15 Oracle Key Vault General System Administration
General system administration refers to system management tasks for the Oracle Key Vault system, such as configuring network details and services.
- Overview of Oracle Key Vault General System Administration
System administrators can perform most general administration tasks in the Oracle Key Vault management console, including finding the current status of the overall system. - Configuring Oracle Key Vault in a Non-Multi-Master Cluster Environment
On the system Settings page, you can configure the network settings for either a standalone environment or a primary-standby environment. - Configuring Oracle Key Vault in a Multi-Master Cluster Environment
When you configure Oracle Key Vault in a multi-master cluster environment, you can configure either individual nodes or the entire multi-master cluster environment. - Managing System Recovery
System recovery includes tasks such as recovering lost administrative passwords. - Support for a Primary-Standby Environment
To ensure that Oracle Key Vault can always access security objects, you can deploy Oracle Key Vault in a primary-standby (highly available) configuration. - Commercial National Security Algorithm Suite Support
You can use scripts to perform Commercial National Security Algorithm (CNSA) operations for Oracle Key Vault HSM backup and upgrade operations. - Minimizing Downtime
Business-critical operations require data to be accessible and recoverable with minimum downtime.
15.1 Overview of Oracle Key Vault General System Administration
System administrators can perform most general administration tasks in the Oracle Key Vault management console, including finding the current status of the overall system.
- About Oracle Key Vault General System Administration
System administrators configure the Oracle Key Vault system settings. - Viewing the Oracle Key Vault Dashboard
The dashboard presents the current status of the Oracle Key Vault at a high level and is visible to all users. - Using the Status Panes in the Dashboard
The status panes on the dashboard provide useful high level information, such as links to alerts and an overview of current user activity.
Parent topic: Oracle Key Vault General System Administration
15.1.1 About Oracle Key Vault General System Administration
System administrators configure the Oracle Key Vault system settings.
The Oracle Key Vault system settings include administration, local and remote monitoring, email notification, backup and recovery operations, and auditing. You must have the appropriate role for performing these tasks. Users who have the System Administrator role can perform most of the administrative tasks, and users with the Audit Manager role can configure audit settings and export audit records. In most cases, you will perform these tasks in the Oracle Key Vault management console.
To quickly find information about the current status of the Oracle Key Vault system, you can view the Oracle Key Vault dashboard.
15.1.2 Viewing the Oracle Key Vault Dashboard
The dashboard presents the current status of the Oracle Key Vault at a high level and is visible to all users.
The Home tab of the management console displays the dashboard when you log into the management console.
Alerts and Managed Content are the first sections you will see on logging in.
Figure 15-1 Alerts and Managed Content Panes
![Description of Figure 15-1 follows Description of Figure 15-1 follows](img/okv_26.png)
Description of "Figure 15-1 Alerts and Managed Content Panes"
The Data Interval, Operations, Endpoint Activity, and User Activity panes of the Home page follow Alerts and Managed Content.
Figure 15-2 Data Interval, Operations, Endpoint Activity, and User Activity Panes
![Description of Figure 15-2 follows Description of Figure 15-2 follows](img/okv_26a.gif)
Description of "Figure 15-2 Data Interval, Operations, Endpoint Activity, and User Activity Panes"
15.2 Configuring Oracle Key Vault in a Non-Multi-Master Cluster Environment
On the system Settings page, you can configure the network settings for either a standalone environment or a primary-standby environment.
- Configuring the Network Details
In a non-multi-master cluster environment, you can configure the network details from any Oracle Key Vault management console. - Configuring the Network Services
In a non-multi-master cluster, you can configure the network services from any Oracle Key Vault management console. - Configuring the System Time
In a non-multi-master cluster environment, you can set the system time for the Oracle Key Vault system. - Configuring DNS
In a non-multi-master cluster environment, you can enter up to three DNS server IP addresses. - Configuring FIPS Mode
In a non-multi-master cluster environment, you can enable or disable FIPS mode for Oracle Key Vault. - Configuring Syslog
In a non-multi-master cluster environment, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). - Configuring RESTful Services
In a non-multi-master cluster environment, you can enable or disable RESTful services. - Configuring Oracle Audit Vault Integration
In a non-multi-master cluster environment, you can enable Oracle Key Vault to send data to Oracle Audit Vault for centralized audit reporting and alerting. - Configuring the Oracle Key Vault Management Console Web Session Timeout
In a non-multi-master cluster environment, you can configure a timeout value in minutes for the Oracle Key Vault management console Web session. - Restarting or Powering Off Oracle Key Vault
You can manually restart or power off Oracle Key Vault as required for maintenance or for patch and upgrade procedures.
Parent topic: Oracle Key Vault General System Administration
15.2.1 Configuring the Network Details
In a non-multi-master cluster environment, you can configure the network details from any Oracle Key Vault management console.
15.2.2 Configuring the Network Services
In a non-multi-master cluster, you can configure the network services from any Oracle Key Vault management console.
15.2.3 Configuring the System Time
In a non-multi-master cluster environment, you can set the system time for the Oracle Key Vault system.
Related Topics
15.2.4 Configuring DNS
In a non-multi-master cluster environment, you can enter up to three DNS server IP addresses.
Related Topics
15.2.5 Configuring FIPS Mode
In a non-multi-master cluster environment, you can enable or disable FIPS mode for Oracle Key Vault.
15.2.6 Configuring Syslog
In a non-multi-master cluster environment, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP).
15.2.7 Configuring RESTful Services
In a non-multi-master cluster environment, you can enable or disable RESTful services.
15.2.8 Configuring Oracle Audit Vault Integration
In a non-multi-master cluster environment, you can enable Oracle Key Vault to send data to Oracle Audit Vault for centralized audit reporting and alerting.
15.2.9 Configuring the Oracle Key Vault Management Console Web Session Timeout
In a non-multi-master cluster environment, you can configure a timeout value in minutes for the Oracle Key Vault management console Web session.
20
minutes, then the user can extend the session for another 20 minutes.
15.3 Configuring Oracle Key Vault in a Multi-Master Cluster Environment
When you configure Oracle Key Vault in a multi-master cluster environment, you can configure either individual nodes or the entire multi-master cluster environment.
- Configuring System Settings for Individual Multi-Master Cluster Nodes
You can set or change settings that apply to the cluster node. - Managing Oracle Key Vault Multi-Master Clusters
You can create, configure, manage, and administer an Oracle Key Vault multi-master cluster by using the Oracle Key Vault management console.
Parent topic: Oracle Key Vault General System Administration
15.3.1 Configuring System Settings for Individual Multi-Master Cluster Nodes
You can set or change settings that apply to the cluster node.
Examples of these settings are the network details, network services, system time, DNS, FIPS mode, syslog, and Oracle Audit Vault integration. Values set for the node override the cluster setting. However, you can clear any individual node setting to revert to the cluster setting.
- Configuring the Network Details for the Node
In a multi-master cluster, you can change the host name for a node. - Configuring the Network Services for the Node
In a multi-master cluster, you can configure the network services for a node. - Configuring the System Time for the Node
In a multi-master cluster, you can set the system time for a node. - Configuring DNS for the Node
When you configure the DNS for a multi-master cluster node, you should enter more than one DNS IP address. - Configuring the FIPS Mode for the Node
All multi-master cluster nodes must use the same FIPS mode setting or you will receive an alert. - Configuring Syslog for the Node
In a node, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). - Configuring Oracle Audit Vault Integration for the Node
You can configure the integration of Oracle Audit Vault (but not the Database Firewall component) for a node. - Restarting or Powering Off Oracle Key Vault from a Node
You can manually restart or power off an Oracle Key Vault node as required for maintenance or for patch and upgrade procedures.
15.3.1.1 Configuring the Network Details for the Node
In a multi-master cluster, you can change the host name for a node.
15.3.1.2 Configuring the Network Services for the Node
In a multi-master cluster, you can configure the network services for a node.
15.3.1.3 Configuring the System Time for the Node
In a multi-master cluster, you can set the system time for a node.
15.3.1.4 Configuring DNS for the Node
When you configure the DNS for a multi-master cluster node, you should enter more than one DNS IP address.
15.3.1.5 Configuring the FIPS Mode for the Node
All multi-master cluster nodes must use the same FIPS mode setting or you will receive an alert.
15.3.1.6 Configuring Syslog for the Node
In a node, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP).
15.3.1.7 Configuring Oracle Audit Vault Integration for the Node
You can configure the integration of Oracle Audit Vault (but not the Database Firewall component) for a node.
- Log into any Oracle Key Vault management console as a user who has the System Administrator role.
- Select the System tab, and then System Settings from the left navigation bar.
- Select the Enable check box to Oracle Audit Vault Integration for the node.
- In the Password and Reenter password fields that appear after you click Enable, enter the password of the user in the database that Audit Vault and Database Firewall will use to extract the audit records.
- Click Save.
15.3.1.8 Restarting or Powering Off Oracle Key Vault from a Node
You can manually restart or power off an Oracle Key Vault node as required for maintenance or for patch and upgrade procedures.
15.3.2 Managing Oracle Key Vault Multi-Master Clusters
You can create, configure, manage, and administer an Oracle Key Vault multi-master cluster by using the Oracle Key Vault management console.
- About Configuring Cluster System Settings
You can set or change settings that apply to an entire multi-master cluster. - Configuring the System Time for the Cluster
When you configure the system time, you can set it for multiple servers and also set the synchronization. - Configuring DNS for the Cluster
When you configure the DNS for a cluster, you can enter up to three DNS server IP addresses. - Configuring Maximum Disable Node Duration for the Cluster
You can set the Configuring Maximum Node Duration time for the cluster in hours. - Configuring RESTful Services for the Cluster
You can enable or disable RESTful Services for the cluster. - Configuring Syslog for the Cluster
In a multi-master cluster environment, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). - Configuring SNMP Settings for the Cluster
You can enable or disable SNMP access for a multi-master cluster. - Configuring the Oracle Key Vault Management Console Web Session Timeout for the Cluster
You can configure a timeout value in minutes for the Oracle Key Vault management console for all nodes in a multi-master cluster.
15.3.2.1 About Configuring Cluster System Settings
You can set or change settings that apply to an entire multi-master cluster.
You can set the system time, DNS, the maximum time a server can be disabled before it is evicted from the cluster, enable RESTful services, the protocol to use for syslog, the syslog destination, and monitoring settings for the cluster. Any values that are set and saved to an individual node will not be overridden by cluster settings. It may take several minutes for changes to propagate to other nodes.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
15.3.2.2 Configuring the System Time for the Cluster
When you configure the system time, you can set it for multiple servers and also set the synchronization.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
15.3.2.3 Configuring DNS for the Cluster
When you configure the DNS for a cluster, you can enter up to three DNS server IP addresses.
- Log into any Oracle Key Vault management console as a user who has the System Administrator role.
- Select the System tab, and then Cluster System Settings from the left navigation bar.
- In the DNS section of the Cluster System Settings page, enter up to three DNS Server IP addresses.
- In the DNS section, click Save to Cluster.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
15.3.2.4 Configuring Maximum Disable Node Duration for the Cluster
You can set the Configuring Maximum Node Duration time for the cluster in hours.
- Log into any Oracle Key Vault management console as a user who has the System Administrator role.
- Select the System tab, and then Cluster System Settings from the left navigation bar.
- In the Maximum Disable Node Duration section, enter a value, in hours, for the duration that a node can be disabled before it is evicted from the cluster.
- In the Maximum Disable Node Duration section, click Save to Cluster.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
15.3.2.5 Configuring RESTful Services for the Cluster
You can enable or disable RESTful Services for the cluster.
- Log into any Oracle Key Vault management console as a user who has the System Administrator role.
- Select the System tab, and then Cluster System Settings from the left navigation bar.
- Select the Enable checkbox in the RESTful Services section.
- In the RESTful Services section, click Save to Cluster.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
15.3.2.6 Configuring Syslog for the Cluster
In a multi-master cluster environment, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP).
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
15.3.2.7 Configuring SNMP Settings for the Cluster
You can enable or disable SNMP access for a multi-master cluster.
- Log into any Oracle Key Vault management console as a user who has the System Administrator role.
- Select the System tab, and then Monitoring Settings from the left navigation bar.
- For Scope, select Cluster.
- Select who has SNMP access to the multi-master cluster by choosing one of the options:
- All: Allows SNMP access from all IP addresses.
- Disabled: Allows no SNMP access.
- IP address(es): Allows SNMP access from the list of IP addresses supplied in the address box. Enter a space-separated list of IP addresses.
- Enter values for the following fields:
- Username: Enter the SNMP user name.
- Password: Enter the SNMP password.
- Reenter Password: Enter the SNMP password again.
- Click Save to Cluster.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
15.3.2.8 Configuring the Oracle Key Vault Management Console Web Session Timeout for the Cluster
You can configure a timeout value in minutes for the Oracle Key Vault management console for all nodes in a multi-master cluster.
20
minutes, then the user can extend the session for another 20 minutes.
15.4 Managing System Recovery
System recovery includes tasks such as recovering lost administrative passwords.
- About Managing System Recovery
To perform system recovery, you use the recovery passphrase. - Recovering Credentials for Administrators
You can recover the system by adding credentials for administrative users. - Changing the Recovery Passphrase in a Non-Clusters Environment
Periodically changing the recovery passphrase is a good security practice. - Changing the Recovery Passphrase in a Multi-Master Cluster
Changing the recovery passphrase in a multi-master cluster is a two-step process. - Changing the Installation Passphrase
You can change the installation passphrase from the system console.
Parent topic: Oracle Key Vault General System Administration
15.4.1 About Managing System Recovery
To perform system recovery, you use the recovery passphrase.
In an emergency when no administrative users are available, or you must change the password of administrative users, you can recover the system with the recovery passphrase that was created during Oracle Key Vault installation. In addition, you can change the recovery passphrase to keep up with security best practices.
Parent topic: Managing System Recovery
15.4.2 Recovering Credentials for Administrators
You can recover the system by adding credentials for administrative users.
Related Topics
Parent topic: Managing System Recovery
15.4.3 Changing the Recovery Passphrase in a Non-Clusters Environment
Periodically changing the recovery passphrase is a good security practice.
Related Topics
Parent topic: Managing System Recovery
15.4.4 Changing the Recovery Passphrase in a Multi-Master Cluster
Changing the recovery passphrase in a multi-master cluster is a two-step process.
To change the recovery passphrase for a multi-master cluster, you must first initiate the change throughout the nodes in the multi-master cluster environment before changing the recovery passphrase.
- Step 1: Initiate the Recovery Passphrase Change Across the Nodes
A user with the System Administrator role should perform a new backup whenever the recovery passphrase changes. - Step 2: Change the Recovery Passphrase
After the multi-master cluster nodes have been notified of the impending recovery passphrase change, you can change the recovery passphrase.
Parent topic: Managing System Recovery
15.4.4.1 Step 1: Initiate the Recovery Passphrase Change Across the Nodes
A user with the System Administrator role should perform a new backup whenever the recovery passphrase changes.
15.4.5 Changing the Installation Passphrase
You can change the installation passphrase from the system console.
- About Changing the Installation Passphrase
You can only change the installation passphrase during a specific window of time. - Changing an Installation Passphrase
You must change the installation passphrase in the system console.
Parent topic: Managing System Recovery
15.4.5.1 About Changing the Installation Passphrase
You can only change the installation passphrase during a specific window of time.
The installation passphrase is specified during installation. You must use the installation passphrase to log in to Oracle Key Vault and complete the post-installation tasks. The installation passphrase can only be changed on the console after installation but before post-installation. After the post-installation tasks are completed, this option no longer appears on the console.
If you forget the installation passphrase, then you can create a new installation passphrase. As with all Oracle Key Vault passphrases, it is important to store the installation passphrase securely.
Parent topic: Changing the Installation Passphrase
15.4.5.2 Changing an Installation Passphrase
You must change the installation passphrase in the system console.
Parent topic: Changing the Installation Passphrase
15.5 Support for a Primary-Standby Environment
To ensure that Oracle Key Vault can always access security objects, you can deploy Oracle Key Vault in a primary-standby (highly available) configuration.
This configuration also supports disaster recovery scenarios.
You can deploy two Oracle Key Vault servers in a primary-standby configuration. The primary server services the requests that come from endpoints. If the primary server fails, then the standby server takes over after a configurable preset delay. This configurable delay ensures that the standby server does not take over prematurely in case of short communication gaps.
The primary-standby configuration was previously known as the high availability configuration. The primary-standby configuration and the multi-master cluster configuration are mutually exclusive.
Oracle Key Vault supports primary-standby read-only restricted mode. When the primary server is affected by server, hardware, or network failures, primary-standby read-only restricted mode ensures that an Oracle Key Vault server is available to service endpoints, thus ensuring operational continuity. However, key and sensitive operations, such as generation of keys are disabled, while operations such as generation of audit logs are unaffected.
When an unplanned shutdown makes the standby server unreachable, the primary server is still available to the endpoints in read-only mode.
Related Topics
Parent topic: Oracle Key Vault General System Administration
15.6 Commercial National Security Algorithm Suite Support
You can use scripts to perform Commercial National Security Algorithm (CNSA) operations for Oracle Key Vault HSM backup and upgrade operations.
- About Commercial National Security Algorithm Suite Support
You can configure Oracle Key Vault for compliance with the Commercial National Security Algorithm (CNSA) Suite. - Running the Commercial National Security Algorithm Scripts
The Commercial National Security Algorithm (CNSA) scripts update theokv_security.conf
file. - Performing Backup and Restore Operations with CNSA
After you back up and restore Oracle Key Vault, use/usr/local/okv/bin/okv_cnsa
to use the enhanced Commercial National Security Algorithm (CNSA) Suite. - Upgrading a Standalone Oracle Key Vault Server with CNSA
You can upgrade a standalone Oracle Key Vault while using Commercial National Security Algorithm (CNSA) compliance by upgrading and then executing theokv_cnsa
script. - Upgrading Primary-Standby Oracle Key Vault Servers to Use CNSA
You can upgrade Oracle Key Vault primary-standby servers while using Commercial National Security Algorithm (CNSA) compliance by upgrading and then executing theokv_cnsa
script.
Parent topic: Oracle Key Vault General System Administration
15.6.1 About Commercial National Security Algorithm Suite Support
You can configure Oracle Key Vault for compliance with the Commercial National Security Algorithm (CNSA) Suite.
This compliance applies to TLS connections to and from the Oracle Key Vault appliance.
The CNSA suite is a list of strong encryption algorithms and key lengths, that offer greater security and relevance into the future.
Oracle Key Vault release 12.2 BP3 and later do not provide complete compliance across every component in the system. You will be able to switch to the CNSA algorithms, where available by means of the following scripts that are packaged with the Oracle Key Vault ISO:
-
/usr/local/okv/bin/okv_cnsa
makes configuration file changes to update as many components as possible to use the enhanced algorithms. -
/usr/local/okv/bin/okv_cnsa_cert
regenerates CNSA compliant public key pairs and certificates.Note:
The/usr/local/okv/bin/okv_cnsa
and/usr/local/okv/bin/okv_cnsa_cert
scripts are both disruptive because they replace the old key pairs with new ones. This has consequences for the following operations:-
Endpoint Enrollment: Enroll endpoints after running this script when possible. If you had endpoints enrolled before running the CNSA script, you must re-enroll them so that fresh CNSA compliant keys are generated using CNSA algorithms.
-
Primary-Standby: Run the CNSA scripts on both Oracle Key Vault instances before pairing them in a primary-standby configuration when possible. If you had primary-standby before you run the CNSA scripts, then you must re-configure primary-standby as follows: unpair the primary and standby servers, reinstall the standby server, run the CNSA scripts individually on each server, and then pair them again.
-
Limitations:
-
CNSA compliance is not supported for all components in the Oracle Key Vault infrastructure (for example, SSH or Transparent Data Encryption (TDE)).
-
The Firefox browser is not supported for use with the Oracle Key Vault management console when CNSA is enabled. This is because the Firefox browser does not support CNSA-approved cipher suites.
Parent topic: Commercial National Security Algorithm Suite Support
15.6.2 Running the Commercial National Security Algorithm Scripts
The Commercial National Security Algorithm (CNSA) scripts update the okv_security.conf
file.
/usr/local/okv/etc/okv_security.conf
with the following line:USE_ENHANCED_ALGORITHMS_ONLY="1"
Related Topics
Parent topic: Commercial National Security Algorithm Suite Support
15.6.3 Performing Backup and Restore Operations with CNSA
After you back up and restore Oracle Key Vault, use /usr/local/okv/bin/okv_cnsa
to use the enhanced Commercial National Security Algorithm (CNSA) Suite.
Related Topics
Parent topic: Commercial National Security Algorithm Suite Support
15.6.4 Upgrading a Standalone Oracle Key Vault Server with CNSA
You can upgrade a standalone Oracle Key Vault while using Commercial National Security Algorithm (CNSA) compliance by upgrading and then executing the okv_cnsa
script.
15.6.5 Upgrading Primary-Standby Oracle Key Vault Servers to Use CNSA
You can upgrade Oracle Key Vault primary-standby servers while using Commercial National Security Algorithm (CNSA) compliance by upgrading and then executing the okv_cnsa
script.
15.7 Minimizing Downtime
Business-critical operations require data to be accessible and recoverable with minimum downtime.
You can configure Oracle Key Vault to ensure minimum downtime in the following ways:
-
Configuring a multi-master cluster: You can configure a multi-master cluster by adding redundancy in the form of additional nodes. The client can access any available node. In the event of a failure of any node, a client will automatically connect to another node in the endpoint node scan list. This reduces and potentially eliminates downtime.
-
Configuring a primary-standby environment: A primary-standby environment is configured by adding redundancy in the form of a standby server. The standby server takes over from the primary server in the event of a failure, thus eliminating single points of failure, and minimizing downtime.
-
Enabling read-only restricted mode: Primary-standby read-only restricted mode ensures endpoint operational continuity when primary or standby Oracle Key Vault servers are affected by server, hardware, or network failures. When an unplanned shutdown causes the standby server to become unreachable, the primary server is still available to the endpoints.
If primary-standby read-only restricted mode is disabled, then the primary server will become unavailable and stop accepting requests in the event of a standby failure. Endpoints connected to Oracle Key Vault are unable to retrieve keys until connectivity is restored between primary and standby servers.
To ensure endpoint operational continuity in the event of a primary or standby server failure, enable read-only restricted mode.
-
Enabling persistent master encryption key cache: The persistent master encryption key cache ensures that the endpoints can access keys in the event of a primary or standby server failure. While the surviving server is taking over from the failed peer, the endpoints can retrieve keys from the persistent cache and continue operations normally.
-
Apply the TDE heartbeat database patch on endpoints: Apply the database patch for Bug 22734547 to tune the Oracle Key Vault heartbeat.
Oracle strongly recommends that you back up Oracle Key Vault data regularly on a schedule. This practice ensures that backups are current and hold the most recent data. You can use this backup to restore a new or existing Oracle Key Vault server and enable it to be fully operational with minimum downtime and data loss.
If the Oracle Key Vault installation uses an online master key (formerly known as TDE direct connect), then during an upgrade, ensure that you upgrade database endpoints in parallel to reduce total downtime.
Related Topics
Parent topic: Oracle Key Vault General System Administration