Beruflich Dokumente
Kultur Dokumente
Email:
sales@mokumsolutions.com
Web:
http://mokumsolutions.com
About the Author
The author of the Oracle Cloud Cookbook is none other than the owner of
Mokum Solutions, Inc., Roddy Rodstein. Roddy is one of the most respected
Oracle Cloud Computing experts, having designed and managed many of the
worlds largest and most complex Oracle clouds. Before establishing Mokum,
Roddy spent three years at Oracle on the Oracle VM and Linux team
designing and supporting Oracle's largest Oracle VM environments. Before
Oracle, Roddy spent six years at Citrix, designing and supporting Citrix's
largest and most complex customer environments, Including Oracle's.
About Mokum Solutions, Inc.
Founded in March 2011, Mokum Solutions, Inc. specializes in virtualizing
Oracle workloads in private and hybrid clouds. Mokum corporate
headquarters are located in San Francisco, CA
http://mokumsolutions.com
or call 1 415 252 9164.
Why Mokum?
Mokum has deployed hundreds of successful Oracle VM environments.
Mokum can save you months, and years of trial and error, and deliver an
enterprise-ready Oracle VM private cloud managed by Oracle Enterprise
Manager 12c or OpenStack, without having to overprovision hardware or
Oracle licenses. All of Mokums customers are Oracle VM success stories that
have saved MILLIONS in Oracle licensing and hardware costs.
Unlike Mokum, Oracle consulting and traditional Oracle partners have no
incentive for customers to succeed with Oracle VM, since Oracle VM is used
to reduce Oracle licensing costs, and eliminates the need to buy $$$$ Oracle
Engineered Systems. Our customers that have engaged with Oracle and
traditional Oracle partners for Oracle VM projects received junior engineers
with little or no Oracle VM experience that regularly reference our books and
blogs for their deployments. All of Mokums customers are Oracle VM
success stories that have saved MILLIONS in Oracle licensing and hardware
costs.
Copyright 2015 Mokum Solutions, Inc. All rights reserved.
Distribution of the Oracle Cloud Cookbook or derivative of the work in any
form is prohibited unless prior permission is obtained from the Copyright
holder.
Call 415-252-9164
http://mokumsolutions.com/
Table of Contents
Mokum Oracle Private Cloud Reference Design Introduction
Mokum Oracle Private Cloud Reference Design Implementation Overview
Mokum Oracle Private Cloud Reference Design Support Infrastructure
Oracle Private Cloud Architectural Design
Oracle VM Hardware Architecture
..Oracle VM Hardware Sizing
Oracle VM Server Pool Design
Oracle VM Security Standards
Oracle VM Manager Security Controls
Oracle VM Server Security Controls
Virtual Machine Operating System Standards
Oracle VM Disaster Recovery
Oracle VM Application Integration
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Infrastructure
Management
Virtual Machines
Infrastructure as a Service (IaaS)
Note: A detailed explanation of each category and solution in the Mokum Oracle private cloud reference design is
presented in the architectural overview section.
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
cloud reference design outlines the decision points necessary for implementing an Oracle VM private cloud to
deliver self-serviceInfrastructure as a Service using pre-configuredvirtual machine templates from theOracle
Enterprise Manager Cloud Control 12cself service portal, or OpenStack.
This table outlines the decision points for the support infrastructure for the Mokum Oracle private cloud reference
design. For decisions that rely on preexisting factors or specific organizational needs, the appropriate best practice
will be discovered in the infrastructure assessment (IA) and gap analysis (GA). The best practices should be
analyzed carefully and decisions should be made based on organizational needs, existing architecture, and budget
resource availability.
Decision Point
Decision
Justification
Oracle Support
Agreements
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Oracle Exalogic, and the Oracle Private Cloud Appliance.Oracle VM for x86 software is Oracle's leading edge
server virtualization software that was designed to make Oracle databases, middleware and applications easier to
deploy, support, and license, on commodity x86 hardware. With the Oracle VM for x86 software you can build
your own private cloud on commodity x86 hardware managed by Oracle software, or OpenStack. Oracle offers
commercial support for Oracle VM for x86 and OpenStack on certified third-party hardware, with Sun hardware,
and bundled with Oracle Exadata Database Machine X5-2, Oracle Database Appliance, Oracle Exalogic, and the
Oracle Private CloudAppliance.
Note: Without exception our customers elect tobuild thier own Oracle private clouds using their standard x86
server hardware and storage platforms.As of this writing, over 85% of our Oracle VM projects are being deployed
on Cisco UCS with EMC storage.Cisco UCS withEMC storage is an idealplatform for Oracle VM hosting the
most demanding Oracle workloads.
Oracle engineered systems are preassembled Oracle/Sun hardware and software solutions with targeted
functionality that addresses the buy versus build option.Oracle Exadata X5-2 is a preassembled hardware and
software solution engineered to be the highest-performance and most-available platform for the Oracle Database.
The Oracle Database Appliance is a fixed two node entry level preassembled hardware and software solution
engineered for the Oracle Database. Exadata and the Oracle Database Appliance are not general purpose
virtualization solutions. Exadata and the Oracle Database Appliance have been engineered specifically for Oracle
Database workloads running on Oracle Linux. Oracle Exalogic is a preassembled hardware and software solution
engineered for large-scale, performance-sensitive, mission-critical Oracle and Java applications. Exalogic is not a
general purpose virtualization solution. Exalogic has been engineered specifically for Oracle Applications and Java
workloads running on Oracle Linux. The Oracle Private CloudAppliance is Oracle' converged infrastructure
solution engineered for general purpose virtualization.
Figure 2 shows the Oracle private cloud build verses buy options.
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Oracle approach to virtualization with the focus onsolving challenges at the application layeris indeed in stark
contrast to the other commercial virtualization software, converged, and hyper-converged solutions that solve
applicationchallenges at the virtualinfrastructure layer.For example, Oracle VM and the Oracle
VMenabledOracle engineered systemshave been built from the ground up to manage Oracle licenses, and to
support the most demanding Oracles workloads. Oracle Exadata, Exalogic, and theOracle Private Cloud
Appliancehave a 40G InfiniBand fabric to allow the virtual machines to meet the most demanding I/O and SQL
processing requirements for online transaction processing, data warehousing, and mixed applicationworkloads.
Since Oracle Database, Applications and Middleware software have application level fault tolerance, and data
replication functionality, Oracles virtualization portfolio does not have virtual machine fault tolerance, or storage
migration functionality. Oracles virtualization portfolio relies on Oracle application level fault tolerance, and data
replication, not virtual machine level fault tolerance, and storage migration functionality. The other commercial
virtualization software, converged, and hyper-converged solutions solveapplicationchallenges at
thevirtualinfrastructure layerwithvirtual machinefault tolerance, and live storage migration.Oracle approach to
virtualization has limited Oracle VM's adoption to exclusivelysupporting Oracle workloads.
If you elect to build your own Oracle VM private cloud, theOracle VM for x86 software can be deployed on any of
the hardware platforms listed on theOracle Linux and Oracle VM Hardware Certification List (HCL).
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Oracle VM server sizing is calculated by adding the aggregate CPU, RAM and I/O requirements for all of the
virtual machines that could run on an Oracle VM server, and then selecting server hardware with ample CPU,
RAM and I/O resources. The exact number of network interfaces for an Oracle VM server entirely depends on
your organizations server hardware platform, and network and storage infrastructure capabilities. For example, an
Oracle VM server with four or more 10G NICs, configured with two 802.1Q bonds could support the most
demanding Oracle workloads.The amount of Fibre and HBAs for an Oracle VM Server entirely depends on your
Oracle I/O requirments. For example, an Oracle VM derver with at least two dual-channel8GBHBAs, EMC
PowerPath with an EMC VNX, or VMAX could support an Oracle Data Warehousewith minimumthroughput
requirments of3500MBPS.Once the server hardware has been selected, the number of servers in a server pool is
calculated by selecting enough servers to support the aggregate CPU, RAM and I/O requirements of all of the
virtual machines within a server pool, including the number of additional servers for availability, i.e. HA, Live
Migration and Distributed Resource Scheduling (DRS). Oracle VM server pools that use HA, Live Migration and
DRS must have excess CPU and RAM capacity for hardware failures and virtual machine migrations.Oracle VM
HA and Live Migration along with Distributed Resource Schedulingmust be considered to calculate the total
number of servers required to respond to hardware failures and virtual machine migrations.
Figure 2shows Oracle VM server pool designed with excess CPU and RAM capacity to be able to use HA,
Distributed Resource Scheduling and Live Migration. Excess CPU and RAM capacity is a requirement for HA,
Distributed Resource Scheduling and Live Migration.
The below image shows an
Oracle VM server pool with
excess capacity to be able to use
HA, Live Migration and DRS.
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Oracle VM HA automatically restarts virtual machines when an Oracle VM pool member fails or restarts. Live
Migration is used to eliminate planned downtime by migrating running virtual machines from one Oracle VM pool
member to another during a maintenance event, for example, for repairs or an upgrade. Distributed Resource
Scheduling provides policy based real-time utilization monitoring of Oracle VM servers with the goal to distribute
virtual machine loads across a server pool. Distributed Resource Schedulingautomatically migrates virtual
machines from heavily utilized Oracle VM servers to less utilized Oracle VM servers. Both HA, Live Migration
and Distributed Resource Scheduling require a server pool with at least three servers with excess CPU and RAM
capacity to be able to run and migrate virtual machines across the servers even if one Oracle VM servers fails.
Note:Virtual machines cannot aggregate CPU and memory resources from more than one Oracle VM server. That
is, a virtual machine consumes resources only from the Oracle VM server where the virtual machine is running.
Oracle VM server can be installed on an x86 64 bit server with up to 900CPU cores or threads, up to 6TB of
RAM, with no limit on the number of network ports. Oracle VM server can be installed on as little as a 4GB
partition or disk. Many customers install Oracle VMserver on flash storage modules or boot from SAN to reduce
costs and complexity.
The next table shows the maximum number of CPUs, RAM and NICs for Oracle VM server release 3.2.x, and
3.3.x.
Item
3.2 Maximums
3.3Maximums
160
900
RAM
4 TB
6 TB
NICs
40
No limit
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Before starting an Oracle VM project, we profile the existing Oracle systems to be able to size the Oracle VM
hardware, storage and network infrastructure.The next example shows our system profile format with an EBusiness Suite environment on physical Linux systems, followed by the same E-Business Suite environment hosted
on Oracle VM. The below example shows each E-Business Suitecomponentinstalled on a dedicated HP DL 380.
Hostname
OS
Hardware
CPUs/Cores
Processor
Factor
RAM
Total
Peek
Storage IOPS
Average
IOPS
dbprod
Oracle
Linux
6
DL 380
4 CPUs/16
Cores
8 Licenses
128
GB
1.5 TB
10493
2102
dbtest
Oracle
Linux
6
DL 380
4 CPUs/16
Cores
8 Licenses
128
GB
1.5 TB
14493
3802
obiprod
Oracle
Linux
6
DL 380
2 CPUs/8
Cores
4 Licenses
32
GB
300 GB
1534
91
obitest
Oracle
Linux
6
DL 380
2 CPUs/8
Cores
4 Licenses
32
GB
300 GB
2834
152
soaprod
Oracle
Linux
6
DL 380
2 CPUs/8
Cores
4 Licenses
32
GB
300 GB
2491
68
soatest
Oracle
Linux
6
DL 380
2 CPUs/8
Cores
4 Licenses
32
GB
170 GB
2903
92
approd
Oracle
Linux
6
DL 380
2 CPUs/8
Cores
4 Licenses
32
GB
300 GB
673
22
aptest
Oracle
Linux
6
DL 380
2 CPUs/8
Cores
4 Licenses
32
GB
300 GB
1200
35
8 Hosts
80
CPUs/Cores
40Oracle
Processor
Licenses
448
GB
RAM
4.5 TB
Storage
36621
Peek
IOPS
6364
Average
IOPS
The below example shows the virtualized foot print from the above E-Business Suiteenvironment on Oracle VM
with hyperthreading enabled. Oracle VM reduced the server count by 62.5%, and reduced the Oracle license count
by 65%.
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Hostname
OS
Hardware
*CPUThreads
Processor
Factor
RAM
Total
Peek
Average
Storage IOPS IOPS
dbprod
Oracle
Linux
6
VM
16 vCPUs
4 Licenses
128
GB
1.5 TB
10493
2102
dbtest
Oracle
Linux
6
VM
16 vCPUs
4 Licenses
128
GB
1.5 TB
14493
3802
obiprod
Oracle
Linux
6
VM
4 vCPUs
1 Licenses
32
GB
300 GB
1534
91
obitest
Oracle
Linux
6
VM
4 vCPUs
1 Licenses
32
GB
300 GB
2834
152
soaprod
Oracle
Linux
6
VM
4 vCPUs
1 Licenses
32
GB
300 GB
2491
68
soatest
Oracle
Linux
6
VM
4 vCPUs
1 Licenses
32
GB
170 GB
2903
92
approd
Oracle
Linux
6
VM
4 vCPUs
1 Licenses
32
GB
300 GB
673
22
aptest
Oracle
Linux
6
VM
4 vCPUs
1 Licenses
32
GB
300 GB
1200
35
14Oracle
Processor
Licenses
448
4.5 TB
36621 6364
GB
Storage Peek
Average
RAM
IOPS IOPS
*Note:With hyper-threading enabled, a virtual machine with 4 CPUs is actually accessing 2 CPU cores, 4 CPU
threads, or 1 Oracle CPU license. With hyper-threading disabled, the same virtual machine with 4 CPUs is actually
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
consuming 4 CPU cores, or 2 Oracle CPU license. Oracle recognizes each CPU core as a separate CPU and each
CPU type with a different processor factor. The processor factor determines the processor count. The processor
count determines the number of processors required to license the Oracle product.
The majority of our customers order their standard VMware hardware for Oracle VM, and connect the Oracle VM
servers to their existing storage infrastructure. The majority of theVMware hardware we see has 2 multi-core
CPUs, up to 256 GB of RAM, 2 RAID 1 disks, 4 10G NICs, and 2 1-Port 8Gb HBAs. There are pros and cons to
using your standard VMware hardware and existing storage for Oracle VM. The pros are that your standard x86
server hardware is simple to procure and deploy, and your existing storage infrastructure is in-place and ready to
go. The cons are that production Oracle database workloads can easilyrequiremore I/O throughputthan your
standard VMwarehardware and storage infrastructurecan deliver.
A smaller number of our customers size and order server hardware and storage infrastructure specificallyfor their
Oracle VM environments. These folks typically order servers with 4 multi core CPUs, up to 4TB of RAM, 2 RAID
1 disks, 6 to 8 10G NICs, and 2 2-Port 8Gb HBAs, with dedicated EMC VNX, or VMAX storage. There are pros
and cons to using non standard x86 hardware and dedicated storage for Oracle VM. The pros are that your
production Oracle database workloads will have all of the resources they need. The cons are that a new x86
hardware will be introduced, with dedicated storage, at a higher cost.
A single Oracle VM 3.3server can support up to 900CPU cores or threads, 6TB of memory with local or remote
storage. An Oracle VM server with 6TB of RAM and 900CPU cores or threads could allocate the majority of the
6TB of RAM and more than 900CPU cores or threads to running virtual machines. Oracle VM server supports
CPU oversubscription. CPU oversubscription means that an Oracle VM server with 900CPU cores could
overallocate the total number of CPU cores to virtual machines. Oracle VM server does not support memory
oversubscription, which means that an Oracle VM server with 6TB of RAM cannot overallocate RAM to virtual
machines. By default, each Oracle VM server reserves at leat 512 MB of RAM for Oracle VM server (dom0). The
average memory overhead for each running virtual machine on an Oracle VM server is approximately 20 MB plus
1% of each virtual machine' memory allocation. The remaining RAM can be allocated to virtual machines.
Note: The lack of Oracle VM's memory oversubscription is by design. Memory oversubscription is actually in
Xen, and could easily be enabled in Oracle VM. If customers used CPU oversubscription with Oracle database
workloads, the virtual infrastructure including the Oracle databases would quickly slow down to a crawl with
memory starvation.
The next table outlines the various decision points to size and select Oracle VM for x86 hardware. For decisions
that rely on preexisting factors or specific organizational needs, the appropriate best practice will be discovered in
the infrastructure assessment (IA) and gap analysis (GA). The best practices should be analyzed carefully and
decisions should be made based on organizational needs, existing architecture, and budget resource availability.
Decision Point
Decision
Justification
Certification
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
CPU
RAM
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Network Interface
Cards
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
NAME Rate(bit/s)
Gigabit Ethernet 1 Gbit/s
10 Gigabit Ethernet 10 Gbit/s
40 Gigabit Ethernet 40 Gbit/s
Infiniband DDR 16 Gbit/s
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
We often designOracle VM environments following FIPS PUB 199,theStandards for Security Categorization of
Federal Information and Information Systems to applydefense in depth, the principle of least privilege, and
compartmentalization of information.FIPS PUB 199 can be used to determine the security category of systems
and within which security domain systems should reside.FIPS PUB 199 uses the followingsecurity domains:
Controlled:A controlled security domain is used to restrict access between security domains. A controlled
security domain could contain groups of users with their network equipment or a demilitarized zone (DMZ).
Uncontrolled:An uncontrolled security domain refers to any network not in control of an organization, such as
the Internet.
Restricted:A restricted security domain can represent an organizations production, test and development
networks. Access is restricted to authorized personnel, and there is no direct access from the Internet.
Secured:A secured security domain is a network that is only accessible to a small group of highly trusted users,
such as administrators and auditors.
Figure 3shows fiveOracle VM server pools, managed by three Oracle VM Managersdeployed into the controlled,
restricted,and the secured security domains.
If more than one Oracle VM server pool exists, or locations with Oracle VM server pools, a single Oracle VM
Manager instance can be deployed, or each Oracle VM server pool and/or location could have a dedicated Oracle
VM Manager instance. Figure 3 shows fourOracle VM server pools, 2 oftheOracle VM server pools have a
dedicated Oracle VM Manager instance, and 3 of the server pools are managed by 1Oracle VM Manager instance.
Tip:Oracle Enterprise Manager can be used to aggregate multiple Oracle VM Managers and their resources in to a
single centralized console.
Oracle VM for x86 supports both clustered and non-clustered Oracle VM server pools. The primary difference
between clustered and non-clustered Oracle VM server pools is that clustered server pools use the Oracle Cluster
File System Version2 (OCFS2) with High Availability (HA), and OCFS2 automatic server reboot functionality.
Non-clustered Oracle VM server pools use NFS without OCFS2, High Availability, and OCFS2 automatic server
reboot functionality. Clustered Oracle VM server pools are managed using OCFS2. OCFS2 monitors the status of
each server within an OCFS2 cluster using a network and storage heartbeat. If an Oracle VM server within an
OCFS2 cluster fails to update or respond to network and/or storage heartbeats, by default OCFS2 reboots the
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
affected Oracle VM server. Non-clustered Oracle VM server Pools are not managed using OCFS2, and therefore
are not subject to OCFS2 automatic server reboots.
We have many customers that have been successfully running clustered Oracle VM server pools, each with
exceptional uptime of several years. Many of the Oracle VM server pools with exceptional uptime are static, with
very little change. Conversely, we have also supported many Oracle VM environments that have struggled to tune
out the storage or network interrupts that trigger OCFS2 automatic server reboots. If your clustered Oracle VM
server pools reboot due to storage or network hiccups, and a solution cannot be found, or if you simply cannot
tolerate Oracle VM Server, and virtual machine reboots, I highly recommend non-clustered Oracle VM server
pools.
The following table shows the high level architecture of a clustered and non-clustered Oracle VM server pool.
Figure 4 -Clustered Oracle VM server pool
The following lists provides the pros and cons of clustered and non-clustered Oracle VM server pools.
Clustered Server Pool Pros:
Clustered Oracle VM server pools support Oracle VM HA.
Clustered Oracle VM server pools support virtual machine hot cloning.
Clustered Oracle VM server pools use Fibre Channel for virtual machine storage repositories, and virtual
machine RAW disks, and can also use NFS storage repositories, and shares.
Clustered Server Pool Cons:
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
If a clustered Oracle VM server fails to update or respond to network and/or storage heartbeats, the affected
Oracle VM Server is rebooted, then all HA-enabled virtual machines are restarted on a live Oracle VM Server.
Clustered Oracle VM server Pools require Fibre Channel storage.
Non-clustered Server Pool Pros:
Non-clustered Oracle VM servers will not reboot when network and/or storage interruptions occur.
Non-clustered Oracle VM server pools use NFS for the virtual machine storage repositories, and can use Fibre
Channel for virtual machine RAW disks, and NFS shares.
Non-clustered Server Pool Cons:
Non-clustered Oracle VM server pools do not support Oracle VM HA.
Non-clustered Oracle VM server pools do not support virtual machine hot cloning.
Non-clustered Oracle VM server pools require NFS for the virtual machine storage repositories.
Note:Both clustered and non-clustered Oracle VM server pools support local OCFS2 storage.
This table outlines the decision points foran Oracle VM server pool. For decisions that rely on preexisting factors
or specific organizational needs, the appropriate best practice will be discovered in the infrastructure assessment
(IA) and gap analysis (GA). The best practices should be analyzed carefully and decisions should be made based
on organizational needs, existing architecture, and budget resource availability.
Decision Point
Decision
Justification
Oracle VM server
pool design
Oracle VM
Manager
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
node to self-fence,i.e.reboots.The
keepalive connection time out value is set
via Oracle VM manager and is managed
in each nodes /etc/sysconfig/o2cb file's
O2CB_IDLE_TIMEOUT_MS setting.
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
servers.
Oracle VM Server
Agent Roles
VM Server Role
Unless a server pool is static, VM Servers
should only have the VM Server role
enabled to be able to dedicate CPU, RAM
and I/O resources to running virtual
machines, eliminating the effect of Utility
Server operations.
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
VM Server Role
Servers with the VM Server role are
responsible for allocating CPU,
memory, and disk resources to the
virtual machines in a server pool.
There can be one up to 32 VM
Servers in a clustered Oracle
VMserver pool.
Storage
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Networks
RAM
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Security controls should be employed using industry standard frameworks and standards in the context of the
organization's Enterprise Architecture (EA). Organizations turn to their Enterprise Architecture to understand how
Oracle VM fits within their information system. An Enterprise Architecture is articulated in diagrams and written
policies that define organizational standards and best practices to plan, build, run, and monitor technologies,
including Oracle VM.
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Enterprise Architecture has well defined principles and processes and an approach that generates a comprehensive,
layered policy infrastructure used to communicate managements goals, instructions, procedures, and response to
laws and regulatory mandates. A policy infrastructure consists of written tier 1, tier 2, and tier 3 policies that
encompass people, systems, data, and information. Policies are broken down into high level policies and lower
level standards, procedures, baselines, and guidelines.
Oracle VM policies typically fall within the layered policy infrastructure of the platform architecture domain.
Platform architecture policies are the foundation used to manage the entire lifecycle of an Oracle VM environment.
This table outlines the decision points for Oracle VM Manager security controls. For decisions that rely on
preexisting factors or specific organizational needs, the appropriate best practice will be discovered in the
infrastructure assessment (IA) and gap analysis (GA). The best practices should be analyzed carefully and
decisions should be made based on organizational needs, existing architecture, and budget resource availability.
Decision
Justification
Oracle VM
Manager and
DMZs
Network Time
Protocol (NTP)
Virtual Machine
Console Access
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Host firewallfailed
connection logging
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
Pre-login banner:
Edit the /etc/ssh/sshd_config and add the
following directive:
Banner /etc/banner.net
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
This table outlines the decision points for Oracle VM server security controls. For decisions that rely on preexisting
factors or specific organizational needs, the appropriate best practice will be discovered in the infrastructure
assessment (IA) and gap analysis (GA). The best practices should be analyzed carefully and decisions should be
made based on organizational needs, existing architecture, and budget resource availability.
Decision
Justification
Oracle VM Server
and DMZs
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Build Process
Patch Management
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Host firewall
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Pre-login banner:
Edit the /etc/ssh/sshd_config and add the
following directive:
Banner /etc/banner.net
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Decision
Justification
Virtualization Mode
- HVM vs PVHVM
vs PVM
Virtual Machine
Operating Systems
Virtual Machine
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Operating System
Versioning
Virtual Machine
Operating System
Deployments
Virtual Machine
Disk Partition
Alignment (OCFS2
Storage Only)
Oracle Database
Files
Patch Management
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Decision
Justification
Application Support
Application
Requirements and
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
Dependencies
http://mokumsolutions.com/
Application
Installations
Application
sunsetting
Patch Management
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/
Call 415-252-9164
http://mokumsolutions.com/