2 Installing Oracle Database Vault as an Option

2.1.1 Become Familiar with the Features of Oracle Database Vault

Before you plan the upgrade process, become familiar with the features of Oracle Database Vault. The Oracle Database Vault Administrator's Guide discusses the basic features of Oracle Database Vault.

2.1.2 Check the Hardware Requirements

Table 2–1 discusses the hardware requirements for Oracle Database Vault:

To ensure that the system meets these requirements, follow these steps:

1. Determine the physical RAM size. For a computer using Windows 2003, for example, double-click System in the Windows Control Panel and click the General tab. If the size of the physical RAM installed in the system is less than the required size, then you must install more memory before continuing.

2. Determine the size of the configured virtual memory (also known as paging file size). For a computer using Windows 2003, for example, double-click System in the Control Panel, click the Advanced tab, and click Settings in the Performance section. Then click the Advanced tab. The virtual memory is listed in the Virtual Memory section.

   If necessary, see your operating system documentation for information about how to configure additional virtual memory.

3. Determine the amount of free disk space on the system. For a computer using Windows 2003, for example, double-click My Computer, right-click the drive where the Oracle software is to be installed, and select Properties.

4. Determine the amount of disk space available in the temp directory. This is equivalent to the total amount of free disk space, minus what will be needed for the Oracle software to be installed.

   If there is less than 400 MB of disk space available in the temp directory, then first delete all unnecessary files. If the temp disk space is still less than 400 MB, then set the TEMP or TMP environment variable to point to a different hard drive. For a computer using Windows 2003, for example, double-click System in the Control Panel, click the Advanced tab, and click Environment Variables.

2.1.3 Check the Software Requirements

Oracle Database Vault is installed in an existing Oracle home. All software requirements that were met while installing Oracle Database 10g release 2 are sufficient for Oracle Database Vault.

Table 2-2 lists the software requirements for Oracle Database Vault.

http://metalink.oracle.com

http://metalink.oracle.com

2.1.4 Check the Database Requirements

In order to install Oracle Database Vault, you must be running the Enterprise Edition of Oracle Database 10g release 2 (10.2.0.3). The database should also have Oracle Enterprise Manager Console DB 10.2.0.3.0 installed. In addition, the Database Vault installer requires write access to the files, oratab and oraInst.loc.

A listener must have been configured for the existing database. Oracle Net Configuration Assistant configures the listener when you first install the database. You can also use Oracle Enterprise Manager to administer listeners.

You must have an existing password file for the database. The password file authentication parameter, REMOTE_LOGIN_PASSWORDFILE must have been set to EXCLUSIVE or SHARED.

You can set the REMOTE_LOGIN_PASSWORDFILE parameter in the init.ora file. Use the orapwd utility to create and manage password files.

The following topics discuss applying the 10.2.0.3 patch set and installing the required components:

• Install Oracle Enterprise Manager Console DB

• Apply Oracle Database Release 10.2.0.3 Patch Set

http://metalink.oracle.com

2.1.5 Prepare a Backup Strategy

Oracle strongly recommends that you back up your database before performing any upgrade or installation. The ultimate success of your upgrade depends heavily on the design and execution of an appropriate backup strategy. To develop a backup strategy, consider the following questions:

• How long can the production database remain inoperable before business consequences become intolerable?

• What backup strategy should be used to meet your availability requirements?

• Are backups archived in a safe, offsite location?

• How quickly can backups be restored (including backups in offsite storage)?

• Have recovery procedures been tested successfully?

Your backup strategy should answer all of these questions and include procedures for successfully backing up and recovering your database.

2.1.6 Verify That Oracle Clusterware Is Running (RAC Only)

Oracle Clusterware should be running for the Database Vault installer to find the existing Real Application Clusters (RAC) databases. If you have stopped Oracle Clusterware, then you should restart it before running Oracle Universal Installer. Use the following command to start Oracle Clusterware:

C:/> CRS_HOME/bin/crsctl start crs

2.1.7 Stop Existing Oracle Processes

Stop all processes running in the Oracle home. You must complete this task to enable Oracle Universal Installer to relink certain executables and libraries. For RAC databases, you need to stop the processes on all nodes.

Stop the processes in the following order:

1. Stop the Enterprise Manager Database Control Process

2. Stop the iSQL*Plus Process

3. Shut Down All Database Instances

4. Stop Existing Listeners

5. Stop Oracle Services

C:\> ORACLE_HOME\bin\emctl stop dbconsole

C:\> ORACLE_HOME\bin\isqlplusctl stop

sqlplus SYS "AS SYSOPER"
Enter password:
SQL> shutdown immediate

C:\> ORACLE_HOME\bin\lsnrctl stop listenername

2.1.8 Run Oracle Universal Installer to Install

You can use the graphical user interface (GUI) provided by Oracle Universal Installer to install Oracle Database. The following steps discuss installing Database Vault using Oracle Universal Installer:

1. Log on as a member of the Administrators group.

   If you are installing on a Primary Domain Controller (PDC) or a Backup Domain Controller (BDC), log on as a member of the Domain Administrators group.

2. Insert Oracle Database Vault installation media and navigate to the database directory. Alternatively, navigate to the directory where you downloaded or copied the installation files.

   Use the same installation media to install Oracle Database Vault on all supported Windows platforms.

3. Double-click setup.exe to start Oracle Universal Installer.

4. In the Specify Installation Details screen, you need to specify the path to the Oracle home that contains the existing Oracle Database. The Destination Path box lists the Oracle home paths of all Oracle Database release 2 (10.2.0.3) Enterprise Edition databases registered with the system.

   Select the Oracle home corresponding to the database into which you want to install Oracle Database Vault.

   Note:

   • If an Oracle home does not have an Enterprise Edition of Oracle Database release 10.2.0.3 installed, then it is not displayed. You must ensure that the Oracle home has an Enterprise Edition of Oracle Database release 10.2.0.3 installed.

   • If an Oracle home does not have Oracle Enterprise Manager Console DB 10.2.0.3.0 installed, then it is not displayed. You must ensure that the Oracle home has Oracle Enterprise Manager Console DB 10.2.0.3.0 installed.

   • If an Oracle home contains an Automatic Storage Management (ASM) instance, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home that also contains an ASM instance.

   • If an Oracle home already contains Oracle Database Vault, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home more than once.

   • Oracle Clusterware should be running for the Database Vault installer to find the existing Real Application Clusters (RAC) databases. Ensure that Oracle Clusterware is running before installing Oracle Database Vault. You can use the crsctl command to start Oracle Clusterware.

5. Enter a user name for the Database Vault Owner account in the Database Vault Owner field. The user name can be a minimum of 2 and maximum of 30 characters long.

6. Enter a password for the Database Vault Owner account in the Database Vault Owner Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

7. Reenter the password in the Confirm Password field.

8. Select Create a Separate Account Manager if you want to create a separate Account Manager to manage Oracle Database Vault accounts.

9. In the Database Vault Account Manager field, enter a user name for the Database Vault Account Manager if you have chosen to select the Create a Separate Account Manager check box. The user name can be a minimum of 2 and a maximum of 30 characters.

10. Enter a password for the Database Vault Account Manager account in the Account Manager Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

11. Reenter the password in the Confirm Password field. Click Next.

12. The Select Existing Database screen is displayed. A list of all databases running from the selected Oracle home is displayed. Select the database into which you wish to install Oracle Database Vault.

    Note:

    • If the selected Oracle home contains more than one database, then Operating System (OS) authentication is turned off for all the databases in the Oracle home.

    • Oracle recommends that you install Oracle Database Vault into an Oracle home containing only a single database.

    • If a database is not listed, then check to make sure that you have followed the instructions under "Check the Database Requirements".

13. Enter the existing SYS user password for the selected database in the Existing Database SYS Password field.

14. Reenter the SYS password in the Confirm Password field. Click Next.

    Note:

    At this point, the database requirements are validated.

15. You are prompted to shut down all Oracle processes running from the Oracle home before proceeding. Shut down the Oracle processes, if you have not already done so.

    See Also:

    "Stop Existing Oracle Processes" for more information on stopping existing Oracle processes

16. Product-specific prerequisite checks are performed. Confirm that all tests have passed. Click Next to continue.

17. The Summary screen is displayed with the installation details. Verify the details and click Install.

18. The Installation screen is displayed. After the installation completes, the Database Vault Configuration Assistant (DVCA) is run automatically. DVCA helps configure the Database Vault installation.

2.2.1 Back Up the Database

Make sure you perform a full backup of the production database. See Oracle Database Backup and Recovery User's Guide for details on backing up a database.

2.2.2 Change Passwords for Oracle-Supplied Accounts

Oracle strongly recommends that you change the password for each account after installation. This enables you to effectively implement the strong security provided by Oracle Database Vault.

2.2.3 Enable or Disable Connections with the SYSDBA Privilege

In a default Database Vault installation, the operating system authentication to the database is disabled. In addition, connections to the database using the SYSDBA privilege (that is, those that use the AS SYSDBA clause) are disabled. This is a security feature and is implemented to prevent misuse of the SYSDBA privilege.

If a password file has been created using the orapwd utility with the nosysdba flag set to y (Yes) (the default action of a Database Vault installation), users will not be able to log in to an Oracle Database Vault instance using the SYS account or any account with SYSDBA privilege using the AS SYSDBA clause. You can reenable the ability to connect with the SYSDBA privilege by re-creating the password file with the nosysdba flag set to n (No). You might need to reenable the ability to connect with SYSDBA privileges, if certain products or utilities require it's use.

When you re-create the password file, any accounts other than SYS that were granted the SYSDBA or SYSOPER privileges will have those privileges removed. You will need to regrant the privileges for these accounts after you have re-created the password file.

Use the following syntax to run orapwd:

C:\> ORACLE_HOME\bin\orapwd file=filename password=password [entries=users] force=y/n nosysdba=y/n

Where:

• file: Name of password file (mandatory)

• password: Password for SYS (mandatory). Enter at least six alphanumeric characters.

• entries: Maximum number of distinct DBA users

• force: Whether to overwrite the existing file (optional). Enter y (for yes) or n (for no)

• nosysdba: Whether to enable or disable the SYS logon (optional for Oracle Database Vault only). Enter y (for yes) or n (for no)

  The default is no, so if you omit this flag, the password file will be created enabling SYSDBA access for Oracle Database Vault instances.

For example:

C:\> oracle\product\10.2.0\db_1\bin\orapwd file=C:\oracle\product\10.2.0\db_1\dbs\orapwORCL password=5hjk99 force=y nosysdba=n

2.2.4 Start the Listener and Database on Other Nodes (RAC Only)

You need to start the listener and database on all RAC nodes other than the one on which the installation is performed. Use the following commands to start the listener and the database:

C:\> ORACLE_HOME\bin\lsnrctl start LISTENER_nodename
C:\> ORACLE_HOME\bin\srvctl start instance -d sid -i instance_name -c "SYS/password AS SYSDBA"

2.2.5 Run DVCA to Set Instance Parameters and Lock Out SYSDBA Sessions (RAC Only)

After installing Database Vault for a Real Application Clusters (RAC) instance, you need to run Database Vault Configuration Assistant (DVCA) with the -action optionrac switch on all other RAC nodes. This sets instance parameters and disables SYSDBA operating system authentication.

You need to run this command on all RAC nodes other than the node on which the Database Vault installation is performed. This step is required to enable the enhanced security features provided by Oracle Database Vault.

Use the following syntax to run DVCA:

C:\> ORACLE_HOME\bin\dvca -action optionrac -racnode host_name -oh oracle_home -jdbc_str jdbc_connection_string -sys_passwd sys_password [-logfile ./dvca.log] [-silent] [-nodecrypt] [-lockout]

Where:

• action: The action to perform. optionrac performs the action of updating the instance parameters for the RAC instance and optionally disabling SYSDBA operating system access for the instance.

• racnode: The host name of the RAC node on which the action is being performed. Do not include the domain name with the host name.

• oh: The Oracle home for the RAC instance.

• jdbc_str: The JDBC connection string used to connect to the database. For example, "jdbc:oracle:oci:@orcl1".

• sys_password: The password for the SYS user.

• logfile: Optionally, specify a log file name and location. You can enter an absolute path or a path that is relative to the location of the $ORACLE_HOME/bin directory.

• silent: Required if you are not running DVCA in an xterm window.

• nodecrypt: Reads plaintext passwords as passed on the command line.

• lockout: Used to disable SYSDBA operating system authentication.

2.2.6 Restart Enterprise Manager Database Control

Restart Enterprise Manager Database Control by using the following commands:

C:\> ORACLE_HOME\bin\emctl stop dbconsole
C:\> ORACLE_HOME\bin\emctl start dbconsole