Auditing an Oracle database for security issues is very important. PeteFinnigan.com provides all of the information and tools that you will need Click here for details of PeteFinnigan.com Limited's detailed Oracle database security audit service Click here for details of PeteFinnigan.com Limited's Oracle Security Training Courses
Cookie Policy:We only use essential cookies on small sections of this website. For details see here.

Welcome, Guest. Please Login.
Sep 18th, 2019, 10:09am
News: If you would like to register contact the forum admin
Home | Help | Search | Members | Login
   Pete Finnigan's Oracle Security Forum
   Oracle Security
   Oracle Security
(Moderator: Pete Finnigan)
   Database Links
« Previous topic | Next topic »
Pages: 1  Reply | Notify of replies | Send Topic | Print
   Author  Topic: Database Links  (Read 45611 times)
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Database Links
« on: Jun 11th, 2007, 9:15am »
Quote | Modify

Are there any known security problems in using a database link? What are the favoured alternatives to a database link?
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #1 on: Jun 11th, 2007, 5:09pm »
Quote | Modify

Hi,
 
There are a lot of issues. If you have an incoming link then the issue could be that the database its coming from maybe in an insecure location, not hardened and in essence it forms a gateway to exploit your data.
 
Anothre issues is that often privileges are not matched to the use of the link. i.e. i often see links using DBA accounts. If you use one create the account with the least privileges.
 
Depending on the type of link and oracle redatabase it requires the password for another database to be stored in the linked from database. Also depending on the type of link passwords are often shared between databases, i.e. the scott password would be the same in both databases if scott were used for the link.
 
Links can be used if designed properly, the right type of link used and also network restrictions are in place. Consider whay you are adding a link and see if it can be done aniother way else design carefully and limit the privileges, dont share passwords and close the link when its not in use.
 
cheers
 
Pete
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #2 on: Jun 12th, 2007, 9:56am »
Quote | Modify

Thanks, Pete -
So would it be fair to say that if the database is secure, then the link is secure if it's properly set up?  
Would it be any more or any less secure than a connection via a web service?
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #3 on: Nov 26th, 2007, 9:23pm »
Quote | Modify

Some observations:
 
10g R2 now encrypts the password in the sys.link$ which was long overdue.
 
I recommend having the dblinks created on the more critical database you want to protect and have it do the connecting to the other database(s).
 
As Pete mentioned, create the account you will be connecting to with least privileges to get the job done.   I believe it would be better to create more dblinks that satisfy various requirements than to give extra privileges to a single account to satisfy several needs.  For example, if one function needs to read only certain tables and another function needs to be able to update certain tables, use 2 different accounts for the dblinks.
 
Use private dblinks over public ones if possible.
 
Treat the accounts created for the dblinks like non-interactive accounts dedicated for the dblinks.  If your audit reviews indicate someone is manually using the dblink account, investigate.
 
Secure both databases/endpoints.  IP restrictions via valid node checking and invited nodes is a good idea in any case.
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #4 on: Nov 28th, 2007, 9:35am »
Quote | Modify

Hi Cody,
 
Thanks for your points, the problems with link sin my opinion is not the out going link from the database you control but the incoming links that you dont know about. The risk with those is two fold, the first that the link exists and is a conduit into the database and the second is that it implies a password for your database is known by someone who shouldn't know if they have created the link without your knowledge.  
 
The best way to stop these is to change all passwords.
 
cheers
 
Pete
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #5 on: Nov 28th, 2007, 2:44pm »
Quote | Modify

Correct me if I'm wrong in some of my points:
 
Having a link coming in isn't a risk on the receiving end because it's just a connection to an account like any other.  Someone could abuse that account like any other account be it a link or manual connection.
 
I disagree that the password is known.  For instance, I create a public link from my local database to a remote one.  Anyone on my local database can use the link to connect to and perform whatever work the remote account has privileges to perform but the password is not known by the local users.  The only person that actually knows the password on the other end is myself.  A person using the link does not know the remote password and can only use that account via the dblink.
 
Of course, like you said, once the remote account was created, I changed the password.
 
By the way, I really like your website.   I've been learning from it for some time now.  I was just formally made the security DBA for my organization so I'm working on creating an overall security plan.
 
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #6 on: Nov 29th, 2007, 12:01am »
Quote | Modify

A saved password is a saved password, whether it is in a shell script, SQL Developer connection setup, ODBC setup...(even a post-it note).
Having it encrypted in the database is a BIT more secure than the others, but someone can do a select dbms_metadata.get_ddl('DB_LINK','...') from dual;
They can then cut-and-paste the result to another user or database (eg an XE install on their PC) and they have access using that encrypted password.
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #7 on: Nov 30th, 2007, 10:19pm »
Quote | Modify

Thanks for the info.  I tested this out.
 
I created a public dblink and private dblinks under 2 different users (tester1 and test2).  The dblinks started with the word test.
 
As tester2, I "select * FROM all_db_links;" and see the public dblink and tester2's dblink.  This is as expected.
 
I "SELECT DBMS_METADATA.GET_DDL('DB_LINK', db_link, owner) FROM all_db_links where db_link like 'TEST%';" and it returns a ORA-31603 stating the object, public dblink, of type db_link not found in schema public.
 
I "SELECT DBMS_METADATA.GET_DDL('DB_LINK', db_link) FROM user_db_links where db_link like 'TEST%';" and it returns the info including encrypted password.  This doesn't concern me since this dblink was created with this account's password anyways.
 
Using my DBA account, I could get all the info of course.
 
Was the method you mentioned a something that was stopped in 10.2.03 perhaps?  
 
 
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #8 on: Apr 26th, 2009, 9:12am »
Quote | Modify

Hi Pete
 
Please do you know if Oracle database links transmit information in clear-text form or in encrypted form across the network?
 
Thanks
solaadio
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #9 on: Apr 27th, 2009, 8:20pm »
Quote | Modify

Hi,
 
Yes the data is transmitted in clear text unless you have a proprietory network encryption solution or you have used/licensed Oracle Advanced Security (ASO)
 
cheers
 
Pete
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Database Links
« Reply #10 on: Apr 28th, 2009, 11:48am »
Quote | Modify

Hi Pete,
 
Thanks for your reply. I'm very grateful.  
 
I am planning on using the multimaster replication feature of Oracle 10g using scheduled links. Currently, I have a good 2GB laptop as well as a good desktop server at home. I work quite a lot away from home so I do most of my dev work on the laptop.  
 
Please do you know if it's possible to have two 10g instances on my laptop and still get them to talk to themselves through Oracle Replication or is it mandatory that the two instances must reside on different physical boxes. Reason I'm asking is that I would love to do all my dev work on the laptop while I'm away from home before system testing using the server at home.
 
Regards
Olusola
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pages: 1  Reply | Notify of replies | Send Topic | Print

« Previous topic | Next topic »

Powered by YaBB 1 Gold - SP 1.4!
Forum software copyright 2000-2004 Yet another Bulletin Board