Security & trust model
Principle. Deynao is a 100% on-premise Oracle supervision solution that connects to your databases read-only, with no agent on your database servers. Nothing is transmitted to the vendor.
1. Access to your Oracle databases
- Supervision is performed via a dedicated Oracle account, read-only. A creation-and-privileges script is provided and verifiable before any connection.
- The account only receives CREATE SESSION and SELECT rights on explicitly listed system views: no DBA role, no write privilege (INSERT, UPDATE, DELETE, DDL), no automatic remediation.
- Deynao queries the dynamic views (V$) and the Oracle dictionary needed for diagnostics. No read access is granted to your application tables.
- Excerpt from the provided script:
GRANT SELECT ON v_$instance TO deynao_mon;
GRANT SELECT ON dba_tablespaces TO deynao_mon;
GRANT SELECT ON v_$session TO deynao_mon;
2. No Diagnostics or Tuning Pack required
The supervision account receives no access to the DBA_HIST_*, V$ACTIVE_SESSION_HISTORY or DBA_ADVISOR_* views. No Oracle Diagnostics Pack or Tuning Pack is required to use Deynao's features. The full list of queried views is in the privileges script.
3. Credential protection
- Stored Oracle passwords are encrypted at rest (authenticated symmetric encryption) with a key unique to the installation, generated locally on first launch.
- They are never written in clear text in configuration files or logs.
- In the portable edition, the folder contains the encrypted data and its key: it must be protected like a secret (restricted access rights).
4. Network flows
Deynao sits at the center of the architecture. It communicates with:
- the authorized browsers (web interface, via your infrastructure's reverse proxy);
- your supervised Oracle databases, read-only;
- the SMTP server you configure, to send alerts.
No traffic is sent to Deynao's servers: no telemetry, no supervision data, no online license validation. The license is verified locally, with no Internet call.
5. Anti-lockout safeguard
As soon as an Oracle database rejects authentication, a circuit breaker suspends further attempts instead of retrying in a loop. This greatly reduces the risk of locking out an account and avoids hammering the listener. Using a dedicated supervision account is still recommended.
6. Session traceability
Deynao's connections carry the module Deynao-Supervision-RO, with the action Collector for autonomous supervision. Your DBA can find them at any time in V$SESSION. The collector releases its connection after each collection cycle.
7. Deynao access governance
Three roles separate responsibilities within the application: administrator, operator and reader. A read-only user views the fleet state without being able to change connections, the license or the configuration.
8. Supervised scope
Deynao supervises Oracle 11g and later databases, single-instance. No Oracle client to install for 12c and later; Oracle Instant Client required for 11g. Deynao relies on Oracle's standard system views: it does not depend on a specific version, confirmed during the evaluation. RAC, ASM and Data Guard are not supervised in the current version. Supervised databases may be hosted on Windows or Linux; the Deynao server runs on Windows.
9. Network deployment
Deynao serves its interface directly over HTTPS: you provide your organisation's certificate and the product handles TLS termination. A step-by-step guide (requesting the DNS name, converting the certificate, opening the firewall, verification, rollback) ships with the server edition.
Deynao sits equally well behind your infrastructure's reverse proxy, if that is your rule: TLS termination, HTTP-to-HTTPS redirection and security headers then remain your proxy's responsibility.