Oracle native network encryption
Amazon RDS supports Oracle native network encryption (NNE). With native network encryption, you can encrypt data as it moves to and from a DB instance. Amazon RDS supports NNE for all editions of Oracle Database.
A detailed discussion of Oracle native network encryption is beyond the scope of this guide, but you should
understand the strengths and weaknesses of each algorithm and key before you decide on a solution for your
deployment. For information about the algorithms and keys that are available through Oracle native network
encryption, see Configuring network data encryption
Note
You can use Native Network Encryption or Secure Sockets Layer, but not both. For more information, see Oracle Secure Sockets Layer.
NNE option settings
You can specify encryption requirements on both the server and the client. The DB instance can act as a client
when, for example, it uses a database link to connect to another database. You might want to avoid forcing
encryption on the server side. For example, you might not want to force all client communications to use
encryption because the server requires it. In this case, you can force encryption on the client side using the
SQLNET.*CLIENT
options.
Amazon RDS supports the following settings for the NNE option.
Note
When you use commas to separate values for an option setting, don't put a space after the comma.
Option setting | Valid values | Default values | Description |
---|---|---|---|
|
|
|
The behavior of the server when a client using a non-secure cipher attempts to connect to
the database. If If the setting is
|
|
|
|
The behavior of the server when a client using a non-secure cipher attempts to connect to the database. The following ciphers are considered not secure:
If the setting is If the setting is
|
|
|
|
The data integrity behavior when a DB instance connects to the client, or a server acting as a client. When a DB instance uses a database link, it acts as a client.
|
|
|
|
The data integrity behavior when a client, or a server acting as a client, connects to the DB instance. When a DB instance uses a database link, it acts as a client.
|
|
|
|
A list of checksum algorithms. You can specify either one value or a comma-separated list of values. If you use a comma,
don't insert a space after the comma; otherwise, you receive an
This parameter and |
|
|
|
A list of checksum algorithms. You can specify either one value or a comma-separated list of values. If you use a comma,
don't insert a space after the comma; otherwise, you receive an
This parameter and |
|
|
|
The encryption behavior of the client when a client, or a server acting as a client, connects to the DB instance. When a DB instance uses a database link, it acts as a client.
|
|
|
|
The encryption behavior of the server when a client, or a server acting as a client, connects to the DB instance. When a DB instance uses a database link, it acts as a client.
|
|
|
|
A list of encryption algorithms used by the client. The client uses each algorithm, in order, to attempt to decrypt the server input until an algorithm succeeds or until the end of the list is reached. Amazon RDS uses the following default list from Oracle. You can change the order or limit the algorithms that the DB instance will accept.
You can specify either one value or a comma-separated list of values. If you a comma, don't
insert a space after the comma; otherwise, you receive an This parameter and |
|
|
|
A list of encryption algorithms used by the DB instance. The DB instance uses each algorithm, in order, to attempt to decrypt the client input until an algorithm succeeds or until the end of the list is reached. Amazon RDS uses the following default list from Oracle. You can change the order or limit the algorithms that the client will accept.
You can specify either one value or a comma-separated list of values. If you a comma, don't
insert a space after the comma; otherwise, you receive an This parameter and |
Adding the NNE option
The general process for adding the NNE option to a DB instance is the following:
Create a new option group, or copy or modify an existing option group.
Add the option to the option group.
Associate the option group with the DB instance.
When the option group is active, NNE is active.
To add the NNE option to a DB instance using the AWS Management Console
-
For Engine, choose the Oracle edition that you want to use. NNE is supported on all editions.
-
For Major engine version, choose the version of your DB instance.
For more information, see Creating an option group.
-
Add the NNE option to the option group. For more information about adding options, see Adding an option to an option group.
Note
After you add the NNE option, you don't need to restart your DB instances. As soon as the option group is active, NNE is active.
-
Apply the option group to a new or existing DB instance:
-
For a new DB instance, you apply the option group when you launch the instance. For more information, see Creating an Amazon RDS DB instance.
-
For an existing DB instance, you apply the option group by modifying the instance and attaching the new option group. After you add the NNE option, you don't need to restart your DB instance. As soon as the option group is active, NNE is active. For more information, see Modifying an Amazon RDS DB instance.
-
Setting NNE values in the sqlnet.ora
With Oracle native network encryption, you can set network encryption on the server side and client side. The client is the computer used to connect to the DB instance. You can specify the following client settings in the sqlnet.ora:
-
SQLNET.ALLOW_WEAK_CRYPTO
-
SQLNET.ALLOW_WEAK_CRYPTO_CLIENTS
-
SQLNET.CRYPTO_CHECKSUM_CLIENT
-
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT
-
SQLNET.ENCRYPTION_CLIENT
-
SQLNET.ENCRYPTION_TYPES_CLIENT
For information, see Configuring network data encryption and integrity for Oracle servers and clients
Sometimes, the DB instance rejects a connection request from an application. For example, a rejection can occur when the encryption algorithms on the client and on the server don't match. To test Oracle native network encryption, add the following lines to the sqlnet.ora file on the client:
DIAG_ADR_ENABLED=off TRACE_DIRECTORY_CLIENT=/tmp TRACE_FILE_CLIENT=nettrace TRACE_LEVEL_CLIENT=16
When a connection is attempted, the preceding lines generate a trace file on the client called
/tmp/nettrace*
. The trace file contains information about the connection. For more information
about connection-related issues when you are using Oracle Native Network Encryption, see About negotiating
encryption and integrity
Modifying NNE option settings
After you enable NNE, you can modify its settings. Currently, you can modify NNE option settings only with the AWS CLI or RDS API. You can't use the console. To learn how to modify option settings using the CLI, see AWS CLI. For more information about each setting, see NNE option settings.
Modifying CRYPTO_CHECKSUM_* values
If you modify NNE option settings, make sure that the following option settings have at least one common cipher:
-
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER
-
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT
The following example shows a scenario in which you modify
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER
. The configuration is valid because the
CRYPTO_CHECKSUM_TYPES_CLIENT
and CRYPTO_CHECKSUM_TYPES_SERVER
both use
SHA256
.
Option setting | Values before modification | Values after modification |
---|---|---|
|
|
No change |
|
|
SHA1,MD5,SHA256 |
For another example, assume that you want to modify SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER
from
its default setting to SHA1,MD5
. In this case, make sure you set
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT
to SHA1
or MD5
. These
algorithms aren't included in the default values for SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT
.
Modifying ALLOW_WEAK_CRYPTO* settings
To set the SQLNET.ALLOW_WEAK_CRYPTO*
options from the default value to FALSE
,
make sure that the following conditions are met:
-
SQLNET.ENCRYPTION_TYPES_SERVER
andSQLNET.ENCRYPTION_TYPES_CLIENT
have one matching secure encryption method. A method is considered secure if it's notDES
,3DES
, orRC4
(all key lengths). -
SQLNET.CHECKSUM_TYPES_SERVER
andSQLNET.CHECKSUM_TYPES_CLIENT
have one matching secure checksumming method. A method is considered secure if it's notMD5
. -
The client is patched with the July 2021 PSU. If the client isn't patched, the client loses the connection and receives the
ORA-12269
error.
The following example shows sample NNE settings. Assume that you want to set
SQLNET.ENCRYPTION_TYPES_SERVER
and SQLNET.ENCRYPTION_TYPES_CLIENT
to FALSE,
thereby blocking non-secure connections. The checksum option settings meet the prerequisites because they
both have SHA256
. However, SQLNET.ENCRYPTION_TYPES_CLIENT
and
SQLNET.ENCRYPTION_TYPES_SERVER
use the DES
, 3DES
, and
RC4
encryption methods, which are non-secure. Therefore, to set the
SQLNET.ALLOW_WEAK_CRYPTO*
options to FALSE
, first set
SQLNET.ENCRYPTION_TYPES_SERVER
and SQLNET.ENCRYPTION_TYPES_CLIENT
to a secure
encryption method such as AES256
.
Option setting | Values |
---|---|
|
|
|
SHA1,MD5,SHA256 |
|
|
|
|
Removing the NNE option
You can remove NNE from a DB instance.
To remove NNE from a DB instance, do one of the following:
-
To remove NNE from multiple DB instances, remove the NNE option from the option group they belong to. This change affects all DB instances that use the option group. After you remove the NNE option, you don't need to restart your DB instances. For more information, see Removing an option from an option group.
-
To remove NNE from a single DB instance, modify the DB instance and specify a different option group that doesn't include the NNE option. You can specify the default (empty) option group, or a different custom option group. After you remove the NNE option, you don't need to restart your DB instance. For more information, see Modifying an Amazon RDS DB instance.