Table of Contents

Search

  1. Preface
  2. Introduction to Dynamic Data Masking Administration
  3. Authentication
  4. Security
  5. Connection Management
  6. JDBC Client Configuration
  7. ODBC Client Configuration
  8. Access Control
  9. Logs
  10. High Availability
  11. Server Control
  12. Performance Tuning
  13. Troubleshooting
  14. Appendix A: Database Keywords

Administrator Guide

Administrator Guide

Example SSL Configuration Process

Example SSL Configuration Process

This example demonstrates the process of enabling and configuring SSL communication in Dynamic Data Masking using a custom keystore and truststore.
  1. Stop the Dynamic Data Masking Server.
  2. To convert the Dynamic Data Masking Server port from clear to SSL, run the following command:
    server network edit 8195;SSL
  3. Use the keytool command to add a private key and signed certificate to a new keystore. For example, create a self-signed certificate with a 2048-bit RSA key pair, that is valid for 2555 days, under the specified alias in the keystore:
    keytool -genkey -trustcacerts -alias myHost -validity 2555 -keyalg RSA -keysize 2048 -keystore keyStore.jceks -storetype JCEKS -storepass keystorePass -dname cn= myHost
  4. Export the signed certificate from the keystore to a file. For example, export a binary DER-encoded certificate from the keystore to the file
    myHost.der
    :
    keytool -exportcert -noprompt -alias myHost -file myHost.der -keystore keyStore.jceks -storetype JCEKS -storepass keystorePass
  5. Import the certificate file to the truststore. For example, import the certificate from file
    myHost.der
    under the specified alias myHost:
    keytool -importcert -noprompt -trustcacerts -alias myHost -file myHost.der -keystore trustStore.jceks -storetype JCEKS -storepass truststorePass
  6. Copy the keystore to the Dynamic Data Masking Server. For example, run the following command:
    copy keyStore.jceks C:\DDM\cfg\
  7. Copy the truststore to the Management Console. For example, run the following command:
    copy trustStore.jceks C:\DDM\cfg\
  8. Use one of the following files to configure the keystore in the Dynamic Data Masking Server:
    • cfg/ddm.security
    • jvm.params
  9. In the
    cfg/client.security
    file, configure the truststore you copied to the Management Console.
  10. Start the Dynamic Data Masking Server.
  11. Login to the Dynamic Data Masking Server from the Management Console.
    • Select
      SSL
      in the
      Secure Layer
      menu.
    • To connect in Dynamic Data Masking versions before 9.8.4, select
      None
      in the
      Secure Layer
      menu.
    If the handshake with the Dynamic Data Masking Server fails, the command line tool exits with "error code 1" and prints an error message. Check the security configuration files and try again.
  12. To run commands in the local or remote Dynamic Data Masking Server, specify the SSL argument in the connection parameter. For Dynamic Data Masking versions before 9.8.4, do not specify the SSL argument in the connection parameter. For example, in version 9.8.4, run the following command to check the server status:
    • server status server service add "DDM for ORACLE" -targets admin/admin@127.0.0.1:8195;SSL
    • Run the following command to check the server status in Dynamic Data Masking versions before 9.8.4:
      server status server service add "DDM for ORACLE" -targets admin/admin@127.0.0.1:8195

0 COMMENTS

We’d like to hear from you!