时间：2021-07-01 10:21:17 帮助过：5人阅读
b) The new wallet will contain a number of trusted certificates that are
installed by default, remove all of these well known trusted certificates from
the wallet.
c) Create a self-signed certificate that will be stored in the
wallet.
[oracle@rac1]$ orapki wallet add -wallet /u01/app/11.2.0.2/grid/network/admin/cost -self_signed -dn "cn=secure_register" -keysize 1024 -validity 3650
d) View the wallet contents to confirm that it has a single trusted and
user certificate.
e) Make copies of the finished wallet (ewallet.p12) and place on each
node in the same directory location; /u01/app/11.2.0.2/grid/network/admin/cost.
f) Using orapki create a unique
obfuscated auto-login file "cwallet.sso" on each node. Both PMON and the
listener will use the cwallet.sso to establish a secure SSL connection with each
other. Once COST parameters restricting registration to TCPS are enabled only
instances that have access to the wallet and obfuscated wallet (cwallet.sso)
will be able to register with the SCAN listeners.
Creating the
cwallet.sso file:
g) Modify the permissions of the obfuscated wallet (cwallet.sso) to
allow usage by authorized group members.
Important: Store the wallet password in a safe place. The wallet cannot
be re-opened without it.
1.2) Update the grid home listener.ora so
that it references the wallet location and add the COST parameters that will
restrict registration. Do this for each node.
Add the wallet location to
listener.ora.
At this time also add the COST registration restrictions for the SCAN
listeners to the listener.ora. These parameters should be commented now and will
be enabled later.
The finished listener.ora should look like this:
1.3) Using srvctl modify the SCAN listeners to also include TCPS
protocol endpoints, re-start the SCAN listeners.
1.4) Add the wallet location to the sqlnet.ora of each instance home.
If no sqlnet.ora exists create a new file. Registering instances must know the
wallet location and have access in order to make the required SSL connection
with the SCAN listeners.
Restart each instance after adding the wallet location to
sqlnet.ora.
1.5) Modify instance startup parameters to use TCPS protocol
with remote_listener.
The existing remote_listener value uses an
ezconnect string value in the form. host:port.
The replacement remote_listener value is an address_list containing
the resolved scan listener IP addresses and TCPS ports. The addresses can be
listed using srvctl.
Associate the three IP addresses assigned to the SCAN listeners with the
TCPS port that was added in step 3, in this case port 1523.
The SCAN
addresses are the same for all instances in the cluster so the remote_listener
parameter value can be added from any instance home using the global option
sid=‘*‘. This will update the remote_listener value for all instances.
Changing the remote_listener value is a critical stage as it forces
registration over TCPS using the wallets and certificates that were created in
earlier steps. It is best to stop here and verify that all instances are
registering properly with the scan listeners. If not, go back and review each of
the previous steps to ensure an item was not overlooked.
If registration
using TCP needs to be restored for any reason it is a simple matter to revert to
the previously noted ezconnect address. The following command can be performed
from any instance in the cluster and will make changes globally for all
instances. Do not do this unless it is your intention to revert back to TCP and
not enable COST restrictions in the next step.
1.6) Enable COST parameters restricting instance registration in the
grid home listener.ora.
When instance registration over TCPS with SCAN
listeners is working properly the COST registration rules can be implemented.
Edit the grid home listener.ora and remove the comments from the COST
restriction parameters that were added in step 1.2.
Restart all listeners to load the new parameters.
With COST enabled attempts to register with SCAN listeners using a
protocol other than TCPS are rejected and an event is logged in the listener
log. Instances must also have the proper SSL credentials in order to connect and
register their services.
To verify that COST restrictions are functioning appropriately please refer to DocID:1453883.1, section 3, "Verifying that COST is working".
2) Oracle 11.2 RAC - Securing ASM and Database registration with the Local (node) listener.
Steps:
2.1) Obtain and apply the patch for bug:12880299. The patch should be applied to both the grid and rdbms homes on each node in the cluster.
2.2) Add COST IPC and TCP protocol restrictions to the listener.ora on each node.
Edit the grid home listener.ora and add SECURE_REGISTER_LISTENER = (IPC,TCP) to the existing list of scan listener restrictions.
In 11.2 RAC the grid agent uses the IPC protocol to create and manage node listeners so both IPC and TCP restrictions must be enabled. SECURE_REGISTER_LISTENER = (IPC,TCP)2.3) To activate the COST restriction use srvctl to re-start all instance/local listeners. (This action only needs to be performed on one node, all local listeners will restart.)
[oracle@rac1 ~]$ srvctl stop listenerTo verify that COST restrictions are functioning appropriately please refer to DocID:1453883.1, section 3, "Verifying that COST is working".
3) Oracle RAC versions prior to 11.2 (10.2.0.3 - 11.1)
Steps:
3.1) Using orapki create a wallet with self
signed certificates that will be shared among node listeners and registering
instances to make secure SSL connections.
If SSL is being used
exclusively for instance registration then a single shared wallet with self
signed certificates are all that is needed and this is the easiest setup to
implement. If other SSL features are planned a unique wallet and certificate may
be required for each node. Reference Oracle documentation for the SSL
requirements of any additional SSL features that will be used and adjust as
necessary.
a) Create an Oracle wallet: "ewallet.p12".
The target
directory in this example is within the database home but the location can be
anywhere that is accessible to Oracle.
b) Create a self-signed certificate that will be stored in the
wallet.
c) The new wallet will contain a number of trusted certificates that are
installed by default. You can use Oracle Wallet Manager (OWM), a java tool in
$ORACLE_HOME/bin, to remove all other trusted certificates except for the self
signed certificate "CN=secure_register" that was created in step 3.1-b.
Once all the additional trusted certificates have been removed the
finished wallet should look like this:
d) Make copies of the finished wallet (ewallet.p12) and place on each
node in the same directory location, i.e.,
$ORACLE_HOME/network/admin/cost
e) Using orapki create a unique
obfuscated auto-login file "cwallet.sso" on each node. Both PMON and the
listener will use the cwallet.sso to establish a secure SSL connection with each
other. Once COST parameters restricting remote registration to TCPS are enabled
only instances that have access to the wallet and obfuscated wallet
(cwallet.sso) will be able to remotely register with listeners.
The wallet is now ready to use with files ewallet.p12 and cwallet.sso in
$ORACLE_HOME/network/admin/cost
Important: Store the wallet password in a
safe place. The wallet cannot be re-opened without it.
3.2) Obtain and apply the patch for bug:12880299 to all nodes in the cluster.
In a RAC environment, and without the patch for bug:12880299, an IPC restriction on the local/node listener will cause the scan listener TCP handlers to block incoming connections. The patch not only fixes this issue but also allows for registration from only the local node over TCP provided that TCP is listed as a secure transport for registration.
3.3) Update the listener.ora so that it references the wallet location and add the COST parameters that will restrict registration, also add a listen endpoint for TCPS that pmon will use to send registration updates. Do this on the listener.ora of each node.
The location of the listener.ora that the running listener is using can be
identified with lsnrctl> status.
Before edit, the listener.ora will
look similar to:
a) Add a TCPS address and endpoint to listener.ora. Use the existing node
vip address and any available port for the TCPS endpoint.
b) Add the wallet location to listener.ora.
c) Add the COST registration restrictions for TCP and TCPS to the
listener.ora. The parameter should be commented now but will be enabled
later.
The above actions, 3.3-a,b & c, should be performed on each listener.ora on each cluster node. Make sure references to listener and vip names are accurate for each node.
A finished listener.ora will look like this:
LISTENER_RAC1 =
3.4) After the changes to the listener.ora have been made stop and restart the listener and confirm that it has the TCPS listen endpoint that was added along with the previously existing endpoints.
[oracle@rac1]$ srvctl stop listener -n rac1
3.5) Add the wallet location to the sqlnet.ora of each instance home. The
sqlnet.ora is read by the instance at startup. Registering instances must know
the wallet location and have access in order to make the required SSL connection
with remote listeners.
3.6) Modify instance startup parameters to use the new TCPS protocol
addresses used by all of the node listeners. The instance uses the
remote_listener parameter value to locate those addresses.
In this case the database is using the tns alias "listeners_rac" in tnsnames.ora to store the listener addresses.
Edit the listeners_rac entry in TNSNAMES.ORA that is being used by the database.
Before edit:
LISTENERS_RAC =
Comment the existing TCP addresses and add the new TCPS addresses we will
be using for registration.
The next step is to restart the instance but before doing that make note of the current lsnrctl services output on one of the listeners on another node (a remote listener) so you can compare the results after the restart (they should match). Of particular interest is the remote service handler of the instance you are testing.
srvctl stop instance -d rac -i rac2 -o immediate
If the remote service handler output matches the handler output prior to
the restart then TCPS connectivity and secure network registration is
functional. Repeat this process until all nodes are successfully registering
remotely over TCPS. If the lsnrctl services output is not correct after restart
go back over the configuration steps to make sure nothing was missed. If there
is a need to revert to the previous TCP configuration just remove the comment
from the TCP entries in the listeners_rac tns alias, comment the TCPS entries
and restart the instance.
3.6) When all instances are properly
registering with remote listeners over TCPS protocol you are ready to enable
COST restrictions.
Remove the comment from the cost restriction entry in each listener and restart the listener.
SECURE_REGISTER_LISTENER_RAC1 = (TCP,TCPS)To verify that COST restrictions are functioning appropriately please refer to DocID:1453883.1, section 3, "Verifying that COST is working".
Patch/fix information for BUG:12880299
NOTE:1455068.1
- Force Connections to a Specific Database Service When two Identical Services
are Registered to CMAN
NOTE:1453883.1
- Using Class of Secure Transport (COST) to Restrict Instance Registration
@
BUG:12880299
- RAC: TCP HANDLERS BLOCK IF LISTENER REGISTRATION IS RESTRICTED TO IPC
W/COST
@NOTE:1457854.1
- How To Enable TCPS Support For Oracle Standard Edition
NOTE:1092753.1
- How To Configure Scan Listeners With A TCPS Port?
| Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC [ID 1340831.1] | |||||
| 修改时间 08-OCT-2012 类型 HOWTO 状态 PUBLISHED | |||||
Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC [ID 1340831.1]
标签：comment clu bug addition amp pass conf ssl sar