SlideShare a Scribd company logo

Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam

•
•
Getting value from IoT, Integration and Data Analytics
Getting value from IoT, Integration and Data Analytics

Deze presentatie is gegeven tijdens de Oracle OpenWorld Preview sessie bij AMIS &

Technology
1 of 96
Tips and Tricks for hardening Oracle Fusion Middleware a presentation by Jacco Landlust & Simon Haslam woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Jacco H. Landlust Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • 35 years old • Deventer, the Netherlands • Lives Together with Margot, 2 Daughters (Franka & Jules) and our Cat 2 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Jacco H. Landlust / iDBA Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Independent Red Stack Administrator • Oracle since 2000 • Oracle ACE since 2006 • iDBA since 2010 • Architecture, Clustering, High Availability, Performance & Management 3 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Simon Haslam Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Over 35 years old • Sherborne, UK 4 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Simon Haslam Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Oracle since 1996 (UNIX since 1989) • Founded Veriton in 1996 • Oracle ACE Director since 2009 • Chair of the UKOUG Application Server & Middleware SIG • Architecture, Design, Installation • http://simonhaslam.co.uk 5 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Why present together? Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Lone wolf pack • We just like to talk, share ideas and discuss Oracle Fusion Middleware administrator topics • Oracle Infrastructure Administrators Group 6 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Prerequisites & Disclaimer Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • This is a technical presentation • Background knowledge about middleware is assumed • Best practices of our (Limited) experience • We do not work for Oracle / represent Oracle • We do not pretend this list is complete • We are not ‘native’ American speakers 7 woensdag 3 oktober 12
Tips and Tricks for hardening Oracle Fusion Middleware 8 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Whatever you do Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Run on “current” versions • Monitor for critical patches by Oracle • Apply PSU’s / CPU’s 9 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Architecture Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Decide upon definitions in your team • Document your train of thoughts • We love pictures • Segregation of environments (DTAP) • Start with security measures in DEV • Use SSL wherever you can 10 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Architecture Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Separate system components from Java components • Separate directories • Separate binaries from configuration • Separate AdminServer from Managed Servers • Standardize & automate as much as possible 11 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Architecture Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Tiered architecture • Think about access to components: • from where? • to what? • by whom? 12 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Architecture Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing 13 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing 14 woensdag 3 oktober 12
Introduction Architecture Separate binaries Separate binaries from config Firewall Personal Accounts Nodemanager from configuration SSL Domain Wide Administration Port Database Auditing • No chance of runtime user altering binaries • Runtime users secondary group is primary group of binary owner • Need to fix privileges on some files / directories • One nodemanager per runtime user 15 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Caveats Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • One nodemanager per runtime user • Startup binary of system owner needs to be owner by runtime user • Different layared products have different requirements 16 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Fix Privileges Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing find ${MW_HOME} -type d -exec chmod g+rx {} ; find ${MW_HOME} -type f -exec chmod g+r {} ; chmod g+w ${MW_HOME}/logs touch ${MW_HOME}/domain-registry.xml chmod g+w ${MW_HOME}/domain-registry.xml touch ${MW_HOME}/common/nodemanager/nodemanager.domains chmod g+w ${MW_HOME}/wlserver_10.3/common/nodemanager/nodemanager.domains chmod g+w ${MW_HOME}/wlserver_10.3/server/lib chmod g+w ${MW_HOME}/wlserver_10.3/server/lib/*.jks chmod g+w ${MW_HOME}/oracle_common/sysman chmod g+r ${MW_HOME}/oracle_common/modules/oracle.javacache_11.1.1/server_config/.sslConfig chmod g+r ${MW_HOME}/oracle_common/modules/oracle.javacache_11.1.1/server_config/.joc_demo_keystore.jks chmod g+r ${MW_HOME}/oracle_common/modules/oracle.javacache_11.1.1/server_config/.KEYSTORE find ${MW_HOME} -name perl -exec chmod g+rx {} ; find ${MW_HOME} -name emagent -exec chmod g+rx {} ; find ${MW_HOME} -name emctl -exec chmod g+rx {} ; find ${MW_HOME} -name emdctl -exec chmod g+rx {} ; chown root ${MW_HOME}/Oracle_WT1/ohs/bin/.apachectl chmod 6750 ${MW_HOME}/Oracle_WT1/ohs/bin/.apachectl chown ${DOMUSR} ${MW_HOME}/Oracle_WT1/ohs/bin/apachectl 17 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Firewall Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing http://en.wikipedia.org/wiki/Firewall_(computing) A firewall primary objective is to control the incoming and outgoing network traffic by analyzing the data packets and determining whether it should be allowed through or not, based on a predetermined rule set. A network's firewall builds a bridge between an internal network that is assumed to be secure and trusted, and another network, usually an external (inter)network, such as the Internet, that is not assumed to be secure and trusted 18 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Network Connection Filter Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Connection filters let you deny access at the network level • Network connection filters are a type of firewall in that they can be configured to filter on protocols, IP addresses, and DNS node names • Careful: rules are domain wide 19 woensdag 3 oktober 12
Introduction Architecture Connection Filter Separate binaries from config Firewall Personal Accounts Nodemanager Rules Syntax SSL Domain Wide Administration Port Database Auditing Each rule must be written on a single line. • Tokens in a rule are separated by white space. • A pound sign (#) is the comment character. Everything after a pound sign on a line is ignored. • Whitespace before or after a rule is ignored. • When entering the filter rules on the Administration Console, enter them in the following format: target localAddress localPort action protocols • If no protocol is defined, all protocols will match a rule • The rules are evaluated in the order in which they were written 20 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 127.0.0.1 * 7001 allow 192.168.56.101 * 7001 allow 0.0.0.0/0 * 7001 allow http 0.0.0.0/0 * 7001 deny 21 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing weblogic.security.net.ConnectionFilterImpl 22 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing weblogic.security.net.ConnectionFilterImpl 22 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing weblogic.security.net.ConnectionFilterImpl 22 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing <29-sep-2012 11:58:00 uur CEST> <Notice> <Socket> <BEA-000445> <Connection rejected, filter blocked Socket[addr=192.168.56.1,port=49182,localport=7001], weblogic.security.net.FilterException: [Security:090220]rule 4> 23 woensdag 3 oktober 12
Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 127.0.0.1 * 7001 allow 192.168.56.101 * 7001 allow 0.0.0.0/0 * 7001 allow http 0.0.0.0/0 * 7001 deny 24 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Personal Accounts Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Trace administrative actions to a human • Authentication providers • Identity assertion authentication provider • JAAS control flags • Order of providers matters • Most FMW layered products only find group memberships (and groups) for the first provider 25 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Role Based Privileges Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • For WebLogic configured in /console • For most Fusion Middleware application configured in /em • Policy store provider in OID or Database 26 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing CREATE TABLE USERS ( U_NAME VARCHAR(200) NOT NULL, U_PASSWORD VARCHAR(50) NOT NULL, U_DESCRIPTION VARCHAR(1000), CONSTRAINT PK_USERS PRIMARY KEY (U_NAME)); CREATE TABLE GROUPS ( G_NAME VARCHAR(200) NOT NULL, G_DESCRIPTION VARCHAR(1000) NULL, CONSTRAINT PK_GROUPS PRIMARY KEY (G_NAME)); 27 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing CREATE TABLE GROUPMEMBERS ( G_NAME VARCHAR(200) NOT NULL, G_MEMBER VARCHAR(200) NOT NULL, CONSTRAINT PK_GROUPMEMBERS PRIMARY KEY (G_NAME,G_MEMBER), CONSTRAINT FK1_GROUPMEMBERS FOREIGN KEY ( G_NAME ) REFERENCES GROUPS (G_NAME) ON DELETE CASCADE, CONSTRAINT FK2_GROUPMEMBERS FOREIGN KEY ( G_MEMBER ) REFERENCES USERS (U_NAME) ON DELETE CASCADE ); 28 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing insert into USERS (U_NAME,U_PASSWORD,U_DESCRIPTION) values('jacco','Welcome01','admin user'); insert into GROUPS (G_NAME,G_DESCRIPTION) values('Administrators','Adnministrators'); insert into GROUPMEMBERS (G_NAME,G_MEMBER) values('Administrators','jacco'); 29 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Nodemanager Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Always use secureListener=true • Setup credentials to custom user • Store and protect credentials in keyfiles • Never use demo certificates (in production) 32 woensdag 3 oktober 12
Introduction Architecture Secure Sockets Layer / Separate binaries from config Firewall Personal Accounts Nodemanager Transport Layer Security SSL Domain Wide Administration Port Database Auditing • TLS and predecessor SSL are cryptographic protocols • The TLS protocol allows client-server applications to communicate across a network in a way designed to prevent eavesdropping and tamering. 33 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall How does it work? Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing 1. The client sends the server the client's SSL version number, cipher settings, session-specific data, and other information that the server needs to communicate with the client using SSL. 2. The server sends the client the server's SSL version number, cipher settings, session-specific data, and other information that the client needs to communicate with the server over SSL. The server also sends its own certificate, and if the client is requesting a server resource that requires client authentication, the server requests the client's certificate. 3. The client uses the information sent by the server to authenticate the server (see Server Authentication for details). If the server cannot be authenticated, the user is warned of the problem and informed that an encrypted and authenticated connection cannot be established. If the server can be successfully authenticated, the client proceeds to step 4. 4. Using all data generated in the handshake thus far, the client (with the cooperation of the server, depending on the cipher being used) creates the pre-master secret for the session, encrypts it with the server's public key (obtained from the server's certificate, sent in step 2), and then sends the encrypted pre-master secret to the server. 5. If the server has requested client authentication (an optional step in the handshake), the client also signs another piece of data that is unique to this handshake and known by both the client and server. In this case, the client sends both the signed data and the client's own certificate to the server along with the encrypted pre-master secret. 34 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall How does it work? Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing 6. If the server has requested client authentication, the server attempts to authenticate the client (see Client Authentication for details). If the client cannot be authenticated, the session ends. If the client can be successfully authenticated, the server uses its private key to decrypt the pre-master secret, and then performs a series of steps (which the client also performs, starting from the same pre-master secret) to generate the master secret. 7. Both the client and the server use the master secret to generate the session keys, which are symmetric keys used to encrypt and decrypt information exchanged during the SSL session and to verify its integrity (that is, to detect any changes in the data between the time it was sent and the time it is received over the SSL connection). 8. The client sends a message to the server informing it that future messages from the client will be encrypted with the session key. It then sends a separate (encrypted) message indicating that the client portion of the handshake is finished. 9. The server sends a message to the client informing it that future messages from the server will be encrypted with the session key. It then sends a separate (encrypted) message indicating that the server portion of the handshake is finished. source: http://en.wikipedia.org/wiki/Secure_Sockets_Layer 35 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Key Information Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Identity store: information to uniquely and securely identify yourself • Truststore: knowledge of whom to trust 36 woensdag 3 oktober 12
Introduction Architecture Different Components, Different Separate binaries from config Firewall Personal Accounts Nodemanager Keystores SSL Domain Wide Administration Port Database Auditing • All java components use Java key stores (by default) • All system components use Oracle Wallets • Most system components need auto-login wallets • Default CAs are stored with JRE 37 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall When using WLST Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • -Dweblogic.security.SSL.trustedCAKeyStore=/path/to/ truststore.jks • Setup WLST_PROPERTIES in ${MW_HOME}/wlserver_10.3/common/bin/wlst.sh • Preferably create a wrapper script outside of your middleware home 38 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Nodemanager Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Setup in nodemanager.properties KeyStores=CustomIdentityAndCustomTrust CustomIdentityKeyStoreFileName=identity.jks CustomIdentityKeyStorePassPhrase=Welcome01 CustomIdentityAlias=oow12demo.area51.local CustomIdentityPrivateKeyPassPhrase=Welcome01 CustomTrustKeyStoreFileName=truststore.jks 39 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall WebLogic Servers Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Change keystoretype to Custom Identity (and Custom Trust) • Configure Identity Keystore • Configure Trust Keystore (if custom) • Configure Private key (whoami) • No disabling of hostname verification • 2 way SSL 40 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Layered Products Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Most can be configured from Enterprise Manager (you must have the administrator role!) • Credential Maps are all stored in an Oracle Wallet • Setup SSL in mod_wl_ohs.conf to encrypt traffic between OHS and WLS 41 woensdag 3 oktober 12
Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing • You can separate administration traffic from application traffic in your domain • Run administrative actions on separate threads from application threads • You can start a server in standby state • Since communication uses SSL, administration traffic (which includes such things as administrator passwords) is more secure 42 woensdag 3 oktober 12
Introduction Architecture Separate binaries from config Firewall Caveats Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • All servers in your domain must be configured with support for the SSL protocol • Port conflicts, override per managed server • Inter-layered product communication usually runs over user weblogic / a user with the administrator role • Register system components can be difficult / you cannot use standard config.sh GUI’s 43 woensdag 3 oktober 12
Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing 44 woensdag 3 oktober 12
Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing 44 woensdag 3 oktober 12
Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing 44 woensdag 3 oktober 12
Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing 44 woensdag 3 oktober 12
Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing Console/Management requests or requests with <require-admin-traffic> specified to 'true' can only be made through an administration channel 45 woensdag 3 oktober 12
Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam
Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam
Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam
Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam
Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam
Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam
Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam
Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam
Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam

Recommended

Oracle Fusion Middleware Infrastructure Best Practices
Oracle Fusion Middleware Infrastructure Best PracticesOracle Fusion Middleware Infrastructure Best Practices
Oracle Fusion Middleware Infrastructure Best PracticesRevelation Technologies
 
LAN v podání Brocade
LAN v podání BrocadeLAN v podání Brocade
LAN v podání BrocadeJaroslav Prodelal
 
Cloudian_Cassandra Summit 2012
Cloudian_Cassandra Summit 2012Cloudian_Cassandra Summit 2012
Cloudian_Cassandra Summit 2012CLOUDIAN KK
 
Cisco tec rob soderbery - core enterprise networking
Cisco tec rob soderbery - core enterprise networkingCisco tec rob soderbery - core enterprise networking
Cisco tec rob soderbery - core enterprise networkingCisco Public Relations
 
Ngn2004 Moving Up And To The Edges110204
Ngn2004 Moving Up And To The Edges110204Ngn2004 Moving Up And To The Edges110204
Ngn2004 Moving Up And To The Edges110204guestf6c708
 
Windows Server 2012 Active Directory Domain and Trust (Forest Trust)
Windows Server 2012 Active Directory Domain and Trust (Forest Trust)Windows Server 2012 Active Directory Domain and Trust (Forest Trust)
Windows Server 2012 Active Directory Domain and Trust (Forest Trust)Serhad MAKBULOĞLU, MBA
 
Lecture03 H
Lecture03 HLecture03 H
Lecture03 Hitsvineeth209
 
CloudPassage Overview
CloudPassage OverviewCloudPassage Overview
CloudPassage OverviewCloudPassage
 

Recommended

Oracle Fusion Middleware Infrastructure Best Practices
Oracle Fusion Middleware Infrastructure Best PracticesOracle Fusion Middleware Infrastructure Best Practices
Oracle Fusion Middleware Infrastructure Best PracticesRevelation Technologies
 
LAN v podání Brocade
LAN v podání BrocadeLAN v podání Brocade
LAN v podání BrocadeJaroslav Prodelal
 
Cloudian_Cassandra Summit 2012
Cloudian_Cassandra Summit 2012Cloudian_Cassandra Summit 2012
Cloudian_Cassandra Summit 2012CLOUDIAN KK
 
Cisco tec rob soderbery - core enterprise networking
Cisco tec rob soderbery - core enterprise networkingCisco tec rob soderbery - core enterprise networking
Cisco tec rob soderbery - core enterprise networkingCisco Public Relations
 
Ngn2004 Moving Up And To The Edges110204
Ngn2004 Moving Up And To The Edges110204Ngn2004 Moving Up And To The Edges110204
Ngn2004 Moving Up And To The Edges110204guestf6c708
 
Windows Server 2012 Active Directory Domain and Trust (Forest Trust)
Windows Server 2012 Active Directory Domain and Trust (Forest Trust)Windows Server 2012 Active Directory Domain and Trust (Forest Trust)
Windows Server 2012 Active Directory Domain and Trust (Forest Trust)Serhad MAKBULOĞLU, MBA
 
Lecture03 H
Lecture03 HLecture03 H
Lecture03 Hitsvineeth209
 
CloudPassage Overview
CloudPassage OverviewCloudPassage Overview
CloudPassage OverviewCloudPassage
 
Presentation citrix cloud platform for infrastructure as a service
Presentation citrix cloud platform for infrastructure as a servicePresentation citrix cloud platform for infrastructure as a service
Presentation citrix cloud platform for infrastructure as a servicexKinAnx
 
e-Infrastructures for Science and Industry
e-Infrastructures for Science and Industrye-Infrastructures for Science and Industry
e-Infrastructures for Science and IndustryWolfgang Gentzsch
 
What’s new in windows server 2012
What’s new in windows server 2012What’s new in windows server 2012
What’s new in windows server 2012Alex de Jong
 
Monetizing the Enterprise: Borderless Networks
Monetizing the Enterprise: Borderless NetworksMonetizing the Enterprise: Borderless Networks
Monetizing the Enterprise: Borderless NetworksCisco Service Provider Mobility
 
Emulex OneConnect Universal CNA (Deep Dive)
Emulex OneConnect Universal CNA (Deep Dive)Emulex OneConnect Universal CNA (Deep Dive)
Emulex OneConnect Universal CNA (Deep Dive)Emulex Corporation
 
Oracle Public Cloud: Oracle Java Cloud Service, by Nino Guarnacci
Oracle Public Cloud: Oracle Java Cloud Service, by Nino GuarnacciOracle Public Cloud: Oracle Java Cloud Service, by Nino Guarnacci
Oracle Public Cloud: Oracle Java Cloud Service, by Nino GuarnacciCodemotion
 
MySQL Cluster
MySQL ClusterMySQL Cluster
MySQL ClusterMySQL Brasil
 
Open Cloud System Networking Vision
Open Cloud System Networking VisionOpen Cloud System Networking Vision
Open Cloud System Networking VisionRandy Bias
 
Evaluating Apache Cassandra as a Cloud Database
Evaluating Apache Cassandra as a Cloud DatabaseEvaluating Apache Cassandra as a Cloud Database
Evaluating Apache Cassandra as a Cloud DatabaseDataStax
 
What is cloud computing
What is cloud computingWhat is cloud computing
What is cloud computingBrian Bullard
 
Cloud Networking: Network aspects of the cloud
Cloud Networking: Network aspects of the cloudCloud Networking: Network aspects of the cloud
Cloud Networking: Network aspects of the cloudSAIL
 
Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...
Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...
Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...EMC Forum India
 
Emc world svpg68_2011_05_06_final
Emc world svpg68_2011_05_06_finalEmc world svpg68_2011_05_06_final
Emc world svpg68_2011_05_06_finalItzik Reich
 
WebLogic 12c Developer Deep Dive at Oracle Develop India 2012
WebLogic 12c Developer Deep Dive at Oracle Develop India 2012WebLogic 12c Developer Deep Dive at Oracle Develop India 2012
WebLogic 12c Developer Deep Dive at Oracle Develop India 2012Arun Gupta
 
Containers 101 Meetup - VMs vs Containers
Containers 101 Meetup - VMs vs ContainersContainers 101 Meetup - VMs vs Containers
Containers 101 Meetup - VMs vs ContainersTommy Berry
 
Stacking up with OpenStack: building for High Availability
Stacking up with OpenStack: building for High AvailabilityStacking up with OpenStack: building for High Availability
Stacking up with OpenStack: building for High AvailabilityOpenStack Foundation
 
Stacking up with OpenStack: Building for High Availability
Stacking up with OpenStack: Building for High AvailabilityStacking up with OpenStack: Building for High Availability
Stacking up with OpenStack: Building for High AvailabilityOpenStack Foundation
 
Network Management in System Center 2012 SP1 - VMM
Network Management in System Center 2012 SP1 - VMM Network Management in System Center 2012 SP1 - VMM
Network Management in System Center 2012 SP1 - VMM Microsoft TechNet - Belgium and Luxembourg
 
Simple, Scalable and Secure Networking for Data Centers with Project Calico
Simple, Scalable and Secure Networking for Data Centers with Project CalicoSimple, Scalable and Secure Networking for Data Centers with Project Calico
Simple, Scalable and Secure Networking for Data Centers with Project CalicoEmma Gordon
 
Lessons Learned From Running Spark On Docker
Lessons Learned From Running Spark On DockerLessons Learned From Running Spark On Docker
Lessons Learned From Running Spark On DockerSpark Summit
 
AMIS Oracle OpenWorld en Code One Review 2018 - Blockchain, Integration, Serv...
AMIS Oracle OpenWorld en Code One Review 2018 - Blockchain, Integration, Serv...AMIS Oracle OpenWorld en Code One Review 2018 - Blockchain, Integration, Serv...
AMIS Oracle OpenWorld en Code One Review 2018 - Blockchain, Integration, Serv...Getting value from IoT, Integration and Data Analytics
 
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: Custom Application ...
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: Custom Application ...AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: Custom Application ...
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: Custom Application ...Getting value from IoT, Integration and Data Analytics
 

More Related Content

Similar to Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam

Presentation citrix cloud platform for infrastructure as a service
Presentation citrix cloud platform for infrastructure as a servicePresentation citrix cloud platform for infrastructure as a service
Presentation citrix cloud platform for infrastructure as a servicexKinAnx
 
e-Infrastructures for Science and Industry
e-Infrastructures for Science and Industrye-Infrastructures for Science and Industry
e-Infrastructures for Science and IndustryWolfgang Gentzsch
 
What’s new in windows server 2012
What’s new in windows server 2012What’s new in windows server 2012
What’s new in windows server 2012Alex de Jong
 
Emulex OneConnect Universal CNA (Deep Dive)
Emulex OneConnect Universal CNA (Deep Dive)Emulex OneConnect Universal CNA (Deep Dive)
Emulex OneConnect Universal CNA (Deep Dive)Emulex Corporation
 
Oracle Public Cloud: Oracle Java Cloud Service, by Nino Guarnacci
Oracle Public Cloud: Oracle Java Cloud Service, by Nino GuarnacciOracle Public Cloud: Oracle Java Cloud Service, by Nino Guarnacci
Oracle Public Cloud: Oracle Java Cloud Service, by Nino GuarnacciCodemotion
 
Open Cloud System Networking Vision
Open Cloud System Networking VisionOpen Cloud System Networking Vision
Open Cloud System Networking VisionRandy Bias
 
Evaluating Apache Cassandra as a Cloud Database
Evaluating Apache Cassandra as a Cloud DatabaseEvaluating Apache Cassandra as a Cloud Database
Evaluating Apache Cassandra as a Cloud DatabaseDataStax
 
What is cloud computing
What is cloud computingWhat is cloud computing
What is cloud computingBrian Bullard
 
Cloud Networking: Network aspects of the cloud
Cloud Networking: Network aspects of the cloudCloud Networking: Network aspects of the cloud
Cloud Networking: Network aspects of the cloudSAIL
 
Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...
Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...
Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...EMC Forum India
 
Emc world svpg68_2011_05_06_final
Emc world svpg68_2011_05_06_finalEmc world svpg68_2011_05_06_final
Emc world svpg68_2011_05_06_finalItzik Reich
 
WebLogic 12c Developer Deep Dive at Oracle Develop India 2012
WebLogic 12c Developer Deep Dive at Oracle Develop India 2012WebLogic 12c Developer Deep Dive at Oracle Develop India 2012
WebLogic 12c Developer Deep Dive at Oracle Develop India 2012Arun Gupta
 
Containers 101 Meetup - VMs vs Containers
Containers 101 Meetup - VMs vs ContainersContainers 101 Meetup - VMs vs Containers
Containers 101 Meetup - VMs vs ContainersTommy Berry
 
Stacking up with OpenStack: building for High Availability
Stacking up with OpenStack: building for High AvailabilityStacking up with OpenStack: building for High Availability
Stacking up with OpenStack: building for High AvailabilityOpenStack Foundation
 
Stacking up with OpenStack: Building for High Availability
Stacking up with OpenStack: Building for High AvailabilityStacking up with OpenStack: Building for High Availability
Stacking up with OpenStack: Building for High AvailabilityOpenStack Foundation
 
Simple, Scalable and Secure Networking for Data Centers with Project Calico
Simple, Scalable and Secure Networking for Data Centers with Project CalicoSimple, Scalable and Secure Networking for Data Centers with Project Calico
Simple, Scalable and Secure Networking for Data Centers with Project CalicoEmma Gordon
 
Lessons Learned From Running Spark On Docker
Lessons Learned From Running Spark On DockerLessons Learned From Running Spark On Docker
Lessons Learned From Running Spark On DockerSpark Summit
 

Similar to Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam (20)

Presentation citrix cloud platform for infrastructure as a service
Presentation citrix cloud platform for infrastructure as a servicePresentation citrix cloud platform for infrastructure as a service
Presentation citrix cloud platform for infrastructure as a service
 
e-Infrastructures for Science and Industry
e-Infrastructures for Science and Industrye-Infrastructures for Science and Industry
e-Infrastructures for Science and Industry
 
What’s new in windows server 2012
What’s new in windows server 2012What’s new in windows server 2012
What’s new in windows server 2012
 
Monetizing the Enterprise: Borderless Networks
Monetizing the Enterprise: Borderless NetworksMonetizing the Enterprise: Borderless Networks
Monetizing the Enterprise: Borderless Networks
 
Emulex OneConnect Universal CNA (Deep Dive)
Emulex OneConnect Universal CNA (Deep Dive)Emulex OneConnect Universal CNA (Deep Dive)
Emulex OneConnect Universal CNA (Deep Dive)
 
Oracle Public Cloud: Oracle Java Cloud Service, by Nino Guarnacci
Oracle Public Cloud: Oracle Java Cloud Service, by Nino GuarnacciOracle Public Cloud: Oracle Java Cloud Service, by Nino Guarnacci
Oracle Public Cloud: Oracle Java Cloud Service, by Nino Guarnacci
 
MySQL Cluster
MySQL ClusterMySQL Cluster
MySQL Cluster
 
Open Cloud System Networking Vision
Open Cloud System Networking VisionOpen Cloud System Networking Vision
Open Cloud System Networking Vision
 
Evaluating Apache Cassandra as a Cloud Database
Evaluating Apache Cassandra as a Cloud DatabaseEvaluating Apache Cassandra as a Cloud Database
Evaluating Apache Cassandra as a Cloud Database
 
What is cloud computing
What is cloud computingWhat is cloud computing
What is cloud computing
 
Cloud Networking: Network aspects of the cloud
Cloud Networking: Network aspects of the cloudCloud Networking: Network aspects of the cloud
Cloud Networking: Network aspects of the cloud
 
Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...
Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...
Track 2, Session 2, worlds most powerful intelligent and trusted storage syst...
 
Emc world svpg68_2011_05_06_final
Emc world svpg68_2011_05_06_finalEmc world svpg68_2011_05_06_final
Emc world svpg68_2011_05_06_final
 
WebLogic 12c Developer Deep Dive at Oracle Develop India 2012
WebLogic 12c Developer Deep Dive at Oracle Develop India 2012WebLogic 12c Developer Deep Dive at Oracle Develop India 2012
WebLogic 12c Developer Deep Dive at Oracle Develop India 2012
 
Containers 101 Meetup - VMs vs Containers
Containers 101 Meetup - VMs vs ContainersContainers 101 Meetup - VMs vs Containers
Containers 101 Meetup - VMs vs Containers
 
Stacking up with OpenStack: building for High Availability
Stacking up with OpenStack: building for High AvailabilityStacking up with OpenStack: building for High Availability
Stacking up with OpenStack: building for High Availability
 
Stacking up with OpenStack: Building for High Availability
Stacking up with OpenStack: Building for High AvailabilityStacking up with OpenStack: Building for High Availability
Stacking up with OpenStack: Building for High Availability
 
Network Management in System Center 2012 SP1 - VMM
Network Management in System Center 2012 SP1 - VMM Network Management in System Center 2012 SP1 - VMM
Network Management in System Center 2012 SP1 - VMM
 
Simple, Scalable and Secure Networking for Data Centers with Project Calico
Simple, Scalable and Secure Networking for Data Centers with Project CalicoSimple, Scalable and Secure Networking for Data Centers with Project Calico
Simple, Scalable and Secure Networking for Data Centers with Project Calico
 
Lessons Learned From Running Spark On Docker
Lessons Learned From Running Spark On DockerLessons Learned From Running Spark On Docker
Lessons Learned From Running Spark On Docker
 

More from Getting value from IoT, Integration and Data Analytics

More from Getting value from IoT, Integration and Data Analytics (20)

AMIS Oracle OpenWorld en Code One Review 2018 - Blockchain, Integration, Serv...
AMIS Oracle OpenWorld en Code One Review 2018 - Blockchain, Integration, Serv...AMIS Oracle OpenWorld en Code One Review 2018 - Blockchain, Integration, Serv...
AMIS Oracle OpenWorld en Code One Review 2018 - Blockchain, Integration, Serv...
 
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: Custom Application ...
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: Custom Application ...AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: Custom Application ...
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: Custom Application ...
 
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: SaaS
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: SaaSAMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: SaaS
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 2: SaaS
 
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 1: Data
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 1: DataAMIS Oracle OpenWorld en Code One Review 2018 - Pillar 1: Data
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 1: Data
 
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 1: Cloud Infrastructure
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 1: Cloud Infrastructure AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 1: Cloud Infrastructure
AMIS Oracle OpenWorld en Code One Review 2018 - Pillar 1: Cloud Infrastructure
 
10 tips voor verbetering in je Linkedin profiel
10 tips voor verbetering in je Linkedin profiel10 tips voor verbetering in je Linkedin profiel
10 tips voor verbetering in je Linkedin profiel
 
Iot in de zorg the next step - fit for purpose
Iot in de zorg the next step - fit for purpose Iot in de zorg the next step - fit for purpose
Iot in de zorg the next step - fit for purpose
 
Iot overview .. Best practices and lessons learned by Conclusion Conenct
Iot overview .. Best practices and lessons learned by Conclusion Conenct Iot overview .. Best practices and lessons learned by Conclusion Conenct
Iot overview .. Best practices and lessons learned by Conclusion Conenct
 
IoT Fit for purpose - how to be successful in IOT Conclusion Connect
IoT Fit for purpose - how to be successful in IOT Conclusion Connect IoT Fit for purpose - how to be successful in IOT Conclusion Connect
IoT Fit for purpose - how to be successful in IOT Conclusion Connect
 
Industry and IOT Overview of protocols and best practices Conclusion Connect
Industry and IOT Overview of protocols and best practices Conclusion ConnectIndustry and IOT Overview of protocols and best practices Conclusion Connect
Industry and IOT Overview of protocols and best practices Conclusion Connect
 
IoT practical case using the people counter sensing traffic density build usi...
IoT practical case using the people counter sensing traffic density build usi...IoT practical case using the people counter sensing traffic density build usi...
IoT practical case using the people counter sensing traffic density build usi...
 
R introduction decision_trees
R introduction decision_treesR introduction decision_trees
R introduction decision_trees
 
Introduction overviewmachinelearning sig Door Lucas Jellema
Introduction overviewmachinelearning sig Door Lucas JellemaIntroduction overviewmachinelearning sig Door Lucas Jellema
Introduction overviewmachinelearning sig Door Lucas Jellema
 
IoT and the Future of work
IoT and the Future of work IoT and the Future of work
IoT and the Future of work
 
Oracle OpenWorld 2017 Review (31st October 2017 - 250 slides)
Oracle OpenWorld 2017 Review (31st October 2017 - 250 slides)Oracle OpenWorld 2017 Review (31st October 2017 - 250 slides)
Oracle OpenWorld 2017 Review (31st October 2017 - 250 slides)
 
Ethereum smart contracts - door Peter Reitsma
Ethereum smart contracts - door Peter ReitsmaEthereum smart contracts - door Peter Reitsma
Ethereum smart contracts - door Peter Reitsma
 
Blockchain - Techniek en usecases door Robert van Molken - AMIS - Conclusion
Blockchain - Techniek en usecases door Robert van Molken - AMIS - ConclusionBlockchain - Techniek en usecases door Robert van Molken - AMIS - Conclusion
Blockchain - Techniek en usecases door Robert van Molken - AMIS - Conclusion
 
kennissessie blockchain - Wat is Blockchain en smart contracts @Conclusion
kennissessie blockchain - Wat is Blockchain en smart contracts @Conclusion kennissessie blockchain - Wat is Blockchain en smart contracts @Conclusion
kennissessie blockchain - Wat is Blockchain en smart contracts @Conclusion
 
Internet of Things propositie - Enterprise IOT - AMIS - Conclusion
Internet of Things propositie - Enterprise IOT - AMIS - Conclusion Internet of Things propositie - Enterprise IOT - AMIS - Conclusion
Internet of Things propositie - Enterprise IOT - AMIS - Conclusion
 
Omc AMIS evenement 26012017 Dennis van Soest
Omc AMIS evenement 26012017 Dennis van SoestOmc AMIS evenement 26012017 Dennis van Soest
Omc AMIS evenement 26012017 Dennis van Soest
 

Recently uploaded

How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity PlanDatabarracks
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clashcharlottematthew16
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 
Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfRankYa
 
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfHyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfPrecisely
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsMiki Katsuragi
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteDianaGray10
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLScyllaDB
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubKalema Edgar
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Mattias Andersson
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy
 

Recently uploaded (20)

How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity Plan
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clash
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 
Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdf
 
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfHyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering Tips
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test Suite
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQL
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding Club
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache Maven
 

Tips and Trics for hardening Oracle Fusion Middleware - Jacco Landlust & Simon Haslam

  • 1. Tips and Tricks for hardening Oracle Fusion Middleware a presentation by Jacco Landlust & Simon Haslam woensdag 3 oktober 12
  • 2. Introduction Architecture Separate binaries from config Firewall Jacco H. Landlust Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • 35 years old • Deventer, the Netherlands • Lives Together with Margot, 2 Daughters (Franka & Jules) and our Cat 2 woensdag 3 oktober 12
  • 3. Introduction Architecture Separate binaries from config Firewall Jacco H. Landlust / iDBA Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Independent Red Stack Administrator • Oracle since 2000 • Oracle ACE since 2006 • iDBA since 2010 • Architecture, Clustering, High Availability, Performance & Management 3 woensdag 3 oktober 12
  • 4. Introduction Architecture Separate binaries from config Firewall Simon Haslam Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Over 35 years old • Sherborne, UK 4 woensdag 3 oktober 12
  • 5. Introduction Architecture Separate binaries from config Firewall Simon Haslam Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Oracle since 1996 (UNIX since 1989) • Founded Veriton in 1996 • Oracle ACE Director since 2009 • Chair of the UKOUG Application Server & Middleware SIG • Architecture, Design, Installation • http://simonhaslam.co.uk 5 woensdag 3 oktober 12
  • 6. Introduction Architecture Separate binaries from config Firewall Why present together? Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Lone wolf pack • We just like to talk, share ideas and discuss Oracle Fusion Middleware administrator topics • Oracle Infrastructure Administrators Group 6 woensdag 3 oktober 12
  • 7. Introduction Architecture Separate binaries from config Firewall Prerequisites & Disclaimer Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • This is a technical presentation • Background knowledge about middleware is assumed • Best practices of our (Limited) experience • We do not work for Oracle / represent Oracle • We do not pretend this list is complete • We are not ‘native’ American speakers 7 woensdag 3 oktober 12
  • 8. Tips and Tricks for hardening Oracle Fusion Middleware 8 woensdag 3 oktober 12
  • 9. Introduction Architecture Separate binaries from config Firewall Whatever you do Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Run on “current” versions • Monitor for critical patches by Oracle • Apply PSU’s / CPU’s 9 woensdag 3 oktober 12
  • 10. Introduction Architecture Separate binaries from config Firewall Architecture Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Decide upon definitions in your team • Document your train of thoughts • We love pictures • Segregation of environments (DTAP) • Start with security measures in DEV • Use SSL wherever you can 10 woensdag 3 oktober 12
  • 11. Introduction Architecture Separate binaries from config Firewall Architecture Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Separate system components from Java components • Separate directories • Separate binaries from configuration • Separate AdminServer from Managed Servers • Standardize & automate as much as possible 11 woensdag 3 oktober 12
  • 12. Introduction Architecture Separate binaries from config Firewall Architecture Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Tiered architecture • Think about access to components: • from where? • to what? • by whom? 12 woensdag 3 oktober 12
  • 13. Introduction Architecture Separate binaries from config Firewall Architecture Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing 13 woensdag 3 oktober 12
  • 14. Introduction Architecture Separate binaries from config Firewall Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing 14 woensdag 3 oktober 12
  • 15. Introduction Architecture Separate binaries Separate binaries from config Firewall Personal Accounts Nodemanager from configuration SSL Domain Wide Administration Port Database Auditing • No chance of runtime user altering binaries • Runtime users secondary group is primary group of binary owner • Need to fix privileges on some files / directories • One nodemanager per runtime user 15 woensdag 3 oktober 12
  • 16. Introduction Architecture Separate binaries from config Firewall Caveats Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • One nodemanager per runtime user • Startup binary of system owner needs to be owner by runtime user • Different layared products have different requirements 16 woensdag 3 oktober 12
  • 17. Introduction Architecture Separate binaries from config Firewall Fix Privileges Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing find ${MW_HOME} -type d -exec chmod g+rx {} ; find ${MW_HOME} -type f -exec chmod g+r {} ; chmod g+w ${MW_HOME}/logs touch ${MW_HOME}/domain-registry.xml chmod g+w ${MW_HOME}/domain-registry.xml touch ${MW_HOME}/common/nodemanager/nodemanager.domains chmod g+w ${MW_HOME}/wlserver_10.3/common/nodemanager/nodemanager.domains chmod g+w ${MW_HOME}/wlserver_10.3/server/lib chmod g+w ${MW_HOME}/wlserver_10.3/server/lib/*.jks chmod g+w ${MW_HOME}/oracle_common/sysman chmod g+r ${MW_HOME}/oracle_common/modules/oracle.javacache_11.1.1/server_config/.sslConfig chmod g+r ${MW_HOME}/oracle_common/modules/oracle.javacache_11.1.1/server_config/.joc_demo_keystore.jks chmod g+r ${MW_HOME}/oracle_common/modules/oracle.javacache_11.1.1/server_config/.KEYSTORE find ${MW_HOME} -name perl -exec chmod g+rx {} ; find ${MW_HOME} -name emagent -exec chmod g+rx {} ; find ${MW_HOME} -name emctl -exec chmod g+rx {} ; find ${MW_HOME} -name emdctl -exec chmod g+rx {} ; chown root ${MW_HOME}/Oracle_WT1/ohs/bin/.apachectl chmod 6750 ${MW_HOME}/Oracle_WT1/ohs/bin/.apachectl chown ${DOMUSR} ${MW_HOME}/Oracle_WT1/ohs/bin/apachectl 17 woensdag 3 oktober 12
  • 18. Introduction Architecture Separate binaries from config Firewall Firewall Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing http://en.wikipedia.org/wiki/Firewall_(computing) A firewall primary objective is to control the incoming and outgoing network traffic by analyzing the data packets and determining whether it should be allowed through or not, based on a predetermined rule set. A network's firewall builds a bridge between an internal network that is assumed to be secure and trusted, and another network, usually an external (inter)network, such as the Internet, that is not assumed to be secure and trusted 18 woensdag 3 oktober 12
  • 19. Introduction Architecture Separate binaries from config Firewall Network Connection Filter Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Connection filters let you deny access at the network level • Network connection filters are a type of firewall in that they can be configured to filter on protocols, IP addresses, and DNS node names • Careful: rules are domain wide 19 woensdag 3 oktober 12
  • 20. Introduction Architecture Connection Filter Separate binaries from config Firewall Personal Accounts Nodemanager Rules Syntax SSL Domain Wide Administration Port Database Auditing Each rule must be written on a single line. • Tokens in a rule are separated by white space. • A pound sign (#) is the comment character. Everything after a pound sign on a line is ignored. • Whitespace before or after a rule is ignored. • When entering the filter rules on the Administration Console, enter them in the following format: target localAddress localPort action protocols • If no protocol is defined, all protocols will match a rule • The rules are evaluated in the order in which they were written 20 woensdag 3 oktober 12
  • 21. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 127.0.0.1 * 7001 allow 192.168.56.101 * 7001 allow 0.0.0.0/0 * 7001 allow http 0.0.0.0/0 * 7001 deny 21 woensdag 3 oktober 12
  • 22. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
  • 23. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
  • 24. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
  • 25. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
  • 26. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 22 woensdag 3 oktober 12
  • 27. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing weblogic.security.net.ConnectionFilterImpl 22 woensdag 3 oktober 12
  • 28. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing weblogic.security.net.ConnectionFilterImpl 22 woensdag 3 oktober 12
  • 29. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing weblogic.security.net.ConnectionFilterImpl 22 woensdag 3 oktober 12
  • 30. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing <29-sep-2012 11:58:00 uur CEST> <Notice> <Socket> <BEA-000445> <Connection rejected, filter blocked Socket[addr=192.168.56.1,port=49182,localport=7001], weblogic.security.net.FilterException: [Security:090220]rule 4> 23 woensdag 3 oktober 12
  • 31. Introduction Architecture Setup filter to block Separate binaries from config Firewall Personal Accounts Nodemanager all non-http traffic SSL Domain Wide Administration Port Database Auditing 127.0.0.1 * 7001 allow 192.168.56.101 * 7001 allow 0.0.0.0/0 * 7001 allow http 0.0.0.0/0 * 7001 deny 24 woensdag 3 oktober 12
  • 32. Introduction Architecture Separate binaries from config Firewall Personal Accounts Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Trace administrative actions to a human • Authentication providers • Identity assertion authentication provider • JAAS control flags • Order of providers matters • Most FMW layered products only find group memberships (and groups) for the first provider 25 woensdag 3 oktober 12
  • 33. Introduction Architecture Separate binaries from config Firewall Role Based Privileges Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • For WebLogic configured in /console • For most Fusion Middleware application configured in /em • Policy store provider in OID or Database 26 woensdag 3 oktober 12
  • 34. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing CREATE TABLE USERS ( U_NAME VARCHAR(200) NOT NULL, U_PASSWORD VARCHAR(50) NOT NULL, U_DESCRIPTION VARCHAR(1000), CONSTRAINT PK_USERS PRIMARY KEY (U_NAME)); CREATE TABLE GROUPS ( G_NAME VARCHAR(200) NOT NULL, G_DESCRIPTION VARCHAR(1000) NULL, CONSTRAINT PK_GROUPS PRIMARY KEY (G_NAME)); 27 woensdag 3 oktober 12
  • 35. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing CREATE TABLE GROUPMEMBERS ( G_NAME VARCHAR(200) NOT NULL, G_MEMBER VARCHAR(200) NOT NULL, CONSTRAINT PK_GROUPMEMBERS PRIMARY KEY (G_NAME,G_MEMBER), CONSTRAINT FK1_GROUPMEMBERS FOREIGN KEY ( G_NAME ) REFERENCES GROUPS (G_NAME) ON DELETE CASCADE, CONSTRAINT FK2_GROUPMEMBERS FOREIGN KEY ( G_MEMBER ) REFERENCES USERS (U_NAME) ON DELETE CASCADE ); 28 woensdag 3 oktober 12
  • 36. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing insert into USERS (U_NAME,U_PASSWORD,U_DESCRIPTION) values('jacco','Welcome01','admin user'); insert into GROUPS (G_NAME,G_DESCRIPTION) values('Administrators','Adnministrators'); insert into GROUPMEMBERS (G_NAME,G_MEMBER) values('Administrators','jacco'); 29 woensdag 3 oktober 12
  • 37. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 38. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 39. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 40. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 41. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 42. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 43. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 44. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 45. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 46. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 47. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 48. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 49. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 50. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 51. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 30 woensdag 3 oktober 12
  • 52. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 53. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 54. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 55. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 56. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 57. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 58. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 59. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 60. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 61. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 62. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 63. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 64. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 65. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 66. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 67. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 68. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 69. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 70. Introduction Architecture SQL Based Separate binaries from config Firewall Personal Accounts Nodemanager Authentication Provider SSL Domain Wide Administration Port Database Auditing 31 woensdag 3 oktober 12
  • 71. Introduction Architecture Separate binaries from config Firewall Nodemanager Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Always use secureListener=true • Setup credentials to custom user • Store and protect credentials in keyfiles • Never use demo certificates (in production) 32 woensdag 3 oktober 12
  • 72. Introduction Architecture Secure Sockets Layer / Separate binaries from config Firewall Personal Accounts Nodemanager Transport Layer Security SSL Domain Wide Administration Port Database Auditing • TLS and predecessor SSL are cryptographic protocols • The TLS protocol allows client-server applications to communicate across a network in a way designed to prevent eavesdropping and tamering. 33 woensdag 3 oktober 12
  • 73. Introduction Architecture Separate binaries from config Firewall How does it work? Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing 1. The client sends the server the client's SSL version number, cipher settings, session-specific data, and other information that the server needs to communicate with the client using SSL. 2. The server sends the client the server's SSL version number, cipher settings, session-specific data, and other information that the client needs to communicate with the server over SSL. The server also sends its own certificate, and if the client is requesting a server resource that requires client authentication, the server requests the client's certificate. 3. The client uses the information sent by the server to authenticate the server (see Server Authentication for details). If the server cannot be authenticated, the user is warned of the problem and informed that an encrypted and authenticated connection cannot be established. If the server can be successfully authenticated, the client proceeds to step 4. 4. Using all data generated in the handshake thus far, the client (with the cooperation of the server, depending on the cipher being used) creates the pre-master secret for the session, encrypts it with the server's public key (obtained from the server's certificate, sent in step 2), and then sends the encrypted pre-master secret to the server. 5. If the server has requested client authentication (an optional step in the handshake), the client also signs another piece of data that is unique to this handshake and known by both the client and server. In this case, the client sends both the signed data and the client's own certificate to the server along with the encrypted pre-master secret. 34 woensdag 3 oktober 12
  • 74. Introduction Architecture Separate binaries from config Firewall How does it work? Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing 6. If the server has requested client authentication, the server attempts to authenticate the client (see Client Authentication for details). If the client cannot be authenticated, the session ends. If the client can be successfully authenticated, the server uses its private key to decrypt the pre-master secret, and then performs a series of steps (which the client also performs, starting from the same pre-master secret) to generate the master secret. 7. Both the client and the server use the master secret to generate the session keys, which are symmetric keys used to encrypt and decrypt information exchanged during the SSL session and to verify its integrity (that is, to detect any changes in the data between the time it was sent and the time it is received over the SSL connection). 8. The client sends a message to the server informing it that future messages from the client will be encrypted with the session key. It then sends a separate (encrypted) message indicating that the client portion of the handshake is finished. 9. The server sends a message to the client informing it that future messages from the server will be encrypted with the session key. It then sends a separate (encrypted) message indicating that the server portion of the handshake is finished. source: http://en.wikipedia.org/wiki/Secure_Sockets_Layer 35 woensdag 3 oktober 12
  • 75. Introduction Architecture Separate binaries from config Firewall Key Information Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Identity store: information to uniquely and securely identify yourself • Truststore: knowledge of whom to trust 36 woensdag 3 oktober 12
  • 76. Introduction Architecture Different Components, Different Separate binaries from config Firewall Personal Accounts Nodemanager Keystores SSL Domain Wide Administration Port Database Auditing • All java components use Java key stores (by default) • All system components use Oracle Wallets • Most system components need auto-login wallets • Default CAs are stored with JRE 37 woensdag 3 oktober 12
  • 77. Introduction Architecture Separate binaries from config Firewall When using WLST Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • -Dweblogic.security.SSL.trustedCAKeyStore=/path/to/ truststore.jks • Setup WLST_PROPERTIES in ${MW_HOME}/wlserver_10.3/common/bin/wlst.sh • Preferably create a wrapper script outside of your middleware home 38 woensdag 3 oktober 12
  • 78. Introduction Architecture Separate binaries from config Firewall Nodemanager Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Setup in nodemanager.properties KeyStores=CustomIdentityAndCustomTrust CustomIdentityKeyStoreFileName=identity.jks CustomIdentityKeyStorePassPhrase=Welcome01 CustomIdentityAlias=oow12demo.area51.local CustomIdentityPrivateKeyPassPhrase=Welcome01 CustomTrustKeyStoreFileName=truststore.jks 39 woensdag 3 oktober 12
  • 79. Introduction Architecture Separate binaries from config Firewall WebLogic Servers Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Change keystoretype to Custom Identity (and Custom Trust) • Configure Identity Keystore • Configure Trust Keystore (if custom) • Configure Private key (whoami) • No disabling of hostname verification • 2 way SSL 40 woensdag 3 oktober 12
  • 80. Introduction Architecture Separate binaries from config Firewall Layered Products Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • Most can be configured from Enterprise Manager (you must have the administrator role!) • Credential Maps are all stored in an Oracle Wallet • Setup SSL in mod_wl_ohs.conf to encrypt traffic between OHS and WLS 41 woensdag 3 oktober 12
  • 81. Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing • You can separate administration traffic from application traffic in your domain • Run administrative actions on separate threads from application threads • You can start a server in standby state • Since communication uses SSL, administration traffic (which includes such things as administrator passwords) is more secure 42 woensdag 3 oktober 12
  • 82. Introduction Architecture Separate binaries from config Firewall Caveats Personal Accounts Nodemanager SSL Domain Wide Administration Port Database Auditing • All servers in your domain must be configured with support for the SSL protocol • Port conflicts, override per managed server • Inter-layered product communication usually runs over user weblogic / a user with the administrator role • Register system components can be difficult / you cannot use standard config.sh GUI’s 43 woensdag 3 oktober 12
  • 83. Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing 44 woensdag 3 oktober 12
  • 84. Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing 44 woensdag 3 oktober 12
  • 85. Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing 44 woensdag 3 oktober 12
  • 86. Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing 44 woensdag 3 oktober 12
  • 87. Introduction Architecture Domain Wide Separate binaries from config Firewall Personal Accounts Nodemanager Administration Port SSL Domain Wide Administration Port Database Auditing Console/Management requests or requests with <require-admin-traffic> specified to 'true' can only be made through an administration channel 45 woensdag 3 oktober 12