2 Installing Oracle Database Vault as an Option

2.1.1 Become Familiar with the Features of Oracle Database Vault

Before you plan the upgrade process, become familiar with the features of Oracle Database Vault. The Oracle Database Vault Administrator's Guide discusses the basic features of Oracle Database Vault.

2.1.2 Check the Hardware Requirements

The system must meet the following minimum hardware requirements:

• At least 1024MB of available physical RAM

• The following table gives the relationship between the available RAM and the required swap space.

  Available RAM	Swap Space Required
  Between 512 MB and 2048 MB	1.5 times the size of RAM
  Between 2049 MB and 8192 MB	Equal to the size of RAM
  More than 8192 MB	0.75 times the size of RAM

  
  

• 400 MB of disk space in the /tmp directory

• Up to 5 GB of disk space for the Oracle software, depending on the installation type.

• 1.2 GB of disk space for a preconfigured database that uses file system storage (optional)

  Note:

  The disk space requirement for databases that use Automatic Storage Management or raw device storage is described later in this chapter.

  Additional disk space, either on a file system or in an Automatic Storage Management disk group, is required for the flash recovery area if you choose to configure automated backups.

To ensure that the system meets these requirements:

1. To determine the physical RAM size, enter the following command:

   # /usr/contrib/bin/machinfo  | grep -i Memory
   
   

   If the size of the physical RAM is less than the required size, then you must install more memory before continuing.

2. To determine the size of the configured swap space, enter the following command:

   # /usr/sbin/swapinfo -a
   
   

   If necessary, refer to the operating system documentation for information about how to configure additional swap space.

3. To determine the amount of disk space available in the /tmp directory, enter the following command:

   # bdf /tmp
   
   

   If there is less than 400 MB of free disk space available in the /tmp directory, then complete one of the following steps:

   • Delete unnecessary files from the /tmp directory to meet the disk space requirement.

   • Set the TMP and TMPDIR environment variables when setting the oracle user's environment (described later).

   • Extend the file system that contains the /tmp directory. If necessary, contact your system administrator for information about extending file systems.

4. To determine the amount of free disk space on the system, enter the following command:

   # bdf
   
   

   The following table shows the approximate disk space requirements for software files for each installation type:

   Installation Type	Requirement for Software Files (GB)
   Enterprise Edition	2.0
   Standard Edition	2.5
   Custom (maximum)	2.5

   
   

5. To determine whether the system architecture can run the software, enter the following command:

   # /bin/getconf KERNEL_BITS
   

   Note:

   The expected output of this command is 64. If you do not see the expected output, then you cannot install the software on this system.

2.1.3 Check the Operating System Requirements

Depending on the products that you intend to install, verify that the following software is installed on the system. The procedure following the table describes how to verify whether these requirements are addressed.

To ensure that the system meets these requirements:

1. To determine which version of HP-UX is installed, enter the following command:

   # uname -a
   HP-UX hostname B.11.23 ia64 109444686 unlimited-user license
   
   

   In this example, the version of HP-UX 11i is 11.23.

2. To determine whether a bundle, product, or fileset is installed, enter a command similar to the following, where level is bundle, product, or fileset:

   # /usr/sbin/swlist -l level | more
   
   

   If a required bundle, product, or fileset is not installed, then you must install it. Refer to your operating system or software documentation for information about installing products.

In addition, you need to verify that the following patches, or their later versions, are installed on the system. The procedure following the table describes how to check these requirements.

To determine whether a patch is installed, enter a command similar to the following:

# /usr/sbin/swlist -l patch | grep PHSS_33279

Alternatively, to list all installed patches, enter the following command:

# /usr/sbin/swlist -l patch | more

If a required patch is not installed, then download it from the following Web site and install it:

http://itresourcecenter.hp.com

If the Web site shows a more recent version of the patch, then download and install that version.

Creating Required Symbolic Links

To enable you to successfully relink Oracle products after installing this software, enter the following commands to create required X library symbolic links in the /usr/lib directory:

# cd /usr/lib
# ln -s libX11.3 libX11.sl
# ln -s libXIE.2 libXIE.sl
# ln -s libXext.3 libXext.sl
# ln -s libXhp11.3 libXhp11.sl
# ln -s libXi.3 libXi.sl
# ln -s libXm.4 libXm.sl
# ln -s libXp.2 libXp.sl
# ln -s libXt.3 libXt.sl
# ln -s libXtst.2 libXtst.sl

2.1.4 Configure Kernel Parameters

Verify that the kernel parameters shown in the following table are set either to the formula shown, or to values greater than or equal to the recommended value shown. The procedure following the table describes how to verify and set the values.

To view the current value or formula specified for these kernel parameters, and to change them if necessary:

1. Follow these steps:

   1. Enter the following command to start the kcweb application:

      # /usr/sbin/kcweb -F
      
      

   2. Check the value or formula specified for each of these parameters and, if necessary, modify that value or formula.

      If necessary, refer to the kcweb online Help for more information about completing this step.

      Note:

      If you modify the value of a parameter that is not dynamic, then you must restart the system.

2. If necessary, when the system restarts, log in and switch user to root.

2.1.5 Check the Database Requirements

In order to install Oracle Database Vault, you must be running the Enterprise Edition of Oracle Database 10g release 2 (10.2.0.4). The database should also have Oracle Enterprise Manager Console DB 10.2.0.4.0 installed. In addition, the Database Vault installer requires write access to the files, oratab and oraInst.loc.

A listener must have been configured for the existing database. Oracle Net Configuration Assistant configures the listener when you first install the database. You can also use Oracle Enterprise Manager to administer listeners.

You must have an existing password file for the database. The password file authentication parameter, REMOTE_LOGIN_PASSWORDFILE must have been set to EXCLUSIVE or SHARED.

You can set the REMOTE_LOGIN_PASSWORDFILE parameter in the init.ora file. Use the orapwd utility to create and manage password files.

The following topics discuss applying the 10.2.0.4 patch set and installing the required components:

• Install Oracle Enterprise Manager Console DB

• Apply Oracle Database Release 10.2.0.4 Patch Set

http://metalink.oracle.com

2.1.6 Prepare a Backup Strategy

Oracle strongly recommends that you back up your database before performing any upgrade or installation. The ultimate success of your upgrade depends heavily on the design and execution of an appropriate backup strategy. To develop a backup strategy, consider the following questions:

• How long can the production database remain inoperable before business consequences become intolerable?

• What backup strategy should be used to meet your availability requirements?

• Are backups archived in a safe, offsite location?

• How quickly can backups be restored (including backups in offsite storage)?

• Have recovery procedures been tested successfully?

Your backup strategy should answer all of these questions and include procedures for successfully backing up and recovering your database.

2.1.7 Disable Custom Profiles (If Any)

If you have created custom profiles and password complexity checks in your existing database, then you need to disable these before performing the installation. You can reenable these after the installation is complete. Use the following steps to achieve this:

1. Extract the profile names and associated settings for each profile that is being used. You can use a script to accomplish this.

   Example 2-1 shows a sample script that extracts the profile names and settings to create an output script called, myprofiles.sql. After the installation is complete, you can run myprofiles.sql to restore the profile settings.

   Example 2-1 Extracting Profiles

   set serverout on size 100000
    spool myprofiles.sql
    .
    declare
    l_last varchar2(30) := 'X';
    l_count number := 0;
    begin
        for c in (
            select profile, resource_name , limit
            from dba_profiles
            order by profile, resource_name
        ) loop
            if l_last <> c.profile then
                l_last := c.profile;
                if l_count > 0 then
                    dbms_output.put_line(';');
                end if;
                l_count := l_count + 1;
                dbms_output.put_line('create profile ' || c.profile || ' limit ');
            else
                dbms_output.put_line('    ' || c.resource_name || ' ' || c.limit);
            end if;
        end loop;
        dbms_output.put_line(';');
    end;
    /
    .
    spool off 
   
   

2. Disable the custom profiles and password complexity settings. For example:

   SQL> ALTER PROFILE SomeCustomProfile LIMIT
   PASSWORD_REUSE_MAX UNLIMITED -- The number of times a password can be reused
   PASSWORD_REUSE_TIME UNLIMITED -- The number of days between reuses of a password
   PASSWORD_VERIFY_FUNCTION NULL
   /
   
   

3. After the Oracle Database Vault installation is complete, reenable the profiles by running the script created in Step 1.

   SQL>@myprofiles.sql

2.1.8 Verify That Oracle Clusterware Is Running (RAC Only)

Oracle Clusterware should be running for the Database Vault installer to find the existing Real Application Clusters (RAC) databases. If you have stopped Oracle Clusterware, then you should restart it before running Oracle Universal Installer. Use the following command to start Oracle Clusterware:

$CRS_HOME/bin/crsctl start crs

2.1.9 Stop Existing Oracle Processes

Stop all processes running in the Oracle home. You must complete this task to enable Oracle Universal Installer to relink certain executables and libraries. For RAC databases, you need to stop the processes on all nodes.

Stop the processes in the following order:

1. Stop the Enterprise Manager Database Control Process

2. Stop the iSQL*Plus Process

3. Shut Down All Database Instances

4. Stop Existing Listeners

$ORACLE_HOME/bin/emctl stop dbconsole

$ORACLE_HOME/bin/isqlplusctl stop

sqlplus SYS "AS SYSDBA"
Enter password:
SQL> shutdown immediate

2.1.10 Configure the Oracle User's Environment

Run Oracle Universal Installer (OUI) using the account that owns the Oracle software. This is usually the oracle account.

However, before you start Oracle Universal Installer you must configure the environment of the oracle user. To configure the environment, you must:

• Set the default file mode creation mask (umask) to 022 in the shell startup file.

• Set the DISPLAY environment variable.

To set the oracle user's environment:

1. Start a new terminal session, for example, an X terminal (xterm).

2. Enter the following command to ensure that X Window applications can display on this system:

   $ xhost fully_qualified_remote_host_name
   
   

   For example:

   $ xhost somehost.us.acme.com
   
   

3. If you are not already logged in to the system where you want to install the software, then log in to that system as the oracle user.

4. If you are not logged in as the oracle user, then switch user to oracle:

   $ su - oracle
   
   

5. To determine the default shell for the oracle user, enter the following command:

   $ echo $SHELL
   
   

6. Open the oracle user's shell startup file in any text editor:

   • Bourne shell (sh), Bash shell (bash), or Korn shell (ksh):

     $ vi .bash_profile
     
     

   • C shell (csh or tcsh):

     % vi .login
     
     

7. Enter or edit the following line, specifying a value of 022 for the default file mode creation mask:

   umask 022
   
   

8. If the ORACLE_SID, ORACLE_HOME, or ORACLE_BASE environment variable is set in the file, then remove the corresponding lines from the file.

9. Save the file, and exit from the editor.

10. To run the shell startup script, enter one of the following commands:

    • Bourne, Bash, or Korn shell:

      $ . ./.profile
      
      

    • C shell:

      % source ./.login
      
      

11. If you are not installing the software on the local system, then enter a command similar to the following to direct X applications to display on the local system:

    • Bourne, Bash, or Korn shell:

      $ DISPLAY=local_host:0.0 ; export DISPLAY
      
      

    • C shell:

      % setenv DISPLAY local_host:0.0
      
      

    In this example, local_host is the host name or IP address of the system that you want to use to display Oracle Universal Installer (your workstation or PC).

12. If you determined that the /tmp directory has less than 400 MB of free disk space, then identify a file system with at least 400 MB of free space and set the TEMP and TMPDIR environment variables to specify a temporary directory on this file system:

    1. Use the df -k command to identify a suitable file system with sufficient free space.

    2. If necessary, enter commands similar to the following to create a temporary directory on the file system that you identified, and set the appropriate permissions on the directory:

       $ su - root
       # mkdir /mount_point/tmp
       # chmod a+wr /mount_point/tmp
       # exit
       
       

    3. Enter commands similar to the following to set the TEMP and TMPDIR environment variables:

       • Bourne, Bash, or Korn shell:

         $ TEMP=/mount_point/tmp
         $ TMPDIR=/mount_point/tmp
         $ export TEMP TMPDIR
         
         

       • C shell:

         % setenv TEMP /mount_point/tmp
         % setenv TMPDIR /mount_point/tmp
         
         

13. Enter commands similar to the following to set the ORACLE_BASE and ORACLE_SID environment variables:

    • Bourne, Bash, or Korn shell:

      $ ORACLE_BASE=/u01/app/oracle
      $ ORACLE_SID=sales
      $ export ORACLE_BASE ORACLE_SID
      
      

    • C shell:

      % setenv ORACLE_BASE /u01/app/oracle
      % setenv ORACLE_SID sales
      
      

    In these examples, /u01/app/oracle is the Oracle base directory that you created or identified earlier and sales is the name that you want to call the database (typically no more than five characters).

14. Enter the following commands to ensure that the ORACLE_HOME and TNS_ADMIN environment variables are not set:

    • Bourne, Bash, or Korn shell:

      $ unset ORACLE_HOME
      $ unset TNS_ADMIN
      
      

    • C shell:

      % unsetenv ORACLE_HOME
      % unsetenv TNS_ADMIN
      
      

15. To verify that the environment has been set correctly, enter the following commands:

    $ umask
    $ env | more
    
    

    Verify that the umask command displays a value of 22, 022, or 0022 and the environment variables that you set in this section have the correct values.

2.1.11 Run Oracle Universal Installer to Install

Run Oracle Universal Installer (OUI) to install Oracle Database Vault into an existing Oracle Database 10g release 2 (10.2.0.4) database. You should run the installer as the software owner account that owns the current ORACLE_HOME environment. This is normally the oracle account.

Log in as the oracle user. Alternatively, switch user to oracle using the su command. Change your current directory to the directory containing the installation files. Start Oracle Universal Installer.

./runInstaller

The following steps discuss the options you need to select:

1. In the Specify Installation Details screen, you need to specify the path to the Oracle home that contains the existing Oracle Database. The Destination Path box lists the Oracle home paths of all Oracle Database release 2 (10.2.0.4) Enterprise Edition databases registered with the system.

   Select the Oracle home corresponding to the database into which you want to install Oracle Database Vault.

   Note:

   • If an Oracle home does not have an Enterprise Edition of Oracle Database release 10.2.0.4 installed, then it is not displayed. You must ensure that the Oracle home has an Enterprise Edition of Oracle Database release 10.2.0.4 installed.

   • If an Oracle home does not have Oracle Enterprise Manager Console DB 10.2.0.4.0 installed, then it is not displayed. You must ensure that the Oracle home has Oracle Enterprise Manager Console DB 10.2.0.4.0 installed.

   • If an Oracle home contains an Automatic Storage Management (ASM) instance, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home that also contains an ASM instance.

   • If an Oracle home already contains Oracle Database Vault, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home more than once.

   Note:

   For RAC instances you must verify that Oracle Clusterware is running. For more information refer to Verify That Oracle Clusterware Is Running (RAC Only) .

2. Enter a user name for the Database Vault Owner account in the Database Vault Owner field. The user name can be a minimum of 2 and maximum of 30 characters long.

3. Enter a password for the Database Vault Owner account in the Database Vault Owner Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

4. Reenter the password in the Confirm Password field.

5. Select Create a Separate Account Manager if you want to create a separate Account Manager to manage Oracle Database Vault accounts.

6. In the Database Vault Account Manager field, enter a user name for the Database Vault Account Manager if you have chosen to select the Create a Separate Account Manager check box. The user name can be a minimum of 2 and a maximum of 30 characters.

7. Enter a password for the Database Vault Account Manager account in the Account Manager Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

8. Reenter the password in the Confirm Password field. Click Next.

9. The Select Existing Database screen is displayed. A list of all databases running from the selected Oracle home is displayed. Select the database into which you wish to install Oracle Database Vault.

   Note:

   • Oracle recommends that you install Oracle Database Vault into an Oracle home containing only a single database.

   • If a database is not listed, then check to make sure that you have followed the instructions under "Check the Database Requirements".

10. Enter the existing SYS user password for the selected database in the Existing Database SYS Password field.

11. Reenter the SYS password in the Confirm Password field. Click Next.

    Note:

    At this point, the database requirements are validated.

12. You are prompted to shut down all Oracle processes running from the Oracle home before proceeding. Shut down the Oracle processes, if you have not already done so.

    See Also:

    "Stop Existing Oracle Processes" for more information on stopping existing Oracle processes

13. Product-specific prerequisite checks are performed. Confirm that all tests have passed. Click Next to continue.

14. The Summary screen is displayed with the installation details. Verify the details and click Install.

15. The Installation screen is displayed. After the installation completes, the Database Vault Configuration Assistant (DVCA) is run automatically. DVCA helps configure the Database Vault installation.

2.2.1 Back Up the Database

Make sure you perform a full backup of the production database. See Oracle Database Backup and Recovery User's Guide for details on backing up a database.

2.2.2 Update Environment Variables After the Upgrade (UNIX Systems Only)

Make sure that the following environment variables point to the correct Oracle Database Vault directories:

• ORACLE_HOME

• PATH

• ORA_NLS10

  Note:

  The ORA_NLS10 environment variable replaces the ORA_NLS33 environment variable, so you may need to unset ORA_NLS33 and set ORA_NLS10.

• LD_LIBRARY_PATH

2.2.3 Change Passwords for Oracle-Supplied Accounts

Oracle strongly recommends that you change the password for each account after installation. This enables you to effectively implement the strong security provided by Oracle Database Vault.

2.2.4 Disable Remote SYSDBA Connections (Optional)

Oracle Database Vault allows you to disable remote logins with SYSDBA privileges. This enables enhanced security for your database.

To disable remote SYSDBA connections, re-create the password file with the nosysdba flag set to y (Yes). A user can still log in AS SYSDBA locally using Operating System (OS) authentication. However, remote connections AS SYSDBA will fail.

Use the following syntax to re-create the password file:

orapwd file=filename password=password [entries=users] force=y nosysdba=y

Where:

• file: Name of password file (mandatory)

• password: Password for SYS (mandatory). Enter at least six alphanumeric characters.

• entries: Maximum number of distinct DBA users

• force: Whether to overwrite the existing file

• nosysdba: Whether to enable or disable the SYS logon

  The default is no, so if you omit this flag, the password file will be created enabling SYSDBA access for Oracle Database Vault instances.

For example:

orapwd file=$ORACLE_HOME/dbs/orapworcl password=5hjk99 force=y nosysdba=y

When you re-create the password file, any accounts other than SYS that were granted the SYSDBA or SYSOPER privileges will have those privileges removed. You will need to regrant the privileges for these accounts after you have re-created the password file.

You can reenable the ability to connect with the SYSDBA privilege by re-creating the password file with the nosysdba flag set to n (No). You might need to reenable the ability to connect with SYSDBA privileges, if certain products or utilities require it's use.

Enabling or Disabling Connecting with SYSDBA on Oracle Real Application Clusters Systems

Under a cluster file system and raw devices, the password file under $ORACLE_HOME is in a symbolic link that points to the shared storage location in the default configuration. In this case, the orapwd command you issue affects all nodes.

Enabling or Disabling Connecting with SYSDBA on Automatic Storage Management Systems

For Automatic Storage Management systems, you need to update each node to enable or disable the SYSDBA connection privilege by using the orapwd utility.

2.2.5 Start the Listener and Database on Other Nodes (RAC Only)

You need to start the listener and database on all RAC nodes other than the one on which the installation is performed. Use the following commands to start the listener and the database:

$ORACLE_HOME/bin/lsnrctl start ListenerName
srvctl start instance -d sid -i instance_name

2.2.6 Run DVCA to Set Instance Parameters and Lock Out SYSDBA Sessions (RAC Only)

After installing Database Vault for a Real Application Clusters (RAC) instance, you need to run Database Vault Configuration Assistant (DVCA) with the -action optionrac switch on all other RAC nodes.

You need to run this command on all RAC nodes other than the node on which the Database Vault installation is performed. This step is required to enable the enhanced security features provided by Oracle Database Vault.

Use the following syntax to run DVCA:

# dvca -action optionrac -racnode host_name -oh oracle_home -jdbc_str jdbc_connection_string -sys_passwd sys_password [-logfile ./dvca.log] [-silent] [-nodecrypt] [-lockout]

Where:

• action: The action to perform. optionrac performs the action of updating the instance parameters for the RAC instance and optionally disabling SYSDBA operating system access for the instance.

• racnode: The host name of the RAC node on which the action is being performed. Do not include the domain name with the host name.

• oh: The Oracle home for the RAC instance.

• jdbc_str: The JDBC connection string used to connect to the database. For example, "jdbc:oracle:oci:@orcl1".

• sys_password: The password for the SYS user.

• logfile: Optionally, specify a log file name and location. You can enter an absolute path or a path that is relative to the location of the $ORACLE_HOME/bin directory.

• silent: Required if you are not running DVCA in an xterm window.

• nodecrypt: Reads plaintext passwords as passed on the command line.

• lockout: Used to disable SYSDBA operating system authentication.

2.2.7 Setting the Timeout Value for DVA (Optional)

Oracle Database Vault Administrator (DVA) is a browser-based graphical user interface console that you can use to manage Oracle Database Vault.

You can modify the length of time that DVA stays connected while inactive. By default, the connection duration is 35 minutes. Your session automatically gets expired after 35 minutes of inactivity.

To set the session time for Oracle Database Vault Administrator:

1. Back up the web.xml file, which by default is in the $ORACLE_HOME/dv/jlib/dva_webapp/dva_webapp/WEB-INF directory.

2. In a text editor, open the web.xml file .

3. Search for the following setting:

   <session-config>
    <session-timeout>35</session-timeout>
   </session-config>
   
   

4. Change the <session-timeout> setting to the amount of time in minutes that you prefer.

5. Save and close the web.xml file.

6. Stop and restart the DVA application.

   You can use the following command to restart DVA:

   emctl stop dbconsole
   emctl start dbconsole