Author |
Topic: Database Links (Read 61917 times) |
|
Pete Finnigan
PeteFinnigan.com Administrator
Oracle Security is easier if you design for it
View Profile | WWW | Email
Gender: 
Posts: 309
|
 |
Re: Database Links
« Reply #1 on: Jun 11th, 2007, 5:09pm » |
Quote | Modify
|
Hi,
There are a lot of issues. If you have an incoming link then the issue could be that the database its coming from maybe in an insecure location, not hardened and in essence it forms a gateway to exploit your data.
Anothre issues is that often privileges are not matched to the use of the link. i.e. i often see links using DBA accounts. If you use one create the account with the least privileges.
Depending on the type of link and oracle redatabase it requires the password for another database to be stored in the linked from database. Also depending on the type of link passwords are often shared between databases, i.e. the scott password would be the same in both databases if scott were used for the link.
Links can be used if designed properly, the right type of link used and also network restrictions are in place. Consider whay you are adding a link and see if it can be done aniother way else design carefully and limit the privileges, dont share passwords and close the link when its not in use.
cheers
Pete
|
|
 IP Logged |
Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
|
|
|
Pete Finnigan
PeteFinnigan.com Administrator
Oracle Security is easier if you design for it
View Profile | WWW | Email
Gender:
Posts: 309
|
|
Re: Database Links
« Reply #3 on: Nov 26th, 2007, 9:23pm » |
Quote | Modify
|
Some observations:
10g R2 now encrypts the password in the sys.link$ which was long overdue.
I recommend having the dblinks created on the more critical database you want to protect and have it do the connecting to the other database(s).
As Pete mentioned, create the account you will be connecting to with least privileges to get the job done. I believe it would be better to create more dblinks that satisfy various requirements than to give extra privileges to a single account to satisfy several needs. For example, if one function needs to read only certain tables and another function needs to be able to update certain tables, use 2 different accounts for the dblinks.
Use private dblinks over public ones if possible.
Treat the accounts created for the dblinks like non-interactive accounts dedicated for the dblinks. If your audit reviews indicate someone is manually using the dblink account, investigate.
Secure both databases/endpoints. IP restrictions via valid node checking and invited nodes is a good idea in any case.
|
|
IP Logged |
Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
|
|
|
Pete Finnigan
PeteFinnigan.com Administrator
Oracle Security is easier if you design for it
View Profile | WWW | Email
Gender:
Posts: 309
|
|
Re: Database Links
« Reply #4 on: Nov 28th, 2007, 9:35am » |
Quote | Modify
|
Hi Cody,
Thanks for your points, the problems with link sin my opinion is not the out going link from the database you control but the incoming links that you dont know about. The risk with those is two fold, the first that the link exists and is a conduit into the database and the second is that it implies a password for your database is known by someone who shouldn't know if they have created the link without your knowledge.
The best way to stop these is to change all passwords.
cheers
Pete
|
|
IP Logged |
Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
|
|
|
Pete Finnigan
PeteFinnigan.com Administrator
Oracle Security is easier if you design for it
View Profile | WWW | Email
Gender:
Posts: 309
|
|
Re: Database Links
« Reply #5 on: Nov 28th, 2007, 2:44pm » |
Quote | Modify
|
Correct me if I'm wrong in some of my points:
Having a link coming in isn't a risk on the receiving end because it's just a connection to an account like any other. Someone could abuse that account like any other account be it a link or manual connection.
I disagree that the password is known. For instance, I create a public link from my local database to a remote one. Anyone on my local database can use the link to connect to and perform whatever work the remote account has privileges to perform but the password is not known by the local users. The only person that actually knows the password on the other end is myself. A person using the link does not know the remote password and can only use that account via the dblink.
Of course, like you said, once the remote account was created, I changed the password.
By the way, I really like your website. I've been learning from it for some time now. I was just formally made the security DBA for my organization so I'm working on creating an overall security plan.
|
|
IP Logged |
Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
|
|
|
Pete Finnigan
PeteFinnigan.com Administrator
Oracle Security is easier if you design for it
View Profile | WWW | Email
Gender:
Posts: 309
|
|
Re: Database Links
« Reply #6 on: Nov 29th, 2007, 12:01am » |
Quote | Modify
|
A saved password is a saved password, whether it is in a shell script, SQL Developer connection setup, ODBC setup...(even a post-it note).
Having it encrypted in the database is a BIT more secure than the others, but someone can do a select dbms_metadata.get_ddl('DB_LINK','...') from dual;
They can then cut-and-paste the result to another user or database (eg an XE install on their PC) and they have access using that encrypted password.
|
|
IP Logged |
Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
|
|
|
Pete Finnigan
PeteFinnigan.com Administrator
Oracle Security is easier if you design for it
View Profile | WWW | Email
Gender:
Posts: 309
|
|
Re: Database Links
« Reply #7 on: Nov 30th, 2007, 10:19pm » |
Quote | Modify
|
Thanks for the info. I tested this out.
I created a public dblink and private dblinks under 2 different users (tester1 and test2). The dblinks started with the word test.
As tester2, I "select * FROM all_db_links;" and see the public dblink and tester2's dblink. This is as expected.
I "SELECT DBMS_METADATA.GET_DDL('DB_LINK', db_link, owner) FROM all_db_links where db_link like 'TEST%';" and it returns a ORA-31603 stating the object, public dblink, of type db_link not found in schema public.
I "SELECT DBMS_METADATA.GET_DDL('DB_LINK', db_link) FROM user_db_links where db_link like 'TEST%';" and it returns the info including encrypted password. This doesn't concern me since this dblink was created with this account's password anyways.
Using my DBA account, I could get all the info of course.
Was the method you mentioned a something that was stopped in 10.2.03 perhaps?
|
|
IP Logged |
Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
|
|
|
Pete Finnigan
PeteFinnigan.com Administrator
Oracle Security is easier if you design for it
View Profile | WWW | Email
Gender:
Posts: 309
|
|
Re: Database Links
« Reply #10 on: Apr 28th, 2009, 11:48am » |
Quote | Modify
|
Hi Pete,
Thanks for your reply. I'm very grateful.
I am planning on using the multimaster replication feature of Oracle 10g using scheduled links. Currently, I have a good 2GB laptop as well as a good desktop server at home. I work quite a lot away from home so I do most of my dev work on the laptop.
Please do you know if it's possible to have two 10g instances on my laptop and still get them to talk to themselves through Oracle Replication or is it mandatory that the two instances must reside on different physical boxes. Reason I'm asking is that I would love to do all my dev work on the laptop while I'm away from home before system testing using the server at home.
Regards
Olusola
|
|
IP Logged |
Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
|
|
|
|
PFCLScan
PFCLObfuscate
PFCLCode
PFCLForensics
PFCLReselling
PFCLATK
PFCLCookie
PFCLTraining
PFCLServices
PFCLConsulting
PFCLCustom
PFCLCloud
PFCLUserRights
PFCLSTK
PFCLSFTK
PFCLSEO