Oracle System Security Check List

From: BLOG: http://hi.baidu.com/iuuut
2. Check the list
2.1 oracle version information
A. operation instructions:
Check the version information of all currently installed database products:
When oracle7 to 8.0:
Cd $ ORACLE_HOME/orainst
./Inspdver
Oracle 8i or higher:
Cd $ ORACLE_HOME/install
Cat unix. rgs
B. output result:

2.2 check database patch installation
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba
4) SQL> Select * FROM V $ VERSION;
B. output result:

Oracle 9i enterprise edition release 9.2.0.1.0-64bit production

2.3 check the installation of Oracle Database Components
A. operation instructions:
1) view the database component versions through opatch:
Opatch is a built-in tool for Oracle 10 Gb. The version below 10 Gb must be.
Opatch lsinventory

2) view the database component versions on a Windows Host:
In Windows, click Start/Program/Oracle Installation Products/Universal Installer to start Universal Installer ". Click "installed products ..." To list the detailed directories of installed products. Select "Save as..." on the page ..." Save a text file.

3) view the database component versions on a Unix Host:
In the Xwin terminal window, run one of the following commands as an oracle user:

$ RunInstaller
$ ORACLE_HOME/bin/runInstaller
$/Opt/oracle/product/9.2.0/bin/runInstaller

Click "Installed Products ..." To list the detailed directories of installed products. Click "Save As…" on the page ...", Save a text file.
B. output result:

2.4 initial configuration information of the database (init. ora)
Including: Oracle audit settings, track files, SQL92 security, data dictionary
A. operation instructions:

Cd $ ORACLE_HOME/dbs
Cat init. ora

B. output result:

2.5 Database listener Configuration Information (listener. ora, server configuration)
Including: TNS Listener password, listener management restrictions, listener audit settings, useless listener services, listener ports.
A. operation instructions:

Cd $ ORACLE_HOME/network/admin
Cat listener. ora

B. output result:

2.6 database network instance configuration information (tnsnames. ora, client configuration)
A. operation instructions:

Cd $ ORACLE_HOME/network/admin
Cat tnsnames. ora

B. output result:

2.7 Sqlnet configuration information (sqlnet. ora)
Including: authentication, encryption, and IP connection restrictions
A. operation instructions:

Cd $ ORACLE_HOME/network/admin
Cat tnsnames. ora

B. output result:

2.8 database running status
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba
4) SQL> archive log list;
B. output result:

2.9 query password configuration policies
Including: maximum number of Logon failures, password validity period, password history retention time, password history retention times, password complexity verification function, account lock time after password expiration, and password expiration are allowed logon Time.
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba
4) SQL> select profile, resource_name, limit from dba_profiles where resource_type = PASSWORD;
B. output result:

2.10 check account status and password changes
Including Account creation records, unnecessary accounts, default accounts and passwords, empty passwords, inactive accounts, and default tablespace
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba;
4) SQL> select. name,. ctime,. ptime, B. account_status, B. profile, B. default_tablespace, B. password from user $ a, dba_users B where. name = B. username;
B. output result:

2.11 obtain accounts (shared accounts) that log on to the system from multiple terminals)
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba;
4) SQL> select count (distinct (terminal) Count, username from dba_audit_session having count (distinct (terminal)> 1 group by username;
B. output result:

2.12 obtain the list of users granted administrative permissions
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba
4) SQL> select grantee, privilege from dba_sys_privs where grantee not in (SYS, SYSTEM, DBA) and admin_option = YES;
B. output result:

2.13 list of users granted a management role
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba
4) SQL> select grantee, granted_role from dba_role_privs where grantee not in (SYS, SYSTEM, DBA) and admin_option = YES;
B. output result:

2.14 check Oracle audit settings and privileged audit items
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba
4) SQL> select name, value from v $ parameter where name like audit %;
5) SQL> select * from dbaServer: Microsoft-IIS/5.0 Date: Fri, 21Nov200808: 50: 16GMTX-Powered-By: ASP. NET_priv_audit_opts;
6) SQL> select * from dba_stmt_audit_opts;
B. output result:

2.15 check database connection settings
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba
4) SQL> select * from all_db_links;
B. output result:

2.16 find the package that authorizes the PUBLIC user group to execute permissions
A. operation instructions:
1) oracle Database User Login
2) run the SQL plus/nolog command.
3) SQL> connect/as sysdba
4) SQL> select table_name from dba_tab_privs where grantee = PUBLIC and privilege = EXECUTE and table_name in (UTL_FILE, UTL_TCP, UTL_HTTP, UTL_SMTP, DBMS_LOB, DBMS_SYS_ SQL, DBMS_JOB );
B. output result:

2.17 check whether the database debugging and development environments are separated
A. operation instructions:
Communicate with the database administrator to check whether the database debugging and development environment are separated. If you perform various debugging and development directly within the instance that provides the formal data service, the system performance may be affected, or even the entire system will crash. You can create a new test environment for debugging and development in the new environment. Each instance has its own operating platform. debugging does not affect normal database services.
B. output result:

2.18 check Database Configuration File Permissions
A. operation instructions:
1) obtain a list of all Oracle-related files from the system administrator.
2) Check the list of these files with the system administrator and database administrator to check whether their permission settings are appropriate.