Security planning

Review the following topics for information about how BMC Database Automation provides security and for recommendations on deploying securely:

Security overview

Security within the BMC Database Automation product is comprised of robust authentication mechanisms, flexible and granular Role Based Access Controls (RBAC), and comprehensive monitoring. This makes BMC Database Automation well suited for complex enterprise organizations, such as financial institutions or service providers, where portions of the database infrastructure are managed by different teams that must operate autonomously due to regulatory separation of duty policies. 

BMC Database Automation is handled at multiple tiers:

• Using the management GUI, users can access the web interface based on the product's RBAC mechanisms.
• At a transport level, all of the communications between the management server and the agents are encrypted using SSL, with both server and client certificates being presented. This means that a malicious party cannot masquerade as an agent nor a manager, and that all of the communications are secured against third-party discovery or injections.
• Application-level security is provided by encryption and digital signatures of all of the workflow libraries on the management server (these libraries are what interpret, for example, how to run the Oracle installer), with the keys embedded in the management server code and the agent. This prevents a malicious party from gaining privileged access to the management server and modifying the instructions the management server sends to the agents.

All of the commands that are run are centrally logged and audited on the management server. For any job that is run, a user with the correct privileges can bring up a log file with the commands, arguments, outputs, and associated log files. For information about this and other security-based administrative tasks that can be managed and configured in BMC Database Automation, see Performing security administration tasks.

Security assessment FAQs

RBAC access control

Role Based Access Controls (RBAC), separate from the database server OS-level permissions, enable users to control access to execute commands in BMC Database Automation against servers where they do not have OS-level access. RBAC provides a mechanism for restricting user access and defining segregation of duties based on the concept of roles, groups, and capabilities, where BMC Database Automation users are members of groups and groups are assigned roles (which contains one or more capabilities). For more information about managing RBAC, see Managing the RBAC access controls.

Roles

Groups

A group consists of one or more users. Each group has roles assigned and is granted access to domains. A user can be a member of more than one group. Groups can be granted different roles in different domains or the same role in different domains. When more than one role is granted to the same group on the same domain, the result is cumulative capabilities.

To create a group, do the following:

1. From the Management Console main page, select Security > Groups within the Context Frame.
2. In the Groups Content page, click Create New Group.
3. In the Group Information page, enter a Name and Description for the group, and click Next.

4. To select an available role, click add corresponding to the role in the Grants page.
   You are prompted with the list of domains for granting access.

5. Select the check boxes for the associated domains or subdomains and click OK. Repeat for each role added.

   Notes

   • Selecting Grid, the root level, grants access to all domains and subdomains.
   • Selecting all subdomains in a domain is not equivalent to selecting the parent domain. Selecting the parent domain grants access on all current subdomains and subdomains added to this domain going forward.
   • Roles and domain grants appear in the Modified Grants section at the bottom of the page.
6. Click Next.
7. In the Users Information page, add members to this group by clicking the add link next to the appropriate users.
   Information about the selected users appear in the Modified Users section at the bottom of the page.
8. Click Next.
   The Summary page displays the configuration details.
9. In the Summary page, click Go to to make changes for that section.
10. Click Create Group.

Users

BMC Database Automation user accounts include the full name, user name, password and the groups in which a user is a member. Users must be members of a group to be granted permissions. The group membership for a user determines their assigned roles and granted domains. A user can be a member of more than one group.

To create a user, do the following:

1. From the Management Console main page, select Security > Users in the Context Frame.
2. Click Create New User.
3. In the User Information page, enter the following information in the Create User form, and click Next.
   • Username

   • First Name

   • Last Name

   • Department (optional)

   • Password

   • Confirm Password

     Note

     When using internal authentication, passwords must meet the requirements specified. See Configuring internal authentication for details.

     
     

   • Available Groups
     In the Available Groups section of the Group page, assign group membership for this user by clicking the add link next to the wanted groups.
     Any groups selected are moved to the Modified Groups section.
     

   • Modified Groups

4. Click Create User.

Security implementation examples

Typical enterprise level implementations of BDA include the setup of Roles and Groups that segregate the activities of engineering and operational DBAs. For example, engineering DBAs might only be allowed to create and test patch packages on non-production servers that are published to operational DBAs. As a result, the operational DBAs would only be able to apply or roll back patch packages to production servers but not modify those packages.

Another common example is for non-DBAs (such as DBA Managers) to be granted access to BMC Database Automation only to view DBA activity, check OS and database versions and physical CPU counts, or to run reports without the ability to initiate any other intrusive database-related activities (such as patching or provisioning).

Using calculated RBAC strategies enables Security Managers to operate under a secure and granular system access system that ultimately provides their security teams to operate according to pre-existing policies. Managers can start a RBAC security model with tight controls and then gradually transition the model to less stringent requirements by gradually loosening the permissions.

For example, they might start a model whereby all Oracle DBAs can see all Oracle servers for activities such as provisioning and patching, but not be able to view any Actions that have already been created. Over time, those Actions might be published to certain groups, users, and databases, according to specifications enforced by security teams and management.

Authentication

BMC Database Automation includes its own credential store internally by default. However, in a large enterprise implementation, it is very common to want to authenticate off of a central authentication mechanism.

BMC Database Automation provides the ability to authenticate off of LDAP or Active Directory, and to configure authentication settings including password expiration time and grace period, password complexity requirements, and password lockout policy. For more information, see Configuring authentication.

Data security

All of the communications between the management server and the agents are encrypted using SSL, with both server and client certificates being presented. This means that a malicious party cannot masquerade as an agent nor a BDA manager, and that all of the communications are secured against third-party discovery or injections. All of the workflow libraries on the management server require digital signatures and are encrypted with the keys embedded in the management server code and the agent. This prevents a malicious party from gaining privileged access to the management server and modifying the instructions the management server sends to the agents.

Additional security considerations

The following sections detail additional measures you can take to ensure the security of your BMC Database Automation implementation.

Scanning for malicious files

Disabling the Autocomplete browser feature

Browsers implement the Autocomplete feature that keeps track of information that has been recently and repetitively submitted, such as web addresses, information in forms (user name and passwords), and search queries. Enabling Autocomplete by default prevents the web browser from specifically caching the login_password fields. To disable the web browser Autocomplete feature, open the /app/clarity/dmanager/etc/d2500_config file on the Manager with a text editor and set prevent_password_auto_complete to true.