Oracle 19c Network Security & Sniffing Test Scenario

 ♦️Oracle 19c Network  Security & Sniffing Test Scenario

                        Alireza Kamrani

In this post I provided a sample to increase security network between Clients and Oracle Server by setting on sqlnet.ora file to encrypt data transfer.

And finally I will use the Wireshark utility that listens to the network to see if the data is actually encrypted.

I’m making the examples in the 19c database version on Oracle Virtual Box or Vmware Workstation. The Virtual Box network setting works in the Host-only state.

Let’s start watching the network in Wireshark,

Connect to the database with SQL Developer and run a query,

SQL>select name from v$database;

Name

------

Testdb

Let’s come back to the Wireshark program and examine the results.

As you can see in the picture, the query we run has not made any encryption on the network.  So the query that we run clearly shows what it is.

This is not a safe situation at all.

Now let’s encrypt the traffic between the client and the server by changing the “sqlnet.ora” parameters on the client side.

The client side sqlnet.ora file should look like this,

 

The server-side file should look like this,

Let’s start monitoring the network with Wireshark and connect to SQL Developer and run a query,

select name from v$database;

As shown in the picture, the query appears encrypted after the query we run.  When we look at the traffic in the Wireshark program as before, the query executed on the client side became encrypted.

After you close the connection, let’s search all .trc files on the client.  The trace file created at the time of the connection will tell us whether the connection is encrypted.

Look for the word “encryption” in these file.

This result indicates that the data is encrypted over the network with the AES128 algorithm and data integrity is ensured by the SHA1 algorithm.

Here I present some information about encryption settings:

Configuring for Network Encryption

The configuration for Network Encryption is defined in the “sqlnet.ora” file on the client and server side.  Before configuring, Oracle Net installation must be done on both the server and client side.

Configuration can be done by replacing the file “sqlnet.ora” with the text editor or with the netmgr program.

Two separate parameters are used on the server side.

SQLNET.ENCRYPTION_SERVER = [accepted | rejected | requested | required ]

SQLNET.ENCYRPTION_TYPES_SERVER = (algorithm name)

The parameters used by the client side,

SQLNET.ENCRYPTION_CLIENT = [ accepted | rejected | requested | required ]

SQLNET.ENCYRPTION_TYPES_CLIENT = ( algorithm name )

The SQLNET.ENCRYPTION_SERVER and SQLNET.ENCRYPTION_CLIENT parameters are parameters that determine whether to encrypt the client and the server.

 

This parameter can take the following values, 

• REJECTED
• ACCEPTED
• REQUESTED
• REQUIRED

The default value is ACCEPTED.

 

REJECRED : This means that the client and server will never establish an encrypted connection.

ACCEPTED : It means that the client and the server can establish an encrypted connection if there is a request to establish an encrypted connection.

REQUESTED : It means that the client and the server want to establish an encrypted connection.

REQUIRED : It means that the client or server is necessarily trying to establish an encrypted connection.  The client and server cannot establish a connection when a connection is requested withouth password.

📍Can we use multiple security algorithms?

In any network connection, both the client and server can support multiple encryption algorithms and integrity algorithms. 

When a connection is made, the server selects which algorithm to use, if any, from those algorithms specified in the sqlnet.ora files.The server searches for a match between the algorithms available on both the client and the server, and picks the first algorithm in its own list that also appears in the client list. If one side of the connection does not specify an algorithm list, all the algorithms installed on that side are acceptable. 

The connection fails with error message ORA-12650 if either side specifies an algorithm that is not installed.

Encryption and integrity parameters are defined by modifying a sqlnet.ora file on the clients and the servers on the network.

You can choose to configure any or all of the available encryption algorithms, and either or both of the available integrity algorithms. 

Only one encryption algorithm and one integrity algorithm are used for each connect session.

Note:Oracle Database selects the first encryption algorithm and the first integrity algorithm enabled on the client and the server. Oracle recommends that you select algorithms and key lengths in the order in which you prefer negotiation, choosing the strongest key length first.

📍Are clients side configuration is mandatory?

 Oracle Database servers and clients are set to ACCEPT encrypted connections out of the box. This means that you can enable the desired encryption and integrity settings for a connection pair by configuring just one side of the connection, server-side or client-side.

So, for example, if there are many Oracle clients connecting to an Oracle database, you can configure the required encryption and integrity settings for all these connections by making the appropriate sqlnet.ora changes at the server end.

You do not need to implement configuration changes for each client separately.

More info:

https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/configuring-network-data-encryption-and-integrity.html

Best Regards,

Alireza Kamrani.

How you can prevent burnout as a DBA

 👴🏽How you can prevent burnout as a database Administrator or developer with effective self-care practices👨🏻‍🏫

Alireza Kamrani 

Preventing burnout as a database developer involves a combination of effective self-care practices and mindful work habits. Here are some strategies to help you maintain a healthy balance:

For developers:

1. Set Clear Boundaries

- Work Hours: Define your work hours and stick to them. 

Avoid working late nights or weekends unless absolutely necessary.

- Breaks: Take regular breaks throughout the day to rest your mind and body.

2. Prioritize Physical Health

- Exercise: Incorporate physical activities like walking, biking, or yoga into your daily routine.

- Nutrition: Eat balanced meals and stay hydrated to keep your energy levels up.

3. Nurture Mental Health

- Mindfulness: Practice mindfulness or meditation to reduce stress and improve focus.

- Therapy: Consider talking to a therapist or counselor if you feel overwhelmed.

4. Pursue Hobbies and Interests

- Hobbies: Engage in activities you enjoy outside of work, such as reading, gardening, or playing a musical instrument.

- Social Connections: Spend time with friends and family to build a support network.

5. Efficient Work Practices

- Task Management: Use tools to manage your tasks and prioritize effectively.

- Automation: Leverage automation to reduce repetitive tasks and free up time for more meaningful work.

6. Continual Learning and Growth

- Skill Development: Keep learning new skills and technologies to stay motivated and engaged.

- Professional Community: Join peer communities to share experiences and gain support from fellow developers.

For DBAs:

Preventing burnout as a database administrator involves a combination of self-care practices and setting healthy boundaries. Here are some effective strategies:

1. Prioritize Physical Health

- Regular Exercise: Incorporate physical activities like walking, yoga, or even short exercise breaks throughout your day. This helps reduce stress and improve overall well-being.

- Healthy Diet: Maintain a balanced diet rich in nutrients to keep your energy levels up and improve your mood.

- Adequate Sleep: Ensure you get enough sleep each night to help your body and mind recover from daily stress.

2. Mental and Emotional Well-being

- Mindfulness and Meditation: Practices like mindfulness and meditation can help manage stress and improve focus.

- Take Breaks: Regular breaks during work can prevent mental fatigue. 

Use techniques like the Pomodoro Technique to structure your work and rest periods.

- Seek Support: Connect with colleagues or join professional groups to share experiences and get support.

3. Set Boundaries

- Work Hours: Define clear work hours and stick to them. Avoid working overtime unless absolutely necessary.

- Task Management: Prioritize tasks and delegate when possible. Use tools like task managers to keep track of your workload.

- Learn to Say No: It's important to recognize your limits and not take on more than you can handle.

4. Professional Development

- Continuous Learning: Engage in continuous learning to stay updated with the latest technologies and best practices. 

This can make your job more interesting and less monotonous.

- Career Goals: Set realistic career goals and work towards them. This can provide a sense of direction and purpose.

5. Take Time Off

- Vacations: Take regular vacations to recharge. 

Even short breaks can make a significant difference.

- Hobbies: Engage in hobbies and activities outside of work to relax and unwind.

6. Efficient Work Practices

- Task Management: Use DevOps tools (CI/CD) to manage your tasks as a automated routine.

- Automation: Leverage automation to reduce repetitive tasks and free up time for more meaningful work.

For example for automate of installations use Ansible or Teraform based on your platforms.

♦️In fact, by following these principles, you will help to improve your work style and in the way of standardizing the work model and context, you will also have a better mood while increasing productivity.

♦️In fact, what items do you follow for this purpose in your career field?

♦️Does your work organization support you in this area?

♦️Are your managers aware of your hard working conditions?

🎯By integrating these self-care practices into your routine, you can create a sustainable work-life balance and prevent burnout. 

📍How do you currently manage stress and workload?

📍What is your preferred discipline?

📍What is your opinions!?

♦️Note:

Some of these things that I have mentioned may seem like a dream

But my goal was to express working standards

I think we should try to be close to these things

And if we go away for a short period of time, for example, because of some sudden projects at a certain time, it may not be a problem, but never stay away from them for a long time.

Sincerely,

Alireza Kamrani 

Database Technologies Consultant.