Oracle英文版培训课件之Grid Control：les05Securing Grid Control

SecuringGridControlObjectivesAftercompletingthislesson,youshouldbeableto:DescribethesecurityoptionsavailableforOracleManagementServiceandOracleManagementAgentConfigureGridControlforusewithproxyserversandthroughfirewallsAuthenticateGridControladministratorsusingSingleSign-OnConfigureGridControlforusewithEnterpriseUserSecurityGridControlSecurityGridControlsecurityhastwoprimarygoals:EnsuringsecuretransferofdatabetweenGridControlcomponentsDenyingunauthorizedusersaccesstoGridControlmonitoringdataandadministrativecontrolsSecuringGridControlEnterpriseManagerFrameworkSecurityprovidessafeandsecurecommunicationbetweentheGridControlcomponentsthrough:WorkingwithsecurityfeaturesofOracleHTTPServerImplementingHTTPSandPublicKeyInfrastructure(PKI)componentsforcommunicationsbetweenOracleManagementService(OMS)andOracleManagementAgentsUsingOracleAdvancedSecurityforcommunicationsbetweenOMSandtheManagementRepositoryGridControlSecurityFrameworkGridControlSecurityFrameworkprovidessecure(encrypted)communicationbetweenGridControlcomponents:Agent<->OMSOMS<->RepositoryOHSWebCacheOC4JEMOMSEncryptedchannelEncryptedchannelVerifythatOracleManagementAgentsAreSecureManagingAgentRegistrationPasswordsUseGridControlto:ChangeagentregistrationpasswordsCreateorremoveadditionalregistrationpasswordsRefusingNonsecureUploadsConfigureOMStorefuseunencrypteduploads.StopallOMSservices.ConfigureOMStorefuseuploadsviaHTTP.StartallOMSservices.$emctlsecurelockSecuringOMS–RepositoryCommunicationTosecurecommunicationbetweentheOMSandrepository,enabletheOracleAdvancedSecurityOption(ASO)for:RepositoryOMSAgentmonitoringtherepositorydatabaseEnablingASOfortheRepositoryModifyORACLE_HOME/network/admin/sqlnet.ora

torequestencryption:SQLNET.ENCRYPTION_SERVERSQLNET.CRYPTO_SEEDOMRSQLNET.ENCRYPTION_SERVER=REQUESTEDSQLNET.CRYPTO_SEED="abcdefg123456789"EnablingASOforEachOMSASOfortheOMSisconfiguredthroughentriesinOMS_HOME/sysman/config/perties.StopandrestarttheOMStoimplementthenewparameters.oracle.sysman.emRep.dbConn.enableEncryption=TRUE.encryption_types_client=(DES40C).encryption_client=REQUESTEDEnablingASOfortheAgentCreateAGENT_HOME/network/admin/sqlnet.ora

asatextfilewiththefollowingentry:SQLNET.CRYPTO_SEEDSQLNET.CRYPTO_SEED="abcdefg123456789"SecuringApplicationServerControlStand-aloneApplicationServerControlconsolemayalsobeconfiguredforsecureoperation:Stopthestand-aloneconsole:emctlstopiasconsoleSecurethestand-aloneconsole:emctlsecureemStartthestand-aloneconsole:emctlstartiasconsoleEnablingEnterpriseManagerSecurityFrameworkToenableEnterpriseManagerSecurityFramework,thecomponentsmustbeconfiguredinaspecificorder:SecuretheOMS(donebydefaultinGridControlR2).ForeachOracleManagementAgent,stopit,secureit,andrestartit:

emctlstopagent

emctlsecureagent

emctlstartagentWhenallagentsaresecure,locktheOMS:

emctl

securelockConfiguringEnterpriseManagerforFirewallsBeforeconfiguringyourfirewall,considerthefollowing:ItshouldbethelastphaseoftheEnterpriseManagerdeployment.Forexistingfirewalls,opendefaultEnterpriseManagercommunicationportsuntiltheinstallationandconfigurationprocessesarecomplete.IfenablingEnterpriseManagerFrameworkSecurity,donotsecuretheagentsuntilyouconfirmthatHTTPandHTTPStrafficbetweentheagentandManagementRepositoryworks.AfterconfirmingthattheOMSandOracleManagementAgentscancommunicate,completethetransitionintosecuremodeandchangefirewallconfigurationasnecessary.FirewallConfigurationforGridControlComponentsFirewallsbetweenthebrowserandtheGridControlconsoleOracleManagementAgentprotectedbyafirewallManagementServiceprotectedbyafirewallFirewallsbetweentheManagementServiceandtheManagementRepositoryFirewallsbetweenGridControlandamanageddatabasetargetFirewallsusedwithmultipleManagementServicesFirewallstoallowICMPandUDPtrafficforbeaconsFirewallswhenmanagingOracleApplicationServerConfiguringtheAgentforProxyCommunicationToconfiguretheagentsothatitcommunicatesviaaproxyserver,performthefollowingsteps:StoptheOracleManagementAgent.AddproxyinformationtoAGENT_HOME/sysman/config/perties:REPOSITORY_PROXYHOSTREPOSITORY_PROXYPORTStarttheOracleManagementAgent.ProxyserverConfiguringtheOMSforProxyCommunicationToconfiguretheOMSsothatitcommunicatesviaaproxyserver,performthefollowingsteps:StoptheOMS.AddproxyinformationtoOMS_HOME/sysman/config/perties.StarttheOMS.OHSWebCacheOC4JEMOMSProxyserverAuthenticatingGridControlAdministratorsGridControladministratorsare:AuthenticatedasrepositorydatabaseusersCreatedandmanagedthroughtheGridControlconsoleIfdesired,administratorsmaybecreated,managed,andauthenticatedviaOracleSingleSign-On.OracleSingleSign-OnSingleSign-On(SSO)isacomponentofOracleApplicationServerthatenablesuserstologintoWebapplicationsbyusingasingleusernameandpassword.ConfiguringGridControltouseSingleSign-Onisatwo-stepprocess:ConfiguretheOMStouseSSO.AddGridControlusers.ConfiguringtheOMSforSSOToconfiguretheOMStouseSSO,performthefollowingsteps:StoptheOMS.ReconfiguretheOMStouseSSO.StarttheOMS.emctlconfigsso -–host<SSOServer> -–port<SSODBListenerPort> -–sid<SSODBSID> -–pass<DBpasswordfororasso> -–das<URLforOIDDASserver>OHSWebCacheOC4JEMOMSEnterpriseUserSecurityWithEnterpriseUserSecurity,databaseusersareauthenticatedthroughacentralizeddirectory.Insteadofstoringmanagementcredentialsforeachtargetdatabase,theOMSmaybeconfiguredtou