Oracle Critical Patch Update - April 2010

The 2nd critical patch update for 2010 (CPU April 2010) has been released by Oracle yesterday. Critical patch updates mostly contain fixes to security vulnerabilities plus it would have non-security fixes too. This critical patch update contains 47 new security fixes across all products which includes 7 for Oracle database. For the first time, CPU includes patches/fixes for Sun products. Please review the following URL to see if the product you are using requires this patch or not.

http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html

The next critical patch update (CPU) would be coming in July 2010.

FAQ - http://www.oracle.com/technology/deploy/security/cpu/cpufaq.htm

Related articles by Zemanta

• Oracle to release quarterly Solaris updates (v3.co.uk)

11g New Features - Tablespace Encryption

You might have heard about Transparent Data Encryption or TDE in 10g; In Oracle 11g, it has been taken to a next level with "tablespace encryption". So TDE which started at column level is available at tablespace level.

How does it help?
Now instead of encrypting the columns one-by-one in a table or for a set of tables, you can simply put all tables which need to be encrypted in a single tablespace and encrypt it.

How to do it?
- Create and open the wallet
- Create tablespace with encryption property

CREATE TABLESPACE encrypt_tbsp
DATAFILE '/oradata/encrypt_tbsp01.dbf'
SIZE 100M
ENCRYPTION
DEFAULT STORAGE(ENCRYPT);

- Create tables in the encrypted tablespace

How to find if tablespace is encrypted or not?
- A new column "ENCRYPTED" has been added to DBA_TABLESPACES which will indicate if the tablespace is encrypted or not.
- Query a new dynamic performance view V$ENCRYPTED_TABLESPACES for encrypted tablespaces.

Do I need to do anything special to access data from a encrypted tablespace?
Not really, you continue to access data as usual BUT the wallet must be open. No modification whatsoever is required for the code/SQL to access data from encrypted tablespace.

What is supported and not supported with encrypted tablespaces?
Supported
- Move table back and forth between encrypted tablespace and non-encrypted tablespace
- Datapump is supported to export/import encrypted content/tablespaces
- Transportable tablespace is supported using datapump

Not Supported
- Tablespace encryption cannot be used for SYSTEM, SYSAUX, UNDO and TEMP tablespaces
- Existing tablespace cannot be encrypted
- Traditional export/import utilities for encrypted content

Though I have not been able to create an encrypted tablespace but still wanted to share this information. I will try to post my learnings from the exercise later. Hope this is useful. NJoy! encrypting and do let me know if I have missed out any key messaging herein.

References:- Oracle® Database Advanced Security Administrator's Guide 11g Release 1 (11.1) Part Number B28530-02

11g New Feature - SYSDBA authentication gets stronger

The SYSDBA & SYSOPER authentication gets stronger from 11g; Oracle now extended support for PKI, Kerberos and Radius to SYSDBA and SYSOPER connections. Earlier, this was limited to all users except SYSDBA and SYSOPER. A new initialization parameter LDAP_DIRECTORY_SYSAUTH has been introduced which needs to be set along with LDAP_DIRECTORY_ACCESS for stronger SYSDBA authentication.

You login as SYSDBA the following way if you configure Directory authentication (OID) :-

CONNECT user@11glab AS SYSDBA
Enter password: password

If you have used Kerberos or SSL then connect as SYSDBA the following way :-

CONNECT /@11glab AS SYSDBA

References: Oracle® Database Security Guide 11g Release 1 (11.1) Part Number B28531-04