5

How to check the Oracle database connection encryption type?(between Oracle database and other client applications)How do I assure between Oracle database and Toad the database connection is encrypted? (My Toad version is 9.5 and Oracle database version is 11g)

7

Don't confuse Oracle Advanced Security with encrypted SSL client connections to the database. The Advanced Security option is comprised of two main features, Data Radaction and Transparent Data Encryption. TDE is the encryption of data within tables, so that if someone captures the datafiles they won't be able to read table data in the clear inside the file.

An encrypted SSL connection between a client and the database is just part of the Oracle Net Services and is included with every version. The Oracle documentation explains how to set that up.

To answer your question, run this query:

SELECT sys_context('USERENV', 'NETWORK_PROTOCOL') as network_protocol FROM dual;

If you are connected via SSL you will get the response

NETWORK_PROTOCOL
----------------
tcps

If you get "tcp," then you are on a non-SSL connection.

  • 1
    It's really confusing because Native Encryption and SSL USED to be part of ASO. A few years ago Oracle changed it to make it available on all licenses. However, they (still!) haven't updated all their documentation, so it's still referenced as being part of ASO in many places. – Elezar Apr 21 '16 at 23:55
  • 1
    Update for SQL*Net Native Encryption: The above statement shows "tcp" for native encryption even if the communication itself ist encrypted. – jmk Aug 10 '18 at 7:14
5

Unless you've done 'something' to encrypt the connection it is in the clear.

And if you want to encrypt this communication using an Oracle solution, you must be using the Enterprise Edition and you must purchase the Advanced Security addon.

If you the free way of doing this, use Stunnel https://www.stunnel.org/index.html

Amazingly enough, Stunnel and Advanced Security have many similarities. I've installed both, and like Stunnel.

Stunnel is great, especially when you want to make https connections from a stored procedure. Oracle requires all sorts of hoops like installing the client's certificate in the Wallet (which I think is now gone--finally--yet replaced with some other cumbersome idea. Where as, Stunnel just needs 3 lines of code in a setup file.

Anyway, unless you have a requirement to use Advanced Security Option, look into Stunnel.

And to see if you're running ASO, look in your sqlnet.ora file for strange entries this:

SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (MD5) 
SQLNET.ENCRYPTION_TYPES_CLIENT = (RC4_256) 
SQLNET.ENCRYPTION_CLIENT = required 
SQLNET.CRYPTO_CHECKSUM_CLIENT = required 

Look in both the client and the server's sqlnet.ora file.

  • @sam_mit, as it looks like you are new to StackOverFlow, when someone answers a question and you like it, you want to click the "check mark" beside the answer. – Brian McGinity Jan 20 '14 at 3:44
  • Also, you're welcome. You and (others) can save yourself $20k knowing this... – Brian McGinity Jan 20 '14 at 3:45
-1

Encryption configurations are in the server sqlnet.ora file and those can't be queried directly. However this link from Oracle shows a clever way to tell anyway:

Synopsis from the above link:

Verifying the use of Native Encryption and Integrity

You can verify the use of native Oracle Net Services encryption and integrity by connecting to your Oracle database and examining the network service banner entries associated with each connection. This information is contained in the NETWORK_SERVICE_BANNER column of the V$SESSION_CONNECT_INFO view. The following example shows the SQL command used to display the network service banner entries associated with current connection:

SQL> select network_service_banner 
     from v$session_connect_info 
     where sid in (select distinct sid from v$mystat);

The following example output shows banner information for the available encryption service and the crypto-checksumming (integrity) service, including the algorithms in use:

NETWORK_SERVICE_BANNER
-------------------------------------------------------------------------------------
TCP/IP NT Protocol Adapter for Linux: Version 12.1.0.2.0 - Production
Encryption service for Linux: Version 12.1.0.2.0 - Production
AES256 Encryption service adapter for Linux: Version 12.1.0.2.0 - Production
Crypto-checksumming service for Linux: Version 12.1.0.2.0 - Production
SHA1 Crypto-checksumming service adapter for Linux: Version 12.1.0.2.0 - Production

If native Oracle Net Services encryption and integrity was not in use, the banner entries would still include entries for the available security services; that is, the services linked into the Oracle Database software. However, there would be no entries indicating the specific algorithms in use for the connection. The following output shows an example:

NETWORK_SERVICE_BANNER
-------------------------------------------------------------------------------------
TCP/IP NT Protocol Adapter for Linux: Version 12.1.0.2.0 - Production
Encryption service for Linux: Version 12.1.0.2.0 - Production
Crypto-checksumming service for Linux: Version 12.1.0.2.0 - Production

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.