Skip Headers
Oracle® Database Vault Installation Guide
10g Release 2 (10.2) for Microsoft Windows (32-Bit)

Part Number B32384-03
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Master Index
Master Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

2 Installing Oracle Database Vault

This chapter includes an overview of the major steps required to install Oracle Database Vault into an existing Oracle Database 10g Release 2 (10.2.0.5) database. These procedures transform an existing Oracle Database system (including associated applications) into an Oracle Database Vault system. Databases upgraded using the procedures described in this chapter can work almost in the same manner as in earlier releases and, optionally, can leverage new Oracle Database Vault functionality. For a list of changes that Database Vault makes, refer to Appendix F, "Initialization Parameters" and the Oracle Database Vault Administrator's Guide.

Note:

In order to upgrade a pre-10g release 2 Oracle Database to Oracle Database Vault, you first need to upgrade the database to a 10g Release 2 (10.2.0.5) database.

See Also:

Oracle Database Upgrade Guide, 10g Release2 (10.2) for information about upgrading your Oracle Database to Oracle Database 10g release 2.

This chapter covers the following topics:

2.1 Preinstallation and Installation Tasks

This section covers the following topics:

2.1.1 Become Familiar with the Features of Oracle Database Vault

Before you plan the upgrade process, become familiar with the features of Oracle Database Vault. The Oracle Database Vault Administrator's Guide discusses the basic features of Oracle Database Vault.

2.1.2 Check the Hardware Requirements

Table 2–1 discusses the hardware requirements for Oracle Database Vault:

Table 2-1 Hardware Requirements

Requirement Value

Physical memory (RAM)

256 MB minimum; 512 MB recommended

Virtual memory

Double the amount of RAM

Disk space

270 MB of disk space for the Oracle Database Vaultsoftware

400 MB of space in the temp directory

10 MB of additional disk space for the databasefiles

Video adapter

256 colors

Processor

550 MHz minimum


To ensure that the system meets these requirements, follow these steps:

  1. Determine the physical RAM size. For a computer using Windows 2003, for example, double-click System in the Windows Control Panel and click the General tab. If the size of the physical RAM installed in the system is less than the required size, then you must install more memory before continuing.

  2. Determine the size of the configured virtual memory (also known as paging file size). For a computer using Windows 2003, for example, double-click System in the Control Panel, click the Advanced tab, and click Settings in the Performance section. Then click the Advanced tab. The virtual memory is listed in the Virtual Memory section.

    If necessary, see your operating system documentation for information about how to configure additional virtual memory.

  3. Determine the amount of free disk space on the system. For a computer using Windows 2003, for example, double-click My Computer, right-click the drive where the Oracle software is to be installed, and select Properties.

  4. Determine the amount of disk space available in the temp directory. This is equivalent to the total amount of free disk space, minus what will be needed for the Oracle software to be installed.

    If there is less than 400 MB of disk space available in the temp directory, then first delete all unnecessary files. If the temp disk space is still less than 400 MB, then set the TEMP or TMP environment variable to point to a different hard drive. For a computer using Windows 2003, for example, double-click System in the Control Panel, click the Advanced tab, and click Environment Variables.

2.1.3 Check the Software Requirements

Oracle Database Vault is installed in an existing Oracle home. All software requirements that were met while installing Oracle Database 10g Release 2 (10.2) are sufficient for Oracle Database Vault.

See Also:

Oracle Database Installation Guide for Microsoft Windows for detailed information on the software requirements for installing Oracle Database

Table 2-2 lists the software requirements for Oracle Database Vault.

Table 2-2 Software Requirements

Requirement Value

System Architecture

Processor: Intel (x86), AMD64, and Intel EM64T

The 32-bit Database Vault version, which this installation guide describes, runs on the 32-bit version of Windows on either x86 or x64 hardware. Oracle provides limited certification for 32-bit Oracle Database Vault on 64-bit Windows (x64). For additional information, visit My Oracle Support (formerly OracleMetalink) at:

https://support.oracle.com

Operating System

Oracle Database Vault for 32-bit Windows is supported on the following operating systems:

  • Windows 2000 with Service Pack 1 or later. All editions, including Terminal Services and Microsoft Windows 2000 MultiLanguage Edition (MLE), are supported.

  • Windows Server 2003 - all editions.

  • Windows Server 2003 R2

  • Windows XP Professional - only standalone installation of Database Vault is supported

  • Windows Vista (Business, Enterprise, and Ultimate editions) - only standalone installation of Database Vault is supported

  • Windows Server 2008

  • Windows 7 - Professional, Enterprise, and Ultimate editions (Only standalone installation of Oracle Database Vault is supported)

Windows NT is not supported.

Windows Multilingual User Interface Pack is supported on Windows Server 2003 and Windows XP Professional.

Compiler

Pro*Cobol has been tested and certified with the following two compilers:

  • ACUCOBOL-GT version 6.2

  • Micro Focus Net Express 4.0

Object Oriented COBOL (OOCOBOL) specifications are not supported.

The following components are supported with the Microsoft Visual C++ .NET 2002 7.0 and Microsoft Visual C++ .NET 2003 7.1 compilers:

  • Oracle C++ Call Interface

  • Oracle Call Interface

  • GNU Compiler Collection (GCC)

  • External callouts

  • PL/SQL native compilation

  • XDK

Network Protocol

The Oracle Net foundation layer uses Oracle protocol support to communicate with the following industry-standard network protocols:

  • TCP/IP

  • TCP/IP with SSL

  • Named Pipes

Oracle Database Client

If you plan to connect to Oracle Database Vault from a release of Oracle Database Client that is earlier than 10g release 2 (10.2), you will not be able to do so if the following conditions exist:

  • Oracle Database Client is running on the same computer as Oracle Database 10g Release 2 (10.2).

  • Microsoft Windows Terminal Services is not running on the same computer as Oracle Database Client. Typically, Terminal Services is installed and configured with Microsoft Windows 2003, but on Microsoft Windows 2000 or Windows XP, it may not be installed or enabled.

  • Oracle Database Client is version 8.0, 9.0–9.2.0.6, or 10.1–10.1.0.3.

  • Oracle Database Client is not running as Administrator.

To remedy this problem, upgrade Oracle Database Client by using the latest Oracle Database Family patchset (9.2.0.4, or 10.1.0.4 or later). You can download the patchset from the Patches and Updates section of My Oracle Support (formerly OracleMetalink) at:

https://support.oracle.com

2.1.4 Check the Database Requirements

In order to install Oracle Database Vault, you must be running the Enterprise Edition of Oracle Database 10g Release 2 (10.2.0.5). The database should also have Oracle Enterprise Manager Console DB 10.2.0.5.0 installed. In addition, the Database Vault installer requires write access to the files, oratab and oraInst.loc.

A listener must have been configured for the existing database. Oracle Net Configuration Assistant configures the listener when you first install the database. You can also use Oracle Enterprise Manager to administer listeners.

You must have an existing password file for the database. The password file authentication parameter, REMOTE_LOGIN_PASSWORDFILE must have been set to EXCLUSIVE or SHARED.

You can set the REMOTE_LOGIN_PASSWORDFILE parameter in the init.ora file. Use the orapwd utility to create and manage password files.

See Also:

Oracle Database Administrator's Guide for more information on creating and maintaining a password file

The following topics discuss applying the 10.2.0.5 patch set and installing the required components:

2.1.4.1 Install Oracle Enterprise Manager Console DB

Before installing Oracle Database Vault, you should ensure that Oracle Enterprise Manager Console DB 10.2.0.5.0 is installed. Oracle Enterprise Manager Console DB is installed using the Oracle Universal Installer (OUI). The following steps summarize installing Oracle Enterprise Manager Console DB:

  1. Run Oracle Universal Installer (OUI) and perform a custom installation to install Oracle Enterprise Manager Console DB 10.2.0.1.0. Add Oracle Enterprise Manager Console DB from the list of available product components.

  2. Apply the Oracle Database release 10.2.0.5 patch set.

Note:

You can configure the database to use Enterprise Manager Database Control by using Database Configuration Assistant (DBCA). However, configuring Enterprise Manager Database Control is not a prerequisite for installing Oracle Database Vault.

2.1.4.2 Apply Oracle Database Release 10.2.0.5 Patch Set

To install Oracle Database Vault, you need to upgrade the database to Oracle Database release 10.2.0.5. Oracle strongly recommends that you back up your database before performing any upgrade or installation.

See Also:

Oracle Database Backup and Recovery User's Guide for information on database backups

This section covers the following topics:

Patch Set Overview

The patch set is not a complete software distribution. You must install it in an existing Oracle Database 10g release 2 installation. You can apply the Oracle Database release 10.2.0.5 patch set to the following Oracle Database 10g release 2 installations:

  • Oracle Database

  • Oracle Database Vault

  • Oracle Real Application Clusters

  • Oracle Database Client

  • Oracle Database Companion CD

  • Oracle Clusterware

Oracle Universal Installer Version Requirements

This patch set includes Oracle Universal Installer release 10.2.0.5, which is also installed when you install this patch set. This is to ensure that your Oracle home can be patched in the future. You should not use the Installer from the earlier maintenance release media or Oracle home.

Patch Set Documentation

There are two documents related to this release of the Oracle Database patch set:

  • Oracle Database Patch Set Notes, 10g Release 2 (10.2.0.5) Patch Set 4 for Microsoft Windows (32-Bit)

  • Oracle Database List of Bugs Fixed, 10g Release 2 (10.2.0.5) Patch Set

Both of these documents are included with the patch set. In addition, they are available on the My Oracle Support (formerly OracleMetalink) Web site:

https://support.oracle.com

2.1.5 Prepare a Backup Strategy

Oracle strongly recommends that you back up your database before performing any upgrade or installation. The ultimate success of your upgrade depends heavily on the design and execution of an appropriate backup strategy. To develop a backup strategy, consider the following questions:

  • How long can the production database remain inoperable before business consequences become intolerable?

  • What backup strategy should be used to meet your availability requirements?

  • Are backups archived in a safe, offsite location?

  • How quickly can backups be restored (including backups in offsite storage)?

  • Have recovery procedures been tested successfully?

Your backup strategy should answer all of these questions and include procedures for successfully backing up and recovering your database.

See Also:

Oracle Database Backup and Recovery User's Guide for information on database backups

2.1.6 Disable Custom Profiles (If Any)

If you have created custom profiles and password complexity checks in your existing database, then you need to disable these before performing the installation. You can reenable these after the installation is complete. Use the following steps to achieve this:

  1. Extract the profile names and associated settings for each profile that is being used. You can use a script to accomplish this.

    Example 2-1 shows a sample script that extracts the profile names and settings to create an output script called, myprofiles.sql. After the installation is complete, you can run myprofiles.sql to restore the profile settings.

    Example 2-1 Extracting Profiles

    set serverout on size 100000
     spool myprofiles.sql
     .
     declare
     l_last varchar2(30) := 'X';
     l_count number := 0;
     begin
         for c in (
             select profile, resource_name , limit
             from dba_profiles
             order by profile, resource_name
         ) loop
             if l_last <> c.profile then
                 l_last := c.profile;
                 if l_count > 0 then
                     dbms_output.put_line(';');
                 end if;
                 l_count := l_count + 1;
                 dbms_output.put_line('create profile ' || c.profile || ' limit ');
             else
                 dbms_output.put_line('    ' || c.resource_name || ' ' || c.limit);
             end if;
         end loop;
         dbms_output.put_line(';');
     end;
     /
     .
     spool off 
    
  2. Disable the custom profiles and password complexity settings. For example:

    SQL> ALTER PROFILE SomeCustomProfile LIMIT
    PASSWORD_REUSE_MAX UNLIMITED -- The number of times a password can be reused
    PASSWORD_REUSE_TIME UNLIMITED -- The number of days between reuses of a password
    PASSWORD_VERIFY_FUNCTION NULL
    /
    
  3. After the Oracle Database Vault installation is complete, reenable the profiles by running the script created in Step 1.

    SQL>@myprofiles.sql

2.1.7 Verify That Oracle Clusterware Is Running (Oracle RAC Only)

Oracle Clusterware should be running for the Database Vault installer to find the existing Oracle Real Application Clusters (Oracle RAC) databases. If you have stopped Oracle Clusterware, then you should restart it before running Oracle Universal Installer. Use the following command to start Oracle Clusterware:

C:/> CRS_HOME/bin/crsctl start crs

Note:

  • You need to run the crsctl start crs command on all nodes of the cluster.

  • The crsctl start crs command also starts the database. You will need to shut down the database before running Oracle Universal Installer.

2.1.8 Stop Existing Oracle Processes

Stop all processes running in the Oracle home, except the database listener. You must complete this task to enable Oracle Universal Installer to relink certain executables and libraries. For Oracle RAC databases, you need to stop the processes on all nodes.

Note:

The database listener process must be running before you run the installer.

Stop the processes in the following order:

  1. Stop the Enterprise Manager Database Control Process

  2. Stop the iSQL*Plus Process

  3. Shut Down All Database Instances

  4. Stop Oracle Services

2.1.8.1 Stop the Enterprise Manager Database Control Process

Stop the Enterprise Manager Database Control process, if it is running. Use the following command:

C:\> ORACLE_HOME\bin\emctl stop dbconsole

Here, ORACLE_HOME needs to be replaced by the path to your Oracle home directory.

2.1.8.2 Stop the iSQL*Plus Process

Stop the iSQL*Plus process, using the following command:

C:\> ORACLE_HOME\bin\isqlplusctl stop

Here, ORACLE_HOME needs to be replaced by the path to your Oracle home directory.

2.1.8.3 Shut Down All Database Instances

Shut down all database instances running from the Oracle home directory into which Oracle Database Vault is to be installed.

sqlplus SYS "AS SYSOPER"
Enter password:
SQL> shutdown immediate

Note:

Do not use SQL*Plus to start and stop Oracle RAC instances. See Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database" for more details.

2.1.8.4 Stop Oracle Services

Use the following steps to stop Oracle Database services from the Control Panel:

  1. Access your Windows Services window.

    See Also:

    Your operating system documentation for instructions
  2. Select OracleServiceSID and click Stop.

Note:

If you are installing Database Vault for Oracle Real Application Clusters (Oracle RAC), then you need to shut down all Oracle processes on all cluster nodes. See Appendix A, "How to Stop Processes in an Existing Oracle Real Application Clusters Database"for more details.

2.1.9 Run Oracle Universal Installer to Install

You can use the graphical user interface (GUI) provided by Oracle Universal Installer to install Oracle Database. The following steps discuss installing Database Vault using Oracle Universal Installer:

  1. Log on as a member of the Administrators group.

    If you are installing on a Primary Domain Controller (PDC) or a Backup Domain Controller (BDC), log on as a member of the Domain Administrators group.

  2. Insert Oracle Database Vault installation media and navigate to the database directory. Alternatively, navigate to the directory where you downloaded or copied the installation files.

    Use the same installation media to install Oracle Database Vault on all supported Windows platforms.

  3. Double-click setup.exe to start Oracle Universal Installer.

  4. In the Specify Installation Details screen, you need to specify the path to the Oracle home that contains the existing Oracle Database. The Destination Path box lists the Oracle home paths of all Oracle Database 10g Release 2 (10.2.0.5) Enterprise Edition databases registered with the system.

    Select the Oracle home corresponding to the database into which you want to install Oracle Database Vault.

    Note:

    • If an Oracle home does not have an Enterprise Edition of Oracle Database 10g Release 2 (10.2.0.5) installed, then it is not displayed. You must ensure that the Oracle home has an Enterprise Edition of Oracle Database 10g Release 2 (10.2.0.5) installed.

    • If an Oracle home does not have Oracle Enterprise Manager Console DB 10.2.0.5.0 installed, then it is not displayed. You must ensure that the Oracle home has Oracle Enterprise Manager Console DB 10.2.0.5.0 installed.

    • If an Oracle home contains an Automatic Storage Management (ASM) instance, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home that also contains an ASM instance.

    • If an Oracle home already contains Oracle Database Vault, then it is not displayed. You cannot install Oracle Database Vault into an Oracle home more than once.

    • Oracle Clusterware should be running for the Database Vault installer to find the existing Oracle Real Application Clusters (Oracle RAC) databases. Ensure that Oracle Clusterware is running before installing Oracle Database Vault. You can use the crsctl command to start Oracle Clusterware.

  5. Enter a user name for the Database Vault Owner account in the Database Vault Owner field. The user name can be a minimum of 2 and maximum of 30 characters long.

  6. Enter a password for the Database Vault Owner account in the Database Vault Owner Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

  7. Reenter the password in the Confirm Password field.

  8. Select Create a Separate Account Manager if you want to create a separate Account Manager to manage Oracle Database Vault accounts.

  9. In the Database Vault Account Manager field, enter a user name for the Database Vault Account Manager if you have chosen to select the Create a Separate Account Manager check box. The user name can be a minimum of 2 and a maximum of 30 characters.

  10. Enter a password for the Database Vault Account Manager account in the Account Manager Password field. The password can be a minimum of 8 and a maximum of 30 characters. The password must include at least one alphabet, one digit, and one nonalphanumeric character (symbol). It cannot be the same as the account names for either the Database Vault owner or the Database Vault account manager. It cannot contain any consecutive repeating characters.

  11. Reenter the password in the Confirm Password field. Click Next.

  12. The Select Existing Database screen is displayed. A list of all databases running from the selected Oracle home is displayed. Select the database into which you wish to install Oracle Database Vault.

    Note:

    • Oracle recommends that you install Oracle Database Vault into an Oracle home containing only a single database.

      If there are multiple databases in an Oracle home, you must enable Database Vault for all the databases. You cannot have Database Vault enabled databases coexist with non-Database Vault enabled databases in the same Oracle home. In order to enable Database Vault for addtional databases in the same Oracle home, refer to Appendix C, "Running DVCA After Creating a Database Vault Database"

    • If a database is not listed, then check to make sure that you have followed the instructions under "Check the Database Requirements".

  13. Enter the existing SYS user password for the selected database in the Existing Database SYS Password field.

  14. Reenter the SYS password in the Confirm Password field. Click Next.

    Note:

    At this point, the database requirements are validated.
  15. You are prompted to shut down all Oracle processes running from the Oracle home before proceeding. Shut down the Oracle processes, if you have not already done so.

    See Also:

    "Stop Existing Oracle Processes" for more information on stopping existing Oracle processes
  16. Product-specific prerequisite checks are performed. Confirm that all tests have passed. Click Next to continue.

  17. The Summary screen is displayed with the installation details. Verify the details and click Install.

  18. The Installation screen is displayed. After the installation completes, the Database Vault Configuration Assistant (DVCA) is run automatically. DVCA helps configure the Database Vault installation.

2.2 Postinstallation Tasks

This section lists the tasks to perform after you have completed an upgrade of your database. The following topics are discussed:

2.2.1 Back Up the Database

Make sure you perform a full backup of the production database. See Oracle Database Backup and Recovery User's Guide for details on backing up a database.

2.2.2 Change Passwords for Oracle-Supplied Accounts

Oracle strongly recommends that you change the password for each account after installation. This enables you to effectively implement the strong security provided by Oracle Database Vault.

Note:

If you are creating a database using Database Configuration Assistant, you can unlock accounts after the database is created by clicking Password Management before you exit from Database Configuration Assistant.

2.2.2.1 Using SQL*Plus to Unlock Accounts and Reset Passwords

To unlock and reset user account passwords using SQL*Plus:

  1. Start SQL*Plus and log in using the Database Vault Account Manager account. If you did not create the Database Vault Account Manager account during installation, then you will need to log in using the Database Vault Owner account.

  2. Enter a command similar to the following, where account is the user account that you want to unlock and password is the new password:

    SQL> ALTER USER account [ IDENTIFIED BY password ] ACCOUNT UNLOCK;
    

    In this example:

    • The ACCOUNT UNLOCK clause unlocks the account.

    • The IDENTIFED BY password clause resets the password.

    Note:

    If you unlock an account but do not reset the password, then the password remains expired. The first time someone connects as that user, they must change the user's password.

    To permit unauthenticated access to your data through HTTP, unlock the ANONYMOUS user account.

    See Also:

    Oracle Database Administrator's Guide for more information about:
    • Unlocking and changing passwords after installation

    • Oracle security procedures

    • Best security practices

2.2.3 Disable Remote SYSDBA Connections (Optional)

Oracle Database Vault allows you to disable remote logins with SYSDBA privileges. This enables enhanced security for your database.

To disable remote SYSDBA connections, re-create the password file with the nosysdba flag set to y (Yes). A user can still log in AS SYSDBA locally using Operating System (OS) authentication. However, remote connections AS SYSDBA will fail.

Use the following syntax to re-create the password file:

C:\> ORACLE_HOME\bin\orapwd file=filename password=password [entries=users] force=y nosysdba=y

Where:

  • file: Name of password file (mandatory)

  • password: Password for SYS (mandatory). Enter at least six alphanumeric characters.

  • entries: Maximum number of distinct DBA users

  • force: Whether to overwrite the existing file

  • nosysdba: Whether to enable or disable the SYS logon

    The default is no, so if you omit this flag, the password file will be created enabling SYSDBA access for Oracle Database Vault instances.

For example:

C:\> oracle\product\10.2.0\db_1\bin\orapwd
file=C:\oracle\product\10.2.0\db_1\dbs\orapwORCL password=5hjk99 force=y
nosysdba=y

Note:

Do not insert spaces around the equal (=) character.

See Also:

Oracle Database Administrator's Guide for more information on using the orapwd utility.

When you re-create the password file, any accounts other than SYS that were granted the SYSDBA or SYSOPER privileges will have those privileges removed. You will need to regrant the privileges for these accounts after you have re-created the password file.

You can reenable the ability to connect with the SYSDBA privilege by re-creating the password file with the nosysdba flag set to n (No). You might need to reenable the ability to connect with SYSDBA privileges, if certain products or utilities require it's use.

2.2.4 Start the Database on Other Nodes (Oracle RAC Only)

You need to start the database on all Oracle RAC nodes other than the one on which the installation is performed. Use the following command to start the listener and the database:

Note:

You need to connect AS SYSDBA to run the command.
C:\> ORACLE_HOME\bin\srvctl start instance -d sid -i InstanceName

Note:

You must use the Server Control (srvctl) utility to start and stop Oracle RAC instances. Do not use SQL*Plus to start and stop Oracle RAC instances. You need to enable SYSDBA connections before you can use the srvctl command.

2.2.5 Configure Oracle Database Vault on Oracle RAC Nodes (Oracle RAC Only)

After you install Oracle Database Vault for an Oracle Real Application Clusters (Oracle RAC) instance, complete the following procedure for each Oracle RAC node. This procedure assumes that you have a separate Oracle home for each node.

Note:

The dvca -action optionrac option has been deprecated and can no longer be used to configure Oracle RAC nodes.
  1. Log in to SQL*Plus as user SYS with the SYSDBA privilege.

    sqlplus SYS "AS SYSDBA"
    Enter password:
    
  2. Run the following ALTER SYSTEM statements:

    SQL> ALTER SYSTEM SET AUDIT_SYS_OPERATIONS=TRUE SCOPE=SPFILE;
    SQL> ALTER SYSTEM SET OS_ROLES=FALSE SCOPE=SPFILE; 
    SQL> ALTER SYSTEM SET RECYCLEBIN='OFF' SCOPE=SPFILE; 
    SQL> ALTER SYSTEM SET REMOTE_LOGIN_PASSWORDFILE='EXCLUSIVE' SCOPE=SPFILE;
    SQL> ALTER SYSTEM SET SQL92_SECURITY=TRUE SCOPE=SPFILE; 
    SQL> ALTER SYSTEM SET OS_AUTHENT_PREFIX='' SCOPE=SPFILE;
    
  3. Restart Oracle Database.

    C:\> ORACLE_HOME\bin\srvctl stop database -d db_name
    C:\> ORACLE_HOME\bin\srvctl start database -d db_name
    

2.2.6 Manually Deploy Oracle Database Vault Administrator (Special Cases)

If you have created an Oracle database manually, and have configured Oracle Enterprise Manager Database Control by using Enterprise Manager Configuration Assistant, you must manually deploy Oracle Database Vault Administrator. This procedure deploys Database Vault Administrator in the same OC4J container as the current Enterprise Manager, rather than creating a new application.

This section contains:

2.2.6.1 Deploying Database Vault Administrator to a Standalone OC4J Container

You can manually deploy Database Vault Administrator to the Oracle Application Server Containers for J2EE (OC4J) home, which by default is in the ORACLE_HOME\oc4j\j2ee\home directory.

To manually deploy Database Vault Administrator:

  1. Edit the file ORACLE_HOME\oc4j\j2ee\home\config\server.xml. Enter the following line just before the last line that reads, </application-server>:

    <application name="dva" path="ORACLE_HOME\dv\jlib\dva_webapp.ear" auto-start="true" />
    

    For example:

    <application name="dva" path="C:\oracle\product\10.2.0\db1\dv\jlib\dva_webapp.ear"
    auto-start="true" />
    
  2. Edit the file ORACLE_HOME\oc4j\j2ee\home\config\http-web-site.xml. Enter the following line just above the last line that reads, </web-site>:

    <web-app application="dva" name="dva_webapp" root="/dva" />
    
  3. Edit the file ORACLE_HOME\oc4j\j2ee\home\config\global-web-application.xml. Search for <servlet-class>oracle.jsp.runtimev2.JspServlet</servlet-class>. Uncomment the following lines after this:

    <init-param>
       <param-name>main_mode</param-name>
       <param-value>justrun</param-value>
    </init-param>
    
  4. Create the following directory:

    ORACLE_HOME\dv\jlib\sysman\config
    
  5. Create the database connection configuration file, emoms.properties, in the configuration directory that you just created. Add the following lines to the file:

    oracle.sysman.emSDK.svlt.ConsoleMode=standalone 
    oracle.sysman.eml.mntr.emdRepRAC=FALSE 
    oracle.sysman.eml.mntr.emdRepDBName=ORACLE_SID
    oracle.sysman.eml.mntr.emdRepConnectDescriptor=TNS_connection_string
    

    Follow these instructions:

    • For an Oracle RAC environment, set oracle.sysman.eml.mntr.emdRepRAC to TRUE.

    • For oracle.sysman.eml.mntr.emdRepConnectDescriptor, you can use an alias from ORACLE_HOME\network\admin\tnsnames.ora. Alternatively, you can use the following syntax:

      oracle.sysman.eml.mntr.emdRepConnectDescriptor=
        (DESCRIPTION\=
          (ADDRESS_LIST\=(ADDRESS\=(PROTOCOL\=TCP) (HOST\=HOSTNAME)(PORT\=PORT))) 
          (CONNECT_DATA\=
             (SERVICE_NAME\=ORACLE_SID))
      
  6. Ensure that the correct environment variables are set.

    For example:

    ORACLE_SID=orcl
    ORACLE_HOME=C:\oracle\product\10.2.0\dv
    LD_LIBRARY_PATH=C:\oracle\product\10.2.0\dv\BIN;C:\oracle\product\10.2.0\dv\LIB
    ;C:\oracle\product\10.2.0\dv\jdbc\lib
    PATH=ORACLE_HOME\bin;ORACLE_HOME\jdk\bin;%PATH%
    

    Ensure that you set the LD_LIBRARY_PATH variable to use the OCI-based JDBC libraries.

  7. Start OC4J using the following syntax:

    C:\> ORACLE_HOME\jdk\bin\java -Djava.awt.headless=true -DEMDROOT=ORACLE_HOME\dv\jlib -jar ORACLE_HOME\oc4j\j2ee\home\oc4j.jar  -userThreads -config ORACLE_HOME\oc4j\j2ee\home\config\server.xml
    

After you complete these steps, you can start Database Vault Administrator. The HTTP port defaults to 8888 for this environment. Use the following syntax for the URL:

http://hostname:8888/dva

2.2.6.2 Deploying Database Vault Administrator to the Database Console OC4J Container

To manually deploy Database Vault Administrator to the Database Console OC4J container:

  1. Stop Oracle Database Console.

    Under Administrative Services, select the Services utility, and then right-click the OracleDBConsolesid service. Select Stop from the context menu.

  2. Create a backup copy and then open the ORACLE_HOME\oc4j\j2ee\OC4J_DBConsole_service_name\config\server.xml file.

  3. Add the following line before the </application-server> element:

    <application name="dva" path="ORACLE_HOME\dv\jlib\dva_webapp.ear" parent="default" start="true" />
    
  4. Create a backup copy and then open the ORACLE_HOME\oc4j\j2ee\OC4J_DBConsole_service_name\config\http-web-site.xml file.

  5. Add the following line before the </web-site> element:

    <web-app application="dva" name="dva_webapp" load-on-startup="true" root="/dva" shared="true"/>
    
  6. Restart Oracle Database Console.

    Under Administrative Services, select the Services utility, and then right-click the OracleDBConsolesid service. Select Start from the menu.

After you complete these steps, you can start Oracle Database Vault Administrator by using the following URL:

https://hostname:port/dva

For example:

https://myserver:1158/dva

If you are unsure of the port number, open the ORACLE_HOME\host_sid\sysman\config\emd.properties file and search for REPOSITORY_URL. In most cases, the host name and port number are the same as Oracle Enterprise Manager Database Control.

2.2.7 Restart Enterprise Manager Database Control

Restart Enterprise Manager Database Control by using the following commands:

C:\> ORACLE_HOME\bin\emctl stop dbconsole
C:\> ORACLE_HOME\bin\emctl start dbconsole

Note:

Run the above commands on all cluster nodes for an Oracle RAC database.

2.2.8 Setting the Timeout Value for DVA (Optional)

Oracle Database Vault Administrator (DVA) is a browser-based graphical user interface console that you can use to manage Oracle Database Vault.

You can modify the length of time that DVA stays connected while inactive. By default, the connection duration is 35 minutes. Your session automatically gets expired after 35 minutes of inactivity.

To set the session time for Oracle Database Vault Administrator:

  1. Back up the web.xml file, which by default is in the ORACLE_HOME\dv\jlib\dva_webapp\dva_webapp\WEB-INF directory.

  2. In a text editor, open the web.xml file .

  3. Search for the following setting:

    <session-config>
     <session-timeout>35</session-timeout>
    </session-config>
    
  4. Change the <session-timeout> setting to the amount of time in minutes that you prefer.

  5. Save and close the web.xml file.

  6. Stop and restart the DVA application.

    You can use the following command to restart DVA:

    emctl stop dbconsole
    emctl start dbconsole
    

2.3 Removing Oracle Database Vault

The following procedures uninstall Oracle Database Vault from an Oracle Database installation. They apply to both single-instance and Oracle RAC installations.

2.3.1 Step 1: Deconfigure Oracle Database Vault

  1. Disable Oracle Database Vault, as described under "Step 1: Disable Oracle Database Vault" in Oracle Database Vault Administrator's Guide.

  2. In SQL*Plus, connect as user SYS with the SYSDBA privilege.

    CONNECT SYS/AS SYSDBA
    Enter password: password
    
  3. Disable the recycle bin.

    To check if the recycle bin is enabled, enter the following command:

    SHOW PARAMETER RECYCLEBIN
    

    If it is enabled, then run the following SQL statement:

    ALTER SYSTEM SET RECYCLEBIN = OFF SCOPE=SPFILE;
    

    Disabling the recycle bin does not purge or otherwise affect objects that are already in the recycle bin.

  4. Run the following SQL script:

    ORACLE_HOME\rdbms\admin\dvremov.sql
    
  5. Manually drop the DV_OWNER and DV_ACCTMGR user accounts.

    For example:

    DROP USER dbv_owner CASCADE;
    DROP USER dbv_acctmgr CASCADE;
    
  6. Restart the database.

    For example:

    SHUTDOWN IMMEDIATE
    STARTUP
    

2.3.2 Step 2: Deinstall Oracle Database Vault

  1. Start OUI by invoking setup.exe from the ORACLE_HOME\oui\bin directory.

  2. In the Welcome window, select Deinstall Products.

  3. Navigate to the correct directory and then select Database Vault 10.2.0.5 from the list.

  4. In the confirmation window, select Yes.

  5. Exit OUI.

Afterward, you can double-check that Oracle Database Vault is truly deinstalled by logging in to SQL*Plus and entering the following statement:

SELECT * FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';

If Oracle Database Vault is deinstalled, the following output appears:

PARAMETER                     VALUE
----------------------------- -----------------------
Oracle Database Vault         FALSE