/appliance.conf:

TLS_CLIENT_AUTH="0"
Import the Database Firewall monitoring point inbound certificate (/usr/local/dbfw/va/N/pki/in/in.crt or /usr/local/dbfw/va/in.crt) into the SQL client’s key store as a trusted CA certificate.

Note: For Oracle SQL clients this involves importing the Database Firewall monitoring point CA certificate into the SQL client’s wallet. Refer to the SQLNET Administrator Guide for complete information. For other (non Oracle) SQL clients, refer to the respective database documentation.

Database Firewall authenticates the database it is connecting to. Follow these steps to disable mutual authentication for outbound TLS communication:

Modify the following value in the sqlnet.ora configuration file:

SSL_CLIENT_AUTHENTICATION = FALSE
Copy the trusted CA certificate of the target database into the corresponding Database Firewall monitoring point’s outbound CA directory (/usr/local/dbfw/va/N/pki/out/ca).
See Also:

Configuring a TLS Proxy for an Oracle Real Application Clusters Database

Learn about additional steps that are required to configure a TLS proxy for Oracle Real Application Clusters (Oracle RAC).

Oracle Oracle Database Security Central supports monitoring TLS encrypted SQL traffic between the database clients and Oracle Database. This functionality is supported for Oracle RAC.

Prerequisites

The database client must have a wallet that is configured with credentials to communicate with the Oracle RAC database instance.
The Oracle RAC database instance must have a wallet that is configured to communicate with the client.
The client and the Oracle RAC database instance must be able to connect by using TCPS.
You must have an externally created Oracle wallet for the Database Firewall to use, and it must be configured with credentials to communicate with the Oracle RAC database instance. See Managing Oracle Wallets with the orapki Utility for creating and managing oracle wallets.

Create a TLS-enabled Database Firewall monitoring point for the Oracle RAC target. Select Oracle RAC and TLS in the Oracle Database Security Central console. See Creating and Configuring a Database Firewall Monitoring Point.
Complete the TLS configuration for inbound connections. See Modifying a Database Firewall Monitoring Point.
Import the externally created wallet to the Database Firewall instance.
1. Copy the externally created wallet to the file system in the Database Firewall (for example, /tmp/my_rac_wallet).
2. Switch to the root user.
3. Run the following command to deploy the wallet for the appropriate Database Firewall secured target:
```
/opt/avdf/bin/deploy-wallet  <PATH-TO-WALLET>
      <SECURED-TARGET-NAME>
```
Note:

To view a list of all available secured targets, run the following command:
```
/opt/avdf/bin/deploy-wallet

--list-targets
```

(Optional) Enabling Common Name Verification for the Database Server

In addition to verifying that the target database’s certificate is valid, you can verify the database server’s common name from the database certificate. This verification matches the server’s common name against a set of allowed common names that you configure.

To enable this additional check of the database certificate’s common name, follow these steps:

Log in to the Database Firewall through SSH and switch to the root user.
Identify the secured target for which you want to enable this feature.

Edit the appliance.conf file for the secured target.

Find the monitoring point number:

Log in to the Database Firewall through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Change to /var/dbfw/va directory.
Identify the Database Firewall monitoring point by searching for the target name configured in the Audit Vault Server. Run the following command:
```
grep -lr <TARGET NAME> *
```

Find the monitoring point number from the output which contains the name and path of the configuration file. For example: 1/etc/appliance.conf. In this example, 1 is the monitoring point number.

For example, in the following file path, N represents the monitoring point number: /usr/local/dbfw/va/*N*/etc/appliance.conf

Locate the following keyword in the file: TLS_PROXY_OUTBOUND_ALLOWED_CN_LIST
Provide an allowed list of values in one of the following formats, depending on whether the secured target type is an Oracle Real Application Clusters (Oracle RAC) database.

Secured Target Type	Description of Allowed List of Values	Example
Non-Oracle RAC database	Provide a list of allowed common names that the Database Firewall is allowed to connect to	`TLS_PROXY_OUTBOUND_ALLOWED_CN_LIST = "CN=:CN="`
Oracle RAC database	Provide the distinguished name for the peer RAC database	`TLS_PROXY_OUTBOUND_ALLOWED_CN_LIST = "CN=, O=, L="`

Save the edited configuration.
Restart the monitoring point.

For instructions, see Starting, Stopping, or Deleting Database Firewall Monitoring Points.