Oracle reinforcement experience (Personal supplement and improvement)

Man8_msf

Recently saw oracle reinforcement experience in the blog of the coflies article: http://www.bkjia.com/Article/201008/54895.htmlIn combination with your own experience. 1. delete or lock an account Alter user username lock; Drop user username cascade; 2. Change the password Alter user username identified by "password" 3. Restrict the remote login of the database super Administrator 1. Set in spfile REMOTE_LOGIN_PASSWORDFILE = NONE 2. Set in sqlnet. ora SQLNET. AUTHENTICATION_SERVICES = NONE disable automatic SYSDBA Logon 4. Enable audit logs 1. Set the parameter audit_trail = db or OS to enable database audit. 2. Then, you can use the Audit Command to Audit the corresponding objects. 5. Set only a trusted IP address to access the database through the listener: Set the following lines in the file $ ORACLE_HOME/network/admin/sqlnet. ora on the server: Tcp. validnode_checking = yes Tcp. invited_nodes = (ip1, ip2 ...) 6. Set database connection timeout (10 minutes) Set the following parameters in sqlnet. ora: SQLNET. EXPIRE_TIME = 10 7. You can set the listener. ora file to restrict access to the database from the client IP address. The specific steps include: Tcp. validnode_checking = YES Tcp. excluded_nodes = (list of IP addresses) Tcp. invited_nodes = (list of IP addresses) Restart listener 8. Failed Login Attempts Check failed logon attempts SQL> select * from dba_profiles where RESOURCE_NAME = FAILED_LOGIN_ATTEMPTS; If the LIMIT value is NULL, we recommend that you modify the failed logon attempt. Alter profile "DEFAULT" LIMIT FAILED_LOGIN_ATTEMPTS 3; 9. By default, the password is transmitted in plaintext. Encrypted transmission through DES configured on the network Set the ORA_ENCRYPT_LOGIN variable to true on the Client. Set the DBLINK_ENCRYPT_LOGIN parameter to true on the Server. 10. restrict the number of operating system users in the DBA group. Generally, only the Oracle installer is in the DBA group. Check whether other users are in the DBA group through the/etc/passwd file. 11. Set a password for shutting down and starting the Database LISTENER (LISTENER) Run the following command to set the password: $ Lsnrctl LSNRCTL> change_password Old password: <OldPassword> Not displayed New password: <NewPassword> Not displayed Reenter new password: <NewPassword> Not displayed Connecting to (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP) (HOST = prolin1) (PORT = 1521) (IP = FIRST ))) Password changed for LISTENER The command completed successfully LSNRCTL> save_config 12. Set only trusted IP addresses to access the database through listeners You only need to set the following lines in the file $ ORACLE_HOME/network/admin/sqlnet. ora on the server: Tcp. validnode_checking = yes Tcp. invited_nodes = (ip1, ip2 ...) 13. Develop database audit policies according to business requirements 1. Set the parameter audit_trail = db or OS to enable database audit. 2. Then, you can use the Audit Command to Audit the corresponding objects.