16 Oracle Key Vault General System Administration
General system administration refers to system management tasks for the Oracle Key Vault system, such as configuring network details and services.
- Overview of Oracle Key Vault General System Administration
System administrators can perform most general administration tasks in the Oracle Key Vault management console, including finding the current status of the overall system. - Configuring Oracle Key Vault in a Non-Multi-Master Cluster Environment
On the system Settings page, you can configure the network settings for either a standalone environment or a primary-standby environment. - Configuring Oracle Key Vault in a Multi-Master Cluster Environment
When you configure Oracle Key Vault in a multi-master cluster environment, you can configure either individual nodes or the entire multi-master cluster environment. - Managing System Recovery
System recovery includes tasks such as recovering lost administrative passwords. - Support for a Primary-Standby Environment
To ensure that Oracle Key Vault can always access security objects, you can deploy Oracle Key Vault in a primary-standby (highly available) configuration. - Commercial National Security Algorithm Suite Support
You can use scripts to perform Commercial National Security Algorithm (CNSA) operations for Oracle Key Vault HSM backup and upgrade operations. - Minimizing Downtime
Business-critical operations require data to be accessible and recoverable with minimum downtime.
16.1 Overview of Oracle Key Vault General System Administration
System administrators can perform most general administration tasks in the Oracle Key Vault management console, including finding the current status of the overall system.
- About Oracle Key Vault General System Administration
System administrators configure the Oracle Key Vault system settings. - Viewing the Oracle Key Vault Dashboard
The dashboard presents the current status of the Oracle Key Vault at a high level and is visible to all users. - Using the Status Panes in the Dashboard
The status panes on the dashboard provide useful high level information, such as links to alerts.
Parent topic: Oracle Key Vault General System Administration
16.1.1 About Oracle Key Vault General System Administration
System administrators configure the Oracle Key Vault system settings.
The Oracle Key Vault system settings include administration, local and remote monitoring, email notification, backup and recovery operations, and auditing. You must have the appropriate role for performing these tasks. Users who have the System Administrator role can perform most of the administrative tasks, and users with the Audit Manager role can configure audit settings and export audit records. In most cases, you will perform these tasks in the Oracle Key Vault management console.
To quickly find information about the current status of the Oracle Key Vault system, you can view the Oracle Key Vault dashboard.
16.1.2 Viewing the Oracle Key Vault Dashboard
The dashboard presents the current status of the Oracle Key Vault at a high level and is visible to all users.
16.2 Configuring Oracle Key Vault in a Non-Multi-Master Cluster Environment
On the system Settings page, you can configure the network settings for either a standalone environment or a primary-standby environment.
- Configuring the Network Details
In a non-multi-master cluster environment, you can configure the network details from any Oracle Key Vault management console. - Configuring the Network Services
In a non-multi-master cluster, you can configure the network services from any Oracle Key Vault management console. - Configuring the System Time
Oracle strongly recommends that you synchronize Oracle Key Vault with an NTP time source. - Configuring DNS
In a non-multi-master cluster environment, you can enter up to three DNS server IP addresses. - Configuring FIPS Mode
In a non-multi-master cluster environment, you can enable or disable FIPS mode for Oracle Key Vault. - Configuring Syslog
In a non-multi-master cluster environment, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). - Changing the Network Interface Mode
You can switch between dual NIC mode and classic mode for the network interface. - Configuring RESTful Services
RESTful services allow you to automate endpoint enrollment and provisioning. - Configuring Oracle Audit Vault Integration
In a non-multi-master cluster environment, you can enable Oracle Key Vault to send data to Oracle Audit Vault for centralized audit reporting and alerting. - Configuring the Oracle Key Vault Management Console Web Session Timeout
In a non-multi-master cluster environment, you can configure a timeout value in minutes for the Oracle Key Vault management console Web session. - Restarting or Powering Off Oracle Key Vault
You can manually restart or power off Oracle Key Vault as required for maintenance or for patch and upgrade procedures.
Parent topic: Oracle Key Vault General System Administration
16.2.1 Configuring the Network Details
In a non-multi-master cluster environment, you can configure the network details from any Oracle Key Vault management console.
16.2.2 Configuring the Network Services
In a non-multi-master cluster, you can configure the network services from any Oracle Key Vault management console.
16.2.3 Configuring the System Time
Oracle strongly recommends that you synchronize Oracle Key Vault with an NTP time source.
You can configure Oracle Key Vault to use an NTP server to remain synchronized with the current time. (Fields for up to three servers are provided.) If an NTP server is not available, then you can set the current time manually. You should use the calendar icon to set the date and time so that these values are stored in the correct format.
Related Topics
16.2.4 Configuring DNS
In a non-multi-master cluster environment, you can enter up to three DNS server IP addresses.
Related Topics
16.2.5 Configuring FIPS Mode
In a non-multi-master cluster environment, you can enable or disable FIPS mode for Oracle Key Vault.
16.2.6 Configuring Syslog
In a non-multi-master cluster environment, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP).
16.2.7 Changing the Network Interface Mode
You can switch between dual NIC mode and classic mode for the network interface.
Related Topics
16.2.8 Configuring RESTful Services
RESTful services allow you to automate endpoint enrollment and provisioning.
16.2.9 Configuring Oracle Audit Vault Integration
In a non-multi-master cluster environment, you can enable Oracle Key Vault to send data to Oracle Audit Vault for centralized audit reporting and alerting.
16.2.10 Configuring the Oracle Key Vault Management Console Web Session Timeout
In a non-multi-master cluster environment, you can configure a timeout value in minutes for the Oracle Key Vault management console Web session.
20
minutes, then the user can extend the session for another 20 minutes.
16.3 Configuring Oracle Key Vault in a Multi-Master Cluster Environment
When you configure Oracle Key Vault in a multi-master cluster environment, you can configure either individual nodes or the entire multi-master cluster environment.
- About Configuring Oracle Key Vault in a Multi-Master Cluster Environment
You have the option of configuring settings for individual nodes or the entire multi-master cluster. - Configuring System Settings for Individual Multi-Master Cluster Nodes
You can set or change settings that apply to the cluster node. - Managing Oracle Key Vault Multi-Master Clusters
You can create, configure, manage, and administer an Oracle Key Vault multi-master cluster by using the Oracle Key Vault management console.
Parent topic: Oracle Key Vault General System Administration
16.3.1 About Configuring Oracle Key Vault in a Multi-Master Cluster Environment
You have the option of configuring settings for individual nodes or the entire multi-master cluster.
Some of the settings for individual nodes and the entire cluster are the same. For example, you can set the DNS for an individual node or for an entire cluster. Any values that are set and saved to an individual node will not be overridden by cluster settings. When you set a value for the entire cluster, it may take several minutes for changes to propagate to other nodes.
When you start the configuration, you have the choice of setting the following View Settings menu options:
- Node only means that the setting can be set only on that node and will apply to only node.
- Cluster only means that the setting is a cluster-wide setting and updating it will change the settings across the cluster.
- Both means that the setting can be set at both node level and cluster level. For these settings, you can navigate between node and cluster settings by using the right arrow button that is present in the respective setting page. For example, if you select DNS, then you can configure DNS settings for both individual nodes and for the entire cluster, in one operation.
- All shows all the available settings without any filter.
16.3.2 Configuring System Settings for Individual Multi-Master Cluster Nodes
You can set or change settings that apply to the cluster node.
Examples of these settings are the network details, network services, system time, FIPS mode, syslog, and Oracle Audit Vault integration. Values set for the node override the cluster setting. However, you can clear any individual node setting to revert to the cluster setting.
- Configuring the Network Details for the Node
In a multi-master cluster, you can change the host name for a node. - Configuring the Network Services for the Node
In a multi-master cluster, you can configure the network services for a node. - Configuring the System Time for the Node
In a multi-master cluster, you can set the system time for a node. - Configuring DNS for the Node
When you configure the DNS for a multi-master cluster node, you should enter more than one DNS IP address. - Configuring the FIPS Mode for the Node
All multi-master cluster nodes must use the same FIPS mode setting or you will receive an alert. - Configuring Syslog for the Node
In a node, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). - Changing the Network Interface Mode for the Node
You can switch between dual NIC mode and classic mode for the network interface for a node in a multi-master cluster environment. - Configuring Auditing for the Node
You can enable or disable audit settings for a node. - Configuring SNMP Settings for the Node
You can enable or disable SNMP access for a multi-master cluster node. - Configuring Oracle Audit Vault Integration for the Node
You can configure the integration of Oracle Audit Vault (but not the Database Firewall component) for a node. - Restarting or Powering Off Oracle Key Vault from a Node
You can manually restart or power off an Oracle Key Vault node as required for maintenance or for patch and upgrade procedures.
16.3.2.1 Configuring the Network Details for the Node
In a multi-master cluster, you can change the host name for a node.
16.3.2.2 Configuring the Network Services for the Node
In a multi-master cluster, you can configure the network services for a node.
16.3.2.3 Configuring the System Time for the Node
In a multi-master cluster, you can set the system time for a node.
16.3.2.4 Configuring DNS for the Node
When you configure the DNS for a multi-master cluster node, you should enter more than one DNS IP address.
16.3.2.5 Configuring the FIPS Mode for the Node
All multi-master cluster nodes must use the same FIPS mode setting or you will receive an alert.
16.3.2.6 Configuring Syslog for the Node
In a node, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP).
Related Topics
16.3.2.7 Changing the Network Interface Mode for the Node
You can switch between dual NIC mode and classic mode for the network interface for a node in a multi-master cluster environment.
16.3.2.8 Configuring Auditing for the Node
You can enable or disable audit settings for a node.
Related Topics
16.3.2.9 Configuring SNMP Settings for the Node
You can enable or disable SNMP access for a multi-master cluster node.
16.3.2.10 Configuring Oracle Audit Vault Integration for the Node
You can configure the integration of Oracle Audit Vault (but not the Database Firewall component) for a node.
- Log into the Oracle Key Vault management console for the node as a user who has the System Administrator role.
- Select the System tab, and then Settings from the left navigation bar.
- In the Monitoring and Alerts area, click Audit Vault.
- In the Audit Vault Integration window, select the Enable check box to enable Oracle Audit Vault Integration for the node.
- In the Password and Reenter password fields that appear after you click Enable, enter the password of the user in the database that Audit Vault and Database Firewall will use to extract the audit records.
- Click Save.
16.3.2.11 Restarting or Powering Off Oracle Key Vault from a Node
You can manually restart or power off an Oracle Key Vault node as required for maintenance or for patch and upgrade procedures.
- Log into the Oracle Key Vault management console for the node as a user who has the System Administrator role.
- Select the System tab, and then Status from the left navigation bar.
- At the top of the Status page, do one of the following to restart or power off the node:
- To restart, click Reboot.
- To power off, click Power Off.
16.3.3 Managing Oracle Key Vault Multi-Master Clusters
You can create, configure, manage, and administer an Oracle Key Vault multi-master cluster by using the Oracle Key Vault management console.
- Configuring the System Time for the Cluster
When you configure the system time, you can set it for multiple servers and also set the synchronization. - Configuring DNS for the Cluster
When you configure the DNS for a cluster, you can enter up to three DNS server IP addresses. - Configuring Maximum Disable Node Duration for the Cluster
You can set the maximum node duration time for the cluster in hours. - Configuring Syslog for the Cluster
In a multi-master cluster environment, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). - Configuring RESTful Services for the Cluster
You can enable or disable RESTful Services for the cluster. - Configuring Auditing for the Cluster
You can enable or disable audit settings for the cluster. - Configuring SNMP Settings for the Cluster
You can enable or disable SNMP access for a multi-master cluster. - Configuring the Oracle Key Vault Management Console Web Session Timeout for the Cluster
You can configure a timeout value in minutes for the Oracle Key Vault management console for all nodes in a multi-master cluster.
16.3.3.1 Configuring the System Time for the Cluster
When you configure the system time, you can set it for multiple servers and also set the synchronization.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
16.3.3.2 Configuring DNS for the Cluster
When you configure the DNS for a cluster, you can enter up to three DNS server IP addresses.
- Log into any Oracle Key Vault management console as a user who has the System Administrator role.
- Select the System tab, and then Settings from the left navigation bar.
- In the Network Services area, click DNS.
- In the DNS window, click the arrow to the left to toggle to the Cluster Details page.
- In the Cluster Details page, enter up to three DNS Server IP addresses.
- Click Save.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
16.3.3.3 Configuring Maximum Disable Node Duration for the Cluster
You can set the maximum node duration time for the cluster in hours.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
16.3.3.4 Configuring Syslog for the Cluster
In a multi-master cluster environment, you can enable syslog for specific destinations and transmit the records either using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP).
Related Topics
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
16.3.3.5 Configuring RESTful Services for the Cluster
You can enable or disable RESTful Services for the cluster.
- Log into any Oracle Key Vault management console as a user who has the System Administrator role.
- Select the System tab, and then Settings from the left navigation bar.
- In the System Configuration area, click RESTful Services.
- In the RESTful Services window, select the Enable check box.
- Click Save.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
16.3.3.6 Configuring Auditing for the Cluster
You can enable or disable audit settings for the cluster.
Related Topics
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
16.3.3.7 Configuring SNMP Settings for the Cluster
You can enable or disable SNMP access for a multi-master cluster.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
16.3.3.8 Configuring the Oracle Key Vault Management Console Web Session Timeout for the Cluster
You can configure a timeout value in minutes for the Oracle Key Vault management console for all nodes in a multi-master cluster.
20
minutes, then the user can extend the session for another 20 minutes.
Parent topic: Managing Oracle Key Vault Multi-Master Clusters
16.4 Managing System Recovery
System recovery includes tasks such as recovering lost administrative passwords.
- About Managing System Recovery
To perform system recovery, you use the recovery passphrase. - Recovering Credentials for Administrators
You can recover the system by adding credentials for administrative users. - Changing the Recovery Passphrase in a Non-Clusters Environment
Periodically changing the recovery passphrase is a good security practice. - Changing the Recovery Passphrase in a Multi-Master Cluster
Changing the recovery passphrase in a multi-master cluster is a two-step process.
Parent topic: Oracle Key Vault General System Administration
16.4.1 About Managing System Recovery
To perform system recovery, you use the recovery passphrase.
In an emergency when no administrative users are available, or you must change the password of administrative users, you can recover the system with the recovery passphrase that was created during Oracle Key Vault installation. In addition, you can change the recovery passphrase to keep up with security best practices.
Parent topic: Managing System Recovery
16.4.2 Recovering Credentials for Administrators
You can recover the system by adding credentials for administrative users.
- From a web browser using HTTPS, enter the IP address of the Oracle Key Vault installation.
- In the Oracle Key Vault login page, do not log in.
- Click the System Recovery link at the lower right corner of the page.
- In the Recovery Passphrase field, enter the recovery passphrase and then click Login.
- In the page that appears, select the Administrator Recovery tab.
- Fill out the fields in the Key Administrator, System Administrator, and Audit Manager panes to assign these roles to new or existing user accounts.
- Click Save.
Parent topic: Managing System Recovery
16.4.3 Changing the Recovery Passphrase in a Non-Clusters Environment
Periodically changing the recovery passphrase is a good security practice.
Parent topic: Managing System Recovery
16.4.4 Changing the Recovery Passphrase in a Multi-Master Cluster
Changing the recovery passphrase in a multi-master cluster is a two-step process.
To change the recovery passphrase for a multi-master cluster, you must first initiate the change throughout the nodes in the multi-master cluster environment before changing the recovery passphrase.
- Step 1: Initiate the Recovery Passphrase Change Across the Nodes
A user with the System Administrator role should perform a new backup whenever the recovery passphrase changes. - Step 2: Change the Recovery Passphrase
After the multi-master cluster nodes have been notified of the impending recovery passphrase change, you can change the recovery passphrase.
Parent topic: Managing System Recovery
16.4.4.1 Step 1: Initiate the Recovery Passphrase Change Across the Nodes
A user with the System Administrator role should perform a new backup whenever the recovery passphrase changes.
Related Topics
16.5 Support for a Primary-Standby Environment
To ensure that Oracle Key Vault can always access security objects, you can deploy Oracle Key Vault in a primary-standby (highly available) configuration.
This configuration also supports disaster recovery scenarios.
You can deploy two Oracle Key Vault servers in a primary-standby configuration. The primary server services the requests that come from endpoints. If the primary server fails, then the standby server takes over after a configurable preset delay. This configurable delay ensures that the standby server does not take over prematurely in case of short communication gaps.
The primary-standby configuration was previously known as the high availability configuration. The primary-standby configuration and the multi-master cluster configuration are mutually exclusive.
Oracle Key Vault supports primary-standby read-only restricted mode. When the primary server is affected by server, hardware, or network failures, primary-standby read-only restricted mode ensures that an Oracle Key Vault server is available to service endpoints, thus ensuring operational continuity. However, key and sensitive operations, such as generation of keys are disabled, while operations such as generation of audit logs are unaffected.
When an unplanned shutdown makes the standby server unreachable, the primary server is still available to the endpoints in read-only mode.
Related Topics
Parent topic: Oracle Key Vault General System Administration
16.6 Commercial National Security Algorithm Suite Support
You can use scripts to perform Commercial National Security Algorithm (CNSA) operations for Oracle Key Vault HSM backup and upgrade operations.
- About Commercial National Security Algorithm Suite Support
You can configure Oracle Key Vault for compliance with the Commercial National Security Algorithm (CNSA) Suite. - Running the Commercial National Security Algorithm Scripts
The Commercial National Security Algorithm (CNSA) scripts update theokv_security.conf
file. - Performing Backup and Restore Operations with CNSA
After you back up and restore Oracle Key Vault, use/usr/local/okv/bin/okv_cnsa
to use the enhanced Commercial National Security Algorithm (CNSA) Suite. - Upgrading a Standalone Oracle Key Vault Server with CNSA
You can upgrade a standalone Oracle Key Vault while using Commercial National Security Algorithm (CNSA) compliance by upgrading and then executing theokv_cnsa
script. - Upgrading Primary-Standby Oracle Key Vault Servers to Use CNSA
You can upgrade Oracle Key Vault primary-standby servers while using Commercial National Security Algorithm (CNSA) compliance by upgrading and then executing theokv_cnsa
script.
Parent topic: Oracle Key Vault General System Administration
16.6.1 About Commercial National Security Algorithm Suite Support
You can configure Oracle Key Vault for compliance with the Commercial National Security Algorithm (CNSA) Suite.
This compliance applies to TLS connections to and from the Oracle Key Vault appliance.
The CNSA suite is a list of strong encryption algorithms and key lengths, that offer greater security and relevance into the future.
Oracle Key Vault release 12.2 BP3 or later do not provide complete compliance across every component in the system. You will be able to switch to the CNSA algorithms, where available by means of the following scripts that are packaged with the Oracle Key Vault ISO:
-
/usr/local/okv/bin/okv_cnsa
makes configuration file changes to update as many components as possible to use the enhanced algorithms. -
/usr/local/okv/bin/okv_cnsa_cert
regenerates CNSA compliant public key pairs and certificates.Note:
The/usr/local/okv/bin/okv_cnsa
and/usr/local/okv/bin/okv_cnsa_cert
scripts are both disruptive because they replace the old key pairs with new ones. This has consequences for the following operations:-
Endpoint Enrollment: Enroll endpoints after running this script when possible. If you had endpoints enrolled before running the CNSA script, you must reenroll them so that fresh CNSA compliant keys are generated using CNSA algorithms.
-
Primary-Standby: Run the CNSA scripts on both Oracle Key Vault instances before pairing them in a primary-standby configuration when possible. If you had primary-standby before you run the CNSA scripts, then you must re-configure primary-standby as follows: unpair the primary and standby servers, reinstall the standby server, run the CNSA scripts individually on each server, and then pair them again.
-
Limitations:
-
CNSA compliance is not supported for all components in the Oracle Key Vault infrastructure (for example, SSH or Transparent Data Encryption (TDE)).
-
The Firefox browser is not supported for use with the Oracle Key Vault management console when CNSA is enabled. This is because the Firefox browser does not support CNSA-approved cipher suites.
Parent topic: Commercial National Security Algorithm Suite Support
16.6.2 Running the Commercial National Security Algorithm Scripts
The Commercial National Security Algorithm (CNSA) scripts update the okv_security.conf
file.
/usr/local/okv/etc/okv_security.conf
with the following line:USE_ENHANCED_ALGORITHMS_ONLY="1"
Related Topics
Parent topic: Commercial National Security Algorithm Suite Support
16.6.3 Performing Backup and Restore Operations with CNSA
After you back up and restore Oracle Key Vault, use /usr/local/okv/bin/okv_cnsa
to use the enhanced Commercial National Security Algorithm (CNSA) Suite.
Related Topics
Parent topic: Commercial National Security Algorithm Suite Support
16.6.4 Upgrading a Standalone Oracle Key Vault Server with CNSA
You can upgrade a standalone Oracle Key Vault while using Commercial National Security Algorithm (CNSA) compliance by upgrading and then executing the okv_cnsa
script.
16.6.5 Upgrading Primary-Standby Oracle Key Vault Servers to Use CNSA
You can upgrade Oracle Key Vault primary-standby servers while using Commercial National Security Algorithm (CNSA) compliance by upgrading and then executing the okv_cnsa
script.
Related Topics
Parent topic: Commercial National Security Algorithm Suite Support
16.7 Minimizing Downtime
Business-critical operations require data to be accessible and recoverable with minimum downtime.
You can configure Oracle Key Vault to ensure minimum downtime in the following ways:
-
Configuring a multi-master cluster: You can configure a multi-master cluster by adding redundancy in the form of additional nodes. The client can access any available node. In the event of a failure of any node, a client will automatically connect to another node in the endpoint node scan list. This reduces and potentially eliminates downtime.
-
Configuring a primary-standby environment: A primary-standby environment is configured by adding redundancy in the form of a standby server. The standby server takes over from the primary server in the event of a failure, thus eliminating single points of failure, and minimizing downtime.
-
Enabling read-only restricted mode: Primary-standby read-only restricted mode ensures endpoint operational continuity when primary or standby Oracle Key Vault servers are affected by server, hardware, or network failures. When an unplanned shutdown causes the standby server to become unreachable, the primary server is still available to the endpoints.
If primary-standby read-only restricted mode is disabled, then the primary server will become unavailable and stop accepting requests in the event of a standby failure. Endpoints connected to Oracle Key Vault are unable to retrieve keys until connectivity is restored between primary and standby servers.
To ensure endpoint operational continuity in the event of a primary or standby server failure, enable read-only restricted mode.
-
Enabling persistent master encryption key cache: The persistent master encryption key cache ensures that the endpoints can access keys in the event of a primary or standby server failure. While the surviving server is taking over from the failed peer, the endpoints can retrieve keys from the persistent cache and continue operations normally.
-
Apply the TDE heartbeat database patch on endpoints: Apply the database patch for Bug 22734547 to tune the Oracle Key Vault heartbeat.
Oracle strongly recommends that you back up Oracle Key Vault data regularly on a schedule. This practice ensures that backups are current and hold the most recent data. You can use this backup to restore a new or existing Oracle Key Vault server and enable it to be fully operational with minimum downtime and data loss.
If the Oracle Key Vault installation uses an online master key (formerly known as TDE direct connect), then during an upgrade, ensure that you upgrade database endpoints in parallel to reduce total downtime.
Related Topics
Parent topic: Oracle Key Vault General System Administration