Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Oracle 11g Anti-hacker's Cookbook
  • Table Of Contents Toc
Oracle 11g Anti-hacker's Cookbook

Oracle 11g Anti-hacker's Cookbook

By : Adrian Neagu
5 (5)
Buy this Book
close
close
Oracle 11g Anti-hacker's Cookbook

Oracle 11g Anti-hacker's Cookbook

5 (5)
By: Adrian Neagu
Buy this Book

Overview of this book

For almost all organizations, data security is a matter of prestige and credibility. The Oracle Database is one of the most rich in features and probably the most used Database in a variety of industries where security is essential. To ensure security of data both in transit and on the disk, Oracle has implemented the security technologies to achieve a reliable and solid system. In Oracle 11g Anti-Hacker's Cookbook, you will learn about the most important solutions that can be used for better database security."Oracle 11g Anti-hacker's Cookbook" covers all the important security measures and includes various tips and tricks to protect your Oracle Database."Oracle 11g Anti-hacker's Cookbook" uses real-world scenarios to show you how to secure the Oracle Database server from different perspectives and against different attack scenarios. Almost every chapter has a possible threads section, which describes the major dangers that can be confronted. The initial chapters cover how to defend the operating system, the network, the data and the users. The defense scenarios are linked and designed to prevent these attacks. The later chapters cover Oracle Vault, Oracle VPD, Oracle Labels, and Oracle Audit. Finally, in the Appendices, the book demonstrates how to perform a security assessment against the operating system and the database, and how to use a DAM tool for monitoring.
Table of Contents (16 chapters)
close
close
close
Oracle 11g Anti-hacker's Cookbook
Icon
Oracle 11g Anti-hacker's Cookbook
Credits
Icon
Credits
Foreword
Icon
Foreword
About the Author
Icon
About the Author
About the Reviewers
Icon
About the Reviewers
www.PacktPub.com
Icon
www.PacktPub.com
Preface
Icon
Preface
Lock Free Chapter
1
Operating System Security
chevron up
Icon
Operating System Security
Icon
Introduction
Icon
Using Tripwire for file integrity checking
Icon
Using immutable files to prevent modifications
Icon
Closing vulnerable network ports and services
Icon
Using network security kernel tunables to protect your system
Icon
Using TCP wrappers to allow and deny remote connections
Icon
Enforcing the use of strong passwords and restricting the use of previous passwords
Icon
Restricting direct login and su access
Icon
Securing SSH login
2
Securing the Network and Data in Transit
Icon
Securing the Network and Data in Transit
Icon
Introduction
Icon
Hijacking an Oracle connection
Icon
Using OAS network encryption for securing data in motion
Icon
Using OAS data integrity for securing data in motion
Icon
Using OAS SSL network encryption for securing data in motion
Icon
Encrypting network communication using IPSEC
Icon
Encrypting network communication with stunnel
Icon
Encrypting network communication using SSH tunneling
Icon
Restricting the fly listener administration using the ADMIN_RESTRICTION_LISTENER parameter
Icon
Securing external program execution (EXTPROC)
Icon
Controlling client connections using the TCP.VALIDNODE_CHECKING listener parameter
3
Securing Data at Rest
Icon
Securing Data at Rest
Icon
Introduction
Icon
Using block device encryption
Icon
Using filesystem encryption with eCryptfs
Icon
Using DBMS_CRYPTO for column encryption
Icon
Using Transparent Data Encryption for column encryption
Icon
Using TDE for tablespace encryption
Icon
Using encryption with data pump
Icon
Using encryption with RMAN
4
Authentication and User Security
Icon
Authentication and User Security
Icon
Introduction
Icon
Performing a security evaluation using Oracle Enterprise Manager
Icon
Using an offline Oracle password cracker
Icon
Using user profiles to enforce password policies
Icon
Using secure application roles
Icon
How to perform authentication using external password stores
Icon
Using SSL authentication
5
Beyond Privileges: Oracle Virtual Private Database
Icon
Beyond Privileges: Oracle Virtual Private Database
Icon
Introduction
Icon
Using session-based application contexts
Icon
Implementing row-level access policies
Icon
Using Oracle Enterprise Manager for managing VPD
Icon
Implementing column-level access policies
Icon
Implementing VPD grouped policies
Icon
Granting exemptions from VPD policies
6
Beyond Privileges: Oracle Label Security
Icon
Beyond Privileges: Oracle Label Security
Icon
Introduction
Icon
Creating and using label components
Icon
Defining and using compartments and groups
Icon
Using label policy privileges
Icon
Using trusted stored units
7
Beyond Privileges: Oracle Database Vault
Icon
Beyond Privileges: Oracle Database Vault
Icon
Introduction
Icon
Creating and using Oracle Database Vault realms
Icon
Creating and using Oracle Vault command rules
Icon
Creating and using Oracle Database Vault rulesets
Icon
Creating and using Oracle Database Vault factors
Icon
Creating and using Oracle Database Vault reports
8
Tracking and Analysis: Database Auditing
Icon
Tracking and Analysis: Database Auditing
Icon
Introduction
Icon
Determining how and where to generate audit information
Icon
Auditing sessions
Icon
Auditing statements
Icon
Auditing objects
Icon
Auditing privileges
Icon
Implementing fine-grained auditing
Icon
Integrating Oracle audit with SYSLOG
Icon
Auditing sys administrative users
1
Index
Icon
Index

Using immutable files to prevent modifications

It is a very powerful method to set files as not modifiable even by the root user. Usually configuration files, binaries, and libraries, which are static in nature, are good candidates to set as immutable.

Getting ready

All steps will be performed on nodeorcl1 as root.

How to do it...

Before you change the file attribute to immutable, be absolutely sure that these files are static and may not cause outages.

  1. For example, to prevent any modification to the Oracle listener configuration file listener.ora, modify it as immutable by executing the following command:

    [root@nodeorcl1 kit]# chattr -V +i /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
Flags of /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora set as ----i--------

  2. Now the file cannot be modified even by the root user:

    [root@nodeorcl1 kit]# echo "" >> /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora 
bash: /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora: Permission denied

  3. At this step, we will set a library as immutable. For example, to protect against disabling the Oracle Database Vault option, turn $ORACLE_HOME/rdbms/lib/libknlopt.a immutable:

    chattr -V +i /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a
chattr 1.39 (29-May-2006)
Flags of /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a set as ----i--------

  4. If we try to disable the Oracle Database Vault option, we will receive an Operation not permitted message:

    [oracle@nodeorcl1 lib]$ make -f $ORACLE_HOME/rdbms/lib/ins_rdbms.mk dv_off
/usr/bin/ar d /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a kzvidv.o
/usr/bin/ar: unable to rename '/u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a' reason: Operation not permitted
make: *** [dv_off] Error 1
[oracle@nodeorcl1 lib]$

  5. To check if a file is immutable we can use the lattr command:

    [root@nodeorcl1 kit]# lsattr /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
----i-------- /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
[root@nodeorcl1 kit]#

  6. To disable the immutable flag from listener.ora, execute the following command:

    [root@nodeorcl1 kit]# chattr -V -i /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
chattr 1.39 (29-May-2006)
Flags of /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora set as -------------

  7. The lsattr command can be used to check if the immutable flag is on or off:

    [root@nodeorcl1 kit]# lsattr /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
------------- /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
[root@nodeorcl1 kit]#

How it works...

The immutable flag can be set with the chattr command using the +i switch. To disable the immutable flag use –i. The –V switch translates to verbose mode. More about the chattr command can be found in the man pages.

There's more...

In this section we will see how we can use lcap to prevent the root user from changing the immutable attribute. The kernel capabilities modified with lcap will stay disabled until the system is rebooted.

The lcap utility can disable some specific kernel capabilities.

  1. Download and install lcap:

    [root@nodeorcl1 kit]# rpm -Uhv lcap-0.0.6-6.2.el5.rf.x86_64.rpm 
warning: lcap-0.0.6-6.2.el5.rf.x86_64.rpm: Header V3 DSA signature: NOKEY, key ID 6b8d79e6
Preparing...                ########################################### [100%]
   1:lcap                   ########################################### [100%]
[root@nodeorcl1 kit]#

  2. Disable the possibility to disable or enable immutability for files:

    [root@nodeorcl1 kit]# lcap CAP_LINUX_IMMUTABLE
[root@nodeorcl1 kit]# chattr -V -i /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a
chattr 1.39 (29-May-2006)
Flags of /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a set as -------------
chattr: Operation not permitted while setting flags on /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a
CONTINUE READING
83
Tech Concepts
36
Programming languages
73
Tech Tools
Icon Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.
Icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Icon 50+ new titles added per month and exclusive early access to books as they are being written.
Oracle 11g Anti-hacker's Cookbook
End of Section 1
Next Section
notes
bookmark Notes and Bookmarks search Search in title playlist Add to playlist font-size Font size

Change the font size

margin-width Margin width

Change margin width

day-mode Day/Sepia/Night Modes

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY

Submit Your Feedback

Modal Close icon
Modal Close icon
Modal Close icon