Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> Database Links
        
(Message started by: Pete Finnigan on Jun 11^th, 2007, 9:15am)

Title: Database Links
Post by Pete Finnigan on Jun 11^th, 2007, 9:15am

Are there any known security problems in using a database link? What are the favoured alternatives to a database link?

Title: Re: Database Links
Post by Pete Finnigan on Jun 11^th, 2007, 5:09pm

Hi,

There are a lot of issues. If you have an incoming link then the issue could be that the database its coming from maybe in an insecure location, not hardened and in essence it forms a gateway to exploit your data.

Anothre issues is that often privileges are not matched to the use of the link. i.e. i often see links using DBA accounts. If you use one create the account with the least privileges.

Depending on the type of link and oracle redatabase it requires the password for another database to be stored in the linked from database. Also depending on the type of link passwords are often shared between databases, i.e. the scott password would be the same in both databases if scott were used for the link.

Links can be used if designed properly, the right type of link used and also network restrictions are in place. Consider whay you are adding a link and see if it can be done aniother way else design carefully and limit the privileges, dont share passwords and close the link when its not in use.

cheers

Pete

Title: Re: Database Links
Post by Pete Finnigan on Jun 12^th, 2007, 9:56am

Thanks, Pete -
So would it be fair to say that if the database is secure, then the link is secure if it's properly set up?
Would it be any more or any less secure than a connection via a web service?

Title: Re: Database Links
Post by Pete Finnigan on Nov 26^th, 2007, 9:23pm

Some observations:

10g R2 now encrypts the password in the sys.link$ which was long overdue.

I recommend having the dblinks created on the more critical database you want to protect and have it do the connecting to the other database(s).

As Pete mentioned, create the account you will be connecting to with least privileges to get the job done. I believe it would be better to create more dblinks that satisfy various requirements than to give extra privileges to a single account to satisfy several needs. For example, if one function needs to read only certain tables and another function needs to be able to update certain tables, use 2 different accounts for the dblinks.

Use private dblinks over public ones if possible.

Treat the accounts created for the dblinks like non-interactive accounts dedicated for the dblinks. If your audit reviews indicate someone is manually using the dblink account, investigate.

Secure both databases/endpoints. IP restrictions via valid node checking and invited nodes is a good idea in any case.

Title: Re: Database Links
Post by Pete Finnigan on Nov 28^th, 2007, 9:35am

Hi Cody,

Thanks for your points, the problems with link sin my opinion is not the out going link from the database you control but the incoming links that you dont know about. The risk with those is two fold, the first that the link exists and is a conduit into the database and the second is that it implies a password for your database is known by someone who shouldn't know if they have created the link without your knowledge.

The best way to stop these is to change all passwords.

cheers

Pete

Title: Re: Database Links
Post by Pete Finnigan on Nov 28^th, 2007, 2:44pm

Correct me if I'm wrong in some of my points:

Having a link coming in isn't a risk on the receiving end because it's just a connection to an account like any other. Someone could abuse that account like any other account be it a link or manual connection.

I disagree that the password is known. For instance, I create a public link from my local database to a remote one. Anyone on my local database can use the link to connect to and perform whatever work the remote account has privileges to perform but the password is not known by the local users. The only person that actually knows the password on the other end is myself. A person using the link does not know the remote password and can only use that account via the dblink.

Of course, like you said, once the remote account was created, I changed the password.

By the way, I really like your website. I've been learning from it for some time now. I was just formally made the security DBA for my organization so I'm working on creating an overall security plan.

Title: Re: Database Links
Post by Pete Finnigan on Nov 29^th, 2007, 12:01am

A saved password is a saved password, whether it is in a shell script, SQL Developer connection setup, ODBC setup...(even a post-it note).
Having it encrypted in the database is a BIT more secure than the others, but someone can do a select dbms_metadata.get_ddl('DB_LINK','...') from dual;
They can then cut-and-paste the result to another user or database (eg an XE install on their PC) and they have access using that encrypted password.

Title: Re: Database Links
Post by Pete Finnigan on Nov 30^th, 2007, 10:19pm

Thanks for the info. I tested this out.

I created a public dblink and private dblinks under 2 different users (tester1 and test2). The dblinks started with the word test.

As tester2, I "select * FROM all_db_links;" and see the public dblink and tester2's dblink. This is as expected.

I "SELECT DBMS_METADATA.GET_DDL('DB_LINK', db_link, owner) FROM all_db_links where db_link like 'TEST%';" and it returns a ORA-31603 stating the object, public dblink, of type db_link not found in schema public.

I "SELECT DBMS_METADATA.GET_DDL('DB_LINK', db_link) FROM user_db_links where db_link like 'TEST%';" and it returns the info including encrypted password. This doesn't concern me since this dblink was created with this account's password anyways.

Using my DBA account, I could get all the info of course.

Was the method you mentioned a something that was stopped in 10.2.03 perhaps?

Title: Re: Database Links
Post by Pete Finnigan on Apr 26^th, 2009, 9:12am

Hi Pete

Please do you know if Oracle database links transmit information in clear-text form or in encrypted form across the network?

Thanks
solaadio

Title: Re: Database Links
Post by Pete Finnigan on Apr 27^th, 2009, 8:20pm

Hi,

Yes the data is transmitted in clear text unless you have a proprietory network encryption solution or you have used/licensed Oracle Advanced Security (ASO)

cheers

Pete

Title: Re: Database Links
Post by Pete Finnigan on Apr 28^th, 2009, 11:48am

Hi Pete,

Thanks for your reply. I'm very grateful.

I am planning on using the multimaster replication feature of Oracle 10g using scheduled links. Currently, I have a good 2GB laptop as well as a good desktop server at home. I work quite a lot away from home so I do most of my dev work on the laptop.

Please do you know if it's possible to have two 10g instances on my laptop and still get them to talk to themselves through Oracle Replication or is it mandatory that the two instances must reside on different physical boxes. Reason I'm asking is that I would love to do all my dev work on the laptop while I'm away from home before system testing using the server at home.

Regards
Olusola