Cool ORACLE feature that i would love to have on AWS : More predefined security recipe

Although The AWS cloud offers the wider range of security services than the other providers and the highest level of customization of any vendor, in my opinion something is still missing.

The ORACLE cloud compared to AWS come with many predefined security recipe which allow more automated enforcement of security practices with far less configuration . For inexperienced user this can be very helpful for enhancing the overall security without requiring additional manual effort and reducing human error.

Continue reading

Oracle Multitenant : Statspack on steroids

If like me you like having the full picture of the system, then you may want to install statspack at the CDB level. Ok it’s not supported but every one has his own position on that :p Franck Pachot already wrote about that a while ago :

One important missing piece of information (among others) when doing that is that it will not capture the different sql statement at the PDB level, for that we will need to install statspack at the PDB level also but there is another alternative : Statspack on steroids :p

Continue reading

AWS SSO and SSMSessionRunAs session tag

One of the cool new feature with aws sso is the possibility to pass user attributes also known as session tags. This can be very useful for Attribute-Based Access Control (ABAC) as described on the previous article. Another useful case is using the SSMSessionRunAs TAG to specify with which credential an AWS system session manager session is launched which will allow for better security as the default user “ssm-user” has full administrative privilege on the target instance .

Continue reading

pgSilo Extension : Enhance your PostgreSQL security and isolation

PgSilo is a new PostgreSQL extension that aim to provide better security and isolation by confining PostgreSQL back-end session into silo. Every PostgreSQL cluster will be split into many silo, we can have at must one silo per database, this aim to provide better native security when deploying PostgreSQL. A compromised process connected to database A  (Silo A) will not be able to affect database B (Silo B)  in the same cluster or in another database cluster on same HOST machine. That’s the ultimate objective , but we are still far from that!

pgSilo is still in active development and there is still a lot to do but I decided to share it at the early stage to get feedback and contribution of course . Here is a glimpse of what the actual Pre-APLHA release can do :

Continue reading

Read-only bind mounting your ORACLE_HOME

When checking the file system Layout on my last blog post Oracle DbNest file system isolation : pivot root/ bind mount something caught my attention. So even if in oracle 20C read only oracle home is the way to go by default and DbNest is there to provide file system isolation (beside many other things) the oracle home is not mounted read only by default (DBNEST_PDB_FS_CONF not set) in the new nest mount namespace !

Which is curious because a malicious user on a compromised PDB can exploit that and impact the hole environment.

Continue reading