Configuring the Oracle Database Protector

The Oracle Database Protector provides the following files that contain different parameters to control the protector behavior:

• config.ini - provides parameters to control the protector behavior.
• rpagent.cfg - provides parameters to control the RPAgent behavior.

Updating the parameters in the config.ini file:

1. Log in to the node.

2. Navigate to the /opt/protegrity/databaseprotector/oracle/data directory.

3. To open the config.ini file, run the following command:

   vi config.ini
   

4. Press ENTER.

   The command opens the config.ini file.

   ###############################################################################
   # Protector configuration
   ###############################################################################
   [protector]
   
   # Cadence determines how often the protector connects with ESA / proxy to fetch the policy updates in background.
   # Default is 60 seconds. So by default, every 60 seconds protector tries to fetch the policy updates.
   # If the cadence is set to "0", then the protector will get the policy only once.
   #
   # Default 60.
   cadence = 60
   
   
   ###############################################################################
   # Log Provider Config
   ###############################################################################
   [log]
   
   # In case that connection to fluent-bit is lost, set how audits/logs are handled
   #
   # drop  : (default) Protector throws logs away if connection to the fluentbit is lost
   # error : Protector returns error without protecting/unprotecting
   #         data if connection to the fluentbit is lost
   mode = drop
   
   # Host/IP to fluent-bit where audits/logs will be forwarded from the protector
   #
   # Default localhost
   host = localhost
   

5. Update the parameters, as per the description in the table.

   Parameter	Description
   cadence	Specifies the frequency at which the protector retrieves the policy. The default value is 60 seconds. If the cadence is set to “0”, then the protector will get the policy only once.
   mode	Specifies the approach of handling logs when the connection to the Log Forwarder is lost.

6. Save the changes to the config.ini file.

Updating the parameters in the rpagent.cfg file:

1. Log in to the required node.

2. Navigate to the /opt/protegrity/rpagent/data directory.

3. To open the rpagent.cfg file, run the following command:

   vi rpagent.cfg
   

4. Press ENTER.

   The command opens the rpagent.cfg file.

   ###############################################################################
   # Resilient Package Sync Config
   ###############################################################################
   [sync]
   
   # Protocol to use when communicating with the service providing Resilient Packages.
   # Use 'https' for ESA or 'shmem' for local shared memory.
   protocol = https
   
   # Host/IP to the service providing Resilient Packages
   host = <IP_address>
   port = 8443
   
   # Path to CA certificate
   ca = /opt/protegrity/rpagent/data/CA.pem
   
   # Path to client certificate
   cert = /opt/protegrity/rpagent/data/cert.pem
   
   # Path to client certificate key
   key = /opt/protegrity/rpagent/data/cert.key
   
   # Path to a secret file that is used to decrypt the client certificate key.
   # When using a custom certificate bundle, the 'secretcommand' can instead be
   # used to execute an external command that obtains the secret.
   secretfile = /opt/protegrity/rpagent/data/secret.txt
   
   ###############################################################################
   # Log Provider Config
   ###############################################################################
   [log]
   
   # In case that connection to fluent-bit is lost, set how audits/logs are handled
   #
   # drop  : (default) Protector throws logs away if connection to the fluentbit is lost
   # error : Protector returns error without protecting/unprotecting
   #         data if connection to the fluentbit is lost
   mode = drop
   
   # Host/IP to fluent-bit where audits/logs will be forwarded from the protector
   #
   # Default localhost
   host = localhost
   

5. Update the parameters, as per the description in the table.

   Parameter	Description
   interval	Specifies the frequency at which the RPAgent retrieves the policy. The minimum value is 1 second and the maximum value is 86400 seconds. This is an optional parameter and must be included in the Sync section of the rpagent.cfg file.
   protocol	Specifies the protocol to use when communicating with the service providing Resilient Packages.
   host	Specifies the hostname to the service providing the Resilient packages.
   port	Specifies the port to the service providing the Resilient packages.
   ca	Specifies the path to the CA certificate.
   cert	Specifies the path to the client certificate.
   key	Specifies the path to the client certificate key.
   secretfile	Specifies the path to the secret file that is used to decrypt the client certificate key.
   mode	Specifies the approach of handling logs when the connection to the Log Forwarder is lost.
   host	Specifies the hostname or the IP address to where the Log Forwarder will forward the audit logs from the protector.

6. Save the changes to the rpagent.cfg file.