Oracle Database Vault (part1)


Database Vault restricts access to the specific areas of the database from different users in the database as well as the administrative users. It also helps us to protect the database against insider threats. Insider threats, meaning the protecting database from the access users who have sysdba and sysoper privileges. Using database vault we can also enforce separation of duties where we can allocate different accounts for database account management and other database activities.

Database vault installation

Installation of the database vault includes two steps, enabling the database vault at the binary level and the registering database vault using dbca:
Enabling the database vault at the binary level
First of all, stop database console, listener and shutdown database. Database vault is dependent on oracle label security, so beforeinstallation of database vault you must enable label security.

Execute following  command :
For enabling label security component Chopt enable lbac
For enabling  database vault components Chopt enable dv

[oracle@orcl ~]$ emctl stop dbconsole
[oracle@orcl ~]$ lsnrctl stop
[oracle@orcl ~]$ chopt enable lbac 
Writing to /u01/app/oracle/product/11.2/db_1/install/enable_lbac.log...
%s_unixOSDMakePath% -f /u01/app/oracle/product/11.2/db_1/rdbms/lib/ lbac_on
%s_unixOSDMakePath% -f /u01/app/oracle/product/11.2/db_1/rdbms/lib/ ioracle

[oracle@orcl ~]$ chopt enable dv
Writing to /u01/app/oracle/product/11.2/db_1/install/enable_dv.log...
%s_unixOSDMakePath% -f /u01/app/oracle/product/11.2/db_1/rdbms/lib/ dv_on
%s_unixOSDMakePath% -f /u01/app/oracle/product/11.2/db_1/rdbms/lib/ ioracle

Run the following commands. The make command enables both Oracle Database Vault (dv_on) and Oracle Label Security (lbac_on). You must enable Oracle Label Security before you can use Database Vault.

[oracle@orcl Datafiles]$ cd $ORACLE_HOME/rdbms/lib
[oracle@orcl lib]$ make -f dv_on lbac_on
/usr/bin/ar d /u01/app/oracle/product/11.2/db_1/rdbms/lib/libknlopt.a kzvndv.o
/usr/bin/ar cr /u01/app/oracle/product/11.2/db_1/rdbms/lib/libknlopt.a /u01/app/oracle/product/11.2/db_1/rdbms/lib/kzvidv.o 
/usr/bin/ar d /u01/app/oracle/product/11.2/db_1/rdbms/lib/libknlopt.a kzlnlbac.o
/usr/bin/ar cr /u01/app/oracle/product/11.2/db_1/rdbms/lib/libknlopt.a /u01/app/oracle/product/11.2/db_1/rdbms/lib/kzlilbac.o 
[oracle@orcl lib]$ cd $ORACLE_HOME/bin
[oracle@orcl bin]$ relink all
writing relink log to: /u01/app/oracle/product/11.2/db_1/install/relink.log

Start the database, database control console process, and listener. Then run DBCA command to register Database Vault

[oracle@orcl ~]$ emctl start dbconsole
[oracle@orcl ~]$ lsnrctl start
SQL> startup;
ORACLE instance started.
Total System Global Area  534462464 bytes
Fixed Size		    2254952 bytes
Variable Size		  213911448 bytes
Database Buffers	  314572800 bytes
Redo Buffers		    3723264 bytes
Database mounted.
Database opened.

[oracle@orcl ~]$ dbca

Select configure database option to configure database vault


Select the database which will be configured for database vault


Select label security component and dv components click next


Also we can select this options when installing oracle database :


In the next screen you must specify the username and password for database vault owner and account manager.


And click next, select dedicated server mode , click ok and then finsh database vault configuration.




You can check if Oracle Database Vault is enabled or disabled by querying the V$OPTION data dictionary view. If Oracle Database Vault is enabled, the query returns TRUE. Otherwise, it returns FALSE.

Remember that the PARAMETER column value is case sensitive. For example:


PARAMETER                                                                   VALUE
---------------------------------------------------------------- ---------------
Oracle Database Vault                                                      TRUE

In the next blog post i will write about Oracle database Vault Access Control Components, changes happened after Database Vault installation and management of Database Vault.