0

My environment is as below -

Server: Oracle 12C 12.1.0.2.v17 ( AWS RDS Service)

Client: Windows 2012 machine with Oracle 19C 64 bit full client

Tools : SQL Developer and Toad on the client machine

I have configured native network encryption for the RDS service by following these instructions.

I set following options on the RDS -

SQLNET.ENCRYPTION_SERVER= Accepted
SQLNET.ENCRYPTION_TYPES_SERVER= AES256

The client Oracle 19c 64 bit home is C:\oracle\product\19.0.0\client_1\network\admin\sqlnet.ora

Both client tools using the TNS name in the above path; I verified this by using tnsping

The sqlnet.ora in client has following options -

SQLNET.ENCRYPTION_CLIENT=REQUIRED
SQLNET.ENCRYPTION_TYPES_CLIENT=(AES256)

After the above configurations, I restarted my windows machine (just to make sure) and am able to establish connection to the RDS with Toad and SQL Developer tool.

MY question: How do I verify if my connection is encrypted ?

I tried executing below query -

select NETWORK_SERVICE_BANNER
from v$session_connect_info
where SID = sys_context('USERENV','SID');

The output I am seeing is

TCP/IP NT Protocol Adapter for Linux: Version 12.1.0.2.0 - Production

Encryption service for Linux: Version 12.1.0.2.0 - Production

Crypto-checksumming service for Linux: Version 12.1.0.2.0 - Production

SHA1 Crypto-checksumming service adapter for Linux: Version 12.1.0.2.0 - Production

I do not see "AES256 Encryption" in the NETWORK_SERVICE_BANNER output.

Related question: I need all the client connections from this machine to my server use encryption. Is there a way I can enforce this by using logon trigger ?

3
  • By default Sql Developer uses thin client and you can solve your problem without changing server side by setting Sql Developer to use thick client but I'm not sure about Toad
    – user168186
    Dec 13, 2019 at 11:32
  • I did this simple test -On the database server set the encryption to required and on client set the encryption to rejected. I made sure Toad, SQL Developer are using the thick client . With these options set, I could not connect to the server from Toad, SQL Developer or SQL Plus. This shows the encryption options are working. I Just need to confirm from the server that the client connections are using encryption. I do not want to set encryption to required on the server permanently as there are other client connections that do not need to be encrypted.
    – RKA
    Dec 13, 2019 at 15:24
  • @Kumar, Starting with SQL Developer release 19.1, for any Oracle connection type, there is an Advanced tab that you can use to set custom JDBC properties or specify OCI/THICK for a connection by selecting the Use OCI checkbox in the Advanced tab.
    – RKA
    Dec 13, 2019 at 15:27

1 Answer 1

0

You're confused with my comments,with accepted on server side and required client side sqlplus connection is encrypted and Sql Developer with thin client is unencrypted but the same Sql Developer with thick client connection is encrypted.(Toad is out of scope I never used at all).In other words accepted on server side is working as expected.

Let me demonstrate for you

 sqlnet.ora on server 

    $ cat $TNS_ADMIN/sqlnet.ora
    # sqlnet.ora Network Configuration File: /u01/app/oracle/product/19/network/admin/sqlnet.ora
    # Generated by Oracle configuration tools.
    
    NAMES.DIRECTORY_PATH= (TNSNAMES, ONAMES, HOSTNAME)
    
    SQLNET.ENCRYPTION_SERVER = accepted
    
    SQLNET.ENCRYPTION_TYPES_SERVER= (AES256)
    
    SQLNET.CRYPTO_CHECKSUM_SERVER = required
    
    [CDB2] oracle@hol:~
    
   Client side Window 10 Pro

sqlnet.ora

# sqlnet.ora Network Configuration File: C:\app\oracle\product\19.3.0\db_1\network\admin\sqlnet.ora
# Generated by Oracle configuration tools.

# This file is actually generated by netca. But if customers choose to 
# install "Software Only", this file wont exist and without the native 
# authentication, they will not be able to connect to the database on NT.

SQLNET.AUTHENTICATION_SERVICES= (NTS)

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

#SQLNET.ENCRYPTION_CLIENT=REQUIRED   -- commented out
#SQLNET.ENCRYPTION_TYPES_CLIENT=(AES256) -- commented out



    SQL> @network_encryption

NETWORK_SERVICE_BANNER
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
TCP/IP NT Protocol Adapter for Linux: Version 19.0.0.0.0 - Production
SHA1 Crypto-checksumming service adapter for Linux: Version 19.0.0.0.0 - Production
Crypto-checksumming service for Linux: Version 19.0.0.0.0 - Production
Encryption service for Linux: Version 19.0.0.0.0 - Production

Now I'll uncomment last two lines in sqlnet.ora client side

# sqlnet.ora Network Configuration File: C:\app\oracle\product\19.3.0\db_1\network\admin\sqlnet.ora
# Generated by Oracle configuration tools.

# This file is actually generated by netca. But if customers choose to 
# install "Software Only", this file wont exist and without the native 
# authentication, they will not be able to connect to the database on NT.

SQLNET.AUTHENTICATION_SERVICES= (NTS)

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

SQLNET.ENCRYPTION_CLIENT=REQUIRED

SQLNET.ENCRYPTION_TYPES_CLIENT=(AES256)




ADR_BASE = C:\app\oracle\product\19.3.0\db_1\log


SQL> @network_encryption

NETWORK_SERVICE_BANNER
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
TCP/IP NT Protocol Adapter for Linux: Version 19.0.0.0.0 - Production
AES256 Encryption service adapter for Linux: Version 19.0.0.0.0 - Production
SHA1 Crypto-checksumming service adapter for Linux: Version 19.0.0.0.0 - Production
Crypto-checksumming service for Linux: Version 19.0.0.0.0 - Production
Encryption service for Linux: Version 19.0.0.0.0 - Production.

Now let's test with Sql Developer thin client

enter image description here

It's evident from above image it uses jdbc thin driver.Let's check the sql out put in Sql Developer and as expected there is no AES256 encryption

enter image description here

Now I will switch to thick client,check both images enter image description here

enter image description here

Hope this clears up

1
  • NO I was not confused with your earlier comments. When I initial;y tested with the server to accepted and the client to Required, the NETWORK_SERVICE_BANNER was not showing the message 'AES256 Encryption service adapter...'. M<y client probably was not using the updated sqlnet.ora settings. Now I do see the message and I am good. Your detailed comment made it clear as well, I will accept it as answer.
    – RKA
    Dec 16, 2019 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.