Using Mutual Authentication for Communication Between the Database Firewall and the Host Monitor Agent

By default, the Database Firewall allows the Host Monitor Agent connection based on one-way authentication. To provide mutual authentication, follow these steps after installing the Host Monitor Agent.

  1. Log in to the Audit Vault Server through SSH and switch to the root user.

    See Logging In to Oracle DBSecCentral Appliances Through SSH.

  2. Run the following command to create oracle wallet and certificate:

    sudo -u avdf_api_pki_manage /opt/avdf/bin/generate_hmwallet.py <hostname>

    Replace <hostname> with the host name of the machine on which host monitor is present.

  3. Copy the wallet contents(cwallet.sso) to HOSTMON_HOME/hm_fw_wallet on the host monitor machine.

    You will have to create the hm_fw_wallet directory as it does not exist by default.

  4. (Unix hosts only) As root on the host monitor machine, run the following commands:

    chown root:root HOSTMON_HOME/hm_fw_wallet/*

    For AIX you should replace root:root with root:system.

    chmod 400 HOSTMON_HOME/hm_fw_wallet/*

  5. (Windows hosts only) Ensure that above wallet contents have agent user ownership and appropriate permissions to prevent unwanted user access.

  6. Repeat steps one to five for every Host Monitor Agent that is using the Database Firewall.

  7. On the Database Firewall, log in as root and run the following commands:

    cp /etc/pki/tls/certs/dbfw-ca.crt /usr/local/dbfw/etc/fw_ca.crt
    chown arbiter:arbiter /usr/local/dbfw/etc/fw_ca.crt
    chmod 400 /usr/local/dbfw/etc/fw_ca.crt

    If more than one Database Firewall is used, repeat this step for each Database Firewall.

  8. Restart all the running network trails for which above changes were applied.

Related Topics