Chapter 2. Securing the Network and Data in Transit

In this chapter we will cover the following topics:

• Hijacking an Oracle connection

• Using OAS network encryption for securing data in motion

• Using OAS data integrity for securing data in motion

• Using OAS SSL network encryption for securing data in motion

• Encrypting network communication using IPSEC

• Encrypting network communication with stunnel

• Encrypting network communication with SSH tunneling

• Restricting the fly listener administration using ADMIN_RESTRICTION_LISTENER parameter

• Securing external program execution (EXTPROC)

• Controlling the client connections using the TCP.VALIDNODE_CHECKING listener parameter

Introduction

As most of the applications that are using Oracle Databases are two or three tiered, communication over network is involved. The network and its components are probably the most vulnerable area due to the increased amount of exposure. Network communication layer attacks are usually one of the hardest to detect as the majority of them do not require a direct connection to the database server, but instead are targeted towards the network traffic and the data in flight. In the following chapter we will present some of the most widely used attack and defense techniques against the Oracle network components.

Hijacking an Oracle connection

This connection hijacking scenario and the proxy program used were developed by Laszlo Toth and presented at Hackactivity 2009 (http://soonerorlater.hu/index.khtml?article_id=514).The flash presentation can be viewed at http://soonerorlater.hu/flash/pytnsproxy_1.htm.

This is a classic scenario and example of a man in the middle (MITM) attack in which an interposed attacker hijacks a client connection.

For this scenario we will use three hosts: database server (noderorcl1), Oracle client (nodeorcl5), and attacker host (mitmattack). The scenario will be performed using Oracle 11.0.1.6 Enterprise Edition on all hosts. The attacker host will be configured on a virtual machine running Fedora 11 x 84 (Leonidas # 1 SMP 2.6.29.4-167.fc11.x86_64 Wed May 27 17:27:08 EDT 2009 x86_64 x86_64 x86_64 GNU / Linux). The setting up and configuration of the attacker host, mitmattack, will be covered in this recipe.

Getting ready

Download and install Oracle Enterprise Edition version...

Using OAS network encryption for securing data in motion

Oracle has built-in network encryption methods in its Oracle Advanced Security pack. The main advantage of using OAS encryption instead of other encryption methods is its ability to integrate and work with other Oracle security products such as Oracle Database Firewall and third-party products provided by other vendors such as IBM (InfoSphere Guardium), Imperva, and others. As a disadvantage, being a separate pack, it is expensive and requires licensing.

In case that you use unencrypted network communication, all the data flow from server to client will be sent in clear text. The only exception is the password which is sent in encrypted form during authentication. Packet interception becomes a trivial task if the attacker is located at the right place on the network and the data is transmitted unencrypted. In this recipe we will sniff and analyze the data in flight between nodeorcl5 and nodeorcl1 using Winshark. We will capture the...

Using OAS data integrity for securing data in motion

Using data integrity guarantees that the packets will not be altered during transmission and reception. Data integrity can be used against replay attacks and MITM attacks, where the attacker may send crafted packets to obtain or modify different information from the database. Oracle provides SHA1 and MD5 hash functions for data integrity. Similarly with network encryption, if you want to use data integrity, an OAS license must be purchased. In the following recipe we will configure SHA1 for data integrity and we will demonstrate its utility against the Oracle Hijacking scenario.

Getting ready

The steps from this recipe will be performed on nodeorcl1 and nodeorcl5.

How to do it...

1. Open the $ORACLE_HOME/network/admin/sqlnet.ora configuration file on nodeorcl1. Similarly with network encryption, data integrity also has desired checksum behavior which can be specified by using SQLNET.CRYPTO_CHECKSUM_SERVER. Set the value to required as follows...

Using OAS SSL network encryption for securing data in motion

In Oracle you also have the possibility to use SSL based encrypted transmission between clients and servers. In this recipe we will introduce Oracle wallets. As its name suggests, an Oracle wallet is a container that can hold certificates, keys, and passwords. These are used primarily for network security operations and in implementing transparent data encryption, a subject that we will cover in Chapter 3, Securing Data at Rest.

Getting ready

In this recipe we will use nodeorcl1 and nodeorcl5.

How to do it...

In this recipe we will introduce Oracle wallets created and managed with the orapki utility.

1. As the user root the create directories for wallets and assign oracle as the owner on the nodeorcl1 and nodeorcl5 hosts:

   [root@nodeorcl1 ~]# mkdir -p /security/wallets/ssl
   [root@nodeorcl1 ~]# chown -R oracle:oinstall /security/wallets/ssl
   
   [root@nodeorcl5 ~]# mkdir -p /security/wallets/ssl
   [root@nodeorcl5 ~]# chown oraclient:oinstall ...

Encrypting network communication using IPSEC

Internet Protocol Security (IPSEC) is a protocol suite developed to encapsulate security using encryption, integrity, and authentication for Internet Protocol. It operates at the Internet layer of the IP protocol and is currently supported by all major operating systems. IPSEC implementation is suitable from small to large enterprise networks and can be used as an alternative to Oracle Advanced Security encryption. In this recipe we will show how to establish an IPSEC connection between nodeorcl5 and a Windows client. On Red Hat we will use freeswan IPSEC implementation and will configure a test-like setup using prehashed keys.

Getting ready

As a prerequisite, create a new virtual machine and install Windows 7 and Oracle Client 11.2.0.3 on it.

How it works...

We will start this recipe with the Linux IPSEC freeswan configuration.

1. First, we will configure the participant hosts, encryption algorithms, and the checksum algorithm. Open the freeswan configuration...

Encrypting network communication with stunnel

Stunnel is a program that acts as a proxy that removes, wraps, and encrypts the network communication using SSL thought tunnelling. It is suitable mainly to be used by DBAs for remote database administration or for encrypting communication (log transport) with DataGuard. In this recipe we will encrypt a connection between nodeorcl5 and nodeorcl1 using stunnel.

Getting ready

All steps will be performed on nodeorcl1 and nodeorcl5.

As a prerequisite download and install stunnel from http://www.stunnel.org/downloads.html both on nodeorcl1 and nodeorcl5.

How to do it...

1. We will start to configure stunnel as a service. Download stunnel_RC_script from http://www.gaztronics.net/rc/stunnel.php and copy it to /etc/init.d.

2. Next, change the owner permissions for stunnel to root and define it as a service as follows:

   [root@nodeorcl1 stunnel]# chown root:root /etc/init.dstunnel
   [root@nodeorcl1 stunnel]# chkconfig --add stunnel
   

3. Because stunnel will forward from...

Encrypting network communication using SSH tunneling

In these days ssh is the de facto method for establishing a remote connection to a host. It can also be used to tunnel and encrypt network communication between two hosts. SSH tunneling can be implemented for encrypting network communication between a computer used by a DBA for remote database administration, but is also suitable to be used with Data Guard for encrypting log shipping. In this recipe we will encrypt the network communication between nodeorcl1 and nodeorcl5 using ssh.

Getting ready

All steps will be performed on nodeorcl1 and nodeorcl5.

How to do it...

To use tunneling you must enable ssh port forwarding on the server. Open the /etc/ssh/sshd_conf configuration file and uncomment the following line:

AllowTcpForwarding yes

Save and close the file and restart sshd service as follows:

service sshd restart

1. To forward the listening port to the ssh port execute the following command:

   [oracle@nodeorcl1 ~]#
   ssh -N -L1530:nodeorcl1:1521...

Restricting the fly listener administration using the ADMIN_RESTRICTION_LISTENER parameter

Using the set lsnrctl command listener, we may dynamically change and override parameters. An attacker may use this capability for his own advantage by launching a series of DoS attacks against the database. The simplest DoS attack example is to simply stop the listener. Other DoS attacks can be produced by setting the listener trace (for example set listener trace to overwrite system01.dbf - set trc_file '/u01/HACKDB/system01.dbf')or log files to overwrite data files or redo logs, or they can be used to generate scripts in a desired location that may be used later.

Getting ready

All steps will be performed on nodeorcl1.

How to do it...

1. The format of parameter is ADMIN_RESTRICTION_listener_name. In our case we will disable the fly administration of the listener named LISTENER. Open $ORACLE_HOME/network/admin/listener.ora and enable ADMIN_RESTRICTION_LISTENER as follows:

   ADMIN_RESTRICTION_LISTENER=ON
   

2. Reload...

Securing external program execution (EXTPROC)

Some database applications can use external dynamic libraries implemented in a language such as C or C++. Usually these external libraries are developed for performance reasons, but they can also represent a major security threat by being replaced with ones that contain malicious code. Therefore this feature must be used with maximum precaution.

The listener process allows executing external programs using a dedicated program named extproc, which is located by default at $ORACLE_HOME/bin. The access to these external libraries can be configured within the listener configuration file listener.ora.

The following is a configuration example from listener.ora that allows executing a specific library:

  (SID_LIST =
    (SID_DESC =
      (SID_NAME = CLRExtProc)
      (ORACLE_HOME = /u01/app/oracle/product/11.2.0/db/)
      (PROGRAM = extproc)
      (ENVS = "EXTPROC_DLLS=ONLY:/home/oracle/appclrso.so")
    )
  )

The corresponding entry for extproc from...

Controlling client connections using the TCP.VALIDNODE_CHECKING listener parameter

The usage of the valid node checking security feature is very similar to the TCP wrappers presented in Chapter 1, Operating System Security. Using this capability, you can deny or the allow connecting clients based on IP address or hostname.

Getting ready

All steps will be performed on nodeorcl1.

How to do it...

1. Open $ORACLE_HOME/network/admin/sqlnet.ora and enable valid node checking by setting TCP.VALIDNODE_CKECINK as follows:

   TCP.VALIDNODE_CHECKING=ON
   

2. Next, you can establish the hosts that will be allowed to connect by setting the TCP.INVITED_NODES parameter as follows:

   TCP.INVITED_NODES= {nodeorcl5}
   

3. After you add the invited nodes you must reload the listener configuration.

   lsnrctl reload
   

4. If we want to establish a connection from a node that is not included in the invited node list, the ORA-12537: TNS:connection closed error will be thrown as follows:

   oraclient@nodeorcl2:~> sqlplus hr/hr@HCKDB
   
   SQL...