tailieunhanh - Applied Oracle Security: Developing Secure Database and Middleware Environments- P49

Applied Oracle Security: Developing Secure Database and Middleware Environments- P49:Computer security is a field of study that continues to undergo significant changes at an extremely fast pace. As a result of research combined with increases in computing capacity, computer security has reached what many consider to be “early adulthood.” From advances in encryption and encryption devices to identity management and enterprise auditing, the computer security field is as vast and complex as it is sophisticated and powerful | 454 Part IV Applied Security for Oracle APEX and Oracle Business Intelligence As you can see the SSL port at the time of install was 4458. I changed this port in to 443 but this change will not show up in . Additionally if you want to list the ports that OHS is listening on from a bash shell the following command will show all ports in use by the HTTPD process sudo netstat -tnlp grep httpd tcp tcp tcp 0 0 7202 0 0 7780 0 0 443 LISTEN LISTEN LISTEN 5830 httpd 5830 httpd 5830 httpd This does not tell you what type of traffic the ports are listening for but it is useful for a quick reminder of the ports in use without your having to dig too deep into the file system to find ssl. con. Keep in mind that HTTPD is the process name for Apache-based HTTP servers so if you re running more than one HTTP server that uses Apache you will see all the ports from all of the Apache instances. Now that you know what port to test let s test an HTTPS connection from a web browser by entering https in a web browser to display the OHS home page substituting your actual values for machine-name and port which is 443 in this case . If we were using the default wallet the browser should display a warning that this certificate is not valid. The certificate actually fails all three criteria in that it is expired the domain name listed does not match our domain and it is not signed by a trusted Certificate Authority. For testing purposes however this is fine. SSL and APEX Now that we have verified that SSL is working correctly let s configure an APEX application using two different scenarios regarding SSL. The goal of the first scenario is to switch to HTTPS for the login page of an application and then switch back to HTTP for subsequent requests. We want to encrypt the usernames and passwords sent over the network from the login page but the company policy allows internal traffic to be unencrypted so the application will switch back to