SecureDBA

How to Implement Auto Discovery in Oracle Enterprise Manager 12c

Intended Audience: Oracle Enterprise Manager (OEM) Cloud Control Administrators

Purpose: This document provides a guideline for how to implement Auto Discovery in OEM 12c. It is not a detailed build document or cookbook. Its purpose is to provide experienced OEM administrators a quick start and avoid pitfalls.

Requirements

As with any implementation, knowing the requirements for Auto Discovery is critical. Know who the customer is and get their requirements. The most critical input required is the list of VLANs to scan and the specific ports to scan for in your environment.

Summary

Setting up Auto Discovery has the following basic steps:

• Setup Scanning Account
• Determine Scanning Host(s)
• Setup Privilege Delegation
• Create Scanning Account Credential
• Configure Auto Discovery

Setup Scanning Account

The operating system account used to perform the scans must have permission to execute nmosudo as root. In OEM 12c Release 3, nmosudo can be found in the sbin directory which is under the AGENT_BASE directory; for example, AGENT_BASE/sbin/nmosudo. Note that in earlier versions, sbin was under the MIDDLEWARE_HOME which meant its location changed every time an upgrade occurred requiring sudo permissions on this account to change every release. If you are using an older version make sure you locate nmosudo as the full path is required for sudo.

When Auto Discovery is executed, nmosudo will then call nmap which is part of the OEM installation, not the nmap that is part of the OS distribution. In R3, nmap can be found at AGENT_INST/discovery/nmap/bin/nmap. Note that sudo can be implemented in a very granular manner and nmosudo may not be able to invoke nmap in your environment. In that case, you need to explicitly allow the scanning account to execute nmap as root as well.

 

Determine Scanning Agent(s)

You can perform the scan from any host that has an OEM agent installed. You may want to choose multiple hosts to share the workload and/or provide high availability. It is not unusual to use the Oracle Management Server hosts for this task.

 

Setup Privilege Delegation

The host that will perform the scan need to be setup for privilege delegation as the scanning account needs to be configured with sudo to root. Root is required in order to scan the low order privileged ports such as 22 and 80.

Go to Setup/Security/Privilege Delegation and select the host(s) to be used for the scan. Click on the edit icon and select the Sudo radio button and then enter:

sudo -E -u  %RUNAS%  %COMMAND%

Note that the -E allows the passing of your environment to the command that is invoked. Some environments do not allow this for security reasons. If so, you can leave the -E off as running nmap does not require any environment variables to be passed.

 

Create Scanning Account Credential

Next we need to create the credential for the scanning account as this is required to configure Auto Discovery. Go to Setup/Security/Named Credentials.

Create a host credential and make sure to specify Run Privilege as Sudo and Run as root. Test the credential against one of the scanning hosts and save.

 

Configure Auto Discovery

Go to Setup/Add Target/Configure Auto Discovery. Click the wrench icon next to Host and Oracle VM Manager.

Click Create.

Give the Job a meaningful name based on what it is you are going to scan.

Click Add and then search for and select the agent or agents you wish to scan from (the ones configured for Privilege Delegation above).

Click Edit Nmap Scan Services and Ports and add and/or remove ports you wish (or do not wish) to scan. Note that these are in addition to any ports that OEM will always scan for. Make sure that if you use non-default ports for services, you specify the ports here or they may be missed by the scan.

In IP Ranges to Scan, enter the IP addresses or hostnames to scan. CIDR codes are accepted so typically you’ll want to enter the VLANs you want to scan by their CIDR code values.

Under schedule choose whether or not this is a repeating scan and when it should occur. You’ll generally want to perform these on a repeating schedule to catch any new hosts that are added to the environment.

Under Credentials, select Named and then choose the named credential that was created above.

Click Save and Submit Scan and monitor the results

How to Implement Compliance Monitoring in Oracle Enterprise Manager 12c

Intended Audience: Oracle Enterprise Manager (OEM) Cloud Control Administrators

Purpose: This document provides a guideline for how to implement compliance monitoring in OEM 12c. It is not a detailed build document or cookbook. Its purpose is to provide experienced OEM administrators a quick start and avoid pitfalls.

Requirements

As with any implementation, knowing the requirements for compliance monitoring is critical. The ISSO should provide the major portion of the requirements. Documentation such as Secure Baselines can also be critical input to the process.

Summary

Setting up compliance monitoring has the following basic steps:

• Establish Compliance Standard Rules
• Establish Compliance Standards
• Establish Compliance Framework
• Add Compliance Standards to your Template Collections
• Reporting on Compliance Events
• Export/Import of Compliance Frameworks, Standards and Rules

 

Establish Compliance Standard Rules

Compliance Standard Rules are how you implement the compliance requirements. OEM 12c ships with almost 2,000 rules for you to choose from or you can create your own. Go to Enterprise/Compliance/Library/Compliance Standard Rules and then use the Advanced Search feature to find rules that you need. If you cannot find an exact match, find something close and use the Create Like feature to make a similar but different rule. Save the names of all the rules you need to implement the requirements. You may want to establish a naming convention for rules you create to distinguish them from the Oracle supplied rules.

Rules can be in either Development or Production Compliance Rule State. Development rules will not actually fire until you put them into production state.

Be sure to test the rules using the Test button before you put them in production state to be sure they do not return errors or otherwise do not work in the way you intended.

Even if you find an Oracle rule that matches your need exactly, make a copy of is using Create Like because you cannot import Oracle-supplied rules across environments.

Establish Compliance Standards

Compliance Standards are simply a grouping of rules for a given target type.

For example, if you were implementing compliance rules for databases and listeners, you would create two Compliance Standards, one for database rules and one for listener rules.

Go to Enterprise/Compliance/Compliance Standards.

When creating the Compliance Rules, simply right click on the name of the rule on the left navigation panel and you will have the option of adding your rules – this is why it is important to note the names of the rules from the previous step so it makes them easier to find.

If you want to get fancy you can also insert folder names and then create rules under them in a directory structure.

Compliance Standards, like Compliance Standard Rules also have a state of Development or Production that works the same way.

 

Establish Compliance Framework

A Compliance Framework is simply a collection of Compliance Standards.

Go to Enterprise/Compliance/Compliance Frameworks and create a framework. You can then add the Compliance Standards in the same way that you added Compliance Standard Rules to the Compliance Standards.

Note that Compliance Frameworks also have the Development and Production states.

 

Add Compliance Standards to Your Template Collections

Just as Monitoring Templates are grouped in Template Collections and the associated with your Administration Hierarchy, Compliance Standards work the same way. This ensure as new targets are discovered, the appropriate Compliance Standard is applied.

Go to Enterprise/Monitoring/Template Collections, choose or create a Template Collection, Click on the Compliance Standard tab, and add your Compliance Standards. It his Template Collection is already associated with the Admin Hierarchy, you are done; otherwise go to Setup/Add Target/Administration Groups, highlight the admin group you want to associate the template collection with then click on Associate Template Collection an choose the Template collection you just created or modified.

 

Reporting on Compliance Alerts

As compliance violations generally do not require critical attention, there is no need to create Incident Rules for them. Creating Incidents for these events may result in too may incidents and mask or make it more difficult to find more critical Incidents that may require more immediate action.  For the same reason, there is no reason to send out email notifications and therefore, no reason to create an Incident Rules for these types of events.

 

Export/Import of Compliance Frameworks, Standards and Rules

If you only have a single OEM installation for you entire enterprise, you can skip this section; otherwise, the Export/Import function will be important to you. If, for instance, you have a Dev, a Test and a Prod OEM and you want to keep them in synchronized, Export/Import is very useful (however, look out for the know issue below).

You can export at any level from the entire Framework, to a Standard or to a specific rule and then import at that same level to the next environment, This is a very easy and safe way to promote changes in your Compliance monitoring across your environments. 

 

Know Issue with Compliance Functionality in Version 12.1.0.3

 

You cannot import an Oracle-Supplied rule, only rules you have created. If you have no need to use export and import, then by all means simply add the Oracle-supplied rules you want directly to your Compliance Standards. However, if export/import is important, we'd suggest using create like to make an exact copy of the Oracle-supplied rule which will then have no export/import restrictions.