Configuring Security with Securityconfig

You can also run the securityconfig tool before or after the makebootconfig process by using the following command:

java -Xmx64m -Xms64m -jar $KVHOME/lib/kvstore.jar securityconfig

For more information on creating, adding, removing or merging the security configuration using securityconfig, see the following sections.

Creating the security configuration

You can use the config create command to create the security configuration:

config create
-root <secroot> [ -secdir <security dir> ]
[-pwdmgr { pwdfile | wallet <class-name>} ]
[-kspwd <server key and trust store password>]
[-kstype <key and trust store type>]
[-ctspwd <client.trust password>]
[-external-auth {kerberos}]
  [-krb-conf <kerberos configuration>]
  [-kadmin-path <kadmin utility path>]
  [-instance-name <database instance name>]
  [-admin-principal <kerberos admin principal name>]
  [-kadmin-keytab <keytab file>]
  [-kadmin-ccache <credential cache file>]
  [-princ-conf-param <param=value>]*
  [-param [client:|ha:|internal:|]<param>=<value>]*

where:

For more information on configuring security in single node and multi-node deployments, see Performing a Secure Oracle NoSQL Database Installation.

For more information on configuring Kerberos with securityconfig, see Kerberos Authentication Service.

Adding the security configuration

You can use the config add-security command to add the security configuration you created earlier:

config add-security
-root $KVROOT [-secdir <security dir>]
[-config <config.xml>]

Note: When running this command, the securityconfig tool will verify the existence of the referenced files and will update the specified bootstrap configuration file to refer to the security configuration. This process is normally done with the data store instance stopped, and must be performed on each Storage Node of the store.

where:

When using Kerberos as an external authentication service, you can use the config add-kerberos command to add the security configuration you created earlier:

config add-kerberos -root <secroot> [-secdir <security dir>]
[-krb-conf <Kerberos configuration>]
[-kadmin-path <kadmin utility path>]
[-instance-name <database instance name>]
[-admin-principal <kerberos admin principal name>]
[-kadmin-keytab <keytab file> ]
[-kadmin-ccache <credential cache file>]
[-princ-conf-param <param=value>]*
[-param <param=value>]*

Verifying the security configuration

You can use the config verify command to verify the consistency and correctness of a security configuration:

config verify -secdir <security dir>

where:

For example:

security-> config verify -secdir security
Security configuration verification passed.

Updating the security configuration

You can use the config update command to update the security parameters of a security configuration:

config update -secdir <security dir> [-kstype <keystore type>] [-ctspwd <client.trust password>] [-param <param=value>]*

where:

For example:

security-> config update -secdir security -kstype PKCS12 -param clientAuthRequired=false
Configuration updated.

Showing the security configuration

You can use the config show command to print out all security configuration information.

config show -secdir <security dir>

where:

For example:

security-> config show -secdir security
Security parameters:
certMode=shared
internalAuth=ssl
keystore=store.keys
keystorePasswordAlias=keystore
passwordClass=oracle.kv.impl.security.filestore.FileStoreManager
passwordFile=store.passwd
securityEnabled=true
truststore=store.trust

internal Transport parameters:
clientAllowProtocols=TLSv
1.2
clientAuthRequired=true
clientIdentityAllowed=dnmatch(CN=NoSQL)
clientKeyAlias=shared
serverIdentityAllowed=dnmatch(CN=NoSQL)
serverKeyAlias=shared
transportType=ssl

client Transport parameters:
clientAllowProtocols=TLSv1.2
serverIdentityAllowed=dnmatch(CN=NoSQL)
serverKeyAlias=shared
transportType=ssl

ha Transport parameters:
allowProtocols=TLSv1.2
clientAuthRequired=true
clientIdentityAllowed=dnmatch(CN=NoSQL)
serverIdentityAllowed=dnmatch(CN=NoSQL)
serverKeyAlias=shared
transportType=ssl

Keystore:
security/store.keys

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

shared, Jun 1, 2016, PrivateKeyEntry,
Certificate fingerprint (SHA1): A6:54:9C:42:13:66:DC:E9:A8:62:DB:
A8:87:FD:DE:23:F7:AD:11:FB

Keystore:
security/store.trust

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

mykey, Jun 1, 2016, trustedCertEntry,
Certificate fingerprint (SHA1):A6:54:9C:42:13:66:DC:E9:A8:62:DB:
A8:87:FD:DE:23:F7:AD:11:FB

Removing the security configuration

If you want to disable security for some reason in an existing installation, you can use the config remove-security command:

config remove-security -root <kvroot> [-config >config.xml>]

Note: When running this command, the securityconfig tool will update the specified bootstrap configuration file to refer to the security configuration. This process is normally done with the KVStore instance stopped, and must be performed on each Storage Node of the store.

where:

For example:

security-> config remove-security -secdir security
Configuration updated.

Merging truststore configuration

If you want to merge truststore entries from one security configuration into another security configuration use the config merge-trust command. This command is helpful when performing security maintenance, particularly when you need to update the SSL key/certificate. See Guidelines for Updating SSL Keys and Certificates

When running the config merge-trust command, the securityconfig tool will verify the existence of the referenced files (client.trust and store.trust) and will combine trust entries from the source security configuration ( For example: /users/user_name/tmp/kvroot/newKey) into the primary security configuration($KVROOT/security). After running this command, the client.trust and store.trust files will have two SSL certificate entries.

config merge-trust
-root <secroot> [-secdir <security dir>]
-source-root <source secroot> [-source-secdir <source secdir>] [-ctspwd <client.trust password>]

Note: When running this command, the securityconfig tool will verify the existence of the referenced files and will combine trust entries from the source security configuration into the primary security configuration.

where: