Isolate database

[djoq]

Hey guys. I am developing a work on database insulation, I do not know if this is the correct name. What I did was the following, I created an application, I created your database with the tables, but I did not connect the application in this database that has the tables. I created an intermediate base that has only procedures and functions, this intermediate base connects in the application and makes the insert, update, delete at the base where the tables are. So if an attacker can access my database via application, it will not have access to the base where the records are stored. Now my question, where do I find material that talks about this concept of database isolation? Is this the correct name, data base isolation? Thank you for help! =)

[fbifabio]

@djoq,

I do not know if I understood very well. Are you creating 2 bds? Why did you decide to do this? I see no need for such thing, which in my view would only make the application slower. BD has many security features that can prevent access to records. A simple mode of implementing this in the same BD, is to create 2 users, 1 tables owner and the other for which the application connects. In the Schema of this second user you create stored procedures to update / access data from the other schema, okay?

[djoq]

Hello Fabio, I expressed myself badly, is this same two schemas, in one of them stored procedures and the other tables. Is there any material that speaks about this?

Thanks!

[adrianoturbo]

Brother, would not be encapsulation or concealment of codes in PL / SQL? Type procedures, packages and packages Bodies, if this is a Utility in Oracle named Wrapp that encrypts codes in PL / SQL.
If you want to delve into the wrapping, follow the Oracle link that clarifies very well all this: [urlhttp://docs.oracle.com/cd/B28359_01/appdev.111/b28370/wrap.htm

[adrianoturbo]

Hehe is not brother is sister, a thousand excuses djoq http://docs.oracle.com/cd/B28359_01/app ... 0/wrap.htm

[djoq]

Huehe.Adrianoturbo was worth the tip, I'll see this link that you passed.
Thanks !!

[stcoutinho]

Hello Djoq,

I think you can proceed exactly how Fábio suggested.

For this you could create the following objects (example):
a) Name user "Djoq", which would be the owner of the schema of your system . In it you will create all database objects, including your procedures.
b) "Djoqueser" user, which would be the user for your application will point. This user will only be allowed to perform their procedures / packages that will do all DML (Select-Insert-Delete-Update) operations
c) a "djoq_all" name role, which will be assigned to the user "Djoquser ". For this role, you will give the Performance permission of each procedure / package that were created in the "Djoq" schema.

Exemplifying (you need to search the commands more in the background):

1) Create the user: Search more about CREATE USER command;

Select all

CREATE USER DJOQ IDENTIFIED BY DJOQ ...;

2) Create the user:

Select all

CREATE USER DJOQUSER IDENTIFIED BY DJOQUSER ..;

3) Create the role:

Select all

CREATE ROLE DJOQ_ALL;

4) Assign role For the user:

Select all

GRANT DJOQ_ALL TO DJOQUSER;

5) Create a TB_usuario table in the Schema Djoq:

Select all

CREATE TABLE TB_USUARIO ..;

6) Create a PKG_USARIO package in Schema Djoq, which will do all operations of Select-insert-delete-update in the tb_usuario table:

Select all

CREATE OR REPLACE PACKAGE PKG_USUARIO ... END PGK_USUARIO; CREATE OR REPLACE PACKAGE BODY PKG_USUARIO ... END PGK_USUARIO;

7) Assign Package permission to the role:

Select all

GRANT ALL ON PKG_USUARIO TO DJOQ_ALL;

Create private synonym for the Application:

Select all

CREATE OR REPLACE SYNONYM DJOQUSER.PKG_USUARIO FOR DJOQ.PKG_USUARIO;

These steps will allow you to isolate the application, just as the forists have explained.

In my case, I even create a third user, for audit / support purposes (eg Djoqaudit). This user can only make Select (or run only the SELECT procedure) of the system tables, being suitable for application support teams.

Hugs,

Sergio Coutinho

[djoq]

Sergio thanks for the excellent tutorial , it was very easy to understand.
Great help!
Embrace