Oracle Advanced Networking Option Administrator's Guide
Release 8.0.3
A54084_01

Library
Product
Contents
Index

Prev Next

5
Configuring Oracle for Use with the SecurID Adapter

This chapter describes how to configure and use the SecurID authentication adapter with the Oracle server and clients. It assumes that you are familiar with the Security Dynamics ACE/Server and that the ACE/Server is installed and running. Refer to the "Preface" for a list of related publications to read.

The following topics are discussed:

5.1 System Requirements

To use the SecurID authentication adapter included in the Oracle Advanced Networking Option release 8.0.3, you need the following:

5.2 Known Limitations

The SecurID authentication adapter does not support database links, also known as "proxy authentication." This is a direct consequence of the fact that the SecurID card codes can only be used once.

When using the SecurID authentication adapter, password encryption is disabled. This means that the SecurID card code (and, if you use standard cards, the PIN), are sent over to the Oracle server in clear text. This could be a security problem, so Oracle recommends that you turn on the Oracle Advanced Networking Option datastream encryption, which ensures that the PIN is encrypted when sent to the Oracle server. For information on how to use datastream encryption, see Chapter 2, "Configuring Encryption and Checksumming".

5.3 Steps to Perform to Enable SecurID Authentication

This section contains information on the following tasks:

5.3.1 Register Oracle as a SecurID Client (ACE/Server Release 1.2.4)

Register the machine on which the Oracle Server resides as a SecurID client with the ACE server. You can do this with the Security Dynamics tool sdadmin. From the Client menu, choose Create Client (ACE/Server 1.2.4) or Add Client (ACE/Server 2.0), to create a client.

Refer to the Security Dynamics ACE/Server Instruction manual, version 1.2.4, or to the Security Dynamics ACE/Server version 2.0 Administration manual for more detailed information.

5.3.2 Ensure that Oracle Can Find the Correct UDP Port (ACE/Server Release 1.2.4)

First verify that the ACE/Server, the Oracle server, and the Oracle Advanced Networking Option are installed.

Make sure that the Oracle server can discover what the correct UDP port for contacting the ACE/Server is. These port numbers are typically stored in a file called services. On the UNIX operating system, this file is typically in the /etc directory. If you are using NIS (Network Information Services) as a naming service, make sure that the services map contains the correct entries for SecurID.

Note:

You can verify which port the ACE server is using by running the Security Dynamics tool Kitconts (for ACE/Server 1.2.4) or sdinfo (for ACE/Server 2.0).  

5.3.3 Install the Oracle Advanced Networking Option on the Oracle Server and Client

Install the Oracle Advanced Networking Option on the Oracle server and Oracle client using the Oracle Installer.

5.3.4 Configure Oracle as a SecurID Client (for ACE/Server Release 1.2.4)

5.3.4.1 Install the SecurID configuration files on the Oracle server machine.

You can obtain the SecurID configuration files from any other SecurID client or from the machine that runs the ACE/Server.

Note:

The information in the following sections is UNIX-specific.  

These files are typically stored in /var/ace. On the Oracle server machine, create this directory and copy the configuration files to it. At the minimum, you need the file sdconf.rec. The configuration files are used by both Oracle and the standard SecurID tools. Because the SecurID tools run setuid root, there can be a problem with the access permissions on the directory /var/ace and the files in this directory. Make sure that the owner of the Oracle executable (for example, the user "oracle8") is able to read all the files in /var/ace and can create new files in this directory.

Attention:

Do not attempt to overcome this by running Oracle setuid root. It is not necessary, and it is dangerous to do so.  

There are two ways to reach this goal without compromising security. Both ways work, but it is recommended that you use method #1. Both methods allow you to use Oracle with the SecurID authentication adapter and still continue using the other SecurID tools.

Method #1

The owner of the Oracle executable should also own the /var/ace directory and the files in /var/ace. For example, if the owner of the Oracle executable is the user "oracle8," perform the following steps, as root: 

# chown oracle8 /var/ace
# chmod 0770 /var/ace
# chown oracle8 /var/ace/*
# chmod 0660 /var/ace/*

Method #2

The other option is to have root own the /var/ace directory and the files in /var/ace, but give the Oracle group read and write access. If the Oracle group is "dba", you need to perform the following steps, as root: 

# chown root /var/ace
# chmod 0770 /var/ace
# chgrp dba /var/ace
# chown root /var/ace/*
# chmod 0660 /var/ace/*
# chgrp dba /var/ace/*

5.3.5 Configure Oracle as a SecurID Client (Release ACE/Server 2.0)

The Oracle process will act as an ACE server client. For this reason, you need to install the ACE client software on the Oracle server machine. For information on how to install an ACE client, refer to the ACE/Server Version 2.0 Client for UNIX manual.

Note the following:

Whether Oracle can read the configuration data depends on how you installed the ACE client software on the Oracle server. During the installation of the ACE client software, you can specify which administrator should own the configuration files.

Attention:

Whether you use Method 1 or Method 2, below, make sure that you do not install Oracle as root.  

5.3.5.1 Method #1

If root is the owner of the ACE server configuration data files, you will have to change the UNIX file permissions so that the owner of the oracle executable can read and write to these files. For example, the following commands give Oracle access to the files, and all the Security Dynamics tools that run as setuid root will still be able to access the files. 

# chown oracle8 /var/ace 
# chown oracle8 /var/ace/*
# chmod 0770 /var/ace
# chmod 0660 /var/ace/*

If the environment variable VAR_ACE is set to a different location than /var/ace, you should instead execute the following commands: 

# ln -s $VAR_ACE /var/ace
# chown oracle8 $VAR_ACE
# chown oracle8 $VAR_ACE/*
# chmod 0770 $VAR_ACE
# chmod 0660 $VAR_ACE/*

5.3.5.2 Method #2

If the ACE files are not owned by root, you have two options:

For the change to take effect, do the following:

  1. Log out, and log in again as the Oracle owner.
  2. Restart your Network listener.
  3. Restart your Oracle server.

5.4 Configure the SecurID Authentication Adapter using the Net8 Assistant

The following steps show you how to use the Net8 Assistant to configure the
SECURID authentication adapter. Refer also to the Net8 Assistant online HELP
system for instructions on how to configure the SECURID Authentication adapter.

Configure Clients, and Servers, to use encryption as follows. Refer to Figure 5-1, "Profile folder Encryption tab".

  1. Click the Profile folder.
  2. Select Advanced Networking Options from the drop-down list box.
  3. Click the Encryption tab.
  4. Click the Encryption drop-down list box, and click CLIENT or SERVER.
  5. Click the Encryption Type drop-down list box, and click one of the following values: requested, required, accepted, rejected.
  6. Type between 10 and 70 random characters for the Encyption Seed.
  7. Move services to and from the Available Services and Selected Services lists by selecting a service and clicking the arrow keys.

    8. Figure 5-1 Profile folder Encryption tab

Next, you must configure an authentication service on your network. Refer to Figure 5-2, "Profile folder Authentication tab".

  1. Click the Profile folder.
  2. Click the Authentication tab.
  3. Click to select the authentication service you want from the Available Services list.
  4. Click the [<] button to move the service over to the Selected Services list.
  5. Repeat steps 4 and 5, above, until you have selected all of your required authentication services.
  6. Arrange the selected services in order of desired use. Click on a service to select it, then click [Promote] or [Demote] to arrange the services in the list. For example, put SECURID at the top of the list if you want that service to be the first one used.

    7. Figure 5-2 Profile folder Authentication tab

You now must configure the authentication parameters. Refer to Figure 5-3, "Profile folder Parameter tab". You do not provide any additional parameter for the SECURID authentication service.

  1. Click the Profile folder.
  2. Click the Parameter tab.
  3. Click the Authentication Service drop-down list box, and select SECURID.
  4. No additional parameters are required.

    5. Figure 5-3 Profile folder Parameter tab

5.5 Creating Users for the SecurID Adapter

To create users for the SecurID authentication adapter, perform the following steps:

  1. Assign a card to a person, using the Security Dynamics sdadmin program. When the sdadmin tool asks for a login name when creating a new user, fill in the same name you will use later to create the Oracle user. Refer to the Security Dynamics documentation for information on how to do this.

    2. If you want the user to be able to specify a new PIN to the card using the Oracle tools, choose the option that allows the user to make up his or her own PIN. If you do not allow this, the user will have to use the Security Dynamics tools to generate a PIN if the card is in new-PIN mode. Activate the user on the Oracle Server. (The Oracle Server should already be registered as a SecurID client.)

  2. Create an Oracle Server account for this user. You can do this by using Server Manager connected as a user with the create user database role. Use the following syntax to create an account: 
    3. SVRMGRL> connect system/manager
SVRMGRL> create user os_authent_prefix username identified externally

    The OS_AUTHENT_PREFIX is an Oracle Server initialization parameter (for example, in INIT.ORA). The OS_AUTHENT_PREFIX default value is OPS$. The username should be the same as the name you assigned to the card in step 1 above.

    Note:

    Because user names can be long and Oracle user names are limited to 30 characters, it is strongly recommended that OS_AUTHENT_PREFIX be set to a null value:

    OS_AUTHENT_PREFIX=""

    At this point, an Oracle user with username should not yet exist.  

    Example: Assuming you have assigned a card to the user "king", and assuming that os_authent_prefix has been set to a null value (""), at this point you should create an Oracle user account using the following syntax: 

    SQLDBA> create user king identified externally;
  3. You may want to give this user some database privileges. At the minimum, the user should have the "create session" privilege. 
    4. SQLDBA> grant create session to king;

    The user "king" can now connect to Oracle using his or her SecurID card.

    For information on how to log into an Oracle server after the SecurID adapter has been installed and configured, see Section 6.1.1, "Log into the Oracle Server".

5.6 Troubleshooting the Configuration of the SecurID Authentication Adapter

This section lists some things to verify if you experience problems while configuring the SecurID Adapter.