Oracle generally requires an application proxy to use SQL*net/Net8 through a firewall. Oracle provides its proxying code "free of charge" to firewall vendors. (Of course free of charge doesnt necessarily mean compatible with open licensing arrangements). The application proxy is also part of Oracle connection manager which, presumably, you could set up on your firewall box. In theory connection manager + any firewall software = oracle friendly firewall I guess. This is, of course, only if you are using SQL*Net/Net8 to communicate between client and server. Michael Paxton ------------------------------------------- Michael Paxton - Michael.Paxton@aihw.gov.au Data & Information Technology Unit Australian Institute of Health & Welfare -----Original Message----- From: Reckhard, Tobias [mailto:tobias.reckhard@secunet.com] Sent: Tuesday, April 30, 2002 2:22 PM To: suse-security@suse.com Subject: RE: [suse-security] Firewall Linux? Firewall software
Chaps and chapesses, does anyone out there know a good location or doc for firewall security with Oracle? Metalink (Oracle's site doesn't seem to be too hot). Inside / Outside the firewall pro's and con's issues, how to set up that sort of thing. On Linux of course. Is there a firewall version of Linux? Is it not just normal Linux with some packages installed and some tweaking? Am I barfing up the wrong tree?
Why would you want something specific to Oracle? The dangers facing servers are very similar, be it that they serve web, news, mail, directory or database content and functions. The differences from a firewalling perspective lie in the direction of communication and the protocol used, the question whether an application layer gateway is available, and the ports used. IMHO, you'd be a fool not to shield an Oracle database with a firewall if you're allowing access from a potentially hostile environment. Many people prefer to place 'staging' databases in DMZ networks that hold only the bare records necessary to perform their function and that exchange data with the production database on the internal network, so that the latter never has direct contact with the hostile environment. Really, apply common sense and security principles and you'll get a sound design, no matter what type of service you're dealing with.
This message is confidential and may also contain privileged [snip]
You do realise that your disclaimer is twice as long as the mail you wrote? <shrug> Tobias -- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here