Today I did have my first presentation at the UKOUG TechFest 2019 in Brighton. Looking back it was a great day with many interesting lectures and good conversations with colleagues and partners. After a long and exhausting day I’ll take a few minutes to sum up my presentation about the PDB isolation and Security.
When you start using Oracle Multitenant, it makes sense to consider a few specific security topics. In general, the same security principles apply to Oracle Multitenant databases as to regular single tenant databases. But depending on the purpose of PDBs, it will be relatively important to implement a few security measures which are beyond of the scope of general database security.
PDB Isolation and Security at a glance
In operation, Oracle container databases use shared resources. These include a backup LAN, management LAN and other system resources. On the other hand, individual Oracle features do access system resources as user oracle. In a common environment, this is basically a security risk. In a DBAAS environment, these can be the following risks.
- PDB admin use privilege escalation.
- Excessive use of shared resources.
- Access sensitive data via shared resources e.g. backup or management LAN.
- Break out of PDB and get OS access as oracle.
- Gain access to the root container (cdb$root)
- Gain access to other PDBs.
- Gain access to the network.
- Use of critical features like.
- Administration features
- Oracle JVM
- DBMS_SCHEDULER
- External table pre-processor
In principle, the owner of each PDB has DBA privileges or equivalent privileges on his PDB. Various measures are taken to ensure security and separation from the operating system and other PDBs. This includes the following measures:
- Provide DBA role respectively customized DBA role to PDB_ADMIN
- Managing OS Access using PDB_OS_CREDENTIAL.
- Manage File Access using PDB PATH_PREFIX and CREATE_FILE_DEST.
- Restrict user operation in PDBs in an Oracle multitenant container database using lockdown profiles.
The following figure shows a diagram of the container database and security measures.
Demo and Engineering Environment
The easiest way to verify the various measures for PDB security, is to use a couple of examples. The demo and test environment for PDB isolation and security presented here is based on Oracle database in Docker containers. The Docker images are build according to the build script in the GitHub repository https://github.com/oehrlis/docker. With a few adjustments the scripts can be run in any Oracle container database. If you follow the Docker-based approach, the following basic images are required:
- Oracle Database 12 Release 2 RU April 2019
- Oracle Database 19c Release Update October 2019 (19.5.0.0)
See https://github.com/oehrlis/docker/tree/master/OracleDatabase for more Information about how to build the Docker images.
Setup Docker Container
If the appropriate docker images are available, an adequate lab environment can be set up within a very short time. Just make sure you update and adjust the docker-compose.yml file to fit your environment, before you setup the docker container. The compose file does contain two database services. One for Oracle 12c Release 2 and on for Oracle 19c (19.5.0.0).
Run docker-compose to create the Docker containers.
docker-compose up -d
Check the progress of you container and database creation
docker-compose logs -f
As soon as you the the following message your database is ready to use.
tvd122 | ---------------------------------------------------------------
tvd122 | - DATABASE TTVD122 IS READY TO USE!
tvd122 | ---------------------------------------------------------------
...
tvd190 | ---------------------------------------------------------------
tvd190 | - DATABASE TTVD190 IS READY TO USE!
tvd190 | ---------------------------------------------------------------
Test which PDB OS credential require some OS user. To create these user log into either of the container as root and run 01_add_pdb_os_user.sh.
docker exec -it -u root tvd190 bash --login
bash-4.2# /u01/config/scripts/01_add_pdb_os_user.sh
Found passwd utility
Skip, group orapdb exists.
Skip, user orapdb exists.
Changing password for user orapdb.
passwd: all authentication tokens updated successfully.
Add PDB OS user orapdbsec:
Changing password for user orapdbsec.
passwd: all authentication tokens updated successfully.
Add PDB OS user orapdb1:
Changing password for user orapdb1.
passwd: all authentication tokens updated successfully.
Add PDB OS user orapdb2:
Changing password for user orapdb2.
passwd: all authentication tokens updated successfully.
Add PDB OS user orapdb3:
Changing password for user orapdb3.
passwd: all authentication tokens updated successfully.
Your now ready to use you Docker base PDB isolation and security environment.
Setup regular Database Environment
Of course, the scripts can also be tested in a regular database environment. You only have to make the following adjustments.
- Create a tnsnames.ora entry for you PDB. e.g. PDBSEC.
- Create the run_id.sh scripts and folders according to 00_prepare_pdb_env.sh Script.
- Create dedicated OS user for the PDB_OS_CREDENTIAL test using the scripts 01_add_pdb_os_user.sh.
- Optional install the patch 25820082
- Adjust the demo script to match your environment e.g. directory path, pdb name etc.
Demo and Test Scripts
The demo scripts are located in the script folder. In general, they work for both 12.2 and 19c, except the lockdown profile create script.
- 00_prepare_pdb_env.sh Script to add a tnsname.ora entry and other stuff for the PDB PDBSEC.
- 01_add_pdb_os_user.sh Script to add a PDB OS user.
- 10_create_pdb.sql Create a PDB (pdbsec) used for PDB security engineering.
- 20_create_directories.sql Script to create directories.
- 30_create_datafile.sql Script to create datafiles.
- 40_create_PDB_OS_CREDENTIAL.sql Script to configure PDB_OS_CREDENTIAL.
- 41_create_ext_table.sql Script to configure table pre-processors.
- 42_create_scheduler_job.sql Script to configure external OS jobs.
- 50_create_lockdown_profiles_12.2.sql Script to create lockdown profiles for 12.2.
- 50_create_lockdown_profiles.sql Script to create lockdown profiles.
- 51_lockdown_trace_view.sql Script to create lockdown profiles for trace files.
- 53_lockdown_external_table.sql Script to create lockdown profiles external table.
- 60_dbms_sys_sql_test.sql Script to verify DBMS_SYS_SQL
- 90_drop_pdb.sql Drop PDB (pdbsec) used for PDB security engineering
- ld_profiles.sql Displays information about lockdown profiles.
- ld_rules.sql Displays information about lockdown rules in the current container.
- lpdb.sql List PDBS
Slides of the lecture
The slides for the lecture have been uploaded to slideshare. They do provide a few information about the idea and the concept behind the PDB isolation and security.