Data transport encryption between Database - Apps Server

Hi
We have 10g R2 database on Linux
and would like to setup a basic encryption for data transport between Database and Apps Server.
On searching, i found a couple of SQL ENCRYPTION parameters to be placed in SQLNET.ORA , which am not sure off.
Could anyone suggest as how should i be doing this setup?
Do i also need to be doing changes at the Apps Server side?

Check the Advanced Security Guide, specifically
http://download-east.oracle.com/docs/cd/B19306_01/network.102/b14268/asopart2.htm#sthref141
Note that Advanced Security is a separate licensed option.

Similar Messages

Difference between using app server connection pooling and using the driver

Hi all,
How to get connection pooling with out application server and tomcat also?
What is the difference between using app server connection pooling and using the driver supported connection pooling?
Regards,
Murali

maybe the performance of App server pool is better than the JDBC pool,
for you don't know wether the implementation of the JDBC interface is good or bad.

Unable to load data into any application.database on server.

I have a rather odd problem that's been vexing my for a few days.
I am unable to do a data import into any cubes within Essbase, its as if the cube is in read only mode, though everything seems OK. I'm not running any sort of archiving, and to manually check, within essmsh, I did an "alter database end archive". I've tried with our existing and unchanged data load script as well as from within the EAS ( Right-click Data Load ). If I check the processes running on the server ( LINUX server ) the ESSSVR process is the top process eating 100% CPU. I can do outline builds OK.
From within the application log file, the last few entries are:
[Wed Apr 3 09:44:58 2013]Local/OP_ACC/Accounts/svc_biserver/Info(1021044)
Starting to execute query
[Wed Apr 3 09:44:58 2013]Local/OP_ACC/Accounts/svc_biserver/Info(1021045)
Finished executing query, and started to fetch records
[Wed Apr 3 09:44:58 2013]Local/OP_ACC/Accounts/svc_biserver/Info(1021000)
Connection With SQL Database Server is Established
[Wed Apr 3 09:44:58 2013]Local/OP_ACC/Accounts/svc_biserver/Info(1003040)
Parallel dataload enabled: [1] block prepare threads, [1] block write threads.
[Wed Apr 3 09:45:19 2013]Local/OP_ACC/Accounts/svc_biserver/Info(1021047)
Finished fetching data
Nothing has changed on this server for a few weeks so I'm somewhat flummoxed and no other errors show in any other logs ( nohup.out ).
Essbase 11.1.1.2
Redhat LINUX_x64 2.6

Yes, I tried rebooting the whole box, server has 9Gb free space, same story when I load just 1 row via a text file in the EAS, it seems to hang and the ESSSVR process for that cube goes to 100%.
I've tried a few different cubes, and they all have the same problem, so I suspect its something to do with Essbase itself rather than the specific cube I'm having problems with.
This is our test server I'm experiencing the problem with and I tried migrating 1 app from UAT back to test which still didnt work.
Stumped!

OIM Data Source Configuration in JBoss App Server

Hi experts,
I have deployed OIM on JBoss Application Server. Physical machine on which database is hosted was relocated and its IP address is also get changed.
I have made changes in xlConfig.xml to point to new DB (IP Address).
But DB connections are set in the App server Data Source as well
I made changes in Data Source as well to point to new IP address of DB machine.
Managed to start OIM .
But getting database connection exception in log. similar exception is given in post:
ERROR [DATABASE] Class/Method: tcDataBase/writeStatement encountersome prob
Thanks,
Pallavi
Edited by: Pallavi Chaudhari on Aug 10, 2011 9:47 AM

You should update it in these files,
xlconfig.xml
JBOSS/deploy/xell-ds.xml
\Oracle\xellerate\Profiles\Jboss.profile
Thanks
M

Connection/data source caching in JSC App Server?

Tried to change the data source for one of my apps (changed all data sources on all row sets). I got a connection error despite the fact that the IDE could see the data source.
I restarted the app server to no avail.
I finally stopped the app server AND restarted JSC and eveything started working again (except for the Conversion error I'm tracking down :-) ...

Did the connection error occur at runtime ?
If so, then it's not recommended to change the datasource
especially if you change databases. It's not impossible to make
the changes - you need to edit the Page bean constructor and the
constructor in the SessionBean and anywhere else you
initialize the rowset with the URL.
If you changed the database, then because vendors
map JDBC types differently, you may need to make
changes . Typically you'll see conversion errors when changing
the database.
JDBC Type (which we call SQL Type) --> Java Type:
=========================================
CHAR --> java.lang.String
VARCHAR --> java.lang.String
LONGVARCHAR --> java.lang.String
NUMERIC --> java.math.BigDecimal
DECIMAL --> java.math.BigDecimal
BIT --> boolean
BOOLEAN --> boolean
TINYINT --> byte
SMALLINT --> short
INTEGER --> int
BIGINT --> long
REAL --> float
FLOAT --> double
DOUBLE --> double
BINARY --> byte[]
VARBINARY --> byte[]
LONGVARBINARY --> byte[]
DATE --> java.sql.Date
TIME --> java.sql.Time
TIMESTAMP --> java.sql.Timestamp
CLOB --> java.sql.Clob
BLOB --> java.sql.Blob
ARRAY --> java.sql.Array
DISTINCT --> (mapping of underlying type)
STRUCT --> java.sql.Struct
REF --> java.sql.Ref
DATALINK --> java.net.URL
JAVA_OBJECT --> (underlying Java class)
Source: JDBC 3.0 Specification, Appendix B
Also, see this post for more info :
http://swforum.sun.com/jive/thread.jspa?forumID=123&threadID=47015
John
JSC QA

Transport tablespaces between databases with different character sets

Hi everyone:
I have two 10R2 databases on the same hp-ux 64bit server, 1st one with NLS_CHARACTERSET=US7ASCII, 2nd one with
NLS_CHARACTERSET=AL32UTF8.
NLS_NCHAR_CHARACTERSET on both databases is AL16UTF16.
Can I transfer tablespaces from the 1st one to the 2nd. The data could be in English, French & Spanish.
If not what are my options?
Thanks in advance.

First off, if you are storing French and Spanish data in database 1 where the character set is US7ASCII, you've got some serious problems. US7ASCII doesn't support non-English characters (accents, tildes, etc). If you're storing data this way, you've introduced data corruption that you'd have to resolve before copying the data data over to another machine.
Second, technically, the source and target character set have to be identical. Since US7ASCII is a strict binary superset of AL32UTF8, you could theoretically transport a US7ASCII tablespace to an AL32UTF8 database. In your case, though, since the data is not really US7ASCII, you'd end up with corruption.
Any of the Oracle built-in replication options is going to require that you resolve the corruption issue. Assuming that you can figure out what character set the source database really is, you could potentially dump the data to flat files (taking care not to allow character set conversion to take place) and SQL*Loader them into the destination system by identifying the proper character set in your control file. That's obviously going to be a rather laborious process, though.
Justin

NSS FIPS 140-2 encryption for Glassfish App Server on Windows

We would like to configure Java such that our web service communications will be encrypted in a manner that is FIPS 140-2 compliant.
I see here that Sun has achieved success in compliance testing in conjunction with the NSS libraries from Mozilla:
http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2007.htm#814
I found Andrea's excellent blog which took me through steps in setting up the ..\jre\lib\security\java.security file and in setting up the nss.cfg file:
http://blogs.sun.com/andreas/entry/elliptic_curve_cryptography_in_java
However, when I go to the download of Mozilla \ NSS the latest releases only provide the C code tar bundles. The latest release that provided the binaries for Windows was 3.11 and that was for Windows NT.
ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_11_RTM/
I was therefore hoping that someone might have a step-by-step such that I could create these binaries for Windows XP and Windows Vista. Or even better someone might know of a site where I could download them.
Other information: Our installation of Glassfish also has Metro installed.
Thanks for any help or advice.

Again you are a winner!
I found certutil and modutil under C:\Mozilla\nss-3.12.4-with-nspr-4.8\mozilla\dist\WINNT5.1_DBG.OBJ\bin and the -N -d . was exactly what I needed.
I found this blog: http://blogs.sun.com/arnabold/entry/jks_nss_and_glassfish It is a little dated but I need to somehow get Glassfish start-up to recognize my keystore as FIPS.
The error that I am seeing when I attempt to start GlassfishV2.1 from Netbeans is:
CORE5076: Using [Java HotSpot(TM) Client VM, Version 1.6.0_13] from [Sun Microsystems Inc.]
Using MQ RA for Broker lifecycle control
SEC1002: Security Manager is OFF.
java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at com.sun.enterprise.server.PELaunch.main(PELaunch.java:415)
Caused by: java.lang.ExceptionInInitializerError
at com.sun.enterprise.security.SecurityLifecycle.onInitialization(SecurityLifecycle.java:101)
at com.sun.enterprise.server.ApplicationServer.onInitialization(ApplicationServer.java:262)
at com.sun.enterprise.server.ondemand.OnDemandServer.onInitialization(OnDemandServer.java:103)
at com.sun.enterprise.server.PEMain.run(PEMain.java:399)
at com.sun.enterprise.server.PEMain.main(PEMain.java:336)
... 5 more
Caused by: java.lang.IllegalStateException: java.security.KeyStoreException: FIPS mode: KeyStore must be from provider SunPKCS11-NSS
at com.sun.enterprise.security.SSLUtils.<clinit>(SSLUtils.java:128)
... 10 more
Caused by: java.security.KeyStoreException: FIPS mode: KeyStore must be from provider SunPKCS11-NSS
at com.sun.net.ssl.internal.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyManagerFactoryImpl.java:44)
at javax.net.ssl.KeyManagerFactory.init(KeyManagerFactory.java:239)
at com.sun.enterprise.security.SSLUtils.initKeyManagers(SSLUtils.java:320)
at com.sun.enterprise.security.SSLUtils.<clinit>(SSLUtils.java:106)
... 10 more
I am hoping perhaps someone can tell me how to overcome this one, or point me to a blog that would provide instructions.
Thanks again for your help.

Ifs Instalation (Database+app server same box)

My environment:
Windows Professional 2000
Oracle Database 9.2.0.1 production
Oracle9iAS Java Edition v9.0.3
Oracle Internet File System Release 9.0.2 for windows
I installed Oracle Ok.
I installed Oracle9iAS Java Edition v9.0.3 in separate home Ok
I installed Oracle Internet File System Release 9.0.2 for windows at the same 9ias Home Ok.
Post installation Ok.
%ORACLE_HOME%\9ifs\bin\ifsdeployear OK.
When I launch the ifsmgr
%ORACLE_HOME%\9ifs\bin\ifsmgr
I could not logon with the default password
System
Mnager9ifs
Am I missing any steps.
Any assistance is greatly appreciated.
Regards,
Zakaria Ben-Salem

IFS 9.0.2 is only certified against Oracle 9iAS 9.2.0.1.
Hence it could be any number of things.
I suggest posting a log detailing the error condition on the CM SDK / 9iFS forum. (Not this forum which is for Oracle Files).

Difference between App server & Web server

What is the exact difference between the App Server & Web Server?

What is the exact difference between the App Server &
Web Server?that is sort of like asking what is the difference between colour and
blue, but i will try to explain all the same.
i would define a web server as a server that provides HTTP service.
that is it provides access to resources using the www protocol standards.
i would define an application server as any server providing a service
through the use of some application specific protocol.
by this definition a web server is also an application server, but not
all application servers are web servers.
some Java examples of application servers that are not web servers would
be EJB, or how about practically anything using RMI.
to further confuse the issue some web servers are now acting as more
widely functional application services in an idea called web services.
the idea is to provide non-web based applications through HTTP using
existing web servers.
for more on Java web services go here http://java.sun.com/webservices/
finally to illustrate the difference in a java-based way.
public abstract class ApplicationServer{
}and...
public class WebServer extends ApplicationServer{

What do i need to prepare on premises Apps Server?

hi , i want to use the on-premises Apps, and i will configure the high trust between the apps server and my SharePoint 2013 server, but now i have to know what do i have to install on the apps server i will basically need windows and VS2013, but do i need
any other applications or tools ?

The infrastructure (server) is the same whether you are doing SharePoint hosted apps or provider hosted apps. The only difference is that the provider hosted apps are hosted on a different web site. That web site can be either on the same server
or on a different server. If you want to do provider hosted apps on a separate server then that server needs to be able to host web sites. It can be IIS, Apache, anything that will host web sites. But your AppsServer can be just a different
IIS web site on the SharePoint server.
VS only needs to be on the SPServer when developing Apps. Once the App is developed, tested and packaged you can use the .APP package on any SharePoint server or even another farm.
Paul Stork SharePoint Server MVP
Principal Architect: Blue Chip Consulting Group
Blog: http://dontpapanic.com/blog
Twitter: Follow @pstork
Please remember to mark your question as "answered" if this solves your problem.

Using KAL to monitor app server behind CSS

We have had issues in the past where the app server has crashed and the CSS would keep sending connections to the front end webserver.
I am trying to find a way to monitor/keepalive based on the availability of an app server. The webserver is acting as a database app server front end.
I would like to be able to use the CSS to send a fixed set of (form style or XML) input to the ASP webserver so that it will return an expected output (from the app server) that can be hashed. The GET hash comparison will tell the CSS that the app server is correctly responding to the input.
Any one have any experience with things like this?
Carl

Thanks Steve,
I created a script that I think will do what I want, but I am not really clear on a couple of points.
I could not find anything to expand on the syntax for the socket send command. I noticed that some scripts that were posted used what seems like a directive to use the GET method but did not include any input.
socket send ${SOCKET} "GET ${webpage} http1.0\n\n"
It seems there may be some undocumented arguments to the socket commands. How do I find them?
I need to send an XML query as if it came from a form so the webserver will return the webpage I expect it to. The script I have so far is;
! Filename: ap-kal-dbstat
! Parameters: None - must be coded in script
! Description:
! This script will attempt to connect to a web server
! front end to a database host and
! "GET" an html page with dynamic content. The "sendstring"
! is some XML query which should return an expected output.
! The script checks the contents of the page for the returnstring.
! If found, the script passes.
! Failure Upon:
! 1. The correct arguments are not supplied.
! 2. The CSS is unable to connect to the host.
! 3. The string is not found in the return page.
no echo
if ${ARGS}[#] "LT" "5"
echo "Usage: ap-kal-dbstat \'Hostname Port Page Sendstring Returnstring\'"
echo "Example: ap-kal-dbstat \'10.1.1.1 80 webpage.asp XML=string form-element\'"
exit script 1
endbranch
set host "${ARGS}[1]"
set port "${ARGS}[2]"
set page "${ARGS}[3]"
set sendstring "${ARGS}[4]"
set returnstring "${ARGS}[5]"
set EXIT_MSG "Host ${host} not responding on TCP port ${port}."
socket connect host ${host} port ${port} tcp session
set EXIT_MSG "Socket string: String sent."
socket send ${SOCKET} "GET ${webpage} ${sendstring}"
set EXIT_MSG "Socket->Waitfor returnstring not found or timed out waiting."
socket waitfor ${SOCKET} "${returnstring}" 500
set EXIT_MSG "Socket: disconnected"
socket disconnect ${SOCKET}
echo "String ${returnstring} was found."
no set EXIT_MSG
exit script 0
Does this look like it will achieve my objective?
Carl

How to update Dialog App Server kernel?

Gurus,
How do you update Dialog App Server kernel? I did the same way I did to Central Instance, but in SM51 of the app server it still show the old version kernel.
Thanks in advance,
Allen

Hi Allen,
You didn`t mention your landscape details(OS,DB ver etc). Always start your query by giving the background of your landscape.
If you are using R/3 4.*, Unix, Oracle then below is the procedure,
After applying the kernal patch in CI, there is no need to apply in app servers. The reason is , there is a exe program( SAPCPE.exe) in app server which compares the kernal version of CI and copies the newly added kernel file when ever there is a mis match between the app server and CI.
This is done automatically during the app server restart.
You can check in /usr/sap/<SID>/sys/exe/run/SAPCPE.exe
Award points if it helps your query.
regards,
Vinodh.

Encrypting communication between an app that uses an ODBC/DSN (with ADODB) and SQL Server 2008 R2

I've been doing a lot of reading the last couple of days on how we can encrypt db communication between our product app and a customer's SQL Server db, but cannot make it work as expected. The app uses a ODBC/DSN to connect to the SQL Server db. I use this
ODBC app to setup the DSN (on a Windows 7 PC):
C:\Windows\SysWOW64\odbcad32.exe
The DSNconnection uses the SQL Server driver 6.01.7601.17514 and has these properties:
- WinNT authentication.
- Client Config button: TCP/IP to <server-name>\<instance.-name>
- Change to default db: <name-of-app-db>
- Everything else is default setting.
SQL Server is on the same Windowns 7 PC and has a self-signed cert installed (used IIS to generate it) and has the Force Enryption set to "yes".
I have a test C# program that uses the ADODB 2.7.0.0 COM-wrapper, made by Visual Studio after adding a reference to the ADO 2.7 library version 6.1.7601.17857. The program creates an ADODB.Connection object that has a simple connection string: "DSN=<san-name>;UID=<user>;PWD=<password>". The
program then creates an ADODB.Recordset object and reads and displays a field from a table.
Works fine.
If I go into SQL Server and set Force Encryption to "no," clear the cert, restart the SQL service, and then re-run the program, it works fine.
Here's the kick. If I go into the DSN and select "Use strong encryption for data" the Test button on the DSN works—why does it work? The SQL Server is no longer encrypting the connection so an error should occur. If I run the test program, it works
as well—why? I can look at the connection properties in the test program and see that ADODB has added the ";Encrypt-yes" stuff to the end of the connection string. Yet that option seems to have no effect.
If I set the SQL instance back to Force Encryption:yes, enable the cert, restart the SQL service, and clear the DSN's "Use strong encryption for data" option, I can still connect to the db with the
test program—why?
What am I doing wrong? I need to be able to ensure that the communication between our app product and the SQL instance is encrypted, and that we get an error if the SQL instance does not support encrypted communications. We really don't want the customer
to have to enable Force Encryption because they have other db's on their SQL Server that do not use encrypted communication, but they want to know that our product's communication channel with the db is encrypted.
No, I can't change the app product's code at this point in time. I'm stuck with working with what a DSN called from ADODB has to offer.
Also, how can I be sure that communications are encrypted? I mean, I've tried things like "SELECT * FROM sys.dm_exec_connections" but that doesn't help because I have no idea how to tie the list of sessions shown back to my test program, although
I guess it's a good thing that some of the sessions listed show encrypt_option as TRUE.
-glenn-

Ah yes, very good point. It's easy to miss because you have to delete then recreate the DSN in order to change drivers. So I switched the DSN over to the SQL Native 11 driver.
Now when I try to connect to the SQL instance as <computer-name>\<instance-name>, and without a cert on the server, I get "the target principal name is incorrect". Perfect; now we're getting somewhere!
Change my DSN to use <fqdn>\<instance-name> and it works. This tells me that SQL Server has auto-generated a cert and named it <fqdn>. I would have expected the "cert fail" error, not a cert
name mismatch, because I'm not using Trust Server Cert.
So I load up my self-signed cert, and that works too.
I am still confused as to why I'm not seeing the "cert fail" error when I have no cert loaded on the SQL Server. I am not using Force Encryption on the server at all, so wouldn't expect SQL Server to auto-create a cert when an Encrypt=yes request comes in,
but apparently it does?
I also ran into a problem with this:
select c.session_id, c.encrypt_option, s.client_interface_name
from sys.dm_exec_connections c
join sys.sysprocesses s
on c.session_id = s.session_id
where s.dbid = db_id('MyDatabase')
There is no s.client_interface_name, probably should be s.hostname. There's also no s.session_id. I thought maybe this should be s.sid, but then no rows ever come back. The c.session_id looks like 51 and 52, but the s.sid looks like a very long binary number,
so these two fields cannot be joined. I don't know how to convert the sid's properly so that the join would work. Ah wait, I just found the s.spid column; the join works when that column is used (I assume that's correct anyhow).
If I add a Thread.Sleep(30 seconds) to my C# program just before the connection is closed, this query shows me the session for the correct hostname has encrypt_option=TRUE.
And I have to keep my fingers crossed that all the app I/O will still work properly after
changing the driver. Probably a safe bet though.
Think I'm ready to throw in the towel on getting the "cert fail/no SSL" error to appear.
It does look like I am able to sufficiently show that the connection is encrypted when Encrypt=yes is used with the newer driver.
Thank for all the help!
-glenn-

Is it possible to perform network data encryption between Oracle 11g databases without the advance security option?

Is it possible to perform network data encryption between Oracle 11g databases without the advance security option?
We are not licensed for the Oracle Advanced Security Option and I have been tasked to use Oracle Network Data Encryption in order to encryption network traffic between Oracle instances that reside on remote servers. From what I have read and my prior understanding this is not possible without ASO. Can someone confirm or disprove my research, thanks.

Hi, Srini Chavali-Oracle
As for http://www.oracle.com/technetwork/database/options/advanced-security/advanced-security-ds-12c-1898873.pdf?ssSourceSiteId… ASO is mentioned as TDE and Redacting Sensitive Data to Display. Network encryption is excluded.
As for Network Encryption - Oracle FAQ (of course this is not Oracle official) "Since June 2013, Net Encryption is now licensed with Oracle Enterprise Edition and doesn't require Oracle Advanced Security Option." Could you clarify this? Thanks.

SQL Exceptions, transport-level errors on SharePoint 2010 App Server

SharePoint 2010 becomes inaccessible 2-3 times per day. It happens at approximately the same times: 8 PM, 1 AM and 1 PM. It is inaccessible for about 3-4 minutes and then comes back on its own.
During the time it is down, we see the following errors in the event viewer on the application server:
EventID: 5586 Task Category: Database -
Unknown SQL Exception 64 occurred. Additional error information from SQL Server is included below.A transport-level error has occurred when receiving results from the server.
(provider: TCP Provider, error: 0 - The specified network name is no longer available.)
EventID: 3 Task Category: None -
.Net SqlClient Data Provider: System.Data.SqlClient.SqlException: A transport-level error has occurred when receiving results from the server. (provider: TCP Provider, error:
0 - The specified network name is no longer available.)
EventID: 6398 Task Category: Timer -
The Execute method of job definition Microsoft.Office.Server.Search.Monitoring.HealthStatUpdateJobDefinition (ID f9db48f1-f115-47ab-99b6-552460cbb782) threw an exception. More
information is included below. A transport-level error has occurred when receiving results from the server. (provider: TCP Provider, error: 0 - The specified network name is no longer available.)
EventID: 8086 Task Category: Business Data -
The BDC Service application failed due to a SQL Exception: SQLServer host ums1spd1v. The error returned was: 'A transport-level error has occurred when sending the request to
the server. (provider: TCP Provider, error: 0 - An existing connection was forcibly closed by the remote host.)'
The SharePoint logs have errors during the same time period saying the same kinds of things: Sql exception raw message: A transport-level error has occurred when receiving results from the server,
The specified network name is no longer available, etc.
Our network administrator has looked at the issue and cannot find any network problems.
He setup a continuous ping from the app server to the database server.
Even during the times these errors are occurring, the app server is still able to reach the database server.
However, you cannot ping the app server itself during this time.
Our database administer cannot find any SQL Server issues.
There are no errors in the event viewer or the SQL logs on the database server.
In Central Admin, we can see that one or two jobs fail with SQL errors during the times these errors take place.
It is almost always the “User Profile Service Application – User Profile Language Synchronization Job” and often the “Health Statistics Updating” or “Crawl Log Report for Search Application Search Service Application”.
These jobs run successfully at many other times during the day.
Is there a good way to tell if the database, network or SharePoint itself is the root of these problems?
The database and network guys say there are no problems in their areas, but all I can find in the SharePoint logs is that it can’t reach the database server.
Thank you for any suggestions you may have!

Since these seem to happen at very specific times, I would run a NetMon trace at that window to capture what is going back and forth (or perhaps the timer service is just unable to reach the SQL server).
Trevor Seward, MCC
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Data transport encryption between Database - Apps Server

Similar Messages

Maybe you are looking for