3 Getting Started with Oracle Database Vault

Accessing the Oracle Database Vault Pages from Oracle Enterprise Manager

This section contains:

• Accessing Oracle Database Vault Pages from Database Control

• Accessing Oracle Database Vault Pages from Grid Control

Starting Oracle Database Vault Administrator

If you are not using Oracle Enterprise Manager Database Control or Grid Control, or if you want to connect to Oracle Database Vault from a different computer, follow these steps to start Oracle Database Vault Administrator.

1. If necessary, register Oracle Database Vault.

   If you have just installed Oracle Database Vault, you must register it with the database. See "Registering (Enabling) Oracle Database Vault" for more information.

2. From a browser, enter the following URL:

   https://host_name:port/dva
   

   In this specification:

   • host_name: The server where you installed Oracle Database Vault

   • port: The Oracle Enterprise Manager Console HTTPS port number

   For example:

   https://myserver:1158/dva
   

   If you are unsure of the port number, open the $ORACLE_HOME/host_sid/sysman/config/emd.properties file and search for REPOSITORY_URL. In most cases, the host name and port number are the same as Oracle Enterprise Database Control.

   If you cannot start Oracle Database Vault Administrator, check that the Oracle database console process is running.

   • UNIX: Go to the $ORACLE_HOME/bin directory and run the following command:

     ./emctl status dbconsole
     

     If you must start the dbconsole process, then run the following command:

     ./emctl start dbconsole
     

   • Windows: In the Administrative Services, select the Services utility, and then right-click the OracleDBConsolesid service. If necessary, select Start from the menu to start the database console.

   Log files for the database are in the following directory:

   $ORACLE_HOME/sysman/log
   

3. Log in by using the Oracle Database Vault Owner account that you created during installation.

   To log in, you must enter the full connect string. This enables you to manage multiple Oracle Database instances with Oracle Database Vault.

   By default, you cannot log in to Oracle Database Vault Administrator by using the SYS, SYSTEM, or other administrative accounts. You can log in if you have the DV_ADMIN or DV_OWNER roles.

   Enter the following values:

   • User Name: Enter the name of a user who has been granted the appropriate Oracle Database Vault role:

     • Creating and managing Database Vault policies: DV_OWNER or DV_ADMIN

     • Viewing Database Vault reports: DV_OWNER, DV_ADMIN, or DV_SECANALYST

     • Creating and managing user accounts and roles: DV_ACCTMGR

     See "About Oracle Database Vault Roles" for more information.

   • Password: Enter your password.

   • Host: Enter the host name of the computer of the Oracle Database Vault installation you want. Use the following format:

     server.domain
     

     For example:

     myserver-pc.us.example.com
     

   • Port: Enter the port number for Oracle Database. The default port number is 1521. If you are unsure of the port number, check the tnsnames.ora file.

     For example:

     1521
     

   • SID/Service: Select either SID or Service. You can find these values in the tnsnames.ora file. By default, this file is located in $ORACLE_HOME/network/admin.

     • SID: Enter the name of the Oracle Database instance. For example:

       orcl
       

     • Service: Enter the service name of the database instance, in the following format:

       service_name.domain
       

       For example:

       orcl.us.example.com
       

Figure 3-1 shows the Oracle Database Vault Administrator home page, which appears after you log in.

Figure 3-1 Oracle Database Vault Administrator Home Page

Description of "Figure 3-1 Oracle Database Vault Administrator Home Page"

About This Tutorial

In this tutorial, you create a simple security configuration for the HR sample database schema. In the HR schema, the EMPLOYEES table has information such as salaries that should be hidden from most employees in the company, including those with administrative access. To accomplish this, you add the HR schema to the secured objects of the protection zone, which in Oracle Database Vault is called a realm, inside the database. Then you grant limited authorizations to this realm. Afterward, you test the realm to make sure it has been properly secured. And finally, to see how Oracle Database Vault provides an audit trail on suspicious activities like the one you will try when you test the realm, you will run a report.

Before you can use this tutorial, ensure that the HR sample schema is installed. See Oracle Database Sample Schemas for information on installing the sample schemas.

Step 1: Adding the SYSTEM User to the Data Dictionary Realm

In this tutorial, the SYSTEM user grants the ANY privilege to a new user account, SEBASTIAN. To do this, you must include SYSTEM in the Oracle Data Dictionary realm.

To include SYSTEM in the Oracle Data Dictionary realm:

1. Log in to Oracle Database Vault Administrator as a user who has been granted the DV_OWNER or DV_ADMIN role.

   "Starting Oracle Database Vault" explains how to log in.

2. In the Administration page, under Database Vault Feature Administration, click Realms.

3. In the Realms page, select Oracle Data Dictionary from the list and then click Edit.

4. In the Edit Realm: Oracle Data Dictionary page, under Realm Authorizations, click Create.

5. In the Create Realm Authorization Page, from the Grantee list, select SYSTEM [USER].

6. For Authorization Type, select Owner.

7. Leave Authorization Rule Set at <Non Selected>.

8. Click OK.

   In the Edit Realm: Oracle Data Dictionary page, SYSTEM should be listed as an owner under the Realm Authorizations.

9. Click OK to return to the Realms page.

10. To return to the Administration page, click the Database Instance instance_name link over Realms.

Step 2: Log On as SYSTEM to Access the HR Schema

Log in to SQL*Plus as user SYSTEM and access the HR schema.

sqlplus system
Enter password: password

SELECT FIRST_NAME, LAST_NAME, SALARY FROM HR.EMPLOYEES WHERE ROWNUM < 10;

Output similar to the following appears:

FIRST_NAME           LAST_NAME                     SALARY
-------------------- ------------------------- ----------
Donald               OConnell                        2600
Douglas              Grant                           2600
Jennifer             Whalen                          4400
Michael              Hartstein                      13000
Pat                  Fay                             6000
Susan                Mavris                          6500
Hermann              Baer                           10000
Shelley              Higgins                        12000
William              Gietz                           8300
 
9 rows selected.

If the HR schema is locked and expired, log in to SQL*Plus as the DV_ACCTMGR user and unlock and unexpire the account. For example:

sqlplus amalcolm_dvacctmgr
Enter password: password

ALTER USER HR ACCOUNT UNLOCK IDENTIFIED BY password

Replace password with a password that is secure. See Oracle Database Security Guide for the minimum requirements for creating passwords.

As you can see, SYSTEM has access to the salary information in the EMPLOYEES table of the HR schema. This is because SYSTEM is automatically granted the DBA role, which includes the SELECT ANY TABLE system privilege.

Step 3: Create a Realm

Realms can protect one or more schemas, individual schema objects, and database roles. Once you create a realm, you can create security restrictions that apply to the schemas and their schema objects within the realm. Your first step is to create a realm for the HR schema.

1. In the Realms page of Oracle Database Vault Administrator, click Create.

2. In the Create Realm page, under General, enter HR Realm after Name.

3. After Status, ensure that Enabled is selected so that the realm can be used.

4. Under Audit Options, ensure that Audit On Failure is selected so that you can create an audit trial later on.

5. Click OK.

   The Realms Summary page appears, with HR Realm in the list of realms.

Step 4: Secure the EMPLOYEES Table in the HR Schema

At this stage, you are ready to add the EMPLOYEES table in the HR schema to the secured objects of the HR realm.

1. In the Realms page, select HR Realm from the list and then click Edit.

2. In the Edit Realm: HR Realm page, scroll to Realm Secured Objects and then click Create.

3. In the Create Realm Secured Object page, enter the following settings:

   • Object Owner: Select HR from the list.

   • Object Type: Select TABLE from the list

   • Object Name: Enter EMPLOYEES.

4. Click OK.

5. In the Edit Realm: HR Realm page, click OK.

Step 5: Create an Authorization for the Realm

At this stage, there are no database accounts or roles authorized to access or otherwise manipulate the database objects the realm will protect. So, the next step is to authorize database accounts or database roles so that they can have access to the schemas within the realm. You will create the SEBASTIAN user account. After you authorize him for the realm, SEBASTIAN can view and modify the EMPLOYEES table.

1. In SQL*Plus, connect as the Database Vault Account Manager, who has the DV_ACCTMGR role, and create user SEBASTIAN.

   For example:

   CONNECT amalcolm_dvacctmgr
   Enter password: password
   
   CREATE USER SEBASTIAN IDENTIFIED BY password;
   

   Replace password with a password that is secure. See Oracle Database Security Guide for the minimum requirements for creating passwords.

2. Connect as SYSTEM privilege, and then grant SEBASTIAN the following additional privileges.

   CONNECT SYSTEM
   Enter password: password
   
   GRANT CREATE SESSION, SELECT ANY TABLE TO SEBASTIAN;
   

Do not exit SQL*Plus; you will need it for Step 6: Test the Realm, when you test the realm.

At this stage, even though SEBASTIAN has the SELECT ANY TABLE privilege, he cannot select from the HR.EMPLOYEES table because it is protected by a realm.

Next, authorize user SEBASTIAN to have access to the HR Realm as follows:

1. In the Realms page of Database Vault Administrator, select the HR Realm in the list of realms, and then click Edit.

2. In the Edit Realm: HR Realm page, scroll down to Realm Authorizations and then click Create.

3. In the Create Realm Authorization page, under Grantee, select SEBASTIAN[USER] from the list.

   If SEBASTIAN does not appear in the list, select the Refresh button in your browser.

   SEBASTIAN is the only user who has access to the EMPLOYEES table in the HR schema.

4. Under Authorization Type, select Participant.

   The Participant authorization allows the user SEBASTIAN in the HR realm to manage access, manipulate, and create objects protected by the HR realm. In this case, the HR user and SEBASTIAN are the only users allowed to view the EMPLOYEES table.

5. Under Authorization Rule Set, select <Not Assigned>, because rule sets are not needed to govern this realm.

6. Click OK.

Step 6: Test the Realm

To test the realm, try accessing the EMPLOYEES table as a user other than HR. The SYSTEM account normally has access to all objects in the HR schema, but now that you have safeguarded the EMPLOYEES table with Oracle Database Vault, this is no longer the case.

In SQL*Plus, connect as SYSTEM, and then try accessing the salary information in the EMPLOYEES table again:

sqlplus system
Enter password: password

SELECT FIRST_NAME, LAST_NAME, SALARY FROM HR.EMPLOYEES WHERE ROWNUM <10;

The following output should appear:

Error at line 1:
ORA-01031: insufficient privileges

SYSTEM no longer has access to the salary information in the EMPLOYEES table. However, user SEBASTIAN does have access to this information. Try the following:

CONNECT SEBASTIAN
Enter password: password

SELECT FIRST_NAME, LAST_NAME, SALARY FROM HR.EMPLOYEES WHERE ROWNUM <10;

Output similar to the following appears:

FIRST_NAME           LAST_NAME                     SALARY
-------------------- ------------------------- ----------
Donald               OConnell                        2600
Douglas              Grant                           2600
Jennifer             Whalen                          4400
Michael              Hartstein                      13000
Pat                  Fay                             6000
Susan                Mavris                          6500
Hermann              Baer                           10000
Shelley              Higgins                        12000
William              Gietz                           8300
 
9 rows selected.

Step 7: Run a Report

Because you enabled auditing on failure for the HR Realm, you can generate a report to find any security violations such as the one you attempted in Step 6: Test the Realm.

1. In the Oracle Database Vault Administrator home page, click Database Vault Reports.

   Before you can run the report, you must log in using an account that has the DV_OWNER, DV_ADMIN, or DV_SECANALYST role. Note that user SEBASTIAN cannot run the report, even if it affects his own realm. "Oracle Database Vault Roles" describes these roles in detail. Currently, you should be logged in as the Database Vault Owner (DV_OWNER) account.

2. In the Database Vault Reports page, scroll down to Database Vault Auditing Reports and select Realm Audit.

3. Click Run Report.

Oracle Database Vault generates a report listing the type of violation (in this case, the SELECT statement entered in the previous section), when and where it occurred, the login account who tried the violation, and what the violation was.

Step 8: Remove the Components for This Tutorial

1. Remove the SYSTEM account from the Data Dictionary Realm.

   1. Ensure that you are logged on to Oracle Database Vault Administrator using a database account that has been granted the DV_OWNER role.

   2. From the Administration page, select Realms.

   3. From the list of realms, select Oracle Data Dictionary, and then click Edit.

   4. Under Realm Authorizations, select SYSTEM.

   5. Click Remove, and in the Confirmation window, click Yes.

2. Delete the HR Realm.

   1. In the Realms page, select HR Realm from the list of realms.

   2. Click Remove, and in the Confirmation window, click Yes.

3. Drop user SEBASTIAN.

   In SQL*Plus, log on as the Oracle Database Vault account manager (for example, amalcolm_dvacctmgr) you created when you installed Oracle Database Vault, and then drop SEBASTIAN as follows:

   sqlplus amalcolm_dvacctmgr
   Enter password: password
   
   DROP USER SEBASTIAN;
   

4. If necessary, lock and expire the HR account.

   ALTER USER HR ACCOUNT LOCK PASSWORD EXPIRE;