In my previous post, I have showed how to list all named credentials in Enterprise Manager Cloud Control. As you see, it was not possible using regular user interface, so we connected to the repository database to get the information. Now let’s keep digging and see if we can retrieve “encrypted information” saved in named credentials.
The username, password and role information of named credentials are stored in em_nc_cred_columns table. When we examine it, we can see that there’s one-to-many relation with em_nc_creds using target_guid column, and the sensitive information are stored in cred_attr_value column. That column is encrypted using em_crypto package. The encryption algrotim uses a secret key which is stored in “Admin Credentials Wallet” and a salt (random data for additional security). The wallet file is located in $MIDDLEWARE_HOME/gc_inst/em/EMGC_OMS1/sysman/config/adminCredsWallet/cwallet.sso) and the salt data can be found in cred_salt column of the em_nc_cred_columns table. Here’s what it looks like:
To decrypt the information, we need to call the decrypt in em_crypto package, but if we call it without opening the wallet, we get the following error:
ORA-06512: at line 1 28239. 00000 - "no key provided" *Cause: A NULL value was passed in as an encryption or decryption key. *Action: Provide a non-NULL value for the key.
How can we read the secret key from that wallet? Easiest way is, make Enterprise Manager open the wallet and store the secret key in the repository database. So we issue the following command:
oracle@db-cloud ~$ /u02/Middleware/oms/bin/emctl config emkey -copy_to_repos Oracle Enterprise Manager Cloud Control 12c Release 4 Copyright (c) 1996, 2014 Oracle Corporation. All rights reserved. Enter Enterprise Manager Root (SYSMAN) Password : The EMKey has been copied to the Management Repository. This operation will cause the EMKey to become unsecure. After the required operation has been completed, secure the EMKey by running "emctl config emkey -remove_from_repos".
It asks for SYSMAN password. If you enter the correct password, it reads the wallet file and store the secret key into the repository database. Of course it makes your system unsecure. If you issue the command “emctl config emkey -remove_from_repos”, you can remove the key from repository.
Ok, if you issued the above command and stored the secret key into the repository, you can use the following query to fetch the decrypted information:
SELECT c.cred_owner, c.cred_name, c.target_type, (SELECT em_crypto.decrypt(p.cred_attr_value, p.cred_salt) FROM em_nc_cred_columns p WHERE c.cred_guid = p.cred_guid AND lower(P.CRED_ATTR_NAME) LIKE '%user%') username, (SELECT em_crypto.decrypt(p.cred_attr_value, p.cred_salt) FROM em_nc_cred_columns p WHERE c.cred_guid = p.cred_guid AND lower(P.CRED_ATTR_NAME) LIKE '%role%') rolename, (SELECT em_crypto.decrypt(p.cred_attr_value, p.cred_salt) FROM em_nc_cred_columns p WHERE c.cred_guid = p.cred_guid AND lower(P.CRED_ATTR_NAME) LIKE '%password%') password FROM em_nc_creds c WHERE c.cred_owner <> '<SYSTEM>' ORDER BY cred_owner;
Sample output:
It didn’t work because the jar file, calls another jaf file so our parameter doesn’t affect to the method. We need to change os.name permanently for our terminal session. The JAVA_TOOL_OPTIONS environment variable helps us to do it:
Yesterday, I did my first Sybase IQ upgrade. I upgraded our main datawarehouse from Sybase IQ 16 to 16 SP10. The process was easy: Stop the database instance, install the new software, start the instance (from new software home), run an SQL to upgrade the metadata. Although the process was easy, I had some unexpected problems so I wanted to my notes in case you may need to upgrade your Sybase IQ.
3 
16 
