Security Management AVCLI Commands

The AVCLI security management commands enable you to manage various administrator and super administrator privileges.

About the Security Management AVCLI Commands

The security management AVCLI commands enable you to perform tasks such as registering and modifying SMTP connections.

ALTER DATA ENCRYPTION

Use the ALTER DATA ENCRYPTION command to change Transparent Data Encryption (TDE) configuration to rekey or to reset the repository encryption password.

The ALTER DATA ENCRYPTION command enables super administrators to change the Transparent Data Encryption (TDE) configuration in an Oracle Audit Vault Server repository. A super administrator can use this command to rekey the master encryption key, or to reset the repository encryption (wallet) password.

Syntax

ALTER DATA ENCRYPTION

Examples

avcli> ALTER DATA ENCRYPTION REKEY;

This command rekeys the master encryption key for the Audit Vault Server repository.

avcli> ALTER DATA ENCRYPTION CHANGE WALLET PASSWORD;

This commands gives prompts to change the repository encryption (wallet) password.

ALTER USER

Use the ALTER USER command to unlock user accounts.

The ALTER USER command unlocks a user account. Only super administrators can run this command.

Syntax:

ALTER USER <username> ACCOUNT UNLOCK

Example:

avcli> ALTER USER scott ACCOUNT UNLOCK;

The account for user scott is unlocked.

Note:

To unlock super administrator or super auditor, follow these steps:

1. Connect to the Audit Vault Server as root user.

2. Switch user to dvaccountmgr: su dvaccountmgr

3. Run sqlplus /.

4. Run the command: ALTER USER ACCOUNT UNLOCK

GRANT ACCESS

Use the GRANT ACCESS command to grant access to target names or target group names for specified users.

The GRANT ACCESS command grants access to a target name or target group name to a specified user.

Syntax

GRANT ACCESS ON TARGET <target_name> TO <username>

GRANT ACCESS ON TARGET GROUP <target_group name> TO <username>

Arguments

Argument	Description
username	The specified user.
target_name	The name of the target.
target_group_name	The name of the target group.

Example

avcli> GRANT ACCESS ON TARGET sample_source TO scott;

User scott granted access to target sample_source.

avcli> GRANT ACCESS ON TARGET GROUP hr_db_group TO hr;

User hr granted access to group of targets specified by the group hr_db_group.

GRANT ADMIN

Use the GRANT ADMIN command to grant administrator privileges to specified users.

The GRANT ADMIN command grants administrator privileges to specified user.

Syntax

GRANT ADMIN TO <username>

Arguments

Argument	Description
username	The specified user.

Example

avcli> GRANT ADMIN TO scott;

Administrator privileges granted to user scott.

GRANT AUDITOR

Use the GRANT AUDITOR command to grant auditor privileges to the specified user.

The GRANT AUDITOR command grants auditor privileges to the specified user.

Syntax

GRANT AUDITOR TO <username>

Arguments

Argument	Description
username	The specified user.

Example

avcli> GRANT AUDITOR TO scott;

Auditor privileges granted to user scott.

GRANT SUPERADMIN

Use the GRANT SUPERADMIN command to grant super administrator privileges to users who are specified by username.

The GRANT SUPERADMIN command grants super administrator privileges to the user specified by username.

Syntax

GRANT SUPERADMIN TO <username>

Arguments

Argument	Description
username	The specified user.

Usage Notes

This user automatically receives regular administrator rights as well.

Example

avcli> GRANT SUPERADMIN TO scott;

Super administrator (and administrator) privileges granted to user scott.

GRANT SUPERAUDITOR

Use the GRANT SUPERAUDITOR command to grant super auditor privileges to a specific user.

The GRANT SUPERAUDITOR command grants super auditor privileges to the specified user.

Syntax

GRANT SUPERAUDITOR TO <username>

Arguments

Argument	Description
username	The specified user.

Usage Notes

This user automatically receives regular auditor rights as well.

Example

avcli> GRANT SUPERAUDITOR TO scott;

Super auditor (and auditor) privileges granted to user scott.

REVOKE ACCESS

Use the REVOKE ACCESS command to revoke access to targets or target group names for specified users.

The REVOKE ACCESS command revokes access to a target or target group name from a specified user.

Syntax

REVOKE ACCESS ON TARGET <target_name> FROM <username>

REVOKE ACCESS ON TARGET GROUP <target_group_name> FROM <username>

Arguments

Argument	Description
username	The specified user.
target_name	The name of the target.
target_group_name	The name of the target group.

Example

avcli> REVOKE ACCESS ON TARGET sample_source FROM scott;

Access to target sample_source revoked from user scott.

avcli> REVOKE ACCESS ON TARGET GROUP hr_db_group FROM hr;

Access to a group of targets specified by the group hr_db_group revoked from user hr.

REVOKE ADMIN

Use the REVOKE ADMIN command to revoke administrator privileges from specified users.

The REVOKE ADMIN command revokes administrator privileges from specified user.

Syntax:

REVOKE ADMIN FROM <username>

Arguments

Argument	Description
username	The specified user.

Example:

avcli> REVOKE ADMIN FROM scott;

Administrator privileges revoked from user scott.

REVOKE AUDITOR

Use the REVOKE AUDITOR command to revoke auditor privileges from specified users.

The REVOKE AUDITOR command revokes auditor privileges from specified user.

Syntax:

REVOKE AUDITOR FROM <username>

Arguments

Argument	Description
username	The specified user.

Example

avcli> REVOKE AUDITOR FROM scott;

Auditor privileges revoked from user scott.

REVOKE SUPERADMIN

Use the REVOKE SUPERADMIN command to revoke super administrator privileges from users who are specified by username.

The REVOKE SUPERADMIN command revokes super administrator privileges from users specified by username.

Syntax:

REVOKE SUPERADMIN FROM <username>

Arguments

Argument	Description
username	The specified user.

Usage Notes

The user continues to retain regular administrator rights.

Example:

avcli> REVOKE SUPERADMIN FROM scott;

Super administrator privileges are revoked from user scott.

REVOKE SUPERAUDITOR

Use the REVOKE SUPERAUDITOR command to revoke super auditor privileges from a specific user.

The REVOKE SUPERAUDITOR command revokes super auditor privileges from a specific user.

Syntax

REVOKE SUPERAUDITOR FROM <username>

Arguments

Argument	Description
username	The specified user.

Usage Notes

The user continues to retain regular auditor rights.

Example

avcli> REVOKE SUPERAUDITOR FROM scott;

Super auditor privileges are revoked from user scott. User scott continues to be a normal auditor.

SHOW DATA ENCRYPTION STATUS

Use the SHOW DATA ENCRYPTION STATUS command to show whether data encryption is enabled for Oracle Audit Vault Server repositories.

The SHOW DATA ENCRYPTION STATUS command shows whether encryption is enabled or disabled. Encryption is automatically enabled on new installations.

Syntax

SHOW DATA ENCRYPTION STATUS

Example

avcli> SHOW DATA ENCRYPTION STATUS;

This command shows the encryption status (enabled or disabled).