Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC [ID 1340831.1]

标签：comment   clu   bug   addition   amp   pass   conf   ssl   sar   

In this Document

Applies to:

Oracle Net Services - Version 10.2.0.3 to 11.2.0.3 [Release 10.2 to 11.2]
Information in this document applies to any platform.

Goal

To demonstrate how the COST parameter "SECURE_REGISTER_listener_name = " is used to restrict instance registration with listeners in RAC environments. With COST restrictions in place only local and authorized instances having appropriate credentials will be allowed to register. These instructions can be used to address the issues published in Oracle Security Alert CVE-2012-1675 by using COST to restrict connections to only those instances having appropriate credentials.


About COST

The class of secure transports (COST) parameters specify a list of transports that are considered secure for administration and registration of a particular listener. The COST parameters identify which transports are considered secure for that installation and whether the administration of a listener requires secure transports. COST will not affect client connections utilizing other protocols. For more details and for information about other available COST parameters please see the 11.2 Network Administrators Guide and Network Reference.

Oracle versions that support COST

Although not documented in the Oracle 10g Network Administrator Guide COST parameters and functionality are supported as of 10.2.0.3.

Fix

Topics in this section:

1) Oracle 11.2 RAC - Securing registration with Scan listeners

2) Oracle 11.2 RAC - Securing ASM and Database registration with the Local (node) listener.

3) Oracle RAC versions prior to 11.2 (10.2.0.3 - 11.1)

1) Oracle RAC 11.2 - Securing registration with Scan listeners

This example environment is a two node 11.2 RAC cluster with three SCAN listeners. COST restrictions will limit registration protocols to TCPS for remote registering instances and to IPC for the local grid agent. To establish a connection over TCPS PMON and the listener must perform. a SSL handshake.

Steps:

1.1) Using orapki create a wallet with self signed certificates that will be shared among SCAN listeners and registering instances to make secure SSL connections.

If SSL is being used exclusively for instance registration then a single shared wallet with self signed certificates are all that is needed and this is the easiest setup to implement. If other SSL features are planned a unique wallet and certificate may be required for each node. Reference Oracle documentation for the SSL requirements of any additional SSL features that will be used and adjust as necessary.

a) Create an Oracle wallet: "ewallet.p12".

The target directory in this example is within the grid home but the location can be anywhere that is accessible to Oracle.

b) The new wallet will contain a number of trusted certificates that are installed by default, remove all of these well known trusted certificates from the wallet.

c) Create a self-signed certificate that will be stored in the wallet.

d) View the wallet contents to confirm that it has a single trusted and user certificate.

e) Make copies of the finished wallet (ewallet.p12) and place on each node in the same directory location; /u01/app/11.2.0.2/grid/network/admin/cost.

f) Using orapki create a unique obfuscated auto-login file "cwallet.sso" on each node. Both PMON and the listener will use the cwallet.sso to establish a secure SSL connection with each other. Once COST parameters restricting registration to TCPS are enabled only instances that have access to the wallet and obfuscated wallet (cwallet.sso) will be able to register with the SCAN listeners.

Creating the cwallet.sso file:

g) Modify the permissions of the obfuscated wallet (cwallet.sso) to allow usage by authorized group members.

Important: Store the wallet password in a safe place. The wallet cannot be re-opened without it.


1.2) Update the grid home listener.ora so that it references the wallet location and add the COST parameters that will restrict registration. Do this for each node.

Add the wallet location to listener.ora.

At this time also add the COST registration restrictions for the SCAN listeners to the listener.ora. These parameters should be commented now and will be enabled later.

The finished listener.ora should look like this:

1.3) Using srvctl modify the SCAN listeners to also include TCPS protocol endpoints, re-start the SCAN listeners.

1.4) Add the wallet location to the sqlnet.ora of each instance home. If no sqlnet.ora exists create a new file. Registering instances must know the wallet location and have access in order to make the required SSL connection with the SCAN listeners.

Restart each instance after adding the wallet location to sqlnet.ora.

1.5) Modify instance startup parameters to use TCPS protocol with remote_listener.

The existing remote_listener value uses an ezconnect string value in the form. host:port.

The replacement remote_listener value is an address_list containing the resolved scan listener IP addresses and TCPS ports. The addresses can be listed using srvctl.

Associate the three IP addresses assigned to the SCAN listeners with the TCPS port that was added in step 3, in this case port 1523.

The SCAN addresses are the same for all instances in the cluster so the remote_listener parameter value can be added from any instance home using the global option sid=‘*‘. This will update the remote_listener value for all instances.

Changing the remote_listener value is a critical stage as it forces registration over TCPS using the wallets and certificates that were created in earlier steps. It is best to stop here and verify that all instances are registering properly with the scan listeners. If not, go back and review each of the previous steps to ensure an item was not overlooked.

If registration using TCP needs to be restored for any reason it is a simple matter to revert to the previously noted ezconnect address. The following command can be performed from any instance in the cluster and will make changes globally for all instances. Do not do this unless it is your intention to revert back to TCP and not enable COST restrictions in the next step.

1.6) Enable COST parameters restricting instance registration in the grid home listener.ora.

When instance registration over TCPS with SCAN listeners is working properly the COST registration rules can be implemented. Edit the grid home listener.ora and remove the comments from the COST restriction parameters that were added in step 1.2.

Restart all listeners to load the new parameters.

With COST enabled attempts to register with SCAN listeners using a protocol other than TCPS are rejected and an event is logged in the listener log. Instances must also have the proper SSL credentials in order to connect and register their services.

2) Oracle 11.2 RAC - Securing ASM and Database registration with the Local (node) listener.

Steps:

2.1) Obtain and apply the patch for bug:12880299. The patch should be applied to both the grid and rdbms homes on each node in the cluster.

2.2) Add COST IPC and TCP protocol restrictions to the listener.ora on each node.

Edit the grid home listener.ora and add SECURE_REGISTER_LISTENER = (IPC,TCP) to the existing list of scan listener restrictions.

2.3) To activate the COST restriction use srvctl to re-start all instance/local listeners. (This action only needs to be performed on one node, all local listeners will restart.)

3) Oracle RAC versions prior to 11.2 (10.2.0.3 - 11.1)

Steps:

3.1) Using orapki create a wallet with self signed certificates that will be shared among node listeners and registering instances to make secure SSL connections.

If SSL is being used exclusively for instance registration then a single shared wallet with self signed certificates are all that is needed and this is the easiest setup to implement. If other SSL features are planned a unique wallet and certificate may be required for each node. Reference Oracle documentation for the SSL requirements of any additional SSL features that will be used and adjust as necessary.

a) Create an Oracle wallet: "ewallet.p12".

The target directory in this example is within the database home but the location can be anywhere that is accessible to Oracle.

b) Create a self-signed certificate that will be stored in the wallet.

c) The new wallet will contain a number of trusted certificates that are installed by default. You can use Oracle Wallet Manager (OWM), a java tool in $ORACLE_HOME/bin, to remove all other trusted certificates except for the self signed certificate "CN=secure_register" that was created in step 3.1-b.

Once all the additional trusted certificates have been removed the finished wallet should look like this:

d) Make copies of the finished wallet (ewallet.p12) and place on each node in the same directory location, i.e., $ORACLE_HOME/network/admin/cost

e) Using orapki create a unique obfuscated auto-login file "cwallet.sso" on each node. Both PMON and the listener will use the cwallet.sso to establish a secure SSL connection with each other. Once COST parameters restricting remote registration to TCPS are enabled only instances that have access to the wallet and obfuscated wallet (cwallet.sso) will be able to remotely register with listeners.

The wallet is now ready to use with files ewallet.p12 and cwallet.sso in $ORACLE_HOME/network/admin/cost
Important: Store the wallet password in a safe place. The wallet cannot be re-opened without it.

3.2) Obtain and apply the patch for bug:12880299 to all nodes in the cluster.

3.3) Update the listener.ora so that it references the wallet location and add the COST parameters that will restrict registration, also add a listen endpoint for TCPS that pmon will use to send registration updates. Do this on the listener.ora of each node.

The location of the listener.ora that the running listener is using can be identified with lsnrctl> status.

Before edit, the listener.ora will look similar to:

a) Add a TCPS address and endpoint to listener.ora. Use the existing node vip address and any available port for the TCPS endpoint.

b) Add the wallet location to listener.ora.

c) Add the COST registration restrictions for TCP and TCPS to the listener.ora. The parameter should be commented now but will be enabled later.

A finished listener.ora will look like this:

3.4) After the changes to the listener.ora have been made stop and restart the listener and confirm that it has the TCPS listen endpoint that was added along with the previously existing endpoints.

3.5) Add the wallet location to the sqlnet.ora of each instance home. The sqlnet.ora is read by the instance at startup. Registering instances must know the wallet location and have access in order to make the required SSL connection with remote listeners.

3.6) Modify instance startup parameters to use the new TCPS protocol addresses used by all of the node listeners. The instance uses the remote_listener parameter value to locate those addresses.

In this case the database is using the tns alias "listeners_rac" in tnsnames.ora to store the listener addresses.

Edit the listeners_rac entry in TNSNAMES.ORA that is being used by the database.

Before edit:

Comment the existing TCP addresses and add the new TCPS addresses we will be using for registration.

The next step is to restart the instance but before doing that make note of the current lsnrctl services output on one of the listeners on another node (a remote listener) so you can compare the results after the restart (they should match). Of particular interest is the remote service handler of the instance you are testing.

If the remote service handler output matches the handler output prior to the restart then TCPS connectivity and secure network registration is functional. Repeat this process until all nodes are successfully registering remotely over TCPS. If the lsnrctl services output is not correct after restart go back over the configuration steps to make sure nothing was missed. If there is a need to revert to the previous TCP configuration just remove the comment from the TCP entries in the listeners_rac tns alias, comment the TCPS entries and restart the instance.

3.6) When all instances are properly registering with remote listeners over TCPS protocol you are ready to enable COST restrictions.

Remove the comment from the cost restriction entry in each listener and restart the listener.

References

NOTE:1455068.1 - Force Connections to a Specific Database Service When two Identical Services are Registered to CMAN
NOTE:1453883.1 - Using Class of Secure Transport (COST) to Restrict Instance Registration
@ BUG:12880299 - RAC: TCP HANDLERS BLOCK IF LISTENER REGISTRATION IS RESTRICTED TO IPC W/COST
@NOTE:1457854.1 - How To Enable TCPS Support For Oracle Standard Edition
NOTE:1092753.1 - How To Configure Scan Listeners With A TCPS Port?

Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC [ID 1340831.1]

标签：comment   clu   bug   addition   amp   pass   conf   ssl   sar   

原文地址：https://www.cnblogs.com/yaoyangding/p/12971519.html