About Setting Transport Layer Security Levels

Learn about setting Transport Layer Security (TLS) levels in Oracle DBSecCentral.

This topic describes the different levels of connection encryption deployed on Oracle Database Security Central appliances. Oracle DBSecCentral uses TLS for inter component communication.

You can change the TLS levels and cipher suites for the following:

Note:

Connection Encryption Strength Used OnOracle DBSecCentralAppliances

TLS Level TLS Version Description

Level-4

(Default on new installation)

TLS 1.3

TLS 1.2

This level is the strongest, restricting TLS to version 1.3 for inter communication between all the components in Oracle Database Security Central.

Note:

It is recommended to use Level-4 for all services unless the supported service explicitly requires a lower level of TLS.

Level-3

TLS 1.3

TLS 1.2

This level supports everything that Level-4 does.

Level-3 uses TLS 1.3 for Audit Vault Agent to Audit Vault Server communication. It is the same for Host Monitor Agent to Database Firewall communication.

Level-2

TLS 1.3

TLS 1.2

TLS 1.1

This level adds support for legacy and deprecated ciphers.

Note:

  • While upgrading to Oracle DBSecCentral, the upgrade process does not automatically set to Level-4 in all cases. After the upgrade process is complete (including Agents), it is strongly advisable to set to Level-4.

Level-1

(Custom)

TLS 1.3

TLS 1.2

 This is a customizable cipher set that is configured with Level-4 strength by default.

How To Change TLS Levels and Other Tasks

Task Command Detailed Information
To check the existing TLS levels for Audit Vault Server and Database Firewall. 

grep CIPHER_LEVEL /usr/local/dbfw/etc/dbfw.conf

 Log in as support user and run this command. Use this command to check the actual configuration of the Audit Vault Server and Database Firewall.
To set the TLS level and to find more options. 

/usr/local/dbfw/bin/priv/configure-networking --help

Log in as root user and run this command. By default, on a new installation the TLS level is set to Level-4.

On upgrade it is set to Level-2 by default. This is appropriate to most of the situations.

It is possible to change the level set. Use this command to find the options available.
To set TLS level for the Oracle Database Security Central console. 

/usr/local/dbfw/bin/priv/configure-networking --wui-tls-cipher-level [LEVEL]

 Log in as root user and run this command. This command sets the TLS level for web browser connections to the AVS GUI. The levels can be set to 1, 2, 3, or 4.
To set TLS level for communication between Audit Vault Server and Database Firewall. 

/usr/local/dbfw/bin/priv/configure-networking --internal-tls-cipher-level [LEVEL]

 Log in as root user and run this command. This command sets the desired TLS level and restarts the internal services. The levels can be set to 1, 2, 3, or 4.
To set the TLS level for Audit Vault Agent to Audit Vault Server, and Host Monitor Agent to Database Firewall communication. 

/usr/local/dbfw/bin/priv/configure-networking --agent-tls-cipher-level [LEVEL]

Log in as root user and run this command. This command sets the TLS level for communication between the Audit Vault Agent to Audit Vault Server, and Host Monitor Agent to Database Firewall. The levels can be set to 1, 2, 3, or 4.

Note:

Perform the following steps to upgrade all Agents to the specified TLS levels after executing the configure-networking command:

1. Log in to the Oracle Database Security Central console as root user.

2. Change the directory by using the command:

cd /usr/local/dbfw/bin/priv

3. Run the script using the command:

./send_agent_update_signal.sh

This command must not be executed more than once in a period of one hour.
To apply customized cipher set.

For Oracle Database Security Central console:

  • Edit: /usr/local/dbfw/etc/platform-configuration/tls_configuration_custom_group.xml

    Run: 

    /usr/local/dbfw/bin/priv/configure-networking --wui-tls-cipher-level 1

For Audit Vault Agent or Host Monitor Agent:

  • Edit: /usr/local/dbfw/etc/platform-configuration/tls_configuration_custom_group_agent.xml

  • Run: 

    /usr/local/dbfw/bin/priv/configure-networking --agent-tls-cipher-level 1

For inter appliance communication:

  • Edit: /usr/local/dbfw/etc/platform-configuration/tls_configuration_custom_group_services.xml

  • Run: 

    /usr/local/dbfw/bin/priv/configure-networking --internal-tls-cipher-level 1

By default, on a new installation the product is set to Level-4. On upgrade it is set to Level-2. This is appropriate to most of the situations. It is possible to customize. There are prompts and warning messages during the upgrade process which indicate that the cipher levels are not set to maximum security. The cipher levels are not automatically changed during upgrade.

Use this command to apply the custom defined level from the file created. These commands set the TLS level for web browser connections and restart the internal services and Audit Vault Server.

Note:

After running the command to apply customized cipher set, verify the error output in the system log file available at /var/log/messages to confirm that there are no errors in the file.

Log in as root user to run the command to edit the custom level configuration file. The customizable set of cipher suites is defined in this file. By default, on a new installation the product is set to Level-4. This file can be modified to further restrict the cipher suite and include ciphers available on the product.

To display the complete list of available cipher suites. 

openssl ciphers -v

 Log in as support user to run this command. Use this command to display the current set of available cipher suites.
To change TLS levels for inbound connection from the database client to the Database Firewall monitoring point. See Modifying a Database Firewall Monitoring Point for complete information. Database Firewall supports TLS encrypted SQL traffic. The TLS levels can be changed in the Advanced settings of the Database Firewall monitoring point using the Oracle Database Security Central console.
To change TLS levels for outbound connection from Database Firewall monitoring point to Oracle Database. See Modifying a Database Firewall Monitoring Point for complete information. Database Firewall supports TLS encrypted SQL traffic. The TLS levels can be changed in the Advanced settings of the Database Firewall monitoring point using the Oracle Database Security Central console.

When To Change TLS Levels

Oracle recommends leaving the internal TLS level at Level-4. Here is some more information on when to change the TLS levels:

Component Situation
Internal communication Oracle recommends to set at Level-4 for increased security.
Oracle Database Security Central console (GUI) To support old browsers, set the TLS level to match the browser.
Audit Vault Agent / Host Monitor Agent / Audit Vault Server Oracle recommends to set at Level-4 for increased security.
Audit Vault Agent deployed with IBM AIX On a fresh installation of Oracle DBSecCentral, it is set to Level-4 and there is no change required.

Setting Custom Cipher Sets

Log in as root user to run this procedure for setting the custom cipher set. Do this by creating a custom file that defines the TLS levels and later applying the file.

  1. The customizable set of TLS levels are defined in the following files:

    • /usr/local/dbfw/etc/platform-configuration/tls_configuration_custom_group.xml

    • /usr/local/dbfw/etc/platform-configuration/tls_configuration_custom_group_agent.xml

    • /usr/local/dbfw/etc/platform-configuration/tls_configuration_custom_group_ssl_services.xml

  2. The tls_configuration_custom_group.xml file can be modified as desired to include available ciphers on the product.

  3. Run the following command to display the complete list of available ciphers:

    openssl ciphers -v

  4. Open the tls_configuration_custom_group.xml file and verify the format of the file. The format must be similar to the following:

    <?xml version="1.0" encoding='UTF-8' standalone='yes'?>
    <tls_configuration_groups xmlns='http://www.oracle.com/avdf'>
    <tls_configuration level="1">
    <ssl_protocols>
    <ssl_protocol>...</ssl_protocol>
    </ssl_protocols>
    <ssl_cipher_suite>
    <ssl_cipher>...</ssl_cipher>
    </ssl_cipher_suite>
    </tls_configuration>
    </tls_configuration_groups>

  5. In the customizable tls_configuration_custom_group.xml file, only the following tags can be added or removed as required:

    <ssl_protocol>...</ssl_protocol>

  6. Multiple tags can be applied in a sequence as follows:

    <ssl_cipher>...</ssl_cipher>

  7. The values must be any of the following Apache protocol values:

    1. TLSv1.3

    2. TLSv1.2

    3. TLSv1.1

  8. Run the following command to apply the custom set.

    /usr/local/dbfw/bin/priv/configure-networking --wui-tls-cipher-level 1 --internal-tls-cipher-level 1 --agent-tls-cipher-level 1

    See Also: Monitoring TLS Encrypted SQL Traffic