![19
Strong Isolation and Resource Control
Oracle Solaris Containers Example
(Virtual)
Server
Operating
System
ServiceDB
Server
DB
Server
DB
Server
$ pfexec zonecfg –z ozone info
zonename: ozone
zonepath: /export/zones/ozone
[…]
[max-lwps: 300]
[cpu-shares: 100]
fs:
dir: /etc/security/audit_control
type: lofs
options: [ro, nosuid, nodevices]
[…]
inherit-pkg-dir:
dir: /lib
inherit-pkg-dir:
dir: /platform
inherit-pkg-dir:
dir: /sbin
inherit-pkg-dir:
dir: /usr
[…]
Each Container can
have its own defined
set of resources, file
systems, network
interfaces, etc.](https://image.slidesharecdn.com/presentation-deployingoracledatabase11gsecurelyonoraclesolaris-150728024532-lva1-app6891/85/Presentation-deploying-oracle-database-11g-securely-on-oracle-solaris-19-320.jpg)
![21Copyright © 2010 Oracle Corporation
Comprehensive Monitoring
Oracle Solaris Auditing Example
Event: profile command
time: 2010-09-08 11:56:11.511 -04:00 vers: 2 mod: host: quasar
SUBJECT audit-uid: gbrunett uid: root gid: joe ruid: joe pid: 5015
sid: 685 tid: 0 0 quasar
PATH: /usr/sbin/reboot
CMD
PROCESS: audit-uid: gbrunett uid: root gid: joe ruid: root rgid:
joe pid: 5015 sid: 685 tid: 0 0 quasar
RETURN errval: success retval: 0
ZONE name: ozone
[…]
Event: reboot(1m)
time: 2010-09-08 11:56:11.522 -04:00 vers: 2 mod: host: quasar
SUBJECT: audit-uid: gbrunett uid: root gid: joe ruid: root rgid:
joe pid: 5015 sid:685 tid: 0 0 quasar
RETURN errval: success retval: 0
ZONE name: ozone
Activity is captured
retaining the ID of
the original actor](https://image.slidesharecdn.com/presentation-deployingoracledatabase11gsecurelyonoraclesolaris-150728024532-lva1-app6891/85/Presentation-deploying-oracle-database-11g-securely-on-oracle-solaris-21-320.jpg)
Presentation deploying oracle database 11g securely on oracle solaris
- 1. 1Copyright © 2010 Oracle Corporation
- 2. <Insert Picture Here> Deploying Oracle Database 11g Securely on Oracle Solaris Glenn Brunette Senior Director, Enterprise Security Solutions
- 3. 3Copyright © 2010 Oracle Corporation The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.
- 4. 4Copyright © 2010 Oracle Corporation Agenda • Introduction – Why Focus on Operating Systems? – How Can Oracle Solaris Help? • Deploying On A Strong Foundation – Reduced Attack Surface – Separation of Duty and Least Privilege – Strong Isolation and Resource Control – Comprehensive Monitoring • Embracing a Defense in Depth Architecture – Hardware, Operating System and Database Security
- 5. 5Copyright © 2010 Oracle Corporation Why Focus on the Operating System? • Burglars Don’t Always Use the Front Door – Similar goals can be achieved using different methods
- 6. 6Copyright © 2010 Oracle Corporation Why Focus on the Operating System? • Burglars Don’t Always Use the Front Door – Similar goals can be achieved using different methods • Attacks Don’t Always Originate in the Database – Operating system access provides unique opportunities
- 7. 7Copyright © 2010 Oracle Corporation Why Focus on the Operating System? • Burglars Don’t Always Use the Front Door – Similar goals can be achieved using different methods • Attacks Don’t Always Originate in the Database – Operating system access provides unique opportunities • Security Must Be Systemically Applied – A chain is only as strong as its weakest link
- 8. 8Copyright © 2010 Oracle Corporation How Can Oracle Solaris Help? • Reduced Attack Surface – Package Minimization – (Network) Secure by Default • Separation of Duty and Least Privilege – User Rights Management – Process Rights Management • Strong Isolation and Resource Control – Logical Domains – Containers • Comprehensive Monitoring – Auditing
- 9. 9Copyright © 2010 Oracle Corporation Reduced Attack Surface Oracle Solaris Package Minimization • Selectively install only what is needed – Reduce the operating system file foot print – 3.6 GB vs. 550M (disk consumed by Entire+OEM vs. Reduced Networking) • Uninstalled software… – can not be executed or exploited – does not need updates or patching – does not need configuration or maintenance • Foundation for specialized deployments and appliances
- 10. 10Copyright © 2010 Oracle Corporation Reduced Attack Surface Oracle Solaris Secure by Default • Expose only required services to the network – Reduce the operating system network foot print – Most services are disabled; a few are set to “local only” – Secure Shell is the only exposed service by default • Integrated with Service Management Facility – Common administrative model for all service operations – Fully customizable based upon unique site requirements • Foundation for Additional Network Protections – Host-based packet filtering (Solaris IP Filter) – Secure authentication (Solaris Kerberos) – Secure network communications (Solaris IPsec / IKE)
- 11. 11Copyright © 2010 Oracle Corporation Method for composing collections of administrative rights Rights are specified using hierarchical profiles and authorizations Rights can be assigned to individual users and roles Separation of Duty Oracle Solaris User Rights Management Auditing always tracks the 'real' user – no anonymous admin! Roles can only be assumed by authorized users
- 12. 12 Separation of Duty Example Oracle Solaris User Rights Management Rights User Rights Management User Roles Internal Auditor System Admin. Oracle DBA System Maintenance, Troubleshooting System Security Review, Audit Trail Review Database Administration
- 13. 13 Separation of Duty Example Oracle Solaris User Rights Management
- 14. 14Copyright © 2010 Oracle Corporation Eliminates need for many services to start as ‘root’ Decomposes administrative capabilities into discrete privileges Reduces potential exposure to a variety of security attacks Least Privilege Oracle Solaris Process Rights Management Always enabled and enforced by the Solaris kernel Completely compatible with traditional super-user privilege model
- 15. 15 Least Privilege Example Oracle Solaris Process Rights Management Privileges Process Rights Management Processes Privilege Collection #1 Privilege Collection #2 Privilege Collection #3
- 16. 16 Least Privilege Example Oracle Solaris Process Rights Management $ pfexec ppriv -S `pgrep rpcbind` 933: /usr/sbin/rpcbind flags = PRIV_AWARE E: net_bindmlp,net_privaddr,proc_fork,sys_nfs I: none P: net_bindmlp,net_privaddr,proc_fork,sys_nfs L: none $ pfexec ppriv -S `pgrep statd` 5139: /usr/lib/nfs/statd flags = PRIV_AWARE E: net_bindmlp,proc_fork I: none P: net_bindmlp,proc_fork L: none Every process has a unique set of privileges.
- 17. 17Copyright © 2010 Oracle Corporation Hard Partitions Hypervisor Mediation Kernel Separation Strong Isolation and Resource Control Single OSMultiple OSes SPARC T-Series SPARC M-Series x86/x64 SPARC T-Series x86/x64 SPARC M-Series Oracle Dynamic Domains Oracle VM Server for SPARC Oracle VM Server for x86 Oracle VM VirtualBox Oracle Solaris Containers (Zones + SRM) Oracle Solaris Trusted Extensions Oracle Solaris 8 and 9 Containers
- 18. 18 Strong Isolation and Resource Control Oracle Solaris Containers (Virtual) Server Operating System ServiceDB Server DB Server DB Server • Multiple, independent services • File, network, user, process, and resource isolation • Security protections • Single operating system instance • Centralized management and monitoring
- 19. 19 Strong Isolation and Resource Control Oracle Solaris Containers Example (Virtual) Server Operating System ServiceDB Server DB Server DB Server $ pfexec zonecfg –z ozone info zonename: ozone zonepath: /export/zones/ozone […] [max-lwps: 300] [cpu-shares: 100] fs: dir: /etc/security/audit_control type: lofs options: [ro, nosuid, nodevices] […] inherit-pkg-dir: dir: /lib inherit-pkg-dir: dir: /platform inherit-pkg-dir: dir: /sbin inherit-pkg-dir: dir: /usr […] Each Container can have its own defined set of resources, file systems, network interfaces, etc.
- 20. 20Copyright © 2010 Oracle Corporation Integration with the Solaris kernel enables fine-grained introspection Configurable audit policy at both the system and user level Captured events include administrative actions, commands, syscalls Comprehensive Monitoring Oracle Solaris Auditing Audit logs can be exported as binary, text, or XML files Containers can be audited from within the global zone
- 21. 21Copyright © 2010 Oracle Corporation Comprehensive Monitoring Oracle Solaris Auditing Example Event: profile command time: 2010-09-08 11:56:11.511 -04:00 vers: 2 mod: host: quasar SUBJECT audit-uid: gbrunett uid: root gid: joe ruid: joe pid: 5015 sid: 685 tid: 0 0 quasar PATH: /usr/sbin/reboot CMD PROCESS: audit-uid: gbrunett uid: root gid: joe ruid: root rgid: joe pid: 5015 sid: 685 tid: 0 0 quasar RETURN errval: success retval: 0 ZONE name: ozone […] Event: reboot(1m) time: 2010-09-08 11:56:11.522 -04:00 vers: 2 mod: host: quasar SUBJECT: audit-uid: gbrunett uid: root gid: joe ruid: root rgid: joe pid: 5015 sid:685 tid: 0 0 quasar RETURN errval: success retval: 0 ZONE name: ozone Activity is captured retaining the ID of the original actor
- 22. 22Copyright © 2010 Oracle Corporation Assembling the Pieces OracleVMforSPARC HYPERVISOR CONTROL DOMAIN GUEST DOMAIN / GLOBAL ZONE
- 23. 23Copyright © 2010 Oracle Corporation Assembling the Pieces OracleVMforSPARC HYPERVISOR CONTROL DOMAIN GUEST DOMAIN / GLOBAL ZONE Package Minimization
- 24. 24Copyright © 2010 Oracle Corporation Assembling the Pieces OracleVMforSPARC HYPERVISOR CONTROL DOMAIN GUEST DOMAIN / GLOBAL ZONE Package Minimization Secure by Default / Network Hardening
- 25. 25Copyright © 2010 Oracle Corporation Assembling the Pieces OracleVMforSPARC HYPERVISOR CONTROL DOMAIN GUEST DOMAIN / GLOBAL ZONE Package Minimization Secure by Default / Network Hardening Resource Control
- 26. 26Copyright © 2010 Oracle Corporation Assembling the Pieces OracleVMforSPARC HYPERVISOR CONTROL DOMAIN GUEST DOMAIN / GLOBAL ZONE Package Minimization Secure by Default / Network Hardening Resource Control Auditing
- 27. 27Copyright © 2010 Oracle Corporation Assembling the Pieces OracleVMforSPARC HYPERVISOR CONTROL DOMAIN GUEST DOMAIN / GLOBAL ZONE Package Minimization Secure by Default / Network Hardening Resource Control Auditing CONTAINER
- 28. 28Copyright © 2010 Oracle Corporation Assembling the Pieces OracleVMforSPARC HYPERVISOR CONTROL DOMAIN GUEST DOMAIN / GLOBAL ZONE Package Minimization Secure by Default / Network Hardening Resource Control Auditing CONTAINER
- 29. 29Copyright © 2010 Oracle Corporation Assembling the Pieces OracleVMforSPARC HYPERVISOR CONTROL DOMAIN GUEST DOMAIN / GLOBAL ZONE Package Minimization Secure by Default / Network Hardening Resource Control Auditing CONTAINER Process Rights Management
- 30. 30Copyright © 2010 Oracle Corporation Assembling the Pieces OracleVMforSPARC HYPERVISOR CONTROL DOMAIN GUEST DOMAIN / GLOBAL ZONE Package Minimization Secure by Default / Network Hardening Resource Control Auditing CONTAINER User Rights Management Process Rights Management
- 31. 31Copyright © 2010 Oracle Corporation Just the Tip of the Iceberg • ZFS Data Security and Integrity – Ensures end-to-end data integrity by design – Delivers delegated administration, fine-grained access control, and hierarchical enforcement • Unified Cryptographic Framework – Enables hardware acceleration of algorithms – Integrates with PKCS#11, JCE, OpenSSL, etc. • Service Management Facility – Provides unified way to describe, manage and execute services • Trusted Extensions – Enforces multi-level security access control policies
- 32. 32 Oracle Database Security Defense-in-Depth Access Control • Oracle Database Vault • Oracle Label Security • Oracle Advanced Security • Oracle Secure Backup • Oracle Data Masking Encryption and Masking Auditing and Tracking • Oracle Audit Vault • Oracle Configuration Management • Oracle Total Recall • Oracle Database Firewall Blocking and Monitoring
- 33. 33Copyright © 2010 Oracle Corporation Transparency, Governance, and Compliance Comprehensive Information Protection and Monitoring Security-Enhanced Service Delivery Platforms Secure Service Oriented Architectures End-to-End Identity and Access Management Flexible and Strong Workload Isolation Integrated High-Performance Cryptography Tamper Resistant Key Storage Transparency, Governance, and Compliance Complete Set of Secure and Proven Solutions
- 34. 34Copyright © 2010 Oracle Corporation For More Information…
- 35. 35 Oracle Database Security Hands-on-Labs • Thursday Advanced Security 12:00PM | Marriott Marquis, Salon 10 / 11 Check Availability Audit Vault 1:30PM | Marriott Marquis, Salon 10 / 11 Check Availability
- 36. 36 The preceding is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.
- 37. 37Copyright © 2010 Oracle Corporation
- 38. 38Copyright © 2010 Oracle Corporation