When I started to deal with Oracle Audit Vault and Database Firewall (AVDF), I have always worked with the Web console. Since a few weeks I regularly use the AVCLI and start to like it. It is a simple java based command line utility, from which you can access Audit Vault and Database Firewall servers. The look and feel of AVCLI is comparable with SQLPlus or RMAN utility and allows to configure and administer the Oracle AVDF server. The utility can be used interactive or with scripts. All you need to use it is JDK 1.6 or later and a supported platform. So far I could not find any information about supported operating systems, but I’m assuming that they are the same as for the vault audit agent. The MOS note 1536380.1 Oracle Audit Vault and Database Firewall 12.1 platform support list the latest informations. At the moment I’m using the AVCLI on Windows 7 and Oracle Enterprise Linux 5u8.
Download and Install
The AVCLI has to be downloaded from the AVCLI Web console. For this navigate to settings tab, in the system menu click manage and click the Download Command Line Utility Button to download and save the avcli.jar.
To install it just run java with the following parameters:
java -jar avcli.jar -d INSTALLATIONPATH
First Steps
A user account with the AV_ADMIN role is required to use the AVCLI and connect to the AVDF server. On my test and engineering system still using AVADMIN.
Log in and show the help:
oracle@melete2:/var/lib/oracle/dbfw/ [dbfwdb] avcli
AVCLI : Release 12.1.1.1.0 - Production on Fri Oct 18 10:28:16 UTC 2013
Copyright (c) 1996, 2013 Oracle. All Rights Reserved.
AVCLI> connect avadmin/manager;
Connected.
AVCLI> help;
---------------------------------------------------------------------
For detailed help, see HELP [command] e.g., HELP REGISTER SECURED TARGET
Secured Target Management:
* REGISTER SECURED TARGET [secured target name] OF SECURED TARGET TYPE
[secured target type name] AT [location] [AUTHENTICATED BY
[username/password]]
* ALTER SECURED TARGET [secured target name] SET [options]
* ALTER SECURED TARGET [secured target name] ADD ADDRESS [ip:port]
* ALTER SECURED TARGET [secured target name] DROP ADDRESS [ip:port]
* LIST ATTRIBUTE FOR SECURED TARGET [secured target name]
* LIST METRICS FOR SECURED TARGET [secured target name]
* LIST SECURED TARGET
* LIST SECURED TARGET TYPE
* LIST ADDRESS FOR SECURED TARGET [secured target name]
* DROP SECURED TARGET [secured target name]
Host Management:
* REGISTER HOST [hostname] [WITH IP [ip address]]
* ALTER HOST [hostname] SET [options]
* ACTIVATE HOST [hostname]
* DEACTIVATE HOST [hostname]
* LIST HOST
* DROP HOST [hostname]
Trail Management:
* START COLLECTION FOR SECURED TARGET [options]
* STOP COLLECTION FOR SECURED TARGET [options]
* LIST TRAIL FOR SECURED TARGET [secured target name]
* DROP TRAIL FOR SECURED TARGET [options]
Security Management:
* GRANT ADMIN TO [username]
* REVOKE ADMIN FROM [username]
* GRANT SUPERADMIN TO [username]
* REVOKE SUPERADMIN FROM [username]
* GRANT ACCESS ON SECURED TARGET [secured target name] TO [username]
* GRANT ACCESS ON SECURED TARGET GROUP [secured target group name]
TO [username]
* REVOKE ACCESS ON SECURED TARGET [secured target name] FROM [username]
* REVOKE ACCESS ON SECURED TARGET GROUP [secured target group name]
FROM [username]
Plugin Management:
* DEPLOY PLUGIN [plugin archive]
* UNDEPLOY PLUGIN [plugin id]
* LIST PLUGIN FOR SECURED TARGET TYPE [secured target type name]
SMTP Server Integration:
* REGISTER SMTP SERVER AT [host[:port]] SENDER ID [sender id]
SENDER EMAIL [sender e-mail]
[AUTHENTICATED BY [username]/[password]]
* ALTER SMTP SERVER [options]
* ALTER SMTP SERVER SECURE MODE ON PROTOCOL [SSL | TLS]
[TRUSTSTORE [truststore]]
* ALTER SMTP SERVER SECURE MODE OFF
* ALTER SMTP SERVER ENABLE
* ALTER SMTP SERVER DISABLE
* TEST SMTP SERVER SEND EMAIL TO [e-mail address]
* LIST ATTRIBUTE OF SMTP SERVER
* DROP SMTP SERVER
Server Management:
* ALTER SYSTEM SET [options]
* SHOW CERTIFICATE FOR SERVER
Firewall Management:
* REGISTER FIREWALL [firewall name] WITH IP [ip address]
* LIST FIREWALL
* REBOOT FIREWALL [firewall name]
* POWEROFF FIREWALL [firewall name]
* DROP FIREWALL [firewall name]
* ALTER FIREWALL [firewall name] SET [options]
* SHOW STATUS FOR FIREWALL [firewall name] [WITH DIAGNOSTICS]
* CREATE RESILIENT PAIR FOR FIREWALL PRIMARY [ primary firewall]
SECONDARY [secondary firewall]
* SWAP RESILIENT PAIR HAVING FIREWALL [firewall name]
* DROP RESILIENT PAIR HAVING FIREWALL [firewall name]
Enforcement Point Management:
* CREATE ENFORCEMENT POINT [enforcement point name] FOR
SECURED TARGET [secured target name] USING FIREWALL
[firewall name] TRAFFIC SOURCE [traffic source name]
WITH MODE [mode name DPE/DAM]
* LIST ENFORCEMENT POINT FOR FIREWALL [firewall name]
* LIST ENFORCEMENT POINT FOR SECURED TARGET [secured target name]
* START ENFORCEMENT POINT [enforcement point name]
* STOP ENFORCEMENT POINT [enforcement point name]
* ALTER ENFORCEMENT POINT [enforcement point name] SET [options]
* DROP ENFORCEMENT POINT [enforcement point name]
Miscellaneous:
* CONNECT [username/password]
* QUIT
* HELP
List the secured targets:
AVCLI> LIST SECURED TARGET;
---------------------------------------------------------------------------------------------------------------------------------
| NAME | DESCRIPTION | LOCATION | SECUREDTARGETTYPE |
=================================================================================================================================
| TDB11 | Oracle 11.2.0.3.0 Test Database (Use to be 12.1.0.1 DB) | jdbc:oracle:thin:@//urania:1521/TDB11 | Oracle Database |
| TDB11A | Oracle 11.2.0.3.0 Test Database | jdbc:oracle:thin:@//urania:1521/TDB11A | Oracle Database |
---------------------------------------------------------------------------------------------------------------------------------
2 row(s) selected.
The command completed successfully.
List status of audit trails for a secure target:
AVCLI> LIST TRAIL FOR SECURED TARGET TDB11;
----------------------------------------------------------------------------------------------------------------
| AUDIT_TRAIL_TYPE | HOST | LOCATION | STATUS | REQUEST_STATUS | ERROR_MESSAGE |
================================================================================================================
| DIRECTORY | urania | /u00/app/oracle/admin/TDB11/adump | UNREACHABLE | | |
| TABLE | urania | SYS.AUD$ | UNREACHABLE | | |
| TRANSACTION LOG | urania | | UNREACHABLE | | |
----------------------------------------------------------------------------------------------------------------
3 row(s) selected.
The command completed successfully.
Start collection of an audit trail. This requires to specify the agent host and the trail location. Below you see how to start the audit trail for database table SYS.AUD$ and the redo collector.
AVCLI> START COLLECTION FOR SECURED TARGET TDB11 USING HOST urania FROM TABLE 'SYS.AUD$';
Request submitted successfully.
AVCLI> START COLLECTION FOR SECURED TARGET TDB11 USING HOST urania FROM TRANSACTION LOG;
Request submitted successfully.
AVCLI> LIST TRAIL FOR SECURED TARGET TDB11;
----------------------------------------------------------------------------------------------------------------
| AUDIT_TRAIL_TYPE | HOST | LOCATION | STATUS | REQUEST_STATUS | ERROR_MESSAGE |
================================================================================================================
| DIRECTORY | urania | /u00/app/oracle/admin/TDB11/adump | UNREACHABLE | | |
| TABLE | urania | SYS.AUD$ | IDLE | | |
| TRANSACTION LOG | urania | | COLLECTING | | |
----------------------------------------------------------------------------------------------------------------
3 row(s) selected.
The command completed successfully.
Run Scripts
Scripts can be executed directly as command line parameter when starting AVCLI or interactively when using the AVCLI.
Start a script from the command line with specifying the user and script name.
oracle@melete2:~/ [dbfwdb] avcli -u avadmin -f report_av_status.av
AVCLI : Release 12.1.1.1.0 - Production on Fri Oct 18 10:40:04 UTC 2013
Copyright (c) 1996, 2013 Oracle. All Rights Reserved.
Enter password for 'avadmin':
Connected to:
Oracle Audit Vault Server - Version : 12.1.1.1.0
AVCLI>
---------------------------------------------------------------------------------------------------------------------------------
| NAME | DESCRIPTION | LOCATION | SECUREDTARGETTYPE |
=================================================================================================================================
| TDB11 | Oracle 11.2.0.3.0 Test Database (Use to be 12.1.0.1 DB) | jdbc:oracle:thin:@//urania:1521/TDB11 | Oracle Database |
| TDB11A | Oracle 11.2.0.3.0 Test Database | jdbc:oracle:thin:@//urania:1521/TDB11A | Oracle Database |
---------------------------------------------------------------------------------------------------------------------------------
2 row(s) selected.
The command completed successfully.
AVCLI>
----------------------------------------------------------------------------------------------------------------
| AUDIT_TRAIL_TYPE | HOST | LOCATION | STATUS | REQUEST_STATUS | ERROR_MESSAGE |
================================================================================================================
| DIRECTORY | urania | /u00/app/oracle/admin/TDB11/adump | UNREACHABLE | | |
| TABLE | urania | SYS.AUD$ | IDLE | | |
| TRANSACTION LOG | urania | | COLLECTING | | |
----------------------------------------------------------------------------------------------------------------
3 row(s) selected.
The command completed successfully.
AVCLI>
Or with username/password in the script.
oracle@melete2:~/ [dbfwdb] avcli -f start_trails_TDB11.av
AVCLI : Release 12.1.1.1.0 - Production on Fri Oct 18 10:46:45 UTC 2013
Copyright (c) 1996, 2013 Oracle. All Rights Reserved.
AVCLI> Connected.
AVCLI> AVCLI>
Request submitted successfully.
AVCLI>
Request submitted successfully.
AVCLI>
Request submitted successfully.
AVCLI>
oracle@melete2:~/ [dbfwdb] cat start_trails_TDB11.av
connect avadmin/manager;
START COLLECTION FOR SECURED TARGET TDB11 USING HOST urania FROM TABLE 'SYS.AUD$';
START COLLECTION FOR SECURED TARGET TDB11 USING HOST urania FROM TRANSACTION LOG;
START COLLECTION FOR SECURED TARGET TDB11 USING HOST urania FROM DIRECTORY '/u00/app/oracle/admin/TDB11/adump';
The downside is that the password is stored in the script or it must be entered interactively.
Conclusion
Is a nice little tool that is worth looking at more closely. In addition to the automation of administrative tasks it is a handy day to day tool for the AV administrator with a bit room for improvement. 🙂 Ok would be helpful, if there is an alternative for username/passwords to automatically execute scripts without storing the passwords in cleartext. Why not have something similar to secure external password store or the emcli function to store credentials?
A few possible use cases for AVCLI:
- Provision new secure targets and audit trails
- Automating administration tasks
- Alternative administration interface
- Automatic start of audit collection with system oder database startup
References
Some links related to this post.
