Secure Password

In many cases, it is necessary or advisable to connect to the database quickly and, above all, securely, without exposing the database connection details. One example, as indicated on Oracle website, is when we connect to the database using Shell scripts stored in the file system. If these scripts contain the connection details, they can pose a significant security risk. For this example and others like it, we can use the operating system’s built-in authentication, but starting with Oracle Release 2, Oracle offers the option to use a secure external password store, saving the Oracle login credentials Oracle a client-side wallet. To understand this, a file is created on the client side containing the credentials for connecting to the database; the connection string will specify the location of this “file” to establish the connection. This allows the user to connect using the following syntax: “/@alias,” where “alias” is the name chosen for the database connection.

Configure Secure Password

First, we must choose where we want to save the Oracle —that is, the location where the wallet file containing the connection data will be stored, which Oracle to connect to the database using the following syntax: “/@alias”.

Note: The location can be a common directory where several users have access to connect to the database.

In our case, since this is a test, we'll place the Oracle in the oracle home directory oracle our client machine.

mkdir -poracle

Cargamos las variables de entorno del TNS_ADMIN, si no lo has hecho anteriormente, apuntando al fichero tnsnames.ora donde especificaremos la cadena de conexión a la base de datos de nuestra máquina cliente.

exportoracle.0.oracle

We added the post to the sqlnet.ora file, located in the TNS_ADMIN directory; in our case,oracle.0.oracle.ora”

In this file we must specify the directory where the Wallet file we created earlier is located.

It is important to add the post .WALLET_OVERRIDE post , which allows you to override any existing operating system authentication settings.

WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY =oracle)
)
)
SQLNET.WALLET_OVERRIDE = TRUE
SSL_CLIENT_AUTHENTICATION = FALSE
SSL_VERSION = 0

At this point, we can create the wallet using the ` oracle ` tool with the `-create` option. The wallet is password-protected, but the “Automatic Login” or “autologin” property is enabled; this way, users connecting to the database will do so without needing a password, which is essentially the goal we’re aiming for by creating asecure password.”

[oracle@localhost bin]$ mkstore -wrl «/home/oracle/wallet» -create
Oracle Secret Store Tool Release 21.0.0.0.0 – Production
21.3.0.0.0: Versión {1}
Copyright (c) 2004, 2021, Oracle y/o sus subsidiarias. Todos los Derechos Reservados.
Introducir Contraseña:  
Volver a Introducir Contraseña:  
[oracle@localhost bin]$

The password earlier is the one for the wallet file; it is a good idea to remember it and/or keep it in a safe place because Oracle will ask Oracle in order to access the information it stores. Oracle creates two files (cwallet.sso and ewallet.p12).

The wallet is created with read/write permissions only for the current user, so no other user can read it.

oracle
[oracle wallet]$ ls -rlt
total 8
-rw——-. 1 oracle oracle Sep 27 19:16 ewallet.p12.lck
-rw——-. 1 oracle oracle Sep 27 19:16 ewallet.p12
-rw——-. 1 oracle oracle Sep 27 19:16 cwallet.sso.lck
-rw——-. 1 oracle oracle Sep 27 19:16 cwallet.sso

Once the wallet is created, it can be modified using the "mkstore" command described below.

Add the username and password credentials to the wallet using the -createCredential option. Simply put, at this point, we need to specify the credentials required to connect to the database, which will be stored in a password file.

En nuestro caso vamos a realizar una conexión, siguiendo esta entrada del tnsnames.ora con el usuario test.

TEST_EXTUSER =
(DESCRIPTION =
(ADDRESS =
(PROTOCOL = TCP)
(HOST = localhost)
(PORT = 1521)
)
(CONNECT_DATA = (server=dedicated) (service_name = srv_testing))
)

The code is as follows: The location of the wallet, post database post , and the username and password the user you want to log in as.

mkstore -wrl "oracle" -createCredential TEST_EXTUSER test testpassword

The output of the command is as follows, it will ask you for the wallet password to create the credentials:

[oracle@localhost bin]$ mkstore -wrl «/home/oracle/wallet» -createCredential TEST_EXTUSER test testpassword
Oracle Secret Store Tool Release 21.0.0.0.0 – Production
21.3.0.0.0: Versión {1}
Copyright (c) 2004, 2021, Oracle y/o sus subsidiarias. Todos los Derechos Reservados.
Introducir Contraseña de Cartera:  

Once the wallet has been generated, we can connect to the database using the wallet we created earlier. To connect, we’ll use the following syntax: “/@db_alias,” where db_alias refers to the post we added and configured in our tnsnames file; in our case: /@TEST_EXTUSER

Once the Wallet is generated, we can perform several actions on the generated wallet:

List current entries in our Wallet

List the entries we have created in the wallet. To do this, we'll add the syntax –listCredential, pointing to the path of the wallet for which we want to view the credentials. Oracle will ask Oracle password the password .

oracle@localhost admin]$  mkstore -wrl «/home/oracle/wallet» -listCredential
Oracle Secret Store Tool Release 21.0.0.0.0 – Production
21.3.0.0.0: Versión {1}
Copyright (c) 2004, 2021, Oracle y/o sus subsidiarias. Todos los Derechos Reservados.
Introducir Contraseña de Cartera:  
List credential (index: connect_string username)
1: TEST_EXTUSER test
[oracle@localhost admin]$

Adding a new user connection to a previously created Wallet

Si queremos añadir una nueva conexión a nuestro Wallet para conectaros a la base de datos de forma externa usando “external Password”, simplemente añade el nuevo usuario o una nueva cadena de conexión que coincida con una nueva entrada en tu tnsnames.ora. Esta será la que utilices para realizar la conexión.

[oracle@localhost admin]$ mkstore -wrl «/home/oracle/wallet» -createCredential RAUL_EXTUSER raul testpassword
Oracle Secret Store Tool Release 21.0.0.0.0 – Production
21.3.0.0.0: Versión {1}
Copyright (c) 2004, 2021, Oracle y/o sus subsidiarias. Todos los Derechos Reservados.
Introducir Contraseña de Cartera:  

Si listamos ahora las entradas del wallet podremos ver la nueva entrada que hemos añadido, siendo RAUL_EXTUSER nuestra entrada del tnsnames.ora

[oracle@localhost admin]$  mkstore -wrl «/home/oracle/wallet» -listCredential
Oracle Secret Store Tool Release 21.0.0.0.0 – Production
21.3.0.0.0: Versión {1}
Copyright (c) 2004, 2021, Oracle y/o sus subsidiarias. Todos los Derechos Reservados.
Introducir Contraseña de Cartera:  
List credential (index: connect_string username)
2: RAUL_EXTUSER raul
1: TEST_EXTUSER test

We can test the connection.

[oracle admin]$ sqlplus /@RAUL_EXTUSER
SQL*Plus: Release 21.0.0.0.0 – Production on Sun Oct 2 18:34:07 2022
Version 21.3.0.0.0
Copyright (c) 1982, 2021, Oracle. All rights reserved.
Last Successful Login Time: Sun Oct 02 2022 18:26:16 -04:00
Connected to:
Oracle 21c Standard Edition 2 Release 21.0.0.0.0 – Production
Version 21.3.0.0.0

Modifying the credentials of a Wallet

Wallet credentials can be modified; we can change the password current wallet simply by using the “modifyCredential” syntax.

[oracle@localhost admin]$  mkstore -wrl "/home/oracle/wallet" -modifyCredential RAUL_EXTUSER raul raulnewpassword
Oracle Secret Store Tool Release 21.0.0.0.0 - Production
21.3.0.0.0: Versión {1}
Copyright (c) 2004, 2021, Oracle y/o sus subsidiarias. Todos los Derechos Reservados.
Introducir Contraseña de Cartera:   

Remove credentials from a Wallet

The credentials of a wallet can be deleted with the following command.

mkstore -wrl <wallet_location> -deleteCredential <db_alias>
[oracle@localhost admin]$ mkstore -wrl "/home/oracle/wallet" -deleteCredential RAUL_EXTUSER
Oracle Secret Store Tool Release 21.0.0.0.0 - Production
21.3.0.0.0: Versión {1}
Copyright (c) 2004, 2021, Oracle y/o sus subsidiarias. Todos los Derechos Reservados.
Introducir Contraseña de Cartera:  
[oracle@localhost admin]$