C Postinstallation Oracle Database Vault Procedures

Registering (Enabling) Oracle Database Vault

After you install Oracle Database, you must register (that is, enable) Oracle Database Vault. Oracle Database includes Database Vault by default, but you must register it before you can use it. As part of the registration process, you create the Database Vault administrative accounts. The registration process also creates the Database Vault DVSYS and DVF schemas. This procedure applies to both single-instance and Oracle RAC installations. To check if Database Vault has already been enabled, see "Checking if Oracle Database Vault Is Enabled or Disabled".

1. Ensure that the computer on which you want to register Oracle Database Vault has the Oracle Enterprise Manager Database Console available.

   You can check the status of the Database Console by running the emctl status dbconsole command. For example:

   ./emctl status dbconsole
   

2. Stop the database, Database Control console process, and listener.

   • UNIX: Log in to SQL*Plus as user SYS with the SYSOPER privilege and shut down the database. Then from the command line, stop the Database Console process and listener.

     For example:

     sqlplus sys as sysoper
     Enter password: password
     
     SQL> SHUTDOWN IMMEDIATE
     SQL> EXIT
     
     $ emctl stop dbconsole
     $ lsnrctl stop [listener_name]
     

     For Oracle RAC installations, shut down each database instance as follows:

     $ srvctl stop database -d db_name
     

   • Windows: Stop the database, Database Control console process, and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.

3. Enable Oracle Database Vault as follows:

   • UNIX: Run the following commands. The make command enables both Oracle Database Vault (dv_on) and Oracle Label Security (lbac_on). You must enable Oracle Label Security before you can use Database Vault.

     $ cd $ORACLE_HOME/rdbms/lib
     $ make -f ins_rdbms.mk dv_on lbac_on ioracle
     

   • Windows: In the ORACLE_BASE\ORACLE_HOME\bin directory, rename the oradvll.dll.dbl file to oradvll.dll. Ensure that the name of the Oracle Label Security executable is oralbacll.dll (and not oralbacll.dll.dbl or some other backup name). You must enable Oracle Label Security before you can use Database Vault.

4. Restart the database and listener. (Do not restart the Database Control console process yet.)

   • UNIX: Log in to SQL*Plus as user SYS with the SYSOPER privilege and restart the database. Then from the command line, restart the listener.

     For example:

     sqlplus sys as sysoper
     Enter password: password
     
     SQL> STARTUP
     SQL> EXIT
     
     $ lsnrctl start [listener_name]
     

     For Oracle RAC installations, restart each database instance as follows:

     $ srvctl start database -d db_name
     

   • Windows: Restart the database and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.

5. Start Database Configuration Assistant.

   • UNIX: Enter the following command at a terminal window:

     dbca
     

     By default, dbca is in the $ORACLE_HOME/bin directory.

   • Windows: From the Start menu, click All Programs. Then, click Oracle - ORACLE_HOME, Configuration and Migration Tools, and then Database Configuration Assistant.

     Alternatively, you can start Database Configuration Assistant at a command prompt:

     dbca
     

     As with UNIX, typically, dbca is in the ORACLE_BASE\ORACLE_HOME\bin directory.

6. In the Welcome page, click Next.

   The Operations page appears.

7. Select Configure Database Options, and then click Next.

   The Database page appears.

8. From the list, select the database where you installed Oracle Database and then click Next.

   The Database Content page appears.

9. Perform one of the following actions:

   • If Oracle Label Security is already enabled: Select the Oracle Database Vault option, and then click Next.

   • If Oracle Label Security is not enabled: Select the Oracle Label Security option so that the Oracle Database Vault option becomes available for selection. Select the Oracle Database Vault option as well, and then click Next.

   The Oracle Database Vault Credentials page appears.

10. Specify the name and password for the Database Vault Owner account (for example, DBVOWNER) and the Database Vault Account Manager (for example, DBVACCTMGR).

    Enter any password that is secure, according to the password guidelines described in Oracle Database Security Guide. Oracle Database Vault has additional password requirements, which are displayed if you try to create an incorrect password.

11. Click Next.

    The Connection Mode page appears.

12. Select either Dedicated Server Mode or Shared Server Mode (depending on the selection you made when you created this database), click Finish, and then click OK in the confirmation prompts.

    Database Configuration Assistant registers Oracle Database Vault, and then restarts the database instance.

13. Exit Database Configuration Assistant.

14. Restart the Database Control console process.

    • UNIX: Run the following command:

      $ emctl start dbconsole
      

    • Windows: Restart the Database Control console process (for example, OracleDBConsoleorcl if the name of the database is orcl) from the Services tool in the Control Panel.

After you have registered Oracle Database Vault with an Oracle database, you can start Oracle Database Vault Administrator. See "Starting Oracle Database Vault" for more information.

Checking the Locale and NLS Settings

Ensure that the value of the NLS_LANGUAGE initialization parameter matches the locale and NLS settings (either the NLS_LANG or LANG environment variables) used by the operating system of the computer on which Oracle Database is installed. If these values are inconsistent, then Database Vault Administrator does not display the default realms, command rules, rule sets, or factors.

For example, if the operating system locale (the variable $LANG) setting is en_US.UTF-8, then you must set the corresponding NLS_LANG environment variable to AMERICAN_AMERICA.AL32UTF8 and the database NLS_LANGUAGE initialization parameter value to be AMERICAN. The database NLS_LANGUAGE parameter is derived from the operating system NLS_LANG environment variable.

For more information about checking and configuring locale and NLS settings, see the appendix that covers globalization support in the Oracle Database Installation Guide for your platform.

Manually Deploying Oracle Database Vault Administrator

If you have created an Oracle database manually, and have configured Oracle Enterprise Manager Database Control by using Enterprise Manager Configuration Assistant, you must manually deploy Oracle Database Vault Administrator. This procedure deploys Database Vault Administrator in the same OC4J container as the current Enterprise Manager, rather than creating a new application.

This section contains:

• Deploying Database Vault Administrator to a Standalone OC4J Container

• Deploying Database Vault Administrator to the Database Console OC4J Container

http://hostname:8888/dva

https://hostname:port/dva

https://myserver:1158/dva

Setting the Time-Out Value for Oracle Database Vault Administrator

By default, an Oracle Database Vault session lasts 35 minutes. If you want the session to last for a different time, follow the steps in this section.

To set the session time for Oracle Database Vault Administrator:

1. Back up the web.xml file, which by default is in the $ORACLE_HOME/dv/jlib/dva_webapp/dva_webapp/WEB-INF directory.

2. In a text editor, open the web.xml file.

3. Search for the following setting:

   <session-config>
    <session-timeout>35</session-timeout>
   </session-config>
   

4. Change the <session-timeout> setting to the amount of time in minutes that you prefer.

5. Save and close the web.xml file.

6. Stop and restart the Database Vault Administrator.

   • UNIX: Go to the $ORACLE_HOME/bin directory and run the following command:

     ./emctl stop dbconsole
     ./emctl start dbconsole
     

   • Windows: In the Administrative Services, select the Services utility, and then right-click the OracleDBConsolesid service. Select Stop from the menu. After the console stops, select Start.

Enabling Oracle Database Vault Administrator Accessibility

You can configure Database Vault Administrator to make data accessible and usable to the disabled community. The following sections explain how to enable Database Vault Administrator for full accessibility.

• Enabling Oracle Database Vault Administrator Accessibility Mode

• Providing Textual Descriptions of Database Vault Administrator Charts

Configuring Oracle Database Vault on Oracle RAC Nodes

After you install Oracle Database Vault for an Oracle Real Application Clusters (Oracle RAC) instance, complete the following procedure for each Oracle RAC node. This procedure assumes that you have a separate Oracle home for each node.

1. Log in to SQL*Plus as user SYS with the SYSDBA privilege.

   sqlplus sys as sysdba
   Enter password: password
   

2. Run the following ALTER SYSTEM statements:

   ALTER SYSTEM SET AUDIT_SYS_OPERATIONS=TRUE SCOPE=SPFILE;
   ALTER SYSTEM SET OS_ROLES=FALSE SCOPE=SPFILE; 
   ALTER SYSTEM SET RECYCLEBIN='OFF' SCOPE=SPFILE; 
   ALTER SYSTEM SET REMOTE_LOGIN_PASSWORDFILE='EXCLUSIVE' SCOPE=SPFILE;
   ALTER SYSTEM SET SQL92_SECURITY=TRUE SCOPE=SPFILE; 
   

3. Restart Oracle Database.

   CONNECT SYS/AS SYSOPER
   Enter password: password
   
   SHUTDOWN IMMEDIATE
   STARTUP
   

Adding Languages to Oracle Database Vault

By default, Oracle Database Vault loads only the English language tables. You can add more languages by running the DVSYS.DBMS_MACADM.ADD_NLS_DATA procedure for each new language that you want to add. You can add more than one language to Database Vault.

To add a new language to Oracle Database Vault:

1. Log into SQL*Plus as a user who has been granted the DV_OWNER or DV_ADMIN role.

2. Run the following procedure:

   EXEC DVSYS.DBMS_MACADM.ADD_NLS_DATA('language');
   

   You can specify the language setting using any case. For example:

   EXEC DVSYS.DBMS_MACADM.ADD_NLS_DATA('french');
   
   EXEC DVSYS.DBMS_MACADM.ADD_NLS_DATA('JAPANESE');
   

   Replace language with one of the following supported languages:

   • ENGLISH

   • GERMAN

   • SPANISH

   • FRENCH

   • ITALIAN

   • JAPANESE

   • KOREAN

   • BRAZILIAN PORTUGUESE

   • SIMPLIFIED CHINESE

   • TRADITIONAL CHINESE

Deinstalling Oracle Database Vault

The following procedure removes Oracle Database Vault from an Oracle Database installation. It applies to both single-instance and Oracle RAC installations. The deinstallation process does not affect the initialization parameter settings, even those settings that were modified during the installation process.

To deinstall Oracle Database Vault:

1. Stop the database, Database Control console process, and listener.

   For example:

   sqlplus sys as sysoper
   Enter password: password
   Connected.
   
   SQL> SHUTDOWN IMMEDIATE
   SQL> EXIT
   
   $ emctl stop dbconsole
   $ lsnrctl stop [listener_name]
   

   For Oracle RAC installations, shut down each database instance as follows:

   $ srvctl stop database -d db_name
   

   On Windows, you can stop the database, Database Control console process, and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.

2. Run the following commands to turn off Oracle Database Vault and Oracle Label Security:

   $ cd $ORACLE_HOME/rdbms/lib
   $ make -f ins_rdbms.mk dv_off lbac_off ioracle
   

3. Log in to SQL*Plus and then restart the database, Database Control console process, and listener.

   For example:

   SQL> STARTUP
   SQL> EXIT
   
   $ emctl stop dbconsole
   $ lsnrctl start [listener_name]
   

   For each instance in an Oracle RAC installation:

   $ srvctl start database -d db_name
   

   On Windows, you can restart the database, Database Control console process, and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.

4. In SQL*Plus, log in as user SYS with the SYSDBA privilege.

5. Disable the recycle bin.

   To check if the recycle bin is enabled, enter the following command:

   SQL> SHOW PARAMETER RECYCLEBIN
   

   If the recycle bin is enabled, then disable it as follows:

   SQL> ALTER SYSTEM SET RECYCLEBIN = OFF SCOPE=SPFILE;
   SQL> SHUTDOWN IMMEDIATE
   SQL> STARTUP
   

   Disabling the recycle bin does not purge or otherwise affect objects that are already in the recycle bin. For better security, keep the recycle bin disabled. See "Security Considerations for the Recycle Bin".

6. Run the following SQL script:

   SQL> @$ORACLE_HOME/rdbms/admin/dvremov.sql
   

7. Manually drop the DV_OWNER and DV_ACCTMGR user accounts and the DV_REALM_RESOURCE and DV_REALM_OWNER roles.

   SQL> DROP DBV_OWNER CASCADE;
   SQL> DROP DBV_ACCTMGR CASCADE;
   SQL> DROP DV_REALM_RESOURCE;
   SQL> DROP DV_REALM_OWNER;
   

8. Enable Oracle Label Security.

   $ cd $ORACLE_HOME/rdbms/lib
   $ make -f ins_rdbms.mk lbac_on ioracle
   

Afterward, you can double-check that Oracle Database Vault is truly deinstalled by logging in to SQL*Plus and entering the following statement:

SQL> SELECT * FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';

If Oracle Database Vault is deinstalled, the following output appears:

PARAMETER                     VALUE
----------------------------- -----------------------
Oracle Database Vault         FALSE

Reinstalling Oracle Database Vault

To reinstall Oracle Database Vault, follow the procedure under "Registering (Enabling) Oracle Database Vault".