How to whitelist ip address to access oracle database - database

Question

I am new to oracle database. I work on 12c version oracle database which is hosted in linux platform. I have to whitelist a list of ip addresses to access the oracle database.
Example: Below are the server details and i need to add my ipaddress to connect to the database
(PROTOCOL = TCP)(HOST = 192.168.56.122) (PORT = 1521)
kishan 192.108.10.132 xyz#gmail.com
I have gone through these documents but it was not quite helpful. Any help would be much appreciated!
https://docs.oracle.com/en/cloud/paas/casb-cloud/palug/putting-ip-addresses-blacklists-or-whitelists.html#GUID-17060E3D-D8B6-41F1-AAEB-9CC3F4D7B670
https://docs.oracle.com/en/cloud/paas/exadata-express-cloud/csdbp/configure-ip-whitelist-policy.html

Answer 1

Looks like you're looking for ACL (Access Control List). Here's an example:
Create ACL:
BEGIN
DBMS_NETWORK_ACL_ADMIN.create_acl (
acl => 'kishan.xml',
description => 'HTTP Access',
principal => 'KISHAN', -- user in your database
is_grant => TRUE,
privilege => 'connect',
start_date => NULL,
end_date => NULL);
END;
/
Assign ACL:
BEGIN
DBMS_NETWORK_ACL_ADMIN.assign_acl (acl => 'kishan.xml',
HOST => '192.108.10.132',
lower_port => NULL,
upper_port => NULL);
END;
/
Add privilege
BEGIN
-- TRAFOGLED
DBMS_NETWORK_ACL_ADMIN.add_privilege (acl => 'kishan.xml',
principal => 'KISHAN',
is_grant => TRUE,
privilege => 'connect',
start_date => NULL,
end_date => NULL);
DBMS_NETWORK_ACL_ADMIN.add_privilege (acl => 'kishan.xml',
principal => 'KISHAN',
is_grant => TRUE,
privilege => 'resolve',
start_date => NULL,
end_date => NULL);
END;
/
COMMIT;
After you've done all that, user KISHAN should have access to 192.108.10.132. If there are other users that should gain the same access, just add them into the "add privilege" script.

Answer 2

ACLs as described by #Littlefoot control access from within the database to external resources (e.g. a PL/SQL stored procedure accessing a web service or e-mail server). If you're talking about whitelisting database clients, connecting to the DB from other hosts, there are a couple of options, but be careful not to work yourself into a corner in terms of administrative overhead. It is very important to consider what is the actual problem you are trying to solve.
You can use
the host server's local firewall (e.g. iptables, firewall1, etc.) to restrict access to port 1521 (or whatever port you're using);
the TCP.INVITED_NODES parameter in sqlnet.ora (see here: https://docs.oracle.com/en/database/oracle/oracle-database/19/netrf/parameters-for-the-sqlnet.ora.html#GUID-897ABB80-64FE-4F13-9F8C-99361BB4465C);
or use Oracle Connection Manager if you have an Enterprise Edition database.
In general I wouldn't restrict to anything more narrow than a subnet, though. The reason for that is that there isn't any good way to do it more precisely: IP addresses tend to change frequently with DHCP, which could result in a user being unintentionally locked out, and they can be easily spoofed by bad actors. Tracking each individual IP is an administrative nightmare, too.
See these articles I wrote up last year for more detail and some of the important questions to consider:
https://pmdba.wordpress.com/2020/02/18/how-to-limit-a-user-connection-to-a-specific-ip-address/
https://pmdba.files.wordpress.com/2013/03/deploying-an-oracle-11gr2-connection-manager.pdf