Unix Technical Forum

ASM and O/S Security

This is a discussion on ASM and O/S Security within the Oracle Database forums, part of the Database Server Software category; --> I was reading about how ASM uses raw partitions, instead of an O/S file system, and had a few ...


Go Back   Unix Technical Forum > Database Server Software > Oracle Database

Register FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 02-24-2008, 12:22 PM
GeoPappas
 
Posts: n/a
Default ASM and O/S Security

I was reading about how ASM uses raw partitions, instead of an O/S file
system, and had a few questions:

- Does this mean that the O/S is not used for ASM at all?

- How is security handled? Normally, O/S patches come out every so
often to handle security holes. How is this handled with Oracle raw
devices? Does this make ASM less secure than typical O/S file systems?

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #2 (permalink)  
Old 02-24-2008, 12:22 PM
HansF
 
Posts: n/a
Default Re: ASM and O/S Security

On Mon, 04 Apr 2005 06:00:30 -0700, GeoPappas interested us by writing:

> I was reading about how ASM uses raw partitions, instead of an O/S file
> system, and had a few questions:
>
> - Does this mean that the O/S is not used for ASM at all?


IMO, you are mixing metaphors.

I like to think of ASM replacing the file system layer for an existing
operating system. As examples: for a Windows machine you would have NTFS,
Fat32 and ASM; for Linux, ext3, ReiserFS and ASM.

However, ASM is geared toward managing Oracle-related data, as compared
to traditional files, and it is not meant to be used in place of a
traditional file system for non-Oracle files.

To do this, is is best to give the ASM instance free run of the disk,
bypassing the operating system's control of the disk (ie. raw disk).
Although, for demonstration and study purposes, in a *nix environment it
is possible to set dd an empty file on existng file systems that can be
used for ASM storage.

If this makes you uneasy, remember that Oracle has been managing raw disks
since the early 80s - it's much easier to get performance when there are
fewer layers. Probably the only reason [that I can see] for us ending up
using cooked file systems is that undertrained DBAs and SAs alike didn't
know how to back up and restore raw filesystems.

>
> - How is security handled? Normally, O/S patches come out every so
> often to handle security holes. How is this handled with Oracle raw
> devices? Does this make ASM less secure than typical O/S file systems?


The OS gets it's patches from the OS vendor. ASM gets it's patches from
Oracle. Both sets of patches are needed. In *nix, you could get file
system patches independent of kernel patches - also happens in Windows,
but is just not as obvious.

I don';t really see how 'security' enters into the picture, though. Unless
you are silly enough to use files instead of raw disks, there is a strict
separation of disks. For raw disks, the OS is generally not fully aware
of the disk and will not even attempt to read or write unless coerced.

My conclusion is that your security questions are irrelevant because you
are attempting to 'discuss apple picking machinery in an orange grove'.
Or ASM will be even more secure because most security issues occure at the
operating system level, and ASM isolates the data from the OS.

--
Hans Forbrich
Canada-wide Oracle training and consulting
mailto: Fuzzy.GreyBeard_at_gmail.com
*** I no longer assist with top-posted newsgroup queries ***
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #3 (permalink)  
Old 02-24-2008, 12:23 PM
Volker Hetzer
 
Posts: n/a
Default Re: ASM and O/S Security


"HansF" <News.Hans@telus.net> schrieb im Newsbeitrag newsan.2005.04.04.15.01.00.77008@telus.net...
> On Mon, 04 Apr 2005 06:00:30 -0700, GeoPappas interested us by writing:
>
> > I was reading about how ASM uses raw partitions, instead of an O/S file
> > system, and had a few questions:
> >
> > - Does this mean that the O/S is not used for ASM at all?

>
> IMO, you are mixing metaphors.
>
> I like to think of ASM replacing the file system layer for an existing
> operating system. As examples: for a Windows machine you would have NTFS,
> Fat32 and ASM; for Linux, ext3, ReiserFS and ASM.
>
> However, ASM is geared toward managing Oracle-related data, as compared
> to traditional files, and it is not meant to be used in place of a
> traditional file system for non-Oracle files.

Huh?
But the doc talks about ASM files and directories!

Lots of Greetings!
Volker
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #4 (permalink)  
Old 02-24-2008, 12:23 PM
Ronald Rood
 
Posts: n/a
Default Re: ASM and O/S Security

On Mon, 4 Apr 2005 18:33:42 +0200, Volker Hetzer wrote
(in article <d2rq95$ono$1@nntp.fujitsu-siemens.com>):

>
> "HansF" <News.Hans@telus.net> schrieb im Newsbeitrag
> newsan.2005.04.04.15.01.00.77008@telus.net...
>> On Mon, 04 Apr 2005 06:00:30 -0700, GeoPappas interested us by writing:
>>
>>> I was reading about how ASM uses raw partitions, instead of an O/S file
>>> system, and had a few questions:
>>>
>>> - Does this mean that the O/S is not used for ASM at all?

>>
>> IMO, you are mixing metaphors.
>>
>> I like to think of ASM replacing the file system layer for an existing
>> operating system. As examples: for a Windows machine you would have NTFS,
>> Fat32 and ASM; for Linux, ext3, ReiserFS and ASM.
>>
>> However, ASM is geared toward managing Oracle-related data, as compared
>> to traditional files, and it is not meant to be used in place of a
>> traditional file system for non-Oracle files.

> Huh?
> But the doc talks about ASM files and directories!
>
> Lots of Greetings!
> Volker


That is correct, create asm disks on raw partitions. Multiple raw partitions
can build an asm disk. On the asm disks are datafiles, redologfiles,
archives, controlfiles, backupsets and spfiles, all grouped in directories.
It really is very nice and if you want to use cheap disks for the database I
would take a serious look at it.
One of the advantages over raw partitions is more managebility from within
the database without the need for extra software or SAN stuff and at the same
time create a very robust and redundant database.

With kind regards / met vriendelijke groeten,
Ronald

http://ronr.nl/unix-dba
http://homepage.mac.com/ik_zelf/oracle

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #5 (permalink)  
Old 02-24-2008, 12:23 PM
HansF
 
Posts: n/a
Default Re: ASM and O/S Security

On Mon, 04 Apr 2005 18:33:42 +0200, Volker Hetzer interested us by
writing:


>> However, ASM is geared toward managing Oracle-related data, as compared
>> to traditional files, and it is not meant to be used in place of a
>> traditional file system for non-Oracle files.

> Huh?
> But the doc talks about ASM files and directories!


Looking through the Concepts and DBA manuals again, I see repeated
emphasis of "Automatic Storage Management automates and simplifies the
layout of datafiles, control files, and log files." ... everything being
oriented towards ORACLE related files but NOT general purpose files.

Even more to the point - look at the final entry in table 12-2 of the
10g DBA manual:
http://download-west.oracle.com/docs...n.htm#i1023250

I stick with my conclusion that ASM has a specific purpose (support Oracle
use) and an Oracle environment tends to have few large files rather than
the typical file system which tends to be geared towards many (millions?)
of very small files.

Different tool, different purpose, different optimization.

(Of course, I've known people who will use an electric drill to hammer
nails. Possible, but not necessarily optimal.)

--
Hans Forbrich
Canada-wide Oracle training and consulting
mailto: Fuzzy.GreyBeard_at_gmail.com
*** I no longer assist with top-posted newsgroup queries ***
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #6 (permalink)  
Old 02-24-2008, 12:23 PM
DA Morgan
 
Posts: n/a
Default Re: ASM and O/S Security

Volker Hetzer wrote:

> "HansF" <News.Hans@telus.net> schrieb im Newsbeitrag newsan.2005.04.04.15.01.00.77008@telus.net...
>
>>On Mon, 04 Apr 2005 06:00:30 -0700, GeoPappas interested us by writing:
>>
>>
>>>I was reading about how ASM uses raw partitions, instead of an O/S file
>>>system, and had a few questions:
>>>
>>>- Does this mean that the O/S is not used for ASM at all?

>>
>>IMO, you are mixing metaphors.
>>
>>I like to think of ASM replacing the file system layer for an existing
>>operating system. As examples: for a Windows machine you would have NTFS,
>>Fat32 and ASM; for Linux, ext3, ReiserFS and ASM.
>>
>>However, ASM is geared toward managing Oracle-related data, as compared
>>to traditional files, and it is not meant to be used in place of a
>>traditional file system for non-Oracle files.

>
> Huh?
> But the doc talks about ASM files and directories!
>
> Lots of Greetings!
> Volker


ASM is basically "managed raw."
--
Daniel A. Morgan
University of Washington
damorgan@x.washington.edu
(replace 'x' with 'u' to respond)
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #7 (permalink)  
Old 02-24-2008, 12:23 PM
Volker Hetzer
 
Posts: n/a
Default Re: ASM and O/S Security


"HansF" <News.Hans@telus.net> schrieb im Newsbeitrag newsan.2005.04.04.19.34.36.375877@telus.net...
> On Mon, 04 Apr 2005 18:33:42 +0200, Volker Hetzer interested us by
> writing:
>
>
> >> However, ASM is geared toward managing Oracle-related data, as compared
> >> to traditional files, and it is not meant to be used in place of a
> >> traditional file system for non-Oracle files.

> > Huh?
> > But the doc talks about ASM files and directories!

>
> Looking through the Concepts and DBA manuals again, I see repeated
> emphasis of "Automatic Storage Management automates and simplifies the
> layout of datafiles, control files, and log files." ... everything being
> oriented towards ORACLE related files but NOT general purpose files.

Of course, that's what I mean. I was talking about filesystem versus raw
here.
I'm not going to put Linux on a bunch of asm drives.

Lots of Greetings!
Volker
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #8 (permalink)  
Old 02-24-2008, 12:23 PM
HansF
 
Posts: n/a
Default Re: ASM and O/S Security

On Tue, 05 Apr 2005 10:42:48 +0200, Volker Hetzer interested us by
writing:

>> >> However, ASM is geared toward managing Oracle-related data, as compared
>> >> to traditional files, and it is not meant to be used in place of a
>> >> traditional file system for non-Oracle files.
>> > Huh?
>> > But the doc talks about ASM files and directories!

>>
>> Looking through the Concepts and DBA manuals again, I see repeated
>> emphasis of "Automatic Storage Management automates and simplifies the
>> layout of datafiles, control files, and log files." ... everything being
>> oriented towards ORACLE related files but NOT general purpose files.

>
> Of course, that's what I mean. I was talking about filesystem versus raw
> here.
> I'm not going to put Linux on a bunch of asm drives.


I agree that I would not want to use ASM as a general purpose file system.
[I have no idea how your previous statement and your last one are related.]

The only way I use ASM in production is on raw disk. However, I do demo
and train ASM on 'raw files' created using dd. This is very handy on a
Linux laptop with only the builtin disk.

However, Oracle does have a very good network oriented 'file system' that
I DO use in production on Linux and Windows - Oracle Files, the packaged
implementation of Application Server 10g's Content Management SDK, which
is contained in the Oracle Collaboration Suite.

--
Hans Forbrich
Canada-wide Oracle training and consulting
mailto: Fuzzy.GreyBeard_at_gmail.com
*** I no longer assist with top-posted newsgroup queries ***
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #9 (permalink)  
Old 02-24-2008, 12:23 PM
Volker Hetzer
 
Posts: n/a
Default Re: ASM and O/S Security


"HansF" <News.Hans@telus.net> schrieb im Newsbeitrag newsan.2005.04.05.13.55.03.133148@telus.net...
> The only way I use ASM in production is on raw disk. However, I do demo
> and train ASM on 'raw files' created using dd. This is very handy on a
> Linux laptop with only the builtin disk.

I'm still reading up on the whole thing. We are evaluating 10g and I want
to get a db running that uses it on four disks. So far I have progressed to "I
need to get the asm package first and have to make the disks available to that."
When I talked about files furthe up in the thread I wasn't that far yet and thought
that it all gets managed from the db instance and not from a separate one.


See you!
Volker
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #10 (permalink)  
Old 02-24-2008, 12:23 PM
HansF
 
Posts: n/a
Default Re: ASM and O/S Security

On Tue, 05 Apr 2005 15:18:39 +0200, Volker Hetzer interested us by
writing:

>
> "HansF" <News.Hans@telus.net> schrieb im Newsbeitrag newsan.2005.04.05.13.55.03.133148@telus.net...


> I'm still reading up on the whole thing. We are evaluating 10g and I want
> to get a db running that uses it on four disks. So far I have progressed to "I
> need to get the asm package first and have to make the disks available to that."
> When I talked about files furthe up in the thread I wasn't that far yet and thought
> that it all gets managed from the db instance and not from a separate one.


Ah - got it. (And apologies for my frustration)

The thing that tends to be confusing is that ASM is actually a separate
server (as in software) and has it's own instance. In many ways it feels
like a database instance that you don't take past the mount state, and
some of the commands are even identical to those we use in managing a
database instance.

The database instances then pass the data requests to the ASM server not
unlike hosts passing requests to a SAN frame. And in a similar manner,
one ASM instance can take requests from several database instances. The
big conceptual difference, imo, is that a SAN uses disks and block stripes
whereas ASM uses files (eg: tablespaces) and 'file chunk' stripes.

For almost 20 years I've said "Oracle is an operating system, albeit very
specialized. A lot of similarities, including memory management. Equate
tablespaces to disks, tables to files, and columns to fields and you have
a comfortable grounding for learning Oracle." Now we add "ASM ~= SAN".

--
Hans Forbrich
Canada-wide Oracle training and consulting
mailto: Fuzzy.GreyBeard_at_gmail.com
*** I no longer assist with top-posted newsgroup queries ***
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


All times are GMT. The time now is 09:48 AM.


Powered by vBulletin® Version 3.6.5
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.2.0
www.UnixAdminTalk.com