12 Keeping the Recovery Appliance Secure
This chapter describes policies and procedures to keep Recovery Appliance secure.
Securing the Hardware
After installation of Oracle Zero Data Loss Recovery Appliance, the hardware should be secured.
Hardware can be secured by restricting access to the hardware and recording the serial numbers. Oracle recommends the following practices to restrict access:
-
Install Oracle Zero Data Loss Recovery Appliance and related equipment in a locked, restricted-access room.
-
Lock the rack door unless service is required on components within the rack.
-
Restrict access to hot-pluggable or hot-swappable devices because the components can be easily removed by design. See
-
Store spare field-replaceable units (FRUs) or customer-replaceable units (CRUs) in a locked cabinet. Restrict access to the locked cabinet to authorized personnel.
-
Mark all significant items of computer hardware, such as FRUs.
-
Keep hardware activation keys and licenses in a secure location that is easily accessible to the system managers in the case of a system emergency.
-
Record the serial numbers of the components in Oracle Zero Data Loss Recovery Appliance, and keep a record in a secure place. All components in Oracle Zero Data Loss Recovery Appliance have a serial number.
Related Topics
- How To Obtain The Serial Number Associated With The System Board, Motherboard, Disk Controller, Disks, Infiniband HCA And More Contained In A Cell Or Compute Box (Exadata-Sun V2 or X2 / 11.2)? (My Oracle Support Doc ID 949614.1)
- How to Determine the Serial Number of a Datacenter InfiniBand Switch 36 or QDR InfiniBand Gateway InfiniBand Switch (My Oracle Support Doc ID 1299791.1)
Getting the Rack Serial Number
Use the ipmitool utility to get the serial number for the rack.
When interacting with Oracle Support Services, the CSI number for a rack is based on the rack serial number.
Getting the Serial Numbers for Rack Components
The CheckHWnFWProfile command can be used to display the serial number of most of the system components.
Getting the Rack Serial Number for a Cisco 9336C or 9348 Switch
Use the show license host-id
command on the switch to get the serial number.
Securing the Software
Frequently, hardware security is implemented through software measures.
Implement the following guidelines to protect hardware and software:
-
Change all default passwords when the system is installed at the site. Recovery Appliance uses default passwords for initial installation and deployment that are widely known. A default password could allow unauthorized access to the equipment. Devices such as the network switches have multiple user accounts. Be sure to change all account passwords on the components in the rack.
-
Limit use of the
root
super user account. Usenon-root
access when possible. Create and use Integrated Lights Out Manager (ILOM) user accounts for individual users to ensure a positive identification in audit trails, and less maintenance when administrators leave the team or company. -
Restrict physical access to USB ports, network ports, and system consoles. Servers and network switches have ports and console connections, which provide direct access to the system.
-
Restrict the capability to restart the system over the network.
-
Create named
admin_user
s to manage the hosts. -
Disable direct root and oracle access.
-
Create named
db_user
s for administration and monitoring. -
Disable remote
sys
access. -
Disable remote
rasys
access.
TLS Overview
Configuring TLS between a Recovery Appliance and clients.
When implementing the TLS-encrypted transport from the database server (client) to the Recovery Appliance, prepare the clients before you adjust the Recovery Appliance.
Configuring TLS Data Security on the Client
This section provides the steps required to configure TLS Data Security on the Client.
The client requires some modifications to support TLS. The Recovery Appliance can use https
encryption alone, in dual mode http/https
, or without encryption http
, the default.
Configuring Protected Databases to Support TLS
If you want to continue using non-TLS, update the RMAN settings by adding to CONFIGURE CHANNEL DEVICE TYPE
"_RA_NO_SSL=TRUE
"
CONFIGURE CHANNEL DEVICE TYPE
'SBT_TAPE' PARMS
'SBT_LIBRARY=/u01/app/oracle/product/19.0.0.0/dbhome_1/lib/libra.so,
ENV=(_RA_NO_SSL=TRUE,RA_WALLET=location=file:/<path>
credential_alias=RADB01,_RA_TRACE_LEVEL=1000)' FORMAT '%U_%d';
If you want to start using TLS, you need to perform the following steps.
-
Find the TCPS alias (example:
zdlra_tcps
) from Recovery Appliance host and copy it totnsnames.ora
file on client database. -
Update wallet, or create new one if previous one was created by
mkstore
. Create new wallet usingorapki
. For example:orapki wallet create -wallet $ORACLE_HOME/dbs/Sydney
-
Copy
raCA.pem
from Recovery Appliance host to client database and import it into wallet created or updated above.orapki wallet add -wallet $ORACLE_HOME/dbs/sydney -trusted_cert -cert $ORACLE_HOME/dbs/sydney/raCA.pem
-
Update wallet to
-auto_login
.orapki wallet create -wallet $ORACLE_HOME/dbs/sydney -auto_login
-
Create credential with new alias TCPS and
ravpc
usermkstore -wrl /u01/app/oracle/product/19.0.0.0/dbhome_1/dbs/sydney -createCredential zdlra7_tcps ravpc welcome123
-
Connect RMAN and update “
CONFIGURE CHANNEL DEVICE
” adding wallet informan target / catalog ravpc/welcome123@zdlra7_tcps
Validating TLS Usage
The following commands assist in monitoring the various TLS objects.
- racli run check --check_name=tls_health
- racli run diagnostics --tag=tls
- racli run diagnostics --tag=tls_high
Configuring TLS Data Security on the Recovery Appliance
This section provides the steps for configuring TLS Data Security on the Recovery Appliance.
RACLI commands configure the TLS (Transport Layer Security). The Recovery Appliance can use https
encryption alone, in dual mode http/https
, or without encryption http
, the default.
Note:
Self-signed certificates should not be used long-term or for production. The recommendation is to use a certificate signed by your Certification Authority.The port numbers can be customized. The default ports for encryption are:
- TCPS: 2484
- HTTPS: 8002
- REPL_TCPS: 2485
The default ports for non-encrypted operation are:
- TCP: 1521
- HTTP: 8001
- REPL_TCP: 1522
Create Certificate and Import into Wallet
-
Create the certificates that are used to secure the communication. You can create the signed certificate, the trust certificate, or both at once.
racli create certificate –-country=<VALUE> –-state=<VALUE> --location=<VALUE> –-organization=<VALUE> –-organization_unit=<VALUE> –-email_address=<VALUE> [ –-trusted_cert_valid=<VALUE> ][ –-signed_cert_valid=<VALUE> ]
The optional
–-trusted_cert_valid
specifies the validation days for the trusted certificate. The default value is 3650 days (10 years).The optional
–-signed_cert_valid
specifies validation days for the signed certificate. The default value is 365 days (1 year).Note:
The–-signed_cert_valid
cannot be larger than the–-trusted_cert_valid
. -
Import the certificate into the wallet.
racli add certificate { [--trusted_cert=<VALUE>] | [--signed_cert=<VALUE>] | [--self-signed]
The optional
--trusted_cert
specifies the full path of the root/signing chain. For example--trusted_cert=/radump/abc/raCA.pem
The optional
--signed_cert
specifies the full path of the signed certificate in the trusted store.The optional
--self-signed
specifies that Recovery Appliance will look for both certificates from designated locations. This works best for certificates created by "racli create certificate
". -
Verify that the certificates are available.
racli list certificate
This displays a list of all trusted certificates and signed certificates in the
raa_certs
database table.
Enable TLS Encryption on the Recovery Appliance
The "racli alter network
" command configures TCPS & HTTPS, and TCP & HTTP. It has three encryption modes of operation.
-
Enable TLS Encryption: This enables dual mode TCP/TCPS and HTTP/HTTPS, and will use default ports unless otherwise specified.
racli alter network -–service=ra_server –-encrypt=enable [ --tcps_port=<VALUE> ] [ --https_port=<VALUE> ] [ --repl_tcps_port=<VALUE> ]
-
Disable TLS Encryption: This enables TCP and HTTP, and will use their default ports unless otherwise specified.
racli alter network -–service=ra_server –-encrypt=disable [ --tcp_port=<VALUE> ] [ --http_port=<VALUE> ] [ --repl_tcp_port=<VALUE> ]
-
Enable Only TLS Encryption: This enables only TCPS and HTTPS. The TCP and HTTP are disabled. Default ports are used unless otherwise specified.
racli alter network -–service=ra_server –-encrypt=only [ --tcps_port=<VALUE> ] [ --https_port=<VALUE> ] [ --repl_tcps_port=<VALUE> ]
Validating TLS Usage
The following commands assist in monitoring the various TLS objects.
- racli run check --check_name=tls_health
- racli run diagnostics --tag=tls
- racli run diagnostics --tag=tls_high
Maintaining a Secure Environment
After security measures are implemented, they must be maintained to keep the system secure.
Software, hardware and user access need to be updated and reviewed periodically. For example, organizations should review the users and administrators with access to Recovery Appliance to verify if the levels of access and privilege are appropriate. Without review, the level of access granted to individuals may increase unintentionally due to role changes or changes to default settings. It is recommended that access rights for operational and administrative tasks be reviewed to ensure that each user's level of access is aligned to their roles and responsibilities.
Refer to User Accounts in the Recovery Appliance Environment.
Organizations are encouraged to utilize tools to detect unauthorized changes, configuration drift, and prepare for security updates. Oracle Enterprise Manager provides an integrated solution for managing operational issues for hardware, deployed applications, and services.
Maintaining Network Security
Follow these guidelines to ensure the security of local and remote access to the system:
-
Network switch configuration files should be managed offline, and access to the configuration file should be limited to authorized administrators. The configuration file should contain descriptive comments for each setting. Consider keeping a static copy of the configuration file in a source code control system.
For more information on network switch configuration, refer to the vendor documentation for the network switch.
-
Review the client access network to ensure that secure host and Integrated Lights Out Manager (ILOM) settings are in effect. Review the settings periodically to ensure that they remain intact.
-
Use only signed certificates from the Certification Authority.
-
Set time-outs for extended sessions and set privilege levels.
-
Use authentication, authorization, and accounting (AAA) features for local and remote access to a network switch.
-
Use the port mirroring/switch port analyzer (SPAN) capability of the switch for intrusion detection system (IDS) access.
-
Implement port security to limit access based upon a MAC address (MAC ACL).
-
Require users to use strong passwords by setting minimum password complexity rules and password expiration policies.
-
Enable logging and send logs to a dedicated secure log host.
-
Configure logging to include accurate time information, using NTP and timestamps.
-
Review logs for possible incidents and archive them in accordance with the organization's security policy.