数据库安全审计L07_StrongAuthentication.ppt

1、Strong Authentication,Objectives,After completing this lesson, you should be able to do the following: Describe strong authentication by using: Certificates Kerberos RADIUS Describe a setup for strong authentication by using: Certificates Kerberos KDC,Strong User Authentication,Strong authentication

2、: Is stronger than password authentication Often includes single sign-on functionality Is supported by the following authentication technologies: Certificates, public key infrastructure (PKI) RADIUS, token, and smart cards Kerberos Integrates with Oracle Net Services Requires Oracle Advanced Securit

3、y,hidden,Single Sign-On,Single sign-on is a centralized authentication service. The user has a single username and password. Servers authenticate users through the central service.,Server,Authentication server,Client,Public Key Infrastructure (PKI) Tools,The Oracle database PKI implementation includ

4、es: Components: Oracle Advanced Security Oracle Identity Management Infrastructure Management tools: Oracle Wallet Manager Oracle Enterprise Security Manager,Certificates,Certificates: Are digital documents Provide proof of identity Certificate authority: Is a trusted organization (trust point) Atte

5、sts to the identity of the certificate Issues trusted certificates Certificate use: Requires an SSL Requires a level of trust in the signing authority,How to Use Certificates for Authentication,Install the required components. Configure the server for SSL. Configure the server-side Oracle Net files:

6、 listener.ora sqlnet.ora tnsnames.ora Configure the client for SSL Configure the client-side Oracle Net files: sqlnet.ora tnsnames.ora Create a user that is authenticated with a certificate. Connect to the database.,Configuring SSL on the Server,Configuring Oracle Net Files on the Server,Configuring

7、 SSL on the Client,Configuring Oracle Net Files on the Client,On the client, specify: The servers distinguished name The TCPS protocol listener port The client wallet location,hidden,Creating a User Identified by Certificate,When you create a global user, you can specify the X.509 name that identifi

8、es this user at the enterprise directory server: Create a global user that is mapped to the appropriate schema by the directory information:,CREATE USER global_user1 IDENTIFIED GLOBALLY AS CN=analyst,OU=division1, O=oracle, C=US;,CREATE USER global_user2 IDENTIFIED GLOBALLY AS ;,Connecting to the Da

9、tabase,The user that owns the client wallet may connect to the database by using:,CONNECT /SSL_ENABLED_NAME;,orapki Utility,orapki is a command-line utility for scripting common PKI management tasks. It can be used for: Creating and viewing signed certificates for testing purposes Managing Oracle wa

10、llets Creating and displaying Oracle wallets Renaming CRLs with a hash value for certificate validation,How to Use Kerberos for Authentication,Install Kerberos. Configure a service principal for the database server. Extract a service table from Kerberos. 4.Install an Oracle database server and a cli

11、ent. 5.Install Oracle components. 6.Configure Oracle Net Services and the Oracle database. 7.Configure Kerberos authentication. 8.Create a Kerberos user. 9.Create an externally authenticated Oracle user. 10.Get an initial ticket for the Kerberos and Oracle user.,hidden,How to Use KDC with Windows 20

12、00 for Authentication,Configure an Oracle Kerberos client to interoperate with a Windows 2000 domain controller KDC. Configure a Windows 2000 domain controller KDC to interoperate with an Oracle client. Configure an Oracle database to interoperate with a Windows 2000 domain controller KDC. Get an in

13、itial ticket for the Kerberos and Oracle user.,(hidden),RADIUS Authentication: Overview,RADIUS is a protocol for remote authentication and access. You may use any authentication method that supports the RADIUS standard. You may change authentication methods without changing the database or client configuration. The user is defined in the database as IDENTIFIED EXTERNAL