2 Configuring Oracle GoldenGate Veridata Security

2.2.1 One-Way and Two-Way SSL Connections

SSL can be configured one-way or two-way in Oracle GoldenGate Veridata.

In one-way SSL connection, the SSL Client (Veridata Server) should trust the SSL Server (Veridata Agent). In two-way SSL, mutual trust is required between the SSL Server and the SSL Client. You can either use self-signed certificates or CA signed certificates to enable SSL.

Using self-signed certificates

To establish one-way SSL using self-signed certificates:

• Create self-signed certificates for all Veridata Agents

• Upload all Veridata Agent certificates to the VeridataWebTrustStore of the Veridata Server. See Section 2.2.6, "Using OPSS Keystore Service to Manage Veridata Keystores".

To establish two-way SSL using self-signed certificates:

• Create self-signed certificates for all Veridata Agents.

• Upload all Veridata Agent certificates to the VeridataWebTrustStore of the Veridata Server. See Section 2.2.6, "Using OPSS Keystore Service to Manage Veridata Keystores".

• Create self-signed certificate for the identity store of the Veridata WebLogic Server.

• Upload the WebLogic Server identity certificate to all Veridata Agent truststores.

For more information about creating and importing certificates, see Section 2.2.5, "Creating Keystores and Self-Signed Certificates by using the Keytool Utility".

Using CA-signed certificates

To establish one-way SSL using CA signed certificates:

• Use certificates issued by the same Certificate Authority (CA) for all Veridata Agents.

• Trust the root CA certificate in the Veridata Weblogic Server.

To establish two-way SSL using CA signed certificates:

• Use certificates issued by the same Certificate Authority (CA) for all Veridata Agents.

• Trust the root CA certificate in the Veridata Weblogic Server.

• Use the certificate issued by a CA for identity store of Veridata Weblogic Server.

• Trust the root CA certificate used in the previous step in the Veridata agent truststore.

2.2.2 Enabling SSL: Main Steps

Oracle GoldenGate Veridata Server and Oracle GoldenGate Veridata Agents are not enabled for SSL by default. If you decide to use SSL, you must enable the properties for the server and the agents. See SSL Settings for Oracle GoldenGate Veridata Agent and SSL Settings for GoldenGate Veridata Server.

You must also create the identity and trust keystores. Create self-signed certificates if you are not using a Certificate Authority (CA) certificate. See Creating Keystores and Self-Signed Certificates by using the Keytool Utility.

To verify and establish an SSL connection between the Veridata Server and an Agent, follow these steps:

1. Configure SSL for the Veridata Web Server. See SSL Settings for GoldenGate Veridata Server.

2. Restart the Veridata Web Server.

3. Shutdown the Veridata Agent. Configure SSL for the Veridata Agent. See SSL Settings for Oracle GoldenGate Veridata Agent.

   1. Obtain the agent side keystores. See Using OPSS Keystore Service to Manage Veridata Keystores.

   2. Configure the agent-side keystores in the agent configuration properties file.

4. Run configure_agent_ssl.sh and supply the password to the keystores configured in the agent configuration file. See Modifying the Veridata Agent Wallet.

5. Start the agent.

6. If the trust is established properly between agent keystores and corresponding Veridata Server counterpart present in the OPSS Keystore Service, then SSL communication is established.

2.2.3 SSL Settings for Oracle GoldenGate Veridata Agent

By default, SSL is disabled for the Oracle GoldenGate Veridata Agent. To configure SSL, edit the following properties in the agent.properties file for your Veridata Agent.

2.2.4 SSL Settings for GoldenGate Veridata Server

To enable SSL communication for all Veridata Server-Agent connections, you must set the SSL parameters in the veridata.cfg file located in the DOMAIN_HOME/config/veridata directory of your Veridata installation. Table 2-2 describes the various parameters that you must set in the veridata.cfg file for SSL communication.

You can also establish SSL communication only for certain connections. To do this, edit the connection properties in the Oracle GoldenGate Veridata web user interface. For more information, see the Oracle GoldenGate Veridata Online Help.

2.2.5 Creating Keystores and Self-Signed Certificates by using the Keytool Utility

For mutual authentication and to establish SSL communication, the Veridata Server and the Veridata Agents should mutually trust the add certificates in the respective truststores.

This section explains how to create keystores and self-signed certificates by using the keytool utility that is available as part of the Java Runtime Environment (JRE). For more details about keytool, refer Java documentation at http://docs.oracle.com/javase/7/docs/technotes/tools/#security.

keytool -genkey -keystore certs -keyalg rsa -alias vdt_alias -storepass server_ks_pwd -keypass server_pwd

keytool -genkey -alias agent.server.keys -keyalg RSA -keystore agent.server.keystore -storepass ks_password -keypass keypwd

keytool -export -alias agent.server.keys -keystore agent.server.keystore -storepass ks_password -file agent.server.cer

-genkey -alias vdt.web.client.keys -keyalg RSA -keystore vdt.web.client.keystore -storepass ks_password -keypass keypwd

keytool -export -alias vdt.web.client.keys -keystore vdt.web.client.keystore -storepass ks_password -file vdt.web.client.cer

keytool -import -v -keystore agent.server.truststore -storepass ks_password -file vdt.web.client.cer

keytool -import -v -keystore vdt.web.client.truststore -storepass ks_password -file agent.server.cer

2.2.6 Using OPSS Keystore Service to Manage Veridata Keystores

The Oracle Platform Security Services (OPSS) keystore services is used as a repository for storing identity and trust keystores for Veridata Server. The Veridata Agent keystores can also be managed using the OPSS keystore service. For more information, see "Managing Keys and Certificates with the Keystore Service" in Securing Applications with Oracle Platform Security Services.

Table 2-3 lists the default values for the OPSS settings.

To configure two-way SSL by using the OPSS keystore service:

1. For each Veridata Agent, create an identity and trust keystore.

2. Update the VeridataWebIdentityStore with the identity certificate of the Veridata Web Server.

3. Update the VeridataWebTrustStore with all Veridata Agent certificates.

4. Update each Veridata Agent truststore with the identity certificate of the Veridata Web Server.

5. Export the Agent keystore and truststore as JKS files and note the passwords.

6. Distribute the JKS files to corresponding Agent machines.

7. Run the configure_agent_ssl tool to update the Agent wallet with the keystore passwords.

8. For each Agent, configure the agent.properties file to enable SSL.

To configure one-way SSL by using the OPSS keystore service:

1. For each Veridata Agent, create an identity keystore.

2. Update the VeridataWebIdentityStore with the identity certificate of the Veridata Web Server.

3. Export the Agent keystore and truststore as JKS files and note the passwords.

4. Distribute the JKS files to corresponding Agent machines.

5. Run the configure_agent_ssl tool to update the Agent wallet with the keystore passwords.

6. For each Agent, configure the agent.properties file to enable SSL.

2.2.7 Modifying the Veridata Agent Wallet

Before you start the Veridata agent in SSL mode, you must update the Veridata Agent Wallet with the identity and trust keystore passwords. Otherwise, the Veridata Agent fails to start.

To update the wallet, run the configure_agent_ssl script that is available in the agent home:

AGENT_HOME\configure_agent_ssl.sh AgentID

where AgentID is the name of the agent properties file, without the .properties extension. The default value for AgentID is agent.

When prompted, enter the entry or unlock password for the identity and trust keystores for the agent.

2.3.1 Controlling Access to the Installation Directories

Standard operating system permissions apply to the programs, files, and directories within the Oracle GoldenGate Veridata Server and Web User Interface, and Oracle GoldenGate Veridata Agent installation directories. You should adjust the permissions for these objects based on your business security rules.

2.3.2 Securing files that Contain Business Data

Oracle GoldenGate Veridata Server creates data files that will contain sensitive application data. By default, these files reside in the DOMAIN_HOME/veridata/reports. All of the sub-directories within that directory contain files that may reflect business data.

The types of files that contain sensitive data are:

• The comparison report (rpt sub-directory)

• The out-of-sync report (oosxml and oos sub-directories)

These files inherit the same file permissions as those of the user that runs the Oracle GoldenGate Veridata Server installation program. Do not change the permissions, or Oracle GoldenGate Veridata may be unable to maintain them. These files should be kept just as secure as you would keep your business data. Users of Oracle GoldenGate Veridata Web do not require access to these files because they see the same information through the client interface.

The contents of all report files can be optionally encrypted. For more information, see Section 2.5, "Encrypting Report Files".

2.5.1 Enabling Report Encryption

The encryption is controlled by the following parameters in the Veridata configuration file, veridata.cfg:

• server.encryption

• server.encryption.bits

To enable encryption of Veridata report files, set server.encryption to true.

Encryption of Veridata report files use AES encryption, and the default encryption strength is 128 bits. You can increase the encryption strength to 192 or 256 bits by editing the value of server.encryption.bits parameter in veridata.cfg. Note that any encryption strength greater than 128 requires you to use a JRE that has Unlimited Strength Cryptography Extension installed.

For more information about these parameters, see "Parameters for Report File Encryption".

Encrypted Veridata report files have the following extensions in the file names:

• .xrpt : Encrypted comparison or repair report file

• .xoos: Encrypted binary out-of-sync file

• .xoosxml: Encrypted out-of-sync XML file

• .xNNN: Encrypted out-of-sync XML chunk file (NNN is a decimal number)

2.5.2 Using the reportutil Tool to view Reports

When Veridata report encryption is enabled, all Veridata report files will be encrypted using an encryption key which is initially a large random value. The encryption key can be changed if required.

The encrypted files must be decrypted before you read it. The Veridata Web User Interface automatically decrypts files before displaying them. Alternatively, use the reportutil.sh/.bat utility to display the encrypted contents. This utility is located in the VERIDATA_DOMAIN_HOME\veridata\bin directory. Run the tool as follows:

reportutil   [-wlport port ] -wluser weblogic_user { options }

Where wlport is the WebLogic Server port number (the default port is 8830) and wluser represents the WebLogic Server user name.

The valid options are:

• -version, -v: displays the current version

• -help: displays the help message

• -r: rolls report encryption

• -f filename [-d directory]: decrypts and prints the report file to the specified file if a directory is specified by the -d option. Or else the command prints the decrypted file to the standard output.

Note that the Veridata user running the reportutil tool must be in the appropriate user group to perform the operations:

• -r, -f: Allowed only if the user is a member of veridataCommandLineUser group

• -r: Allowed if the user is a member of veridataAdministrator group

• -f: Allowed if the user is a member of veridataAdministrator group, or a member of veridataPowerUser group, or a member of veridataDetailReportViewer. group

For more information about the user roles, see Section 2.4, "Securing Access to Oracle GoldenGate Veridata by Defining User Roles".