Provisioning Oracle DBSecCentral with the Oracle Cloud Marketplace Image

Learn about provisioning Audit Vault Server or Database Firewall with Oracle Cloud Marketplace image.

The following are required prior to provisioning Oracle DBSecCentral instances using the Oracle Cloud Marketplace image:

  1. A VM standard shape with a minimum memory of 8GB.

  2. Block storage with a minimum of 220 GB.

  3. A Virtual Cloud Network (VCN) in your tenancy.

  4. SSH key pair for ssh access to the instance. Oracle DBSecCentral instance accepts the following key types:

    • ssh-ed25519

    • ssh-ed25519-cert-v01@openssh.com

    • ecdsa-sha2-nistp384

    • ecdsa-sha2-nistp384-cert-v01@openssh.com

    • rsa-sha2-512 key types

Generate an SSH key pair of these types. For example: Run the following command to generate a public key of ssh-ed25519 type:

ssh-keygen -t ed25519

Accessing the Oracle DBSecCentral Cloud Marketplace Image

Learn how to access the Oracle DBSecCentral Cloud Marketplace image.

The Oracle DBSecCentral Cloud Marketplace image is available on the Oracle Cloud Marketplace website. Follow these steps:

  1. Go to Oracle Cloud Marketplace.

  2. In the Applications search field, enter Oracle Database Security Central.

  3. Select Go.

  4. Under the search results, select Oracle Database Security Central to navigate to the Oracle DBSecCentral Cloud Marketplace page.

Note: Access the latest Audit Vault Server 20.x for Audit Vault Server image or Database Firewall 20.x for Database Firewall image from Oracle Cloud Marketplace website. Other artifacts (or installable files) can be downloaded from Oracle Software Delivery Cloud. Refer to About Oracle Oracle Database Security Central Installable Files.

Creating an Oracle DBSecCentral instance with Oracle Cloud Marketplace Image

Learn how to create an Oracle DBSecCentral instance with Oracle Cloud Marketplace image.

Follow these steps:

  1. In the Oracle DBSecCentral Cloud Marketplace page, select Get App .

  2. If you already have an OCI account, select the OCI region, and then select Sign In. Else, select Sign Up to create a new account.

  3. In the Get Version menu, select the latest Audit Vault Server 20.x for Audit Vault Server image or Database Firewall 20.x for Database Firewall image.

  4. In the Compartment menu, select a compartment.

  5. Check the I have reviewed the terms and conditions box.

  6. Select Launch Instance.

  7. The Create Compute Instance page is displayed. Fill in the required details:

    1. Provide a NAME for the Oracle DBSecCentral instance.

    2. Choose the AVAILABILITY DOMAIN.

    3. Under Shape, select Change Shape.

    4. Choose Virtual Machine as the Instance Type.

    5. Select the Shape series.

    6. Then select Select Shape. Choose the shape for the instance.

  8. In the Configure networking section, select the following fields:

    1. VIRTUAL CLOUD NETWORK COMPARTMENT

    2. SELECT A VIRTUAL CLOUD NETWORK

    3. SUBNET COMPARTMENT

    4. SUBNET

  9. Check one of the following options for IP address:

    • ASSIGN A PUBLIC IP ADDRESS

    • DO NOT ASSIGN A PUBLIC IP ADDRESS

    Note: See IP Addresses in your VCN (Virtual Cloud Network) to understand more about public and private IP addresses in Oracle Cloud Infrastructure.

  10. In the Add SSH Keys section, provide your ssh public key by selecting Choose public key files or Paste public keys. If you select any other option, you will not be able to connect to the Oracle DBSecCentral instance.

  11. Under Boot volume section, specify a custom boot volume size if you want the boot volume to be larger than the default size of 220 GB.

    Note: The custom boot volume size should not exceed 2TB. Refer to Scaling Up Oracle DBSecCentral Instances section for more details on expanding storage.

  12. Select Advanced Options, and then choose the default options in all the tabs.

  13. Select Create to start creating the instance.

  14. After the instance state changes to Running in the Oracle Cloud Infrastructure console, wait for a few minutes for the underlying services to start up before accessing the instance.

  15. Perform the post instance creation steps.

Note: For production workload, follow the sizing guidelines (My Oracle Support Doc ID 2092683.1) to calculate shape and storage requirements.

See Also: Creating an instance in Oracle Cloud Infrastructure

Post Instance Creation Steps

Perform one time post instance creation steps.

After the instance creation is completed, you must perform these steps once.

For Audit Vault Server Instance

  1. Log in to the appliance through SSH and switch to the root user.

    See Logging In to Oracle DBSecCentral Appliances Through SSH.

  2. Change root user password by running the following command. The root password is required to troubleshoot the instance using OCI instance console connection.

    sudo passwd root

  3. Generate a one time passphrase by running the command:

    sudo -u oracle /usr/local/dbfw/bin/generate_post_install_passphrase.py

  4. Copy the passphrase that is returned by the above command.

  5. Access the Oracle Database Security Central console by entering https://<IP address of the instance> as the URL in the browser.

  6. Enter the passphrase copied from the earlier step in the Post Install Authentication page of the Oracle Database Security Central console.

  7. Fill in the details in the Post Install Configuration page.

  8. In the AVS IP for Agent Communication section, specify the public IP of the Audit Vault Server if you are expecting to collect audit data from any target outside of OCI. See section Deploying Audit Vault Agents for more details.

    Note: After the post installation step is complete, changing the AVS IP for Agent communication is not supported.

  9. Select Save.

    DNS is automatically set to 169.254.169.254.

See Also: DNS in Your Virtual Cloud Network

For Database Firewall Instance

  1. Log in to the appliance through SSH and switch to the root user.

    See Logging In to Oracle DBSecCentral Appliances Through SSH.

  2. Change root user password by running the following command. The root password is required to troubleshoot the instance using OCI instance console connection.

    sudo passwd root

Confirming Oracle Database Security Central Configuration

  1. Check the system state of the appliance by running the following:

    systemctl get-default

    The above should return avdf-runtime.target.

  2. Check that the runtime target service is active by running the following:

    systemctl is-active avdf-runtime.target

    The above should return active.

  3. Confirm that the sshd and httpd services are running by running the following:

    service sshd status
service httpd status

  4. Confirm that the debug logs (/var/log/debug) have an entry indicating that Oracle Database Security Central booted successfully by finding cloud_init_runcmd_controller.rb DEBUG - Completed Oracle Database Security Central OCI first boot system setup. This can be done by running the following:

    #grep -an "Completed Oracle Database Security Central OCI first boot system setup" /var/log/debug*