Security Configuration Overview

To set up security, you need to create an initial security configuration. To do this, run either the securityconfig or the makebootconfig before starting the SNA on an initial node. You should not create a security configuration at each node. Instead, you should distribute the initial security configuration across all the Storage Nodes in your store. If the stores do not share a common security configuration they will be unable to communicate with one another.

Note: The makebootconfig utility embeds the functionality of securityconfig tool.

The by-product of using one of the tools is they create a set of security files based on the standard configuration. It is possible to perform the same tasks manually, and advanced security configuration might require manual setup, but using these tools help to ensure a consistent setup. For more information on the manual setup, see SSL keystore generation.

Note: It is possible to modify the security configuration after it is created in order to use a non-standard configuration. It is recommended that you use a standard configuration.

Those security files are generated, by default, within a directory named “security”. In a secure configuration, the bootstrap configuration file for a Storage Node includes a reference to that directory, which must be within the KVROOT directory for the Storage Node. The security directory contains:

security/security.xml
security/store.keys
security/store.trust
security/store.passwd  (CE or EE installations)
security/store.wallet  (EE installations only)
security/store.wallet/cwallet.sso (EE installations only)
security/client.security
security/client.trust

where:

• security.xml

  A configuration file that tells the Oracle NoSQL Database server how to apply security.

• store.keys

  A Java keystore file containing one or more SSL/TLS key pairs. This keystore is protected by a keystore password, which is recorded in an accompanying password store. The password store may be either an Oracle Wallet or a FileStore. The password is stored under the alias “keystore” in the password store. This file should be accessible only by the Oracle NoSQL Database server processes, and not to Oracle NoSQL Database clients.

• store.trust

  A Java truststore file, which is a keystore file that contains only public certificates, and no private keys.

• store.passwd (CE or EE installations)

  A password file that acts as the password store for a Community Edition (CE) installation. It contains secret information that should be known only to the server processes.

  For Enterprise Edition (EE) installations, Oracle Wallet usage is preferred over the password file option.

• store.wallet (EE installations only)

  An Oracle Wallet directory that acts as the password store for an Enterprise Edition (EE) installation. It contains secret information that should be known only to the server processes.

• cwallet.sso (EE installations only)

  The wallet password storage file.

• client.security

  A security configuration file that captures the communication transport properties for connecting clients to the data store.

• client.trust

  A truststore file used by clients is generated.

Note: In a multi-host store environment, the security directory and all files contained in it should be copied to each server that will host a Storage Node.