Teleport

Database Access with Oracle

Available for:
Enterprise
Cloud

Teleport can provide secure access to Oracle via the Teleport Database Service. This allows for fine-grained access control through Teleport's RBAC.

In this guide, you will:

Configure an Oracle with mutual TLS authentication.
Join the Oracle database to your Teleport cluster.
Connect to the Oracle database via the Teleport Database Service.

Prerequisites

A running Teleport Enterprise cluster. For details on how to set this up, see the Enterprise Getting Started guide.
The Enterprise tctl admin tool and tsh client tool version >= 14.2.0. You can download these tools by visiting your Teleport account. You can verify the tools you have installed by running the following commands:
```
tctl version
Teleport Enterprise v14.2.0 go1.21

tsh version
Teleport v14.2.0 go1.21
```

A Teleport Enterprise Cloud account. If you do not have one, visit the signup page to begin a free trial of Teleport Team and upgrade to Teleport Enterprise Cloud.
The tctl admin tool and tsh client tool version >= 14.1.3. To download these tools, visit the Downloads page.
```
tctl version
Teleport Enterprise v14.1.3 go1.21

tsh version
Teleport v14.1.3 go1.21
```

Self-hosted Oracle server instance 18c or later.
The sqlcl Oracle client installed and added to your system's PATH environment variable or any GUI client that supports JDBC Oracle thin client.

Step 1/6. Create a Teleport token and user

The Database Service requires a valid auth token to connect to the cluster. Generate one by running the following command against your Teleport Auth Service and save it in /tmp/token on the node that will run the Database Service:

tctl tokens add --type=db

Tip

To modify an existing user to provide access to the Database Service, see Database Access Access Controls

Create a local Teleport user with the built-in access and requester roles:

tctl users add \  --roles=access,requester \  --db-users=\* \  --db-names=\* \  alice

Flag	Description
`--roles`	List of roles to assign to the user. The builtin `access` role allows them to connect to any database server registered with Teleport.
`--db-users`	List of database usernames the user will be allowed to use when connecting to the databases. A wildcard allows any user.
`--db-names`	List of logical databases (aka schemas) the user will be allowed to connect to within a database server. A wildcard allows any database.

Warning

Database names are only enforced for PostgreSQL and MongoDB databases.

For more detailed information about database access controls and how to restrict access see RBAC documentation.

Step 2/6. Create a certificate/key pair and Teleport Oracle Wallet

Teleport uses mutual TLS authentication with self-hosted databases. These databases must be configured with Teleport's certificate authority to be able to verify client certificates. They also need a certificate/key pair that Teleport can verify.

If you are using Teleport Cloud, your Teleport user must be allowed to impersonate the system role Db in order to be able to generate the database certificate.

Include the following allow rule in in your Teleport Cloud user's role:

allow:
  impersonate:
    users: ["Db"]
    roles: ["Db"]

Follow the instructions below to generate TLS credentials for your database.

Export Teleport's certificate authority and a generated certificate/key pair
for host db.example.com with a 1-year validity period.
tctl auth sign --format=oracle --host=db.example.com --out=server --ttl=2190h

In this example, db.example.com is the hostname where the Teleport Database Service can reach the Oracle server.

TTL

We recommend using a shorter TTL, but keep mind that you'll need to update the database server certificate before it expires to not lose the ability to connect. Pick the TTL value that best fits your use-case.

If tctl finds the Orapki tool in your local environment, the tctl auth sign --format=oracle --host=db.example.com --out=server --ttl=2190h command will produce an Oracle Wallet and instructions how to configure the Oracle TCPS listener with Teleport Oracle Wallet. Otherwise the tctl auth sign --format=oracle command will produce a p12 certificate and instructions on how to create an Oracle Wallet on your Oracle Database instance.

Warning

If copying these files to your Oracle server, ensure the cert file permissions are readable by the oracle user.

Step 3/6. Configure Oracle Database

In order to enable the Teleport Oracle integration you will need to configure the TCPS Oracle listener and use the Teleport Oracle Wallet created in the previous step.

Align your listener.ora Oracle configuration file and add the following entries:

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCPS)(HOST = 0.0.0.0)(PORT = 2484))
    )
  )

WALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY = /path/to/oracleWalletDir)))
SSL_CLIENT_AUTHENTICATION = TRUE

Additionally, you will need to extend your sqlnet.ora Oracle configuration:

WALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY = /path/to/oracleWalletDir)))
SSL_CLIENT_AUTHENTICATION = TRUE
SQLNET.AUTHENTICATION_SERVICES = (TCPS)

Tip

You will need to reload Oracle Listener lsnrctl reload after updating the listener.ora configuration file.

Additionally, your Oracle Database user accounts must be configured to require a valid client certificate. If you're creating a new user:

CREATE USER alice IDENTIFIED EXTERNALLY AS 'CN=alice';
GRANT CREATE SESSION TO alice;

Step 4/6. Configure and Start the Database Service

Install and configure Teleport where you will run the Teleport Database Service:

Use the appropriate commands for your environment to install your package:

Teleport Edition

Download Teleport's PGP public key
sudo curl https://apt.releases.teleport.dev/gpg \-o /usr/share/keyrings/teleport-archive-keyring.asc
Source variables about OS version
source /etc/os-release
Add the Teleport APT repository for v14. You'll need to update this
file for each major release of Teleport.
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v14" \| sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null

sudo apt-get update
sudo apt-get install teleport-ent