next up previous contents index
Next: 5. SQL Terminal Up: Ovrimos version 3.0 On-line Previous: 3. Ovrimos Components

Subsections

   
4. Database Manager

  
4.1 Overview

Database Manager has an HTML-based interface and allows the user dbman to:

Additionally, it allows any database user to connect to the Ovrimos Web site and get for free a Serial number for 5 concurrent connections, valid for two months.

You can perform all the above tasks on Database Manager's home page, clicking the relevant text link or button.

Note: For better results it is recommended that you use the Ovrimos navigation options (back, forth, etc.) instead of your browser's.

Figure 4.1 shows Database Manager home screen after installation. Initially, only testbase exists.


  
Figure 4.1: Database Manager home screen. The DBMan Configuration and Certificate Manager options do not appear in non-secure versions.
\includegraphics[width=12cm]{newdbm01}

       
4.2 Starting and Stopping Database Manager

Starting and Stopping Database Manager differs for Unix and Windows users.

Starting and Stopping Database Manager for Unix users

To start Database Manager:
If you chose to install Ovrimos in the boot sequence during installation, Database Manager starts automatically. Otherwise:

To stop Database Manager:

Starting and Stopping Database Manager for Windows users

Database Manager is installed as a service in Windows NT and it is started automatically every time the system is booted. Users may have to stop and then restart Database Manager if they configure it for SSL. In this case, Database Manager must be restarted for the configuration to take effect. See 4.4 for more details.

To start Database Manager:
Use the Services icon of the Control Panel and start Ovrimos DBMan or open a Command Prompt window and type net start dbman in the command line.

To stop Database Manager:
User the Services icon of the Control Panel and stop OvrimosDBMan or open a Command Prompt window and type net stop dbman in the command line.

    
4.3 Accessing Database Manager

All tasks performed on Database Manager require authentication except of Register and get 5 concurrent connections and Certificate Manager. When you are prompted for a User Name  and Password , type dbman and pass  , correspondingly. The password is case sensitive and the maximum number of password characters is 60.

It is also possible that one more password may be required from you if you have set security control via certificates. See 4.5.(Certificate Manager) for more details on this issue.

To access Database Manager:

   
4.4 Database Manager and SSL

This and the following few sections refer to SSL (Secure Socket Layer). Users concerned with security issues may have to read carefully through this part of the chapter before proceeding to database creation. Others, who are not so interested in security at this point, may skip sections 4.4(Database Manager and SSL) through 4.6(Database Manager Configuration) and proceed to section 4.7.

Database Manager has been enhanced to support SSL-based network security for both Database Manager and the databases it handles.

Security in Ovrimos is guaranteed by asymetric algorithms, used for the issuing and verification of certificates. A Certificate Manager is provided for the issuing of certificates. At the same time Database Manager can be configured to provide security to the databases. You may decide on the degree of security provided when you configure Database Manager. See also 4.6.

   
4.5 Certificate Manager

The Certificate Manager can be accessed through the Web interface of Database Manager. Ovrimos Certificate Manager is a tool that:

Figure 4.2 shows the Certificate Manager home screen. For better understanding of the sequence required for setting up the certificate authority and using certificates, the following subsections will describe the steps (in chronological order) required to make a secure database management system.


  
Figure 4.2: Certificate Manager home screen
\includegraphics[width=12cm]{newdbm02}

The first step that ensures security is to place a request for Certificate Authority. This request may be either self-signed, as we will see later, or it may be submitted to another authority for signing it.

4.5.1 New Ovrimos CA Certificate Request

Ovrimos Certificate Manager allows the placing of a request for Certificate Authority. By obtaining a Certificate Authority you are able to issue certificates for the database server and for the database clients. You can see details about the philosophy of CAs in 13.5.1.

Figure 4.3 shows the Certificate Signing Request form. Requesters will have to fill-in the form fields.


  
Figure 4.3: New Certificate Authority Signing Request
\includegraphics[width=12cm]{newdbm03}

Description of the form:

Common Name: The name of the Certificate Authority that will appear on the certificates, e.g Ovrimos CA.

E-Mail Address: The mail address of the Certificate Authority. It is absolutely necessary to provide a valid mail address for this field.

Organizational Unit: The organization department, e.g. R&D.

Organization Name: The name of the organization.

Locality:, State or Province:, Country: City, State and Country where the dbman resides.

Key Length: The length of the encryption key. It ranges between 512 to 4096 bits. It is recommended to choose a short key for client certificates. After submitting the request, you may see the Request Details, as figure 4.4 shows.


  
Figure 4.4: Certificate Authority Signing Request Details
\includegraphics[width=12cm]{newdbm04}

4.5.2 New Ovrimos Server Certificate Request

If you wish for a server to be able to use SSL for communicating with clients, you have to obtain a server certificate for it. Server certificates are used by the clients for authenticaing the server. Figure 4.5 shows the server request form. Requesters will have to fill-in the form fields.


  
Figure 4.5: New Server Certificate Request Form
\includegraphics[width=12cm]{newdbm05}

Common Name: The name of the host computer where the server resides. It is necessary to provide a correct full path computer address, e.g. station5.develop.company.com. Notice that when connecting to a server, its name must be specified exactly as it appears on the certificate, or else the client will not authenticate the server. For example, connecting to moon.yourdomain.com will succeed, but connecting to moon will cause problems with authenticating the server, even though both host name specifications in reality correspond to the same machine. If a machine has more than one name or address, the same warning applies.

You may use an IP address in a dotted decimal format.

E-Mail Address: The mail address. Normally, this will be the mail address of the person who accesses the Ovrimos database server.

Organizational Unit: The organization department, e.g. R&D.

Organization Name: The name of the organization.

Locality:, State or Province:, Country: City, State and Country where the Ovrimos database server is established.

Key Length: The length of the encryption key. It ranges between 512 to 4096 bits. It is recommended to choose a medium length key for the database server.

After pressing the OK button, the request is submitted to the Certificate Authority. Is is not issued yet. The certificate will be issued later by the Certificate Authority.

4.5.3 New Netscape/Explorer Certificate Request

The next step for providing security is to place a request for the clients' certificates. A client is the physical person who is the Database Manager (dbman). This certificate will be used every time a secure action is required by Database Manager if the configuration requires a certificate.

Ovrimos users may have already obtained personal certificates for use in email, or may do so and have them signed by an ECA. Here, we explain how a user can obtain personal certificates for Netscape Nevigator signed by an LCA.

Figure 4.6 shows the Client Signing Request Form for Netscape. Requesters will have to fill-in the form fields. A similar form will have to be filled by Microsoft Explorer clients.


  
Figure 4.6: New Client Signing Request Form
\includegraphics[width=12cm]{newdbm06}

Common Name: The name of the person who will be the dbman.

E-Mail Address: The mail address of the dbman. It is absolutely necessary to provide a valid mail address for this field.

Organizational Unit: The organization department, e.g. R&D.

Organization Name: The name of the organization.

Locality:, State or Province:, Country: City, State and Country where the Ovrimos database server is established.

Key Length: The length of the encryption key. It ranges between 512 to 4096 bits. It is recommended to choose a medium length key for the database server.

To submit the application request you have to press the OK button. If there are no other certificates issued for the client's browser, i.e. if this is the first time a certificate is requested, then the browser will ask for a password. This password will be used consequently every time the certificate is required.

Please make sure that you remember your password because there is no way to retrieve this password from the browser.

The process of placing requests for a client certificate may be repeated as many times as necessary. The private key that will be used for the encoding is made on the client side.

Note! Client requests have nothing to do with database users. As already mentioned above, a client is a dbman.

4.5.4 Certificate Requests

You may click on the Certificate Requests to see the pending certificate requests. Figure 4.7 is an example of certificate requests after making three different kinds of requests, a CA request, a Server request and a Netscape Client request.


  
Figure 4.7: Certificate Requests
\includegraphics[width=12cm]{newdbm07}

You may Revoke Request or Self-Sign a request. Certificates are valid for a limited number of days. Only CA requests may be self-signed. The rest of the requests will have to be signed by a Certificate Authority. To begin the process of signing certificates, you either have to self-sign your CA or import a CA from another source. Then you may use this CA to sign the rest of the pending applications through Local Certification Authorities.

You may also decide on a different CA or an external CA. In this case, the steps are:

another LCA: An LCA signed by another LCA is also simple to set up.

1.
Follow the Local CAs link.
2.
Choose the LCA that will sign the CSR.
3.
Press the CA Actions button.
4.
Choose the new CSR. The CSRs that await signing are under the heading Unsinged Requests.
5.
Enter the amount of days for which the new certificate will be valid.
6.
Press the Sign button. If all goes well, a certificate for the new LCA is signed by the chosen LCA.

an external CA: Different external CAs have different procedures and requirements for signing certificate requests. The paperwork is likely to be the most time-consuming part of the process. On the technical side, the External CA, should be able to accept a PEM-encoded PKCS request and give back to the applicant a PEM-encoded PKCS certificate.

1.
Follow the Requests link.
2.
Click on the icon next to the new CSR. The details of the CSR will appear.
3.
Follow the View Certificate Request. A page displaying the PEM-encoded CSR will appear.
4.
Using your GUI's Copy & Paste facility or otherwise take the certificate request (including the special start and end lines) and hand it to the external CA according to the instructions they give you. After you have done everything the ECA asks you to, they will prepare the certificate and allow you to somehow obtain it in a PEM-encoded format.
5.
Follow the Import link.
6.
Paste the PEM-encoded certificate (including the special start and end lines) into the big text area.
7.
Press the OK button. If all goes well, you will be able to use your new externally-signed LCA.

4.5.5 Local Certification Authorities

Local Certification Authorities presents you with a list of CAs which exist for Ovrimos. As mentioned before, these may be self-signed or imported authorities. Figure 4.8 is an example of two existing CAs.


  
Figure 4.8: Local Certification Authorities
\includegraphics[width=12cm]{newdbm08}

After choosing one of the Local Certification Authorities, and clicking on CA Actions, you may see the details Certification Authority, as in figure 4.9.


  
Figure 4.9: Certificate Authority and Signer Details
\includegraphics[width=12cm]{newdbm09}

Notice in figure 4.9 that the Certificate Details and the Signer Details are the same, because the certificate is self-signed. The certificate must be installed in your browser before you are allowed to use it. To install the certificate, click on Install Certificate in your Browser.

Figure 4.10 shows the Certificates Issued by the previously chosen Certificate Authority and as well as the Unsigned Certificate Requests.


  
Figure 4.10: Unsigned Certificate Requests
\includegraphics[width=12cm]{newdbm10}

For every certificate request you wish to have signed, you may choose it by its radio button and click on the Sign button. You may also determine the number of days the certificate will remain valid. By default, certificates are valid for one year (365 days). As soon as a certificate is signed, Certificate Manager shows the new cituation, as in figure 4.11.


  
Figure 4.11: Signed and Unsigned Certificate Requests
\includegraphics[width=12cm]{newdbm11}

The signing of certificates may continue until all the pending requests are cleared and signed.

Notice the icons on the left of the Certificate header. They are different for the Server and the Client (browser) certificates. By clicking on the icon you may see the certificate details. Figure 4.12 is an example of a client certificate signed by the Ovrimos CA.


  
Figure 4.12: Client Certificate Details
\includegraphics[width=12cm]{newdbm12}

Notice that since this is not a self-signed certificate, the Certificate Details are different from the Signer Details.

Cient certificates have to be installed to the browser before being used. To install a client certificate ypu have to be in the Viewing Details screen and to press the Install Certificate in your Browser.

To see what certificates you have installed, you will have to choose the Security selection from your browser.

Figure 4.13 is an example of client certificates, installed in Netscape.


  
Figure 4.13: Viewing Certificates from Security
\includegraphics[width=12cm]{newdbm13}

You may also use the selection Get a Certificate to obtain a Netscape certificate or Import a Certificate to import a certificate issued by another user. Certificates may also be exported. In this case, another user can import a certificate.

  
4.5.6 Importing a Certificate

As already mentioned, certificates do not have to be issued by the Local authorities. They may be signed by another Authority. If you choose to import a certificate, you must use the Import selection of Certificate Manager. The dbman username and a password will be required.

   
4.6 Database Manager Configuration

Up to this point, the certificates have been requested, signed and installed, but no actions of securing Database Manager or the subsequently created databases have been made. Only by configuring Database Manager one sets the security level and determines the kind of authorization that will be required for using Database Manager. So, after creating all necessary certificates, you will have to proceed to Database Manager configuration. The dbman username and password will be required. Database Manager user name is dbman, while the original password is pass.

Figure 4.12 shows Database Manager configuration form. Notice that the HTTP Port is now 9000, because authorization has been required.


  
Figure 4.14: Database Manager Configuration
\includegraphics[width=12cm]{newdbm14}

Many of the configuration parameters shown in figure 4.14 are described also in A.2.1(Global Parameters).

Section Main Parameters shows the HTTP Port, which is by default 9000, since authorization has been required, the CA E-mail and Mail Server and the product version.

The following section, which is the SSL Security Level allows you to set the security level to any of the following:

None. No SSL is used.

Export. This is the security level supported by browsers outside the US.

Low, Medium, High. Increasingly higher levels of security

Section DBMan SSL Credentials. If more than one server certificate is issued, you may choose which server will be considered secure by the clients.

Section Authentication allows you to choose the kind of certification required for further access of Database Manager. There are four possible choices: Username-Password, Client Certificate and Client Certificate AND Username-Password.

The default choice is Username-Password. If a Client Certificate is required, then instead/besides the dbman username and password, the password of the Client Certificate will be required.

Finally, in section Trusted CAs you may choose one or more of the Certificate Authorities, whose certificates you accept.

After configuring Database Manager you will have to shut it down and restart it in order for the updates to be incorporated into the running process. See 4.2.(Starting and Stopping Database Manager) for details about how to stop and restart Database Manager in your operating system.

       
4.7 Starting up and Shutting down a Database

To start up a database, click the respective Status button. When a database is up and running, its name is changed to an HTML link one can click to connect to it. After having connected to it, a Web page appears which provides users with navigation options, such as links to Roadmap, SQL Terminal and Administrator Console. Figure 4.15 shows the Introductory Database Screen.

Authentication is required for starting up and shutting down the database. In both cases, the User Name is dbman with initial Password pass. If Database Manager requires a client certificate, you will have to provide the certificate password.


  
Figure 4.15: Introductory Database Screen
\includegraphics[width=12cm]{dbm2}

To shut down a database, click the Status button. Unix users can also shut it down by running $TEMPDIR/.sqldown.

   
4.8 Database Creation

When you create a database, a number of directories and files are also created. These are listed and explained below. (Refer to section A.2.2 to view the parameters associated with them.) It should be noted that the system tables are not generated until the database is started for the first time.

    
4.8.1 How to create a database

Figure 4.16 shows the initial screen for database creation.


  
Figure: Initial Database Creation Screen. The Replicator Directory field does not appear in non-replicator versions.
\includegraphics[width=12cm]{newdbm15}

1.
Enter a unique database name.

2.
Fill in the Database Directory    field, a unique, valid path. When you leave this field, all the remaining fields related to the database directories and files (formerly listed) will be filled in automatically.

3.
Set the encryption options. Data can be stored in encrypted form so that anyone with no official rights who tries to access it will see just an unintelligible jumble of bits (refer to User-provided ciphers E.1).

4.
Click OK to create the database.
5.
Proceed to the database configuration to modify the database parameters, if necessary (refer to section 4.9).

    
4.9 Database Configuration

Database Configuration may appear to be intimidating to a first-time user. However, you need not worry about setting these parameters. Most are set automatically by Database Manager and, unless there is a conflict on your system, you need not modify them.

Database configuration parameters fall into the following categories:

NOTE: Parameters that have already appeared in Database creation, are not explained here (see section 4.8).
Reference: Global and database specific parameters are described in section A.2.

  
4.9.1 SQL Server Parameters

Figure 4.17 shows the SQL Server Parameters.


  
Figure 4.17: SQL Server Parameters. The Replicator Port and Replicator Directory fields do not appear in non-replicator versions.
\includegraphics[width=12cm]{newdbm16}

  
4.9.2 HTTP Server Parameters

Figure 4.18 shows the HTTP Server Parameters.


  
Figure 4.18: HTTP Server Parameters
\includegraphics[width=12cm]{newdbm17}

  
4.9.3 Password Parameters

Figure 4.19 shows the Password Parameters for database users.

Refer to section 13.4.2 to view relevant information about Password Policy.


  
Figure 4.19: User Password Parameters
\includegraphics[width=12cm]{newdbm18}

  
4.9.4 Fine Tuning Parameters

These parameters may be editted according to the user's special needs. The dbman will determine after some trials which values suit each database, depending on its needs.

   
4.9.5 Miscellaneous Parameters


  
Figure 4.20: Miscellaneous Parameters
\includegraphics[width=12cm]{newdbm20}

  
4.9.6 SSL Parameters

SSL parameters are set for secure databases.


  
Figure 4.21: Secule Socket Layer
\includegraphics[width=12cm]{newdbm21}

All these parameters are also discussed in A.2.2.(Database Parameters)

    
4.10 Database Deletion

Database deletion is possible only when the database is shut down. To delete any directory or file, click the checkbox of a specified option and then click OK to confirm deletion.

Figure 4.22 shows the database deletion screen.


  
Figure 4.22: Database Deletion
\includegraphics[width=12cm]{dbm8}

Important: If you click the checkbox of the option Delete Database Directory, all the directories and files located under it will also be removed. Thus, to avoid accidental deletion of data, you should check the contents of the Database Directory before confirming its deletion.

   
4.11 Changing the dbman password

As explained in section 4.3, all tasks performed on Database Manager require authentication as user dbman. To modify the password for this user, click the respective text link on Database Manager's home page.

Figure 4.23 shows the Change Password screen. For security reasons, the password characters are not echoed back.

In case a problem arises as a result of some change you have made to the dbman password, follow these steps:


  
Figure 4.23: Change Password Screen
\includegraphics[width=10cm]{dbm9}

   
4.12 Editing the serial number and license

A serial number identifies you as a registered Ovrimos user.
A separate license number determines the number of concurrent connections you have purchased.

Serial number and license are edited in the form accessed by clicking the respective text link on Database Manager's home page. Make sure that all existing databases are shut down before editing these numbers. Depending on how you use Ovrimos (trial or licensed use), read carefully the relevant instructions, to determine which number you should edit.

Figure 4.24 shows the Edit dialog box.


  
Figure 4.24: Editing Serial Number and License
\includegraphics[width=10cm]{dbm10}

Trial use of Ovrimos

1.
Registered users: they either get a free license for 5 concurrent connections for two months or a free license for 1 connection for an unlimited period of time.
(a)
If you have downloaded Ovrimos from http://www.ovrimos.com, you should register at http://www.ovrimos.com/regprod.html
Alternatively, you can register when you access the home page of Database Manager.
By doing so, a unique serial number is sent to you via email. To get the 5 concurrent connections, edit only the serial number in the respective form.
(b)
If you have the product on a CD, you are also provided with a list of available serial numbers and licenses for all the supported platforms. To get the 5 concurrent connections for two months, edit the serial number, corresponding to your system's platform.

To get the 1 connection for an unlimited period of time, edit both the serial number and the license.

2.
Unregistered users: they get a free license for 1 connection for two months.

Licensed use of Ovrimos

   
4.13 Database Manager Error Log

Like most Database Manager actions this one is also performed in a secure mode, thus you will notice that port is set to 9000 as soon as the selection Database Manager Error Log is requested. Events such as Starting Database Manager and possible errors are registed in the error log.

next up previous contents index
Next: 5. SQL Terminal Up: Ovrimos version 3.0 On-line Previous: 3. Ovrimos Components