Oracle User Security (Unix OS)
I am looking at an Oracle instance with weak user id/password protection. Are there some settings to look at or general configurations that I could use to determine whether these weak ids/passwords could be used for remote access (indirect access) to the database? For example, if I know the name/passwd and some basic database name information, can I use an ODBC to directly connect to the Oracle DB? What about Unix security, if Unix security is very tight, does this mean remote access to the database is tight as well, is there Unix authentication necessary to access the database with a valid id/password?
Thanks in Advance...
If you know user names & passwords, you can almost certainly connect to the database via ODBC or via SQL*Plus. It is possible to create users in Oracle that are "externally authenticated", in which case they would generally not use passwords but would use credentials supplied by the operating system. If you have externally authenticated users, hopefully you rely on the local operating system to do the authentication rather than allowing any remote machine to authenticate the user (i.e. REMOTE_OS_AUTHENTICATION is false). If you have a user name & password, though, you can be all but guaranteed that you'll be able to connect to the database via whatever method you'd like.
Unix security is more of a "back door" sort of thing-- if your Unix security is weak, attackers may be able to compromise the system by finding a script that includes user names & passwords, by deleting files Oracle relies on, etc. If the "front door" of your Oracle security is weak, though, the security of your back door is reasonably irrelevent. It's a lot easier to screw up a database by logging in as an overly privileged user than it is to damage the database from Unix.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC
Similar Messages
-
How to implement Oracle user/role security with Access front end?
Hi,
We have successfully migrated our Access database tables to Oracle 10g using SQL developer. We've recreated all the users and roles(i.e., access groups) in Oracle and granted rights to tables.
In the Access front end database, in the Database window we have saved linked Oracle tables which replaced the Access tables. The forms, reports, queries run fine with the linked Oracle tables. All the linked table use one ODBC DSN to the Oracle database with the same Oracle user id.
We need to be able to authenticate users into the Oracle database and RE-link the tables based on their own unique user id. By during so we can allow users to use the Oracle standard user id/role and system privileges to control select, update, ect. rights to the database.
I've been able to use the VB code within Access to logon into the database with a unique id, but I have not been able to find out how to RE-link the tables to the unique user id using VB. There should be some way to relink tables dynamically, based on users login into the Access front end.
I don't know a great deal about Access projects, but I do know with SQL server allows login into your Access project and link tables dynamically.
Can someone give me some assistance or point me in the right direction?
Thanks in advance,
LarryWe had one of our programmers here come up with a VB code solution for re-linking table within Access. However the relinking takes 3-4 minutes for 100+ tables.
In an effort to help you understand the situation better, I will attempt to elaborate on the problem:
We have an Access 2003 application which currently has a front end using Access(forms, reports, queries, & VB code) and a MS Access 2003 backend.
We have migrated the backend tables to Oracle. However, we still have a need to maintain the front end in Access, since we have over 60 forms, 40 reports, 200+ queries in Access. Its easy to understand, we have a significant investment in the front end(Obviously, the plan is to migrate the front end also at some future date).
In order to utilized the existing front end, we have to validate and modify the current front end connections to the new Oracle backend. One of the features of Access is that you can "link" tables and save the link for runtime. Each Access table can have its own link which is a separate ODBC/JET connection. As such, each separate link has its own userid/database information.
The other issue with using the Access front-end is that Access utilizes a workgroup file to implement user and group security. The workgroup file contains all the users and which groups the users belong to in Access. Then within Access, you allow users access to object(tables, queries, ect) by their userid and or group. When users open an Access database with Access security enabled, they are required to log into Access. The login is authenticated by the workgroup file. Once, logged into Access, users have rights to Access objects based on their rights granted to their userid and groups they belong. The problem here is that when you remove the linked Access tables and replace them with linked Oracle tables, Access has knowledge about Oracle table rights granted to users; nor would you expect it to.
The dilema is the disconnect between Access and the fact Oracle utilizes a similar but much more sophisticated security model. It creates users and roles(which are similar to Access groups), and again this is independent of Access security.
Our solution was to still use the Access workgroup file security along with the Oracle security model. By using the Access userid and then creating a similar Oracle userid with similar table rights granted in Access, you could apply security within Access and also with the Oracle database.
For example, a user BOB logs into Access via the workgroup file, using VB code, Access then establishes a Oracle connection logining into Oracle using the same unique userid BOB into Oracle.
After connecting and validating user BOB into Oracle, then the Access tables are relinked to Oracle using the user BOB userid and table rights.
This Oracle userid has been granted table rights specific for this userid.This allows the user BOB to use the Access application and still be authenticated into the Oracle database.
The problem with this solution is that the relinking of the saved Access tables takes 3-7 minutes for about 100+ tables. This is not acceptable for users each time they log into the application.
Our current alternative is to use one Oracle userid to login each user, and use Access form restrictions/security to allow/prevent users from updating/viewing data. Obviously, this is not the optimal solution in respect to security, but it at least allows us to control access to the data(via the forms) by using one logon required for each user, and quick startup time for the application.
I understand SQL server does a better job in integration, but we use Oracle which is what I am trying to work with.
Larry -
Get error while Integrating with Oracle's Enterprise User Security
Hi,
I am trying to create an Oracle Enterprise User integrating with OVD and MS Active Directory.
I am following all the steps in Integrating with Oracle's Enterprise User Security.
In the documentation section: "Configuring Oracle Virtual Directory for the Integration"
I have applied the steps successfully until:
Update and load the entries into the Local Store Adapters by performing the following steps:
I have successfully extended the Oracle Virtual Directory schema with the loadOVD.ldif
However I am getting errors in the next step: Update realmRoot.ldif to use your namespaces
The next step states the following:
Update realmRoot.ldif to use your namespaces, including the dn, dc, o, orclsubscriberfullname,
and memberurl attributes in the file. If you have a DN mapping between Active Directory and
Oracle Virtual Directory, use the DN that you see from Oracle Virtual Directory.
The realmRoot.ldif file is located in ORACLE_VIRTUAL_DIRECTORY_HOME/eus,
where ORACLE_VIRTUAL_DIRECTORY_HOME represents the location where Oracle Virtual Directory is installed.
The realmRoot.ldif file contains core entries in the directory namespace that Enterprise User Security queries. The realmRoot.ldif file also contains the dynamic group that contains the registered Enterprise User Security databases to allow secured access to sensitive Enterprise User Security related attributes, like the user's Enterprise User Security hashed password attribute.
Load your domain root information in the realmRoot.ldif file into Oracle Virtual Directory using the following command:
ldapmodify -h Oracle_Virtual_Directory_Host –p OVD_Port -D cn=admin -w Admin_Password -v -a –f realmRoot.ldif
When I run the ldapmodify command I get the following error:
add dc:
testldap
add objectclass:
top
domain
domainDNS
adding new entry DC=testldap,DC=local
ldap_add: Operations error
ldap_add: additional info: LDAP Error 1 : null
The actual realmRoot.ldif looks like this:
# Please uncomment the following one line if you are importing this
# LDIF file via OVD Manager or OVD Server's ldapmodify tool.
#version: 1
#dn: dc=com
#dc: com
#objectclass: domain
dn: DC=testldap,DC=local
changetype: add
dc: testldap
#o: subarashii
objectclass: top
objectclass: domain
objectclass: domainDNS
#objectclass: orclSubscriber
#orclsubscriberfullname: subarashii
#orclVersion: 90400
# If your domain structure has more layers than dc=subarashii,dc=com,
# for example, it's dc=us,dc=subarashii,dc=com, you will need to load
# the following ldif entry/entries too.
# Uncomment out the following, if required.
#dn: dc=us,dc=subarashii,dc=com
#orclversion: 90400
#orclsubscriberfullname: us
#objectclass: domain
#objectclass: top
#objectclass: orclSubscriber
#dc: us
# Adding EUSDBGroup entry
# Modify the memberurl attribute and replace it with your own domain name
#dn: cn=EUSDBGROUP,dc=subarashii,dc=com
#cn: EUSDBGROUP
#memberurl:ldap:///dc=subarashii,dc=com??sub?(&(objectclass=orclService)(objectclass=orclDBServer))
#objectclass:groupofuniquenames
#objectclass:groupofurls
#objectclass:topDid you ever get your questions answered about the realmRoot.ldif file? Did you manage to configure a successful integration of OVD with EUS? I am battling with trying to get Oracle Virtual Directory integrated with Enterprise User Security, but every step I take in Chapter 7 of the OVD manual fails in some way, and the instructions are often vague. I am not sure how to modify the realmRoot.ldif file. Is there any improved documentation on this? I have logged a Service Request, but not getting any help. Any resources or documentation you know of that provides better guidance would be much appreciated. I am way behind my schedule now and this is a very frustrating exercise.
Thanks. -
Enterpise User Security, OID and Oracle Advanced Security
Do we also need Oracle Advanced Security when using the OID
solution (Oracle Application Server)? I just seem to remember
coming across something where some portion of the LDAP directory
needed to communicate over SSL, and I wasn't sure if this
implied that Oracle Advanced Security was needed.
Thanks.Hi!
As long as you use the LDAP via SSL purely in the Application Server then there is no need for Advanced Security.
As you mentioned Enterprise Users - which is a database user authenticated by the OID, you will need the Advanced Security option.
cu
Andreas -
How to access oracle with any unix user (like root)?
I installed Oracle 10g on Redhat Enterprise Linux 3.
I created one oracle user, and installed oracle in oracle users home directory. In oracle user I can access oracle very well. But I can not use oracle with other unix users like root. What kind of permissions I need to set to do so?You should never try to connect to Oracle as root, but if you want to connect as any other OS user, you will need to run ChangePerm.sh in $ORACLE_HOME/install in order to do this. It may not be present until you upgrade above the base release (like 10.2.0.3).
Can not Logon To SQL*Plus as non-Oracle User: Libclntsh.So.10.1: Permission Denied
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=420083.1 -
I am running Oracle 10g XE on a Linux machine (RHEL 4.0).
I am fairly new to Linux. In the LogWatch report I receive every day, I notice that hackers are trying to log in as the "oracle" user, e.g.:
Authentication Failures:
unknown (200.3.248.22): 4159 Time(s)
oracle (200.3.248.22): 36 Time(s)
How do I know that the password for the "oracle" user is secure? I didn't create it and I don't even know what it is.
Can I change the password to something strong without affecting my system?
Thanks!Can I change the password to something strong without affecting my system?
I just wonder if it will cause any problems if I change the password? I don't want to mess up my system.Well for Oracle SW (and whole local OS) there is no problem. Problem could be if you are using some external scripts that you are using on remote machine (and which using login password sequence to access the OS).
How do I know that the password for the "oracle" user is secure? I didn't create it and I don't even know what it is.To check the password strength you can use some utilities. For example John is very good for that: http://freshmeat.net/projects/john/
I am fairly new to Linux. In the LogWatch report I receive every day, I notice that hackers are trying to log in as the "oracle" user, e.g.:Why aou are running your database in untrusted network segment (internet). Best practice is to place such system to secured segment (DMZ, VLAN). If the reason is that your 3rd party partner needs to connect to database you can do IPSEC tunnel.
Of course don't allow to connect anyone to your machine and to any port. So the recommendation about iptables (netfilter) is appropriate. -
Difference between Security Oracle user and Security User
Hi All,
Can anyone give me the difference between Security-> Oracle -> user and Security-> User in System Administrator Resp of oracle apps R12.
Thanks,
Mahesh.
Edited by: 991854 on Mar 12, 2013 1:49 AMCan anyone give me the difference between Security-> Oracle -> user and Security-> User in System Administrator Resp of oracle apps R12.Security > Oracle > Register:
Use this window to register an ORACLE username with Oracle E-Business Suite. An ORACLE username grants access privileges to the ORACLE database
http://docs.oracle.com/cd/E18727_01/doc.121/e12893/T174296T174305.htm
Security > Oracle > Data Group:
A data group defines the mapping between Oracle E-Business Suite products and ORACLE database IDs. A data group determines which Oracle database accounts a responsibility's forms, concurrent programs, and reports connect to. See: Defining Data Groups, Oracle E-Business Suite System Administrator's Guide - Configuration.
http://docs.oracle.com/cd/E18727_01/doc.121/e12843/T156458T156461.htm
Security > User > Define:
Use this window to define an Oracle E-Business Suite user. This user is an authorized user of Oracle E-Business Suite, and is uniquely identified by a username.
http://docs.oracle.com/cd/E18727_01/doc.121/e12843/T156458T156461.htm
Thanks,
Hussein -
Pass oracle user id - forms to unix com script
In 10g Forms when using the host command to launch a unix .com script, is there anyway to pass the Form user's Oracle user id from the form session to the .com script?
The unix script executes an sqr program that requires an oracle id.I managed to pass the UDT to another procedure as long as I only passed one at a time, instead of passing 2 instances of the UDT at once. Does anyone know if this is a limitation of ODP.NET or is there a way to pass multiple UDTs to a stored procedure? (I checked the code samples which come with ODP.NET but didn't find an exmaple of passing multiple UDTs.)
Thanks -
ORACLE SERVER AND UNIX TP MONITOR-2
제품 : ORACLE SERVER
작성날짜 : 1995-01-24
Subject: Oracle Server and UNIX Transaction Processing Monitors-2
Page(3/4)
This file contains commonly asked questions about Oracle7 Server and UNIX
Transaction Processing Monitors (TPMs). The topics covered in this article are
o Oracle Parallel Server and TP Monitors
o Oracle and DCE-based TP Monitors
o Other commonly asked questions
The questions answered in part 3 provide additional detail to the information
provided in part 1.
Oracle Parallel Server and TP Monitors
======================================
How does Oracle Parallel Server (OPS) work with TP Monitors?
If you are using Oracle-managed transactions, there are no special
considerations. But if you are using TPM-managed transactions, and
thus need to use the XA interface, then Oracle requires release 7.1.3
or later and a special version of the Distributed Lock Manager, called
the session-based lock manager. This version of the DLM is not yet
available for all platforms. To understand this restriction, let's take
a look at one of the technical details of XA.
The XA specification requires that the Resource Manager be able to
move a transaction from one process to another, and even to be
able to commit in a separate process. In Oracle, transactions are
attached to sessions, so that means that we also have to be able to
move sessions. Therefore, the session/transaction can't have any state
which is tied to a particular process. The first generation distributed
lock managers were all built to use the process id as the lock owner,
which doesn't work for locks which need to move with the transaction.
Oracle and DCE-based TP Monitors
================================
How does Oracle interface to the Encina TP monitor? To CICS/6000? I've
heard that they require OSF DCE facilities in order to run?
Oracle interfaces to Encina and CICS/6000 just as it does to any other
TP Monitor. The TP Monitor issues XA commands to control transactions, and
Oracle executes the commands. Encina and CICS/6000 do use DCE features for
their own operation. However, this use is transparent to the Oracle Server.
What DCE facilities can Oracle products take advantage of when working with
a DCE-based TP Monitor?
The two most commonly mentioned DCE features which might be useful
to Oracle users are multi-threading and security. We look at these in
the subsequent questions in this section.
Encina documentation suggests that a Resource Manager such as Oracle can
be either single-threaded or multi-threaded? Which way is Oracle XA
implemented?
The Oracle XA implementation is single-threaded, as is any Oracle client.
Within a single process, at most one thread can access Oracle at a time.
Does that mean that only a single Encina application can access an instance
of Oracle transactionally at any given moment?
No. Oracle XA is only single-threaded within a single application server
process. Multiple applications can access Oracle simultaneously using XA
by using different application processes. Encina allows
(1) serial reuse of a single server by different clients. There are
two options for this. The server can use long term reservation
but be defined to be in shared or concurrent access mode, which
allows the server to be used by another client as soon as an RPC
completes. Alternatively, the server can use default reservation
and exclusive mode, which allows the server to be used by another
client as soon as the current transaction ends.
(2) concurrent execution by multiple servers, even if they are accessing
the same Oracle database. These may be executing the same or different
procedures.
These two features should let you get as much concurrency as you need.
Why isn't the Oracle XA library multi-threaded?
The XA specification specifically states that its use of the phrase
"thread of control" means a process. If an RM were to multi-thread its
XA, it would be in violation of the specification. This restriction
was put place in because at the time the specification was written,
there were numerous thread packages: if the TM used one, the application
another, and perhaps the RM yet a third, there's no way it could work.
As threads standards settle down, the later versions of XA will probably
relax this restriction.
Will Oracle change if the XA specification changes?
Very likely. The exact time frame will of course depend on the priority of
all work items at that time.
Does Oracle use DCE security via the TP Monitors?
The integrity of the connection between a DCE TP Monitor client and DCE
TP Monitor server is protected by the DCE security functionality.
Theoretically, the TP Monitor could make the DCE-protected client security
information available to Oracle. Unfortunately, there's no standard way
for a TP Monitor to pass security information information to a Resource
Manager such as Oracle. Oracle is leading an effort to extend the X/Open
model to allow use of the security information provided by the Monitor.
In the meantime, the basic DCE security features such as encryption are
useful within TP Monitors.
Effective use of DCE security would normally also mean that the security of
the TP Monitor client be passed through the TP Monitor, through the Oracle
client (application server), to the Oracle Server, and possibly on
to other Oracle Servers through database links. The ability to transfer
security information to other processes, called delegation, is missing
in DCE version 1.0. DCE version 1.1, expected to emerge in late 1994,
has some delegation features. Oracle is examining these features to see
how they might be used.
Are there any special considerations for CICS/6000?
There are two:
(1) It is inefficient to run without XA. CICS/6000 is designed to
use XA. It uses XA so that the CICS server can log on to Oracle
when it starts, after which it makes that Oracle connection available
to any transaction it executes. If you don't use XA, the CICS server
does not itself log on to Oracle so each transaction has to log on
and log off - a very expensive mode of operation. Also, it is very
un-cics-like in that the application does the log{on,off} and also
commits - in a mainframe CICS database program CICS would implicitly
do these operations. Oracle does not recommend this mode because of the
performance penalty.
(2) CICS servers are generic and dynamically load application modules.
In order for these modules to access the Oracle connection made by
CICS, the applications must be built with a shared object version of
the Oracle libraries. This is an installation option on platforms which
support CICS/6000 and other products using its architecture such as
CICS 9000.
Other commonly asked questions
==============================
What other Resource Managers can be included in an Oracle XA transaction?
Several other relational database vendors have an XA implementation
available or in progress. There is an XA C-ISAM product from
Gresham Telecomputing. There are also Resource Managers contained
within some of the TP Monitors which can be coordinated in the same
transaction. For example, CICS/6000 has VSAM files and other data
stores, Encina has its RQS queuing system, and Tuxedo has its /Q queuing
system.
What is Recoverable Queuing Service (RQS) and how does it interoperate with
Oracle7 and Encina? What about /Q?
Recoverable Queuing Service is a feature provided by Encina which allows
transactional, distributed queuing (enqueue/dequeue). Tuxedo has a similar
product called /Q. Because these products are themselves coordinated by the
TM component of the TP Monitor, their queue operations are atomically
coordinated with with operations on XA Resource Managers such as Oracle7
Server. That is, they can atomically put something on one of their queues
and commit an Oracle transaction, then at some later time dequeue an
entry atomically with doing some other Oracle transaction. The queue
system guarantees that the message will not be lost or transmitted twice.
Can I mix TP Monitor applications with standard Oracle7 Server applications?
Yes, you can have existing Oracle applications connected to the database
with alongside TPM applications against the same database. The TPM does
not manage the whole database, just those transactions which are started
by the TPM. The Oracle Server will properly handle concurrency control
between the transactions managed by itself and those managed by the TPM.
Is Oracle planning to change its tools to be more suitable for TP Monitors?
With Oracle Procedure Builder 1.5, to be available with CDE2,
Oracle will provide a foreign function interface that allows you to
dynamically set up PL/SQL calls that access C functions. In other
words, you can access C routines in Windows DLLs from within your
PL/SQL procedures. This will allow PL/SQL under Windows easy access to
TP Monitor APIs.
Does Oracle7 Server itself use XA-compliant TPMs as the interface to
foreign RMs?
No, for this purpose Oracle Server uses the SQL*Connect products or the new
Transparent and Procedural Gateway products.
Does Oracle7 Server use XA to coordinate Oracle7-only distributed
transactions?
No, it uses an internal mechanism.
Can database links be used with XA?
If an Oracle7 database is running under XA, it can access other Oracle7
databases through database links, with some restrictions. First, the
access to the other database must use SQL*Net V2 and be running MTS.
Second, it must currently be to another Oracle7 database. Assuming those
restrictions, the Oracle 7 database can do distributed update to another
Oracle 7 database by using a database link, whether it is started by an
Oracle application or a TP Monitor application. The TPM will see Oracle
as only a single RM, but Oracle7 will propagate all the transaction
commands to the other database, including the two-phase commit. If
the transaction is started by a TP Monitor application and is using XA,
it can also update non-Oracle resources managed by the TPM. If it
is started from an Oracle application, it can only include resources
managed by Oracle.
Here's a sample configuration:
| TPM | | TPM |
| client | | client |
| |
| |
| TPM |
| |
| |
| Oracle | Forms, Forms, | Oracle | | non-XA | | XA |
| client | Plus, Plus, | client | | TPM | | TPM |
--------- Pro, Pro, --------- | server | | server |
| Financials, Financials, | |(note 1)| ----------
| etc. etc. | ---------- |
| | | |
| SQL | SQL | SQL | XA
| commit | commit | commit | commit
| | | |
| Oracle | | Oracle | | Oracle | | Oracle |
| server | | server | | server | | server |
| | | |
| | | |
| | | |
| Database 1 | | Database 2 |
| | | |
| A | A
| | dblink to database 1 | |
| ------------------------------------ |
| |
dblink to database 2
Note 1: Oracle will work having both XA and non-XA servers but some TPMs
may have restrictions on this.
Are multiple direct connections possible from a Pro* program?
Using XA, you can not only specify multiple direct connections to Oracle7
databases, you can also update them both in the SAME transaction. The
way to do this is to use a precompiler feature called a named database.
When you use a named database, you qualify the SQL statement with the
database name. For example, you write EXEC SQL AT dbname UPDATE emp ....
We have a complementary feature in the xa open string to let the user
associate the name with a particular RM instance, called the DB clause.
You will also want to use the SqlNet clause in the open string so you
can give the two different SIDs. This clause does not require the use of
the SQL*Net product, it is just a naming convention. For more information,
see Oracle7 Server for UNIX Administrator's Reference Guide.
Some TP Monitors may not support having multiple Resource Mangers in the
same server; check with the TPM vendor.
Is there any collateral available for XA or TP Monitors?
Oracle At Work 52684.0692
Oracle7 Server for UNIX Administrator's #A10324-1
Reference Guide
Guide to Oracle's Products and Services #A10560
Oracle7 Server and CICS/6000 #A14200
Where can I get more information on the DTP model?
X/Open's address is
X/Open company Ltd (Publications)
P O Box 109
Penn
High Wycombe
Bucks HP10 8NP
Tel: +44 (0)494 813844
Fax: +44 (0)494 814989
Request
G307 Distributed Transaction Processing: Reference Model Version 2
X/Open Guide G307 ISBN 1-859120-19-9 28cm.44p.pbk.220g.11/93
Page(4/4)
This file contains commonly asked questions about Oracle Server and UNIX
Transaction Processing Monitors (TPMs). The topics covered in this article are
o Performance with Oracle Server and TP monitors
o Performance using Oracle's XA Library
The questions answered in part 4 provide additional detail to the information
provided in part 1.
Performance with Oracle Server and TP Monitors
==============================================
I have heard that Transaction Processing Monitors (TPMs) will increase
Oracle Server performance. Is this true?
Several hardware and TPM vendors have made the claim that TPMs
will increase RDBMS performance. This claim is based on TPC-A
benchmarks. The key point to understand about TPC-A is that it
requires, for every transaction-per-second, ten times that many
users to be connected. For example, to get 600 TPS, you need 6000
users. The next question will answer in more detail how the the
three-tier architecture addresses this requirement, but first let's
look more generally at what TP Monitors can and can't do to improve
performance.
TP Monitors can provide better performance:
(1) When there are more than several hundred users connected.
This is because of the TP Monitor's role in the three-tier
architecture, described in the next question. In this
architecture, terminal handling is offloaded to one or more
separate machines, freeing up those cycles to do database work.
Note that this does NOT mean that Oracle itself runs faster,
just that we've given it more CPU cycles to use.
(2) When, because of the high potential concurrency of requests,
significant resource contention exists. Use of a TP Monitor can
limit the degree of concurrency and thus reduce contention.
TP Monitors can not provide better performance:
(1) For existing applications. The applications must be designed
to fit the TP Monitor architecture.
(2) For applications which are highly interactive in their use of
the database. These applications put many messages
through the transport system, and the TP Monitor is not as
efficient as SQL*Net for point-to-point communication.
(3) For CPU intensive single-query decision support. When executing
a single large command, Oracle query facilities work efficiently,
especially with the use of Oracle Parallel Query, available in 7.1.
How does the three-tier solution help TPC-A, or other situations with
thousands of on-line users?
The TPC-A test calls for a large number of users to produce a given
result. In the high-end results we produced in June, 1992, for example,
6150 terminals were simulated to produce 618 TPC-A transactions.
Thus, terminal concentration accounts for a large portion of the total
processing time used.
First, let's look at how the Multi Threaded Server would work for
this benchmark. In this case, there are many client processes,
but only a few server processes, which handle client requests on a
first-come first serve basis. When they are done with a request,
they take another client's request.
ORACLE7 CLIENT/SERVER ARCHITECTURE WITH MULTI THREADED SERVER
| Client | | Server |
| __________ |______________|_____ _____________ _____________ |
| | Client | | SQL*Net | |_|Dispatcher | | | |
| | Process| | | ____| Process |___| | |
| |________| | | | __|___________| | | |
|____________| | | | | | | | |
| | | | | | Oracle7 | |
______________ | | | __|__|____ | Server | |
| Client | | | | __|_|_____ | | | |
| __________ | | | | | Shared | |____| | |
| | Client | | SQL*Net | | | | Server |_|____| | |
| | Process|_|______________|__| | | Process|_| | | |
| |________| | | | |________| |___________| |
|____________| | | |
| | |
______________ | | |
| Client | | | |
| __________ | | | |
| | Client | | SQL*Net | | |
| | Process|_|______________|____| |
| |________| | | |
|____________| | |
|_______________________________________|
Client processes = N Dispatcher processes >= 1
Shared server processes >= 1
If there are 500 clients in this environment, there will be one or more
dispatcher processes, dynamically tunable, and one or more shared
server processes, dynamically tunable, on the server. The reduction
in the total number of processes handled by the server system
results in more processing time available for RDBMS activity. Thus
higher RDBMS transaction throughput can be obtained on the
server system.
But the problem for the TPC-A, and for certain large customer
configurations, is not the only ability of the Oracle Server to
process transactions, but also the ability of the operating
system to handle huge numbers of incoming connections.
There is one incoming connection for each client. Most UNIX
operating systems have a limit on how many such connections they can
handle. Even if a particular operating system allows a large number of
connections, each takes some amount of overhead to manage.
In order to service all 6150 terminals, we selected a 3-tier hardware
environment where the middle tier, using a TPM, acted as a terminal
concentrator. The high-end TPC-A architecture looked like the following.
The Application Servers, which contain the Pro*C statements used to
perform the transaction also run on the terminal concentrator machine
in order to offload as much work from the database serve as possible.
They send the compiled SQL over SQL*Net to the Oracle7 Server processes.
ORACLE7 TPS-A CLIENT/SERVER ARCHITECTURE
| Client | | Terminal | | Server |
| ________ | | Concentrator | | |
| | Client | |TPM | | | |
| | Process|_|_____|__ _____ | | |
| |________| |Comm | | | | | | |
|____________| | | | | | | |
| |__| | | | |
____________ | | TPM | | | |
| Client | | ___| | _______ | | ________ _______ |
| ________ | | | | |_| |__|_______|__| Oracle | | | |
| | Client | |TPM | | | | |Appl. | |SQL*Net| | Server |__| | |
| | Process|_|_____|_| |_____| |Server | | | | Process| | | |
| |________| |Comm | |_______| | | |________| | | |
|____________| | | | | | |
|_______________________| | | | |
| | | |
____________ _______________________ | |Oracle7| |
| Client | | Terminal | | |Server | |
| ________ | | Concentrator | | | | |
| | Client | |TPM | | | | | |
| | Process|_|_____|__ _____ | | __________ | | |
| |________| |Comm | | | | _______ |SQL*Net| | Oracle | | | |
|____________| | | | |_| |__|_______|__| Server |__| | |
| |__| | |Appl. | | | | Process| | | |
____________ | | TPM | |Server | | | |________| |_______| |
| Client | | ___| | |_______| | | |
| ________ | | | | | | | |
| | Client | |TPM | | | | | | |
| | Process|_|_____|_| |_____| | | |
| |________| |Comm | | | |
|____________| | | | |
|_______________________| |________________________|
Clients = 6150 Terminal concentrators = 17
TP Monitor instances = 17
Application server processes Oracle Server processes
= 17*8 = 17*8
The TPM is the software component of the terminal concentrator. In this role
it offloads terminal handling from the the machine running Oracle Server.
Since more than one terminal concentrator can be configured, whereas the
database in this case had to run on a single machine, concentrator machines
can be added until the performance of the back-end machine was optimized.
This three-tier solution resulted in the outstanding transaction throughput
announced with Oracle7 Server. Even with Oracle Parallel Server, it may pay
to offload the terminal handling so that the cluster can be exclusively used
for database operations.
Can you summarize the performance discussion for me?
Depending on the number of users required, different architectures may be
used in a client/server environment to maximize performance:
1) For a small number of users, the traditional Oracle two-task
architecture can be used. In this case, there is a one-to-one
correspondence between client processes and server processes. It's
simple, straightforward, and efficient.
2) For a large number of users, Multi Threaded Server might be a better
approach. Although some tuning may be required, Multi Threaded Server
can handle a relatively large number of users for each machine size
compared to the traditional Oracle approach. Using this approach,
customers will be able to handle many hundreds of users on many
platforms. Furthermore, current Oracle applications can move to this
environment without change.
3) For a very large number of users, where transactions are simple and
terminal input concentration is the overriding performance issue, a
3-tier architecture incorporating a TPM may be useful. In this case,
terminal concentration is handled by the TPM in the middle tier. As
you might expect, it is a more complex environment requiring more
system management. For existing Oracle customers, significant Oracle
application modifications will be required.
Oracle provides all of these choices.
Performance using Oracle's XA Library
=====================================
Are there any performance implications to using the XA library (in other
words, to using TPM-managed transactions)?
(1) The XA library imposes some performance penalty. You should use
TPM-managed transactions only if you actually need them. Even if you
are getting the one-phase commit optimization, the code path is
longer because we need to map back and forth between external
formats and internal ones. Also, prior to 7.1, XA requires you
to release all cursors at the end of a transaction, which results
in extra parsing. Even with shared cursors, there is time spent
looking up the one you need and re-validating it. This has been
improved for 7.1.
(2) If you need to use two-phase commit, this will incur additional cost
since extra I/Os are required. If you do need 2PC, you need to account
for that when sizing the application.
(3) Although some TPMs allow parallel execution of services (such as Tuxedo's
"tpacall"), this will not normally enhance performance unless different
resource managers are being used. In fact, Oracle Server must serialize
accesses to the same transaction by the same Oracle instance, and the
block/resume code will in fact degrade performance in that case compared
to running the services sequentially.hello,
the role is the same on all plattforms. the reports server takes requests for running reports, spawns an engine that executes the request. in addition to that, the server also provides scheduling services and security features for the reports environment.
regards,
the oracle reports team -
ORACLE SERVER AND UNIX TP MONITOR-1
제품 : ORACLE SERVER
작성날짜 : 2002-05-17
====================================================================
Subject: Oracle Server and UNIX Transaction Processing Monitors - 1
=====================================================================
PURPOSE
This file contains commonly asked questions about Oracle Server and UNIX
Transaction Processing Monitors (TPMs). The topics covered in this article are
o What is a Transaction Processing Monitor (TPM)?
o What is the X/Open Distributed Transaction Processing Model?
o How does the Oracle Server works with TPMs?
o How should I position TPMs with my customer?
o What Oracle products must a customer purchase?
o Where can my customer purchase a TPM?
o Availability and packaging
Explanation & Example
What is a Transaction Processing Monitor?
=========================================
Under UNIX, a Transaction Processing Monitor (TPM) is a tool that coordinates
the flow of transaction requests between front-end client processes that issue
requests and back-end servers that process them. A TPM is used as
the "glue" to coordinate transactions that require the services of several
different types of back-end processes, such as application servers and
resource managers, possibly distributed over a network.
In a typical TPM environment, front-end client processes perform screen
handling and ask for services from back-end server processes via calls to the
TPM. The TPM then routes the requests to the appropriate back-end server
process or server processes, wherever they are located on the network. Through
configuration information, the TPM knows what services are available and where
they are located. Generally, the back-end server processes are specialized so
that each one handles one type of requested service. The TPM provides
location transparency as well and can send messages through the network
utilizing lower-level transport services such as TCP/IP or OSF DCE.
The back-end servers process the requests as necessary and
return the results back to the TP monitor. The TP monitor then routes
these results back to the original front-end client process.
A TPM is instrumental in the implementation of truly distributed processing.
Front-end clients and back-end processes have no knowledge of each
other. They operate as separate entities, and it is this concept that provides
flexibility in application development. Front-end and back-end processes are
developed in the UNIX client-server style, with each side optimized for its
particular task. Server functionality can be deployed in stages, which makes
it easy to add functionality as needed later in the product cycle. It also
makes it easy to distribute both the front-end and back-end processes
throughout the network on the most appropriate hardware for the job. In
addition, multiple back-end server processes of the same type might be
activated to handle increasing numbers of users.
What is the X/Open Distributed Transaction Processing Model?
============================================================
The X/Open Transaction Processing working group has been working
for several years to establish a standard architecture to implement
distributed transaction processing on open systems. In late 1991,
X/Open published the initial Distributed Transaction Processing (DTP)
model specification and defined the first of several interfaces that
exist between the components of the model. Subsequently, other publications
and a revised model specification have been published.
An important function of the TPM in the X/Open DTP model is the
synchronization of any commits and rollbacks that are required to complete
a distributed transaction request. The Transaction Manager (TM) portion
of the TPM is the entity responsible for ordering when distributed commits
and rollbacks will take place. Thus, if a distributed application program
is written to take advantage of the TM portion of the TPM, then it,
and not the DBMS, becomes responsible for enabling the two-phase commit
process. Article 2 has more detail on this model.
How does the Oracle Server work with TPMs?
==========================================
When a TPM is used without invoking an X/Open TM component to manage the
transactions, Oracle Server needs no special functionality. The transaction
will be managed by Oracle itself. However, when the TPM X/Open TM component
is used to manage the transaction, the Oracle Server, that is the Oracle DBMS,
acts as a Resource Manager--a type of back-end process. In the case of
TPM-managed transactions, the TM needs a way to tell the RMs about the stages
of the transaction. This is done by a standard, X/Open defined interface
called XA. Article 2 of of this document gives more information about both
the X/Open model and Oracle7's use of XA.
Because the XA interface provides a standard interface between the TM and the
resource manager, it follows that the TM can communicate with any XA-compliant
resource manager (e.g., RDBMS), and, conversely, that a resource manager can
communicate with any XA-compliant TM. Thus, the Oracle Server, beginning with
Oracle7, works with any XA-compliant TM.
How should I position TPMs with my customer?
============================================
There's been a great deal of confusion about the need for TPM technology. Some
software suppliers, most notably IBM, will assert that a TPM like CICS is a
necessary requirement for high volume OLTP. Other vendors will assert that
there is seldom a need for such technology. And yet others promote TPMs as
providers of higher transaction throughput.
From Oracle's standpoint, customers might choose TPM technology under any of
the following conditions:
1. For heterogeneous database access, especially for 2PC capability
This means that a TPM can be used to coordinate 2PC between Oracle
DBMS and any other XA-compliant database, such as Informix. This
does NOT provide SQL heterogeneity - SQL calls to Oracle DBMS may be
different than SQL calls to Informix. The TPM handles the routing,
communication, and two-phase commit portion of the transaction, but
does not translate one type of SQL call into another.
2. For transaction monitoring and workload control
The leading TPMs supply tools to actively manage the flow of
transactions between clients and servers and to load balance the work
load across all available processors on a network, not just on a
single multi-processor system. Some TPMs also have the ability to
dynamically bring up additional back-end services during peak work
hours.
3. For more flexible application development and installation
One of the key features of the DTP model is application modularity.
Modularity, that is, the decomposition of a large program into small,
easily defined, coded and maintained "mini-programs" makes it easy to
add new functionality as needed. Modularity also makes it much easier
to distribute the front-end and back-end processes and the resource
managers across hardware throughout a network.
4. For isolating the client from details of the data model
By using the service oriented programming model, the client program
is unaware of the data model. The service can be recoded to use a
different one with no change to the client. To get this advantage,
the application developer must explicitly code the server and client
to fit the service model.
5. For connection of thousands of users
TP Monitors, because of their three-tier architecture, can be used
to connect users to an intermediate machine or machines, removing
the overhead of handling terminal connections from the machine
actually running the database. See Article 4 for more information.
There are also several cases where TPM technology is not the right answer.
These include:
1. If the customer is simply looking for a performance improvement
The customer may have heard a theory that "higher performance
is possible for large scale applications only if they use a
TP monitor". First, no performance gain can be achieved for
existing applications; in fact, they won't even run under a TP
Monitor without recoding. Second, performance improvements have
only been documented for large numbers of users, and "large"
means many hundreds or thousands. Without a TP Monitor,
Oracle Server can handle several hundred users with its normal
two-task architecture and several times that using the Multi
Threaded Server. For more on performance, see Article 4.
2. If the customer has made large investment in his existing Oracle
applications
TP monitor applications must be designed from the ground up to take
advantage of TP monitor technology. Current Oracle customers will find
it difficult to "retrofit" a TP monitor to their existing applications.
The Multi Threaded Server, on the other hand, allows the use of
existing Oracle applications without change.
3. If the customer is committed to the Oracle tool set
Currently, none of Oracle's front-end tools (Oracle Forms, etc.) is
designed to work with TP monitors. It is possible to invoke a
TP Monitor by using user exits. However, the fact that the TP
Monitor model hides the data model from the client means that only
the screen display parts of Forms can be used, not the automatic
mapping from screen blocks to tables.
4. If the customer does not have a staff of experienced software engineers
This is still very young technology for UNIX. There is not a lot of
knowledge in the industry on how to build TP monitor applications or
what techniques are most useful and which are not. Furthermore,
integrating products from different vendors, even with the support
of standard interfaces, is more complex than deploying an integrated
all-Oracle solution. Because TP monitor technology is fairly
complex, we recommend that you let the TP monitor supplier promote
the virtues of their technology and differentiate themselves from
their competitors.
What Oracle products must a customer purchase?
==============================================
If your customer is only interested in building Oracle-managed TP Monitor
transactions, the only Oracle products required are the Oracle Server
and the appropriate Oracle precompiler for whatever language the
application is being written in--most likely C or Cobol. If TPM-managed
transactions are required, the Oracle7 Server with the distributed option
is also required. SQL*Net is optional because the TPM takes care of the
network services. Article 2 describes when you would choose to have the TP
Monitor manage the transactions.
Where can my customer purchase a TPM?
=====================================
There are many vendors offering the UNIX TPM products. (Oracle does not
relicense TPMs.) Information on the most well known products is provided
below:
The following support XA:
Product & Vendor FCS Known OS/Platform Ports
"TUXEDO System/T" 1986 UNIX SVR4 & SVR3: Amdahl, AT&T,
UNIX System Laboratories Bull, Compaq, Dell, Fujitsu, ICL,
190 River Road Motorola, Olivetti, Pyramid,Sequent,
Summit, NJ 07901 Sun, Toshiba, Unisys, NCR, Stratus
Other: IBM AIX, HP/UX, DEC Ultrix
"TOP END" 1992 UNIX SVR4: NCR
NCR Corporation
1334 S. Patterson Blvd.
Dayton, OH 45479
"ENCINA" 1992 IBM AIX, HP, Sun (SunOS and Solaris)
Transarc Corporation Other: OS/2, DOS, HP-UX, STRATUS
707 Grant Street (Depends on DCE)
Pittsburgh, PA 15219
"CICS/6000" 1993 AIX: IBM
IBM Corporation (Depends on DCE)
"CICS 9000" 1994 HP-UX
HP
The following do not currently support XA:
Product & Vendor FCS Known OS/Platform Ports
"VIS/TP" unknown unknown
VISystems, Inc.
11910 Greenville Avenue
Dallas, TX 75243
"UniKix" 1990 UNIX: ARIX, AT&T, NCR, Pyramid,
UniKix Sequent, Sun, Unisys
"MicroFocus 1993 SCO Unix, AIX
Transaction System"
Micro Focus
26 West Street
Newbury RG13 1JT
UK
There are also several third parties who are reselling the products listed
above.
In addition, Groupe Bull, Digital, Siemens-Nixdorf, and several other hardware
vendors are planning to redesign their proprietary TPMs to be XA-compliant and
suitable for use on UNIX systems.
Availability and Packaging
==========================
On what platforms is the XA Library available?
Oracle provides the XA interface with Oracle7 Server on all platforms that
support an XA-compliant TPM. Support for XA is included as part of the
Oracle7 Server distributed option and has no extra charge in and of itself.
Which version of XA does Oracle Server support?
Oracle7 Server supports the Common Application Environment (CAE) version of
XA, based on the specification published by X/Open in late 1991. It will
require that the TM also be at that level. This means Tuxedo /T version 4.2,
for example.
Oracle Server supports all required XA functions. There are some optional
features Oracle Server does not support, such as asynchronous operation.
None of those options affect application programming.
Page (2/4)
This file contains commonly asked questions about Oracle Server and UNIX
Transaction Processing Monitors (TPMs). The topics covered in this article are
o Oracle Server Working with UNIX TPMs
o TPM Application Architecture
The questions answered in part 2 provide additional detail to the information
provided in part 1.
Oracle Server Working with UNIX TP Monitors
===========================================
Do I need XA to use Oracle Server with TPMs? If I don't use it, what are
the consequences?
There are a number of real applications running today with Oracle Server and
TPMs but not using XA. To use a TPM with Oracle without using XA, the user
would write an "application server" program which could handle one or more
"services". For example, a server program might handle a service called
"debit_credit". The key requirement is that the entire transaction,
including the "commit work", must be executed within a single service. This
is the restriction which XA will remove, as we'll see later. Each
server process can serially handle requests on behalf of different clients.
Because a server process can handle many client processes, this can
reduce the total number of active processes on the server system,
thereby reducing resource requirements and possibly increasing overall
throughput.
When Oracle is used with a TPM in this mode, we call it an Oracle-managed
transaction since the transaction commit or rollback is done with a SQL
statement.
What is XA? How does XA help Oracle7 work with UNIX TPMs?
XA is an industry standard interface between a Transaction Manager and a
Resource Manager. A Resource Manager (RM) is an agent which
controls a shared, recoverable resource; such a resource can be
returned to a consistent state after a failure. For example, Oracle7 Server
is an RM and uses its redo log and undo segments to be able to do this.
A Transaction Manager (TM) manages a transaction including the
commitment protocol and, when necessary, the recovery after a failure.
Normally, Oracle Server acts as its own TM and manages its own commitment
and recovery. However, using a standards-based TM allows Oracle7 to
cooperate with other heterogeneous RMs in a single transaction.
The commonly used TPMs include a TM component for this purpose. In order to
use the TM capability of the TPM rather than Oracle7's own transaction
management, the application uses a transaction demarcation API (called TX)
provided by the TPM rather than the SQL transaction control statements (e.g.
"commit work"). For each TX call, the TM then instructs all RMs, by the
appropriate XA commands, to follow the two-phase commit protocol. We
call this a TPM-managed transaction.
The following picture shows these interfaces within a monolithic application
program model. This is the model most commonly described in the
DTP literature. We'll see later what the picture looks like when we add
Oracle7 and when we switch to a modularized client-server application
program model.
| |
| |
| Application Program (AP) |
| |
| |
| | | |
Resource Manager API | | | |
(e.g. SQL) -----|--|------------- | TX API
| | v | |
--------|------------- | |
| v | | v
---------------------- | | --------------------
| | | | | |
| Resource | | |<----->| Transaction |
| Managers | |--- | Manager |
| (RMs) | |<-------->| (TM) |
| |--- | |
| |<----------->| |
---------------------- XA --------------------
Interface
The XA interface is an interface between two system components, not
an application program interface; the application program does
not write XA calls nor need to know the details of this interface.
The TM cannot do transaction coordination without the assistance of
the RM; the XA interface is used to get that assistance.
How does the DTP Model support client-server?
The above picture was actually simplified to make it easier to explain
the role of XA. In a true distributed transaction architecture, there
are multiple applications, each with an Application Program, a Resource
Manager, and a Transaction Manager. The applications communicate by
using a Communication Resource Manager. The CRM is generally provided
as a component of the TPM. It includes the transaction information when
it sends messages between applications, so that both applications can
act of behalf of the same transaction. The following picture
illustrates this:
Client Application
| AP |
||| | |
SQL ||| | TX | CRM
||V V | API
-||-- ----- |
| |V | | | V
--|-- |<---| | -----
| V || | | | |
----- |<----| TM |<-->| CRM |
| || | |XA+ | |
| RMs |<-----| | -----
| | XA | | A
----- ----- | Server Application
| -----------------------------
| | AP |
| -----------------------------
| ||| | |
| SQL ||| | TX | CRM
| ||V V | API
| -||-- ----- |
| | |V | | | V
| --|-- |<---| | -----
| | V || | | | |
| ----- |<----| TM |<-->| CRM |
| | || | |XA+ | |
| | RMs |<-----| | -----
| | | XA | | A
| ----- ----- |
| |
| |
-------- |
/ |
/ |
/ |
Most TP Monitor products include both a TM and a CRM, and also provide
additional functions such as task scheduling and workload monitoring.
What is XA+? What does Oracle need to do to comply with it?
XA+ is an interface that lets the X/Open model actually be distributed
because it allows a communication resource manager to tell a TM on the
server that a message from a client just came in for a particular
transaction. Oracle is not currently planning to provide an X/Open
communication resource manager, so we don't have any plans right now
to do XA+. Version 2 of the DTP model paper from X/Open describes it.
The status of the current XA+ specification is "snapshot".
When would I choose an Oracle-managed transaction vs a TPM-managed
transaction?
Oracle Server is very efficient at managing its own transactions. If
the TPM manages the transaction, in general some additional overhead
will be incurred.
The two main reasons a customer might prefer to use a TPM-managed
transaction are as follows:
(1) He may need to update RMs from different vendors. Experience so far
has been that the most common case is wanting to update both Oracle and
a TP Monitor managed resource such as a transactional queuing service
in the same transaction (see Article 3).
(2) He may want to use the model of having several different services in
a transaction, even to the same database. For example, the
"debit_credit" service could be split into a "debit" service and a
"credit" service. This is a very attractive model, but this type of
modularity does exact a performance penalty (see Article 4).
Can I get a version of XA to run on Oracle Server version 6?
No, the XA functionality uses two underlying mechanisms in the Oracle
Server which are not available in version 6: two-phase commit and
session switching. The upi calls for these functions do not not exist
in version 6.
When would I use XA vs Oracle7 to coordinate all-Oracle distributed
transactions?
Generally speaking, Oracle Server should be used to coordinate all-Oracle
distributed transactions. The main reason for using XA to coordinate
transactions would be that you want to use the TP Monitor service-oriented
architecture. That is, you would like to construct an application built of
services and service requests in order to benefit from the modularity and
workload control such an environment provides.
TP Monitor Application Architecture
===================================
What might a TP Monitor application look like?
Most TPM applications will consist of two more more programs, where
there are front-end client programs which request services and back-end
server programs which provide services. In this case, the TPM supplies an
additional capability which is transactional communication. The client
describes the boundaries of the transaction, through the use of the TX API,
and the TPM relays that transaction information to each requested service.
The overall application structure generally looks like the following in the
client-server model. The "TP Monitor Services" box is not necessarily a
process. It could be one or more processes, or just libraries coordinating
through shared memory. Each client process and server process could be on
a different machine. Normally, the application server processes would be
connected to their Oracle Server processes using the IPC driver; the TPM
would be used to deliver messages between application client processes on
one machine and application server processes on another. However, the
application server processes could also be connected with the standard
Oracle SQL*Net to shadow processes on different machines. This might be
useful if one of the databases was on a machine which did not support TPMs.
|Application| |Application| |Application|
| Client 1 | | Client 2 | | Client 3 |
| | | | | |
\ TPM API | TPM API / TPM API
| |
| TP Monitor Services |
| |
| --------------------- |
| | Transaction Manager | |
---------------|---------------|---------------------
TPM API | | XA | XA | TPM API
| | inter- | inter- |
| | face | face |
| | | |
----------- | | -----------
|Application| | | |Application|
| Server 1 |--- ---| Server 2 |
| (Pro*C) | | | | (Pro*C) |
| SQL | SQL
| | | |
| Resource ----------- ----------- |
| Manager | | | | |
| | Oracle7 | | Oracle7 | |
| | Server | | Server | |
| | Process | | Process | |
| | | | | |
| ----------- ----------- |
| | | |
| ----------------------------------------------------- |
| | | |
| | SGA | |
| | | |
| ----------------------------------------------------- |
| |
Application client programs might be written in C and be linked with
TPM libraries. Alternatively, they could use a screen painter product.
Application server programs would be written in Pro*C or Pro*COBOL and
be linked with TPM libraries, the normal Oracle7 user-side libraries
and libxa.a. The Oracle7 Server process is the regular Oracle7 executable.
More complicated application architectures can also be constructed. Most of
the TPMs allow a server to become a client of another service, so you can
involve additional servers.
Could I use Oracle7's Multi Threaded Server as the SQL*Net connection in the
previous picture?
Yes, but that will not be needed in many cases. For example, both
application server processes in the previous picture could talk to a
single Oracle7 Server process through the Multi Threaded Server in the
previous picture. However, since the TPM architecture typically reduces
the number of server processes, the reduction in processes using Multi
Threaded Server may be less significant than in an architecture without
TPMs. If the application will use database links, however, then MTS will
be required.
How do I write an Oracle TP Monitor application?
The actual API used to talk to the TPM varies between vendors, so you need
to get the documentation from the vendor. However, all have a way to
indicate where a transaction begins and ends and a way to send a request
and receive a response from a client to a server. Some use an RPC model,
some use a pseudo-RPC model, and some use a send/receive model. The TX API
described earlier is a subset of the TPM API as defined by each of
the TPM providers.
The client program and server program might look something like the
following examples. We h (such as Tuxedo's
"tpacall
Reference Ducumment
---------------------hello,
the role is the same on all plattforms. the reports server takes requests for running reports, spawns an engine that executes the request. in addition to that, the server also provides scheduling services and security features for the reports environment.
regards,
the oracle reports team -
ISS Security Advisory
May 6, 1999
Multiple File System Vulnerabilities in Oracle 8
Synopsis:
Internet Security Systems (ISS) X-Force has discovered that
multiple vulnerabilities exist in Oracle 8 that may allow local
attackers to exploit weaknesses in Oracle administrative tools.
Oracle is the market leader in enterprise database solutions.
Attackers may use these vulnerabilities to amplify their
privilege to that of the foracleF user. By default, the oracle
user controls the entire Oracle database system. Attackers may
launch local denial of service attacks against the database as
well as alter or manipulate data.
Affected Versions:
ISS X-Force has determined that most current versions of Oracle
8 for Unix are vulnerable. These versions include 8.03, 8.04,
8.05, and 8.15. Oracle 8 for Windows NT is not affected by
these vulnerabilities.
Description:
The Oracle 8 distribution is shipped with many administrative
utilities that are owned by the oracle user with the setuid bit
enabled. Several of these utilities implement insecure file
creation and manipulation. These utilities also trust Oracle-
related environment variables. The combined effect of these
vulnerabilities may allow local attackers to create, append to,
or overwrite privileged oracle files. Certain vulnerabilities
exist that may allow local attackers to execute arbitrary
commands as the oracle user. Attackers may also be able to
permanently elevate their privilege to that of the oracle user.
Temporary files that follow symbolic links are a common source
of vulnerabilities in setuid executables. Administrators should
remove or restrict access to setuid executables if possible.
Developers of setuid programs need to take special precautions
to prevent
the introduction of vulnerabilities of this nature. ISS X-Force
recommends
that all Unix developers become familiar with Matt BishopFs
secure
programming guide, available at
http://olympus.cs.ucdavis.edu/~bishop/secprog.html
Fix Information:
ISS X-Force has worked with Oracle to provide a patch for the
vulnerabilities described in this advisory. Oracle has provided
the following FAQ to answer any questions concerning these
vulnerabilities.
Q: IFve heard about a setuid security issue with the Oracle
database? What is this all about?
A: On Unix platforms, some executable files have the setuid bit
on. It may be possible for a very knowledgeable user to use
these executables to bypass your system security by elevating
their operating system privileges to that of the Oracle user.
Q: Which releases are affected by this problem?
A: This problem affects Oracle data server releases 8.03, 8.0.4,
8.0.5, and 8.1.5 on Unix platforms only.
Q: Can I correct this problem or do I need a patch?
A: This problem can easily be corrected. The customer can
download the patch from the Oracle MetaLink webpages at
http://www.oracle.com/support/elec_sup. The patch is a Unix
shell script. This shell script should be run immediately, and
also run after each relink of Oracle.
Q: What is Oracle doing to fix this problem?
A: Effective immediately, Oracle will provide the patch on
OracleFs Worldwide Support Web pages. Oracle will ensure the
patches are incorporated into future releases of Oracle8i
(8.1.6) and Oracle8.0 (8.0.6)
Q: What is Oracle doing to notify users about this problem now?
A: Oracle is notifying all supported customers, via the Oracle
Worldwide Support Web pages, of this issue so they can address
it as required.
ISS X-Force also recommends that all administrators complete a
proactive survey on the use or potential misuse of setuid bits
on privileged executables on their systems.
Credits:
These vulnerabilities were primarily researched by Dan
Ingevaldson of the ISS X-Force.
Copyright ( 1999 by Internet Security Systems, Inc. Permission
is hereby granted for the electronic redistribution of this
Security Alert. It is not to be edited in any way without
express consent of the X-Force. If you wish to reprint the
whole or any part of this Alert Summary in any other medium
excluding electronic medium, please e-mail [email protected] for
permission.
About ISS
ISS is the pioneer and leading provider of adaptive network
security software delivering enterprise-wide information
protection solutions. ISSF award-winning SAFEsuite family of
products enables information risk management within intranet,
extranet and electronic commerce environments. By combining
proactive vulnerability detection with real-time intrusion
detection and response, ISSF adaptive security approach creates
a flexible cycle of continuous security improvement, including
security policy implementation and enforcement. ISS SAFEsuite
solutions strengthen the security of existing systems and have
dramatically improved the security posture for organizations
worldwide, making ISS a trusted security advisor for firms in
the Global 2000, 21 of the 25 largest U.S. commercial banks and
over 35 governmental agencies. For more information, call ISS at
678-443-6000 or 800-776-2362 or visit the ISS Web site at
www.iss.net.
Disclaimer
The information within this paper may change without notice. Use
of this information constitutes acceptance for use in an AS IS
condition. There are NO warranties with regard to this
information. In no event shall the author be liable for any
damages whatsoever arising out of or in connection with the use
or spread of this information. Any use of this information is at
the userFs own risk.
X-Force PGP Key available at:
http://www.iss.net/xforce/sensitive.html as well as on MITFs PGP
key server and PGP.comFs key server.
Please send suggestions, updates, and comments to:
X-Force <[email protected] <mailto:[email protected]>> of Internet
Security Systems, Inc.
nullhttp://metalink.oracle.com has all the Oracle documentation online. If you search for Security, you'll get plenty of documents. The Oracle Administrator's Guide has a Security Checklist that it probably a good starting point.
This is a huge topic, though.
Justin -
Does Oracle (installed in unix) support OS Auth for Windows AD?
Hi, I've tried setup the Oracle (installed in Windows) support OS Auth for Windows AD.
But does Oracle (currently I am using 9i) installed in Unix support OS Auth for Windows AD (using LDAP/ Kerberos / etc.)?
If yes, can anyone tell me how to make it ?
Thanks!Yes.. Oracle support Windows AD authentication using Enterprise User security.
Please contact me on following if you need more details
Email: [email protected]
Ph. 732 404 8364
We are planning to have EUS presentation for our clients. Please let me know if you are interested to know more on EUS.
Regards,
Nishi, CISSP CISA -
How to connect oracle database in UNIX OS
Hi All
can any one help me on how to connect to oracle database in UNIX system(PUTTY)..
Generally what i am doing is
1) login with my user name
2) trying to connect oracle using the command sqlplus -s username/password
showing error SQLPLUS: not found
Do i need to go any path where oracle is install? iF yes, how to find out that? or any other step to connect? Please help me by giving the sequence of steps...
Regards
Prem Raj DasariWhat is your database version?
can any one help me on how to connect to oracle database in UNIX system(PUTTY)..
Generally what i am doing is
1) login with my user name
2) trying to connect oracle using the command sqlplus -s username/password
showing error SQLPLUS: not found
Do i need to go any path where oracle is install? iF yes, how to find out that? or any other step to connect? Please help me by giving the sequence of steps...You need to source the database env file before running sqlplus.
R12 -- Maintaining Oracle E-Business Suite Documentation Set
http://docs.oracle.com/cd/B53825_08/current/html/docset.html
11i -- Maintaining Oracle Applications Documentation Set
http://docs.oracle.com/cd/B25516_18/current/html/docset.html
Thanks,
Hussein -
Oracle ADF security integration with Oracle E-Business Suite SDK JAAS
I have an Oracle ADF 11.1.2.2 application that is using ADF security for authentication and authorization.
When we deploy this application to our JDeveloper integrated weblogic server, we utilize the security setting of "Custom" and use weblogic users and roles to map to the ADF application roles. In that environment our security is working properly.
I have a Weblogic 10.3.5 standalone server that has the ADF runtime installed as well as the Oracle E-Business Suite SDK JAAS implementation installed.
When I deploy the Oracle ADF application to the standalone weblogic server, I am directed to the JAAS login page when I attempt to access any JSF page (including those that I have granted View access through the anonymous-role. Does the Oracle ADF anonymous-role work (allow for anonymous page access) when JAAS security is handled by the Oracle E-Business Suite SDK JAAS implementation?
Per the SDK instructions, when we install the Oracle ADF deployment on Weblogic we have selected "DD only" for our security setting. We have defined enterprise roles in the Oracle ADF security setup (jazn-data.xml) that are assigned the appropriate application roles. Those enterprise roles have the same name (i.e. UMX|YOURROLE) as the E-Business Suite roles that are assigned to our test users. When we login with an E-Business Suite user / password we are receiving an error:
Error 401--Unauthorized
From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
10.4.2 401 Unauthorized
Any thoughts on why that would be?
Thanks
DanThanks Juan.
With the debugging options enabled it appears the issue is not an issue with the user / role credentials - it seems like the resource grants from jazn-data.xml are not being reviewed in my standalone weblogic instance EAR deployment:
[JpsAuth] Check Permission
PolicyContext: [TestApp]
Resource/Target: [untitled1PageDef]
Action: [view]
Permission Class: [oracle.adf.share.security.authorization.RegionPermission]
Result: [FAILED]
Evaluator: [ACC]
Failed ProtectionDomain:ClassLoader=sun.misc.Launcher$AppClassLoader@13f5d07
CodeSource=file:/app/oracle/product/Middleware/oracle_common/modules/oracle.adf.share_11.1.1/adf-share-support.jar
Principals=total 2 of principals(
1. JpsPrincipal: oracle.security.jps.internal.core.principals.JpsAnonymousUserImpl "anonymous" GUID=null DN=null
2. JpsPrincipal: oracle.security.jps.internal.core.principals.JpsAnonymousRoleImpl "anonymous-role" GUID=null DN=null)
When I access the same page from my integrated weblogic server I see:
[JpsAuth] Check Permission
PolicyContext: [TestApp]
Resource/Target: [untitled1PageDef]
Action: [view]
Permission Class: [oracle.adf.share.security.authorization.RegionPermission]
Result: [FAILED]
Evaluator: [ACC]
Failed ProtectionDomain:ClassLoader=sun.misc.Launcher$AppClassLoader@13f5d07
CodeSource=file:/app/oracle/product/Middleware/oracle_common/modules/oracle.adf.share_11.1.1/adf-share-support.jar
Principals=total 2 of principals(
1. JpsPrincipal: oracle.security.jps.internal.core.principals.JpsAnonymousUserImpl "anonymous" GUID=null DN=null
2. JpsPrincipal: oracle.security.jps.internal.core.principals.JpsAnonymousRoleImpl "anonymous-role" GUID=null DN=null)
When I review my EAR - I do see jazn-data.xml at:
/META-INF/jazn-data.xml
I will review the system-jazn-data.xml to see if the policy information has been migrated properly as part of the EAR deployment.
Thanks.
-Dan -
How to store Custom principal in Oracle ADF security Framework
Hi guys, hope somebody will help me out.
I am facing the following issue, i need to have a custom principal instance after oracle adf security frame work does authenticate and authorize user.
My custom principal instance should have per say addition attribute, say clientId. I am using Jdeveloper 11.1.2.4 and i setup weblogic to use ReadOnlySQLAuthenticator(it does most of desired functionality).
As far as i get it, i would have to implement a custom provider to have a chance to implement a custom LoginModule, so i can set it up to use my custom principal, am i right ? and i am not sure how ReadOnlySQLAuthenticatorImpl that i chose in weblogic is bound to
DBMSAtnLoginModuleImpl (i mean how does it knows what LoginModule should it use) and if i can , how can i make ReadOnlySQLAuthenticatorImpl use my custom LoginModule.
Sorry if i violated forum rules.and i am not sure how ReadOnlySQLAuthenticatorImpl that i chose in weblogic is bound to
DBMSAtnLoginModuleImpl (i mean how does it knows what LoginModule should it use)
This info is returned by getLoginModuleConfiguration(): AuthenticationProvider (BEA WebLogic Server 10.0 API Reference)
Dario
Maybe you are looking for
-
I have a Lacie 500gb firewire drive which is no mounting on the desktop of my computer. I have a total of 11 drives including the Lacie. I have not had any problems with my set up until now. The drive still cycles to seem like it was going to mount o
-
Streaming Audio Lagging (Unusual Bug)
I have a swf, which loads external movies, each external movie has its own layer in the time line which contains an audio file, the audio is not being used with actionscript, it is just sitting there and plays with the "stream" option enabled in the
-
Issue with upload of time events through SAPCDT45
Dear Consultants, I am facing an issue while uploading the clocking data for locked entries. When the entries are uploaded from CC1TEV to TEVEN table using program SAPCDT45, "Changed By" and "Changed On" fields are coming blank in PA30 IT2011 PFA the
-
Photoshop CC and Lightroom 5 Offer
I plan to subscribe to the PS CC and LR5 offer by Adobe. I currently have a stand alone version of LR5 on my destop and laptop. Do I need to uninstall LR prior to subscribing to the offer?
-
Whenever I use any folder or drive that has image files, Lightroom opens automatically even when I don't want it to. How can I stop this? Is it a Windows or Lightroom preference?