oracle audit vault server 初识一

Step 1: Disable Oracle Database Vault

To disable Oracle Database Vault:

1. Stop the database, Database Control console process, and listener.

   • UNIX: Ensure that the environment variables, ORACLE_HOME, ORACLE_SID, and PATH are correctly set. Log in to SQL*Plus as user SYS with the SYSOPER privilege and shut down the database. Then from the command line, stop the Database Control console process and listener.

     For example:

     sqlplus sys as sysoper
     Enter password: password
     
     SQL> SHUTDOWN IMMEDIATE
     SQL> EXIT
     
     $ emctl stop dbconsole
     $ lsnrctl stop [listener_name]
     

     For Oracle RAC installations, shut down each database instance as follows:

     $ srvctl stop database -d db_name
     

   • Windows: Stop the database, Database Control console process, and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.

2. Disable the Oracle Database Vault option.

   • UNIX: Run the following commands:

     cd $ORACLE_HOME/rdbms/lib
     make -f ins_rdbms.mk dv_off
     cd $ORACLE_HOME/bin
     relink all
     

     For Oracle RAC installations, run these commands on all nodes.

   • Windows: In the ORACLE_HOME\bin directory, rename the oradvll.dll file to another name, such as oradvll.dll.dbl.

3. Restart the database, Database Control console process, and listener.

   • UNIX: Log in to SQL*Plus as user SYS with the SYSOPER privilege and restart the database. Then from the command line, restart the Database Control console process and listener.

     For example:

     sqlplus sys as sysoper
     Enter password: password
     
     SQL> STARTUP
     SQL> EXIT
     
     $ emctl start dbconsole
     $ lsnrctl start [listener_name]
     

     For Oracle RAC installations, restart each database instance as follows:

     $ srvctl start database -d db_name
     

   • Windows: Restart the database, Database Control console process, and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.

4. If the reason you needed to disable Oracle Database Vault was because of forgotten passwords, then connect as SYS or SYSTEM and reset the password.

   For example:

   CONNECT SYSTEM
   Enter password: password
   
   ALTER USER lbrown_dvowner IDENTIFIED BY password;
   

5. At a command prompt, run Oracle Database Vault Configuration Assistant (DVCA) by using the dvca -action disable option.

   The syntax for dvca -action disable is as follows:

   dvca -action disable 
     -oh Oracle_home_directory
     -service service_name 
     -instance Oracle_instance_name 
     -dbname database_name 
     -sys_passwd SYS_password 
     -owner_account DV_owner_account_name 
     -owner_passwd DV_owner_account_password 
     [-logfile ./dvca.log] 
     [-nodecrypt] 
     [-racnode node]
   

   In this specification:

   • -action is the action to perform. In this case the action is disable.

   • -oh is the path to the Oracle home directory. Enter the absolute path.

     For example:

     • UNIX: -oh /u01/app/oracle/product/10.2.0/db_1

     • Windows: -oh c:\oracle\product\db_1

   • -service is the name of the database specifier. The specifier can be a connect descriptor or net service name. For more information about database specifiers, see Oracle Database JDBC Developer's Guide and Reference.

   • -instance is the name of the database instance.

   • -dbname is the database name.

   • -sys_passwd is the SYS password. If you use a cleartext password on the command line, you must include the nodecrypt option. If you omit the password, DVCA prompts you for it. Preferably, omit the password and then enter it interactively when prompted.

   • -owner_account is the Oracle Database Vault Owner account name.

   • -owner_passwd is the Oracle Database Vault Owner account password. If you use a cleartext password on the command line, you must include the nodecrypt option. If you omit the password, DVCA prompts you for it. Preferably, omit the password and then enter it interactively when prompted.

   • -logfile is an optional flag to specify a log file name and location. You can enter an absolute path, or enter a path that is relative to the location of the $ORACLE_HOME/bin directory.

   • -silent is the option to run in command line mode. This option is required if you are not running DVCA in an xterm window.

   • -nodecrypt is the option to read plaintext passwords.

   • -lockout is the flag to use to disable SYSDBA operating system authentication.

   For example:

   dvca -action disable 
     -oh /u01/app/oracle/product/10.2.0/db_1
     -service conn_alias 
     -instance orcl 
     -dbname orcl 
     -owner_account lbrown_dvowner 
     -logfile dvcalog.txt 
     
   Enter SYS password: sys_password
   Enter owner password: owner_password
   

6. Connect to SQL*Plus as SYS using the SYSDBA privilege, and then run the following ALTER TRIGGER statement:

   CONNECT SYS / AS SYSDBA
   Enter password: password
   
   ALTER TRIGGER LBACSYS.LBAC$LOGON ENABLE;
   

Step 2: Perform the Required Tasks

At this stage Oracle Database Vault is disabled. You can perform the following types of activities:

• Use the Oracle Database Vault PL/SQL packages and functions. For example, to correct a login or CONNECT rule set error, use the DBMS_MACADM PL/SQL package or the Oracle Database Vault Administrator interface.

• Use the SYSTEM or SYS accounts to perform tasks such as creating or changing passwords, or locking and unlocking accounts. In addition to modifying regular database and administrative user accounts, you can modify passwords and the lock status of any of the Oracle Database Vault-specific accounts, such as users who have been granted the DV_ADMIN or DV_ACCTMGR roles. (See the tip under "Oracle Database Vault Accounts" for a guideline for avoiding this problem in the future.)

• Perform the installation, upgrade, or other tasks that require security protections to be disabled. If you must run Oracle Database Vault Configuration Assistant (DVCA), ensure that the Oracle Database listener is running. To start the listener, run the following command from the $ORACLE_HOME/bin directory:

  $ ./lsnrctl start [listener_name]
  

Step 3: Enable Oracle Database Vault

To enable Oracle Database Vault:

1. At a command prompt, use DVCA to reenable Oracle Database Vault.

   For example:

   dvca -action enable 
     -oh /u01/app/oracle/product/10.2.0/db_1
     -service conn_alias 
     -instance orcl 
     -dbname orcl 
     -owner_account lbrown_dvowner 
     -logfile dvcalog.txt 
   
   Enter SYS password: sys_password
   Enter owner password: owner_password
   

   See Step 5 under "Disabling and Enabling Oracle Database Vault" for detailed information about the DVCA syntax.

2. Stop the database, Database Control console process, and listener.

   • UNIX: Ensure that the environment variables, ORACLE_HOME, ORACLE_SID, and PATH are correctly set. Log in to SQL*Plus as user SYS with the SYSOPER privilege and shut down the database. Then from the command line, stop the Database Control console process and listener.

     For example:

     sqlplus sys as sysoper
     Enter password: password
     
     SQL> SHUTDOWN IMMEDIATE
     SQL> EXIT
     
     $ emctl stop dbconsole
     $ lsnrctl stop [listener_name]
     

     For Oracle RAC installations, shut down each database instance as follows:

     $ srvctl stop database -d db_name
     

   • Windows: Stop the database, Database Control console process, and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.

3. Enable the Oracle Database Vault option as follows:

   • UNIX: Run the following commands. The make command enables both Oracle Database Vault (dv_on) and Oracle Label Security (lbac_on). You must enable Oracle Label Security before you can use Database Vault.

     cd $ORACLE_HOME/rdbms/lib
     make -f ins_rdbms.mk dv_on lbac_on
     cd $ORACLE_HOME/bin
     relink all
     

   • Windows: In the ORACLE_HOME\bin directory, rename the backed up copy of the oradvll.dll file (for example, oradv11.dll.dbl) to oradvll.dll. Ensure that the name of the Oracle Label Security executable is oralbacll.dll (and not oralbacll.dll.dbl or some other backup name). You must enable Oracle Label Security before you can use Database Vault.

4. Restart the database, Database Control console process, and listener.

   • UNIX: Ensure that the environment variables, ORACLE_HOME, ORACLE_SID, and PATH are correctly set. Log in to SQL*Plus as user SYS with the SYSOPER privilege and restart the database. Then from the command line, restart the Database Control console process and listener.

     For example:

     sqlplus sys as sysoper
     Enter password: password
     
     SQL> STARTUP
     SQL> EXIT
     
     $ emctl start dbconsole
     $ lsnrctl start [listener_name]
     

     For Oracle RAC installations, restart each database instance as follows:

     $ srvctl start database -d db_name
     

   • Windows: Restart the database, Database Control Console process, and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.

5. For Oracle RAC installations, repeat these steps for each node on which the database is installed.