Audit whether the Oracle program files have been modified

In a recent security audit, one of the requirements is:

File integrity detection The corresponding database is the installed program files, configuration files (excluding data files, log files)

That is, the need for regular database software important documents to do content verification, to avoid important documents were tampered with.

The whole idea is:

1. Because there are too many ORACLE files, we assume that the important executable directory is $oracle_home/bin and $oracle_home/lib.
2. Record the md5sum value of these files after scanning.
3. Scan these files regularly, compare md5sum values, and check the file for changes.
4. Each dozen patch, because the executable file will change, need to record after patch, the related file new md5sum value.

We can implement the following:

Find $ORACLE _home/bin-type f-print0 | xargs-0 md5sum >>/tmp/my.md5_before1
Find $ORACLE _home/bin-type f-print0 | xargs-0 md5sum >>/tmp/my.md5_before1

--Roll back a patch and the mock file is modified
[Oracle11g@testdb2 tmp]$ opatch Rollback-id 17411249

Find $ORACLE _home/bin-type f-print0 | xargs-0 md5sum >>/tmp/my.md5_after1
Find $ORACLE _home/bin-type f-print0 | xargs-0 md5sum >>/tmp/my.md5_after1

--use diff to check for files modified by MD5 values:

[Oracle11g@testdb2 tmp]$ diff My.md5_before1 My.md5_after1
1d0
< d41d8cd98f00b204e9800998ecf8427e-
284c283
< 6d068201a219168ccbccb30f06b90202/u01/ora11g/app/oracle/product/11.2.0/db_1/bin/oracle
---
> ab0aa04b8847755f287458c2e2aa1505/u01/ora11g/app/oracle/product/11.2.0/db_1/bin/oracle
289c288
< Ab0aa04b8847755f287458c2e2aa1505/u01/ora11g/app/oracle/product/11.2.0/db_1/bin/oracleo
---
> 6d068201a219168ccbccb30f06b90202/u01/ora11g/app/oracle/product/11.2.0/db_1/bin/oracleo
446c445
< c0befa825eea9033a04772b73353890c/u01/ora11g/app/oracle/product/11.2.0/db_1/lib/libserver11.a
---
> c05354dd80564134c3ed71a591fe3dd3/u01/ora11g/app/oracle/product/11.2.0/db_1/lib/libserver11.a
676c675
< c5d4b4c11499d8969fbe5e51105cd384/u01/ora11g/app/oracle/product/11.2.0/db_1/lib/libcommon11.a
---
> 36bbc228f4fe8cddbe95a8f103875f5b/u01/ora11g/app/oracle/product/11.2.0/db_1/lib/libcommon11.a
[Oracle11g@testdb2 tmp]$

It is similar if you want to audit all the files under Oracle_home:

Find $ORACLE _home-type f-print0 | xargs-0 md5sum >/tmp/my.md5_before

Find $ORACLE _home-type f-print0 | xargs-0 md5sum >/tmp/my.md5_after

But in fact I think the audit all Oracle_home under the document is not necessary, we audit the more important $oracle_home/bin and oracle_home/lib two directory on it.