MIME-Version: 1.0
In-Reply-To: <CAGazuyUbaq69z-Q1vFiPJg2qfynkLjbBUoSfUOQ+oof=zpUWVA@mail.gmail.com>
References: <CAGazuyUbaq69z-Q1vFiPJg2qfynkLjbBUoSfUOQ+oof=zpUWVA@mail.gmail.com>
From: Andy Wattenhofer <watt0012@umn.edu>
Date: Fri, 27 May 2016 08:27:08 -0500
Message-ID: <CAFU3ey7JjKPmW908H2DGER+fV9ECpEbiTPuYdSrrSNAQOkLsdw@mail.gmail.com>
Subject: Re: Safe access to just 1 or 2 databases on RAC cluster via VPN?
To: dmann99@gmail.com
Cc: "oracle-l@freelists.org" <oracle-l@freelists.org>
Content-Type: multipart/alternative; boundary=001a11444130d71f850533d2def3
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-To: watt0012@umn.edu
--001a11444130d71f850533d2def3
Content-Type: text/plain; charset=UTF-8

Have you looked at Oracle Connection Manager?

Andy

On Fri, May 27, 2016 at 7:30 AM, David Mann <dmann99@gmail.com> wrote:

>
> I have a customer that is requesting to add IP addresses of all nodes in a
> cluster to their VPN so they can access a subset of databases on the
> cluster.
>
> If they were the only organization that had databases on that cluster I
> wouldn't have an issue - but there are other databases on there that have
> nothing to do with their workflow.
>
> In the past I would usually work to get them on their own isolated machine
> or cluster so the VPN endpoints could be added to their b2b VPN and they
> would only have access to systems which only housed their data. I don't
> have that option in this case.
>
> I was thinking about setting up a listener for them on another port which
> was only configured for their subset of databases... And block access to
> the general scan listener already set up on the cluster. Would this afford
> any protection to attempts to connect to other databases on the cluster? Or
> better to approach this from a firewall configuration standpoint?
>
> --
> Dave Mann
> General Geekery | www.brainio.us
> Database Geekery | www.ba6.us | @ba6dotus | http://www.ba6.us/rss.xml
>


-- 
Andy

--001a11444130d71f850533d2def3
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Have you looked at Oracle Connection Manager?<div><br></di=
v><div>Andy</div></div><div class=3D"gmail_extra"><br><div class=3D"gmail_q=
uote">On Fri, May 27, 2016 at 7:30 AM, David Mann <span dir=3D"ltr">&lt;<a =
href=3D"mailto:dmann99@gmail.com" target=3D"_blank">dmann99@gmail.com</a>&g=
t;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0=
 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div><b=
r></div><div>I have a customer that is requesting to add IP addresses of al=
l nodes in a cluster to their VPN so they can access a subset of databases =
on the cluster.=C2=A0</div><div><br></div><div>If they were the only organi=
zation that had databases on that cluster I wouldn&#39;t have an issue - bu=
t there are other databases on there that have nothing to do with their wor=
kflow.=C2=A0</div><div><br></div><div>In the past I would usually work to g=
et them on their own isolated machine or cluster so the VPN endpoints could=
 be added to their b2b VPN and they would only have access to systems which=
 only housed their data. I don&#39;t have that option in this case.=C2=A0</=
div><div><br></div><div>I was thinking about setting up a listener for them=
 on another port which was only configured for their subset of databases...=
 And block access to the general scan listener already set up on the cluste=
r. Would this afford any protection to attempts to connect to other databas=
es on the cluster? Or better to approach this from a firewall configuration=
 standpoint?=C2=A0</div><span class=3D"HOEnZb"><font color=3D"#888888"><div=
><br></div>-- <br><div data-smartmail=3D"gmail_signature"><div>Dave Mann</d=
iv><div>General Geekery | <a href=3D"http://www.brainio.us" target=3D"_blan=
k">www.brainio.us</a></div><div>Database Geekery | <a href=3D"http://www.ba=
6.us" target=3D"_blank">www.ba6.us</a> | @ba6dotus | <a href=3D"http://www.=
ba6.us/rss.xml" target=3D"_blank">http://www.ba6.us/rss.xml</a></div></div>
</font></span></div>
</blockquote></div><br><br clear=3D"all"><div><br></div>-- <br><div class=
=3D"gmail_signature"><div dir=3D"ltr"><div>Andy</div></div></div>
</div>

--001a11444130d71f850533d2def3--
--
http://www.freelists.org/webpage/oracle-l