How to Protect Your Oracle Database from Hackers

Management & Technology Consulting

 Oracle E-Business Suite DBA Since 1989
(RDBMS 5, E-Business Suite MPL 6)
 Supported many Portland Oracle Shops.
‣ Sequent Computers
‣ Nike
‣ OHSU
 Interested in Oracle Security for a long time.
 Works for Jibe Consulting.
Jibe Consulting

 Credited in 3 CPU security notes:
‣ Oracle Critical Patch Update – October 2006
‣ Oracle Critical Patch Update Advisory – October 2008
‣ Oracle Critical Patch Update Advisory – July 2013
‣ A forth security issue, for Oracle’s Hyperion software
product, is currently being worked by Oracle Development.
Jibe Consulting

5
 Late last year, I detected a password disclosure issue
with E-Business Suite R12, and reported it to Oracle.
After I made sure that Oracle Support could
replicate the issue, Oracle E-Business Suite
Development worked the issue. The password
disclosure issue has now been addressed in the July
2013 CPU security patch.
Jibe Consulting

6
 The Carnegie Mellon CERT organization has issues a
public advisory about this issue. You can see the
advisory here:
 http://www.kb.cert.org/vuls/id/826463
 As noted in the Oracle Security Alert, the CVE
number is: CVE-2013-3749
 MOS note: Potential Logging of E-Business Suite
Passwords (Doc ID 1579709.1)
Jibe Consulting

8
 You are affected if you have applied any of the E-Business
Suite CPU patches: July 2012, Oct 2012, Jan 2013, or Apr
2013. There are also two one-off patches identified that
cause the same issue: 12832734 and 10009066. See the
MOS note for the latest news about which patches
introduce the problem.
 If you are affected, please follow the mitigation steps in the
note to ensure that your E-Business Suite system is
secured.
Jibe Consulting

9
 Note: Even if you have already applied CPU July 2013,
you still need to read the note, because some of the
mitigation steps will still apply.
 I recommend doing the optional password change
mitigation step (as well as the other mitigation steps).
Jibe Consulting

10
There are two major reasons why Companies should be interest in
Database Security – Data Breaches and Compliance
 Data Breaches: Information about your patients can be useful
to identity thieves. There are a number of websites that track
data breaches. Data breaches are common, averaging more than
one data breach per day. The cost of recovering from a data
breach is significant. For the Healthcare industry, one current
report states that the average cost is $282 per breached record.
 Compliance: There are many compliance requirements.
External requirements include HIPAA, Sarbanes Oxley, PCI DSS,
various data privacy laws, state data breach laws, industry
regulations, etc. Internal requirements include security policies
and standards set by the corporate Information Security group.
In order to achieve a return on your investment in Database Security,
a company must have a Strategy and follow a road map
Jibe Consulting

11
Jibe Consulting
Publicly-Known Data Breaches (http://datalossdb.org)
0
10
20
30
40
50
60
70
80
8/1/1903
8/1/1983
11/1/1986
10/1/1988
12/1/1993
4/1/1997
10/1/1998
1/1/2000
11/1/2000
2/1/2001
5/1/2001
10/1/2001
3/1/2002
2/1/2003
7/1/2003
1/1/2004
4/1/2004
7/1/2004
11/1/2004
2/1/2005
5/1/2005
8/1/2005
11/1/2005
2/1/2006
5/1/2006
8/1/2006
11/1/2006
2/1/2007
5/1/2007
8/1/2007
11/1/2007
2/1/2008
5/1/2008
8/1/2008
11/1/2008
2/1/2009
5/1/2009
8/1/2009
11/1/2009
2/1/2010
Number of Data Breaches per Month
Total

12
Average Cost of a Data Breach (per record lost)
Source: 2008 Annual Study: Cost of a Data Breach
(Performed by Ponemon Institute, Sponsored by PGP Corporation)
Jibe Consulting

13
Source: 2009 Annual Study: Cost of a Data Breach
(Performed by Ponemon Institute, Sponsored by PGP Corporation)
Jibe Consulting

14
 External Compliance Requirements:
‣ HIPAA.
‣ Sarbanes Oxley.
‣ Payment Card Industry Data Security Standard.
‣ ARRA: American Recovery and Reinvestment Act of 2009.
Data breach of unsecured PHI requires notification starting
9/15/09.
‣ Other Data Privacy and Data Breach Laws.
Jibe Consulting

15
 Security standards: General rules:
‣ Ensure the confidentiality, integrity, and availability of all EPHI.
‣ Protect against anticipated threats or hazards to the security or integrity of
EPHI.
‣ Protect against anticipated unauthorized uses or disclosures of EPHI.
 Technical safeguards:
‣ Access control: Required: Unique user identification, Emergency access
procedure. Addressable: Automatic logoff, Encryption and decryption.
‣ Audit controls: Required: for activity that uses EPHI.
‣ Integrity: Addressable: Mechanism to authenticate electronic protected
health information.
‣ Person or entity authentication: Required: to authenticate users of EPHI.
‣ Transmission security: Addressable: Integrity controls, Encryption.
 EPHI: Electronic protected health information. Individually identifiable
health information is protected. For example: names, dates, addresses or locations,
telephone#, fax#, email, SSN, Med Rec#, License plate, etc.)
Jibe Consulting

16
Oracle
RDBMS
SQL*Net Listener
Identificationand
Authentication
StandardRoles
SecureApplicationRoles
Authorized Privileges
StandardAuditing
Fine GrainedAuditing
Virtual PrivateDatabase
StandardEncryption
Additional
Options
AdvancedSecurityOption
AuthenticationOptions
TransparentData Encryption
Oracle LabelSecurity
Oracle DatabaseVault
Oracle Audit Vault
Oracle
Application
Server
Oracle Identity Management
AuthenticationOptions
EnterpriseUsers
EnterpriseRoles
Single Sign-On
Proxy Authentication
Oracle
Enterprise
Manager
SoftwareInventory
Patch Availability
Job Scheduling
SecurityPolicies
SecurityReports
Data Masking Pack
ConfigurationManagement
Pack
Jibe Consulting

Established: 2004
Employees: 130+
Customers: 200+ Over 1000 Projects
Industry Focus: Retail, Manufacturing (process, industrial & high tech),
Consumer Products, Oil & Gas, Engineering and Construction,
Life Sciences, Healthcare, Software and Clean Technologies
Principal business areas:
Management Consulting Technology Consulting
• Business & IT Alignment Strategy • ERP Implementations
• Business & Technology Strategy • Edge Products – PLM, CRM, EPM
• Lean Enterprise Process Analysis & Design • Information Management & Business Intelligence
• Program / Project Management • Managed Services & Hosting
17
Jibe Consulting

18
 Comprehensive Security
Audits with Oracle best
practices & 3rd party security
tools
 Complete systems
management & monitoring
with Oracle Enterprise
Manager
 Extensive Business
Intelligence Solutions with
Hyperion, OBIEE,
Informatica, Discoverer &
Oracle Data Integrator
 Experts in Oracle
Virtualization, including
VMWare, virtual clustering &
Storage infrastructure
 Oracle Gold Partner – Certified
Since 2004
 Certified Microsoft Partner
Since 2006
 IBM Business Partner
 Authorized reseller of Oracle
Products and Education
 Dedicated Technology
consultants local to the PNW &
RMR
 12+ years average industry
experience; 8+ years average
technology experience
 100% of consultants certified
in relevant software or
industry accreditations
 Managed Services
Organization
 Onshore resources
 Remote systems
management
 Hosting
 Virtualization
 Project Jumpstarts
The Resources The Experience The Tools
 Business Intelligence
 Enterprise Performance
Management
 Data Warehousing
 Database installation & Upgrades
 RAC / Grid
 High Availability
 Security Assessments
 Managed Services
 Security
 DBMS
 Hosting
 Virtualization of Database &
Packaged Software (ERP, EPM, BI)
 SOA Enablement
 ESB, Canonical Modeling
 Agile based project development
methodology for Iterative
prototyping and rapid
implementation techniques
Jibe Consulting

19
 Review: Set scope and
review environment.
 Inform: Inform client
about security metrics.
 Assess: Measure security
using chosen metrics.
 Rank: Rank issues based
on risk.
 Recommend: What
needs to be done to
improve database
security?
Review
Inform
Assess
Rank
Recommend
Jibe Consulting

20
 Jibe Consulting commends Oracle Corporation on
providing an excellent checklist for establishing a security
baseline for Oracle databases.
 Jibe Consulting has enhanced this to provide metrics (for
measuring compliance to this security baseline), and
processes (for determining compliance).
 Where appropriate, Jibe Consulting has also added
commentary about security issues related to items in the
security checklist.
Jibe Consulting

21
 “The Oracle Database software installation has two
modes - typical and custom. For production systems,
the custom installation mode can be used to install
the minimum set of features and options required. If
in the future, you wish to install additional features
or options, simply re-run the Oracle installer.
Jibe Consulting

22
 When installing RDBMS, use “custom” to install
minimal set of features.
 Do not install sample schemas
Jibe Consulting

23
 METRIC: Only the minimum Oracle software needed to
do the job is installed.
 METRIC: XDB listener is not activated if it is not
needed.
 METRIC: XPT listener is not activated if it is not
needed.
 METRIC: Sample schemas are not installed.
 METRIC: If Sample schemas are installed, the accounts
are locked.
Jibe Consulting

24
 416132.1: XML Database FAQ
 362540.1: How to Setup XDB Protocol Server: FTP, HTTP,
WebDAV
 Disable the XDB-specific dispatchers, and restart the
listener.
 742156.1: 9iR2: How to Determine if XDB is Being Used in
the Database?
 742113.1: 10g: How to Determine if XDB is Being Used in
the Database?
 733667.1: 11g: How to Determine if XDB is Being Used in
the Database?
 274508.1: Listener Issue: Removing XDB Handlers for
HTTP and FTP Ports 8080 and 2100
Jibe Consulting

25
 “The Oracle database installs with a number of
default (preset) user accounts. Each account has a
default (preset) database password. After
successful installation of the database the database
configuration assistant (DBCA) automatically locks
and expires most default database user accounts. In
addition, the password for accounts such as
SYSTEM are changed to the value specified during
database installation.
Jibe Consulting

26
 METRIC: Most default accounts are locked and
expired.
Jibe Consulting

27
 The following SQL can be used to lock and expire
database accounts.
sqlplus> connect mydba
sqlplus> alter user jsmith account lock and expire”
Jibe Consulting

28
select username, account_status
from dba_users
where username in (
'ADAMS', 'ANONYMOUS', 'APEX_PUBLIC_USER',
'AURORA$ORB$UNAUTHENTICATED',
'BI', 'BLAKE', 'CLARK', 'CTXSYS', 'DBSNMP', 'DIP', 'DMSYS', 'EXFSYS',
'FLOWS_03000', 'FLOWS_FILES', 'HR', 'IX', 'JONES', 'LBACSYS', 'MDDATA',
'MDSYS', 'MGMT_VIEW', 'ODM', 'ODM_MTR', 'OE', 'OLAPSYS', 'ORACLE_OCM',
'ORDPLUGINS', 'ORDSYS', 'OUTLN', 'OWBSYS', 'PERFSTAT', 'PM', 'QS',
'QS_ADM', 'QS_CB', 'QS_CBADM', 'QS_CS', 'QS_ES', 'QS_OS', 'QS_WS',
'RMAN', 'SCOTT', 'SH', 'SI_INFORMTN_SCHEMA', 'SPATIAL_CSW_ADMIN_USR',
'SPATIAL_WFS_ADMIN_USR', 'SYS', 'SYSMAN', 'SYSTEM', 'TRACESVR', 'TSMSYS',
'WKPROXY', 'WKSYS', 'WK_TEST', 'WMSYS', 'XDB', 'XS$NULL'
)
order by username;
Jibe Consulting

29
The most foolproof way?
 Develop and test a password change procedure for
all places where passwords are used:
‣ VPN
‣ OS
‣ Database
‣ Middle-tier
‣ Applications (E-Business Suite, etc.)
 Generate random, long, complex passwords.
 Change ALL passwords.
Jibe Consulting

30
 “Choosing secure passwords and implementing
good password policies are by far the most
important defense for protecting against password
based security threats. Oracle recommends
customers use passwords at least 10 values in
length. In addition, the complexity of the password
is critical. Passwords that are based on dictionary
words are vulnerable to "Dictionary based attacks".
Jibe Consulting

31
 A complex password should contain:
‣ At least 10 values in length
‣ A mixture of letters and numbers
‣ Contain mixed case (Supported in Oracle Database 11g)
‣ Include symbols (Supported in Oracle Database 11g)
‣ Little or no relation to an actual word
Jibe Consulting

32
 METRIC: Password must be at least 10
characters in length.
 METRIC: Password must have both letters and
numbers.
 METRIC: Password must have symbols (“_$#” are
allowed prior to 11g).
 METRIC: Password must have little or no
relation to an actual word.
Jibe Consulting

33
 Prior to 11g: There are some Oracle password
cracking programs that, given the password hash,
can determine the password. If the password is
short and simple, the cracking programs can obtain
the password fairly quickly. If the password is long
and complex, it takes much longer for the cracking
programs to determine the password.
Jibe Consulting

34
 Given this:
1) Choose long, complex passwords.
2) Change passwords reasonably often.
3) Protect the password hashes.
Password hashes are found in SYS tables and also in
the password file in ?/dbs/orapw* files.
Jibe Consulting

35
‣ VPN
‣ OS
‣ Database
‣ Middle-tier
Jibe Consulting

36
 “While you can use the same password for
administrative accounts such as SYSTEM, SYSMAN and
DBSNMP, Oracle recommends using different
passwords for each. In any Oracle environment, be it
production or test, assign strong and distinct
passwords to these administrative accounts.”
 METRIC: Passwords on Administrative accounts are
distinct.
 METRIC: Passwords on Administrative accounts are
strong.
Jibe Consulting

37
 “The default account SCOTT no longer installs
with the default password TIGER. The account is
now locked and expired upon install. All other
accounts installed with a default password that is
the same as the user account. If any of these
accounts is unlocked, assign a new stronger
password. Starting with Oracle Database 11g
security administrators can easily check for
default passwords by using the new database view
DBA_USERS_WITH_DEF_PWD.”
Jibe Consulting

38
 METRIC: All open accounts have non-default
passwords.
 HOW TO CHECK: Run default password scanners.
‣ Oracle’s default password scanner:
‣ MOS note 361482.1: Frequently Asked Questions about
Oracle Default Password Scanner.
‣ Patch 4926128: ORACLE DEFAULT PASSWORD SCANNER
Jibe Consulting

39
 3rd-party default password scanners:
 Pete Finnigan’s password scanner:
‣ http://www.petefinnigan.com/default/default_password
_checker.htm
 NGS Squirrel for Oracle
‣ http://www.ngssoftware.com/products/database-
security/ngs-squirrel-oracle.php
Jibe Consulting

40
 Default password scanners are not all alike. For
example, if you compare the Oracle default
password scanner (from patch 4926128) and Pete
Finnigan’s default password scanner, you will find
many different username, hash_value
combinations that are checked. So, it is good to
run multiple default password scanners.
Jibe Consulting

41
 A better solution would be to evaluate all
accounts. If an account is not a person account,
you should ensure that the password is not
defaulted. One way to do this is to change the
passwords to strong passwords. The Oracle
Database Security Checklist has some guidelines
for strong passwords.
Jibe Consulting

42
 One possible method is to use long, randomly-
generated passwords. (You can store them in a
password safe – randomly generated passwords
are difficult to memorize). If you want to use that
method, some random password generators can
be found here:
 https://secure.pctools.com/guides/password/
 http://keepass.info/
Jibe Consulting

43
‣ VPN
‣ OS
‣ Database
‣ Middle-tier
Jibe Consulting

44
Jibe Consulting
 “Oracle recommends customers enforce failed login,
password expiration, password complexity and reuse
policies using Oracle profiles and follow best practices
defined by Oracle Applications. Oracle Database 11g
provides an optional installation choice that will pre-
configure a default profile to enforce password expiration
and reuse. Oracle recommends that basic password
management rules be applied to all user passwords and
that all users be required to change their passwords
periodically.”

45
Jibe Consulting
 METRIC: Accounts are locked out after a certain
number of failed logins.
 METRIC: Password expiration is implemented.
 METRIC: Password reuse policies are implemented

46
Jibe Consulting
 HOW TO CHECK: Examine the password-related settings in
the profiles.
select * from dba_profiles
where resource_name like '%PASSWORD%’;

47
Jibe Consulting
 Sample Profile settings:
 ALTER PROFILE xys LIMIT PASSWORD_REUSE_TIME 30
PASSWORD_REUSE_MAX 5;
 The last 5 passwords cannot be reused. Users must wait
30 days before changing their passwords again.
 ALTER PROFILE xyz LIMIT PASSWORD_LIFE_TIME 83
PASSWORD_GRACE_TIME 7;
 Password expires after 90 days. Warnings are issues 7
days before password expiration.

48
Jibe Consulting
 ALTER PROFILE xyz LIMIT FAILED_LOGIN_ATTEMPTS 3
PASSWORD_LOCK_TIME UNLIMITED;
 After 3 failed login attempts, the account is locked. You
have to manually unlock the account before it can be used
again.

49
Jibe Consulting
 Number of accounts with passwords that have never been
changed:
select count(*) from sys.user$
where user# in (select user_id from dba_users
where account_status = 'OPEN')
and (
(ptime is null)
or
(ptime is not null
and ptime <= ctime)
);

50
Jibe Consulting
 Oldest password change time:
select min(ptime) from sys.user$
where user# in (select user_id from dba_users
where account_status = 'OPEN')
and ptime is not null
and ptime > ctime;

51
 Secure External Password Store
“The Secure External Password Store feature
introduced with Oracle Database 10g Release 2 is
designed to help secure batch jobs that authenticate
to the database using username / password
credentials. The secure external password store uses
an Oracle Wallet to hold one or more user
name/password combinations to run batch
processes and other tasks that run without user
interaction.
Jibe Consulting

52
 METRIC: Secure Password Store is used to
authenticate batch jobs
Jibe Consulting

53
 HOW TO CHECK:
 How do batch jobs connect to the database? If they
need database passwords supplied, then the password
needs to be cached somewhere and supplied to the
batch job so it can connect to the database.
 In 10gR2, there is a feature called the Secure Password
Store. This allows you to use an Oracle Wallet to store
login credentials for one account per TNS alias. This
means that plaintext passwords are not stored
anywhere on the system.
Jibe Consulting

54
 Resources:
‣ Oracle® Database Security Guide 10g Release 2 (10.2),
Chapter 9 Secure External Password Store.
‣ MOS note 340559.1: Using The Secure External Password
Store.
‣ MOS note 759226.1: How To Maintain Multiple Wallets For
A Single Database Instance.
Jibe Consulting

55
 Notes:
‣ The sqlnet.ora file location: $TNS_ADMIN/sqlnet.ora,
$HOME/.sqlnet.ora
‣ Each Secure Password Store can contain only 1
username/password setting per TNS alias.
Jibe Consulting

56
 “Special attention should be given to managing access to
the SYSDBA and SYSOPER roles. As with any database role,
careful consideration should be given when granting these
roles. Oracle recommends customers refrain from
connecting with the SYSDBA role except when absolutely
required such as called for by an existing Oracle feature or
patching. Moving forward Oracle will be eliminating all
dependencies on direct connections using SYSDBA. Large
and small organizations should create separate
administrative accounts.
Jibe Consulting

57
 METRIC: Database administrators use SYSDBA and
SYSOPER login privileges only when necessary.
 METRIC: Unsuccessful SYSDBA and SYSOPER
connections are audited.
 METRIC: Audit logs are monitored for unsuccessful
SYSDBA and SYSOPER connections.
Jibe Consulting

58
 HOW TO CHECK:
‣ Ask the DBAs if they only use SYSDBA and SYSOPER
privileges when needed.
Jibe Consulting

59
 Make sure auditing is enabled.
 INIT.ORA: AUDIT_TRAIL:
 alter system set audit_trail=os scope=spfile;
Jibe Consulting

60
 Write text file to ADUMP destination.
 Writing audit trail records to the OS is
recommended by Oracle.
 Other possible settings are:
 alter system set audit_trail=db scope=spfile;
Jibe Consulting

61
 Write to AUD$
 alter system set audit_trail='db','extended' scope=spfile;
 Write to AUD$ with SQL statements.
 249438.1: 10G: New Value DB_EXTENDED for the
AUDIT_TRAIL init.ora Parameter
 alter system set audit_trail='xml' scope=spfile;
Jibe Consulting

62
 Write XML file to ADUMP destination.
 alter system set audit_trail='xml','extended' scope=spfile;
Jibe Consulting

63
 “Oracle recommends that customers implement data
dictionary protection to prevent users who have the "ANY"
system privileges from using such privileges to modify or
harm the Oracle data dictionary.
 To enable data dictionary protection, set the
O7_DICTIONARY_ACCESSIBILITY parameter to FALSE. This
can be accomplished by using Oracle Enterprise Manager
Database Control
Jibe Consulting

64
 METRIC: Data Dictionary Protection is enabled.
 HOW TO CHECK:
 Ensure that INIT.ORA parameter
O7_DICTIONARY_ACCESSIBILITY = FALSE.
Jibe Consulting

65
 “Oracle recommends you avoid granting powerful
privileges to new database users, even privileged users.
The Oracle DBA role should be granted with caution and
only to those privileged user who need full DBA privileges.
Special attention should be given when assigning
privileges to application schemas. Access to the SYSDBA
role should be granted with extreme care and only to those
who are in the most trusted position. Auditing should be
used to monitor all activities of users connecting with the
SYSDBA role or other administrative roles such as the DBA
role, CREATE ANY TABLE privilege and so forth. For
optimal auditing performance set your audit destination to
point to the operating system.”
Jibe Consulting

66
 METRIC: The DBA role is only granted to users who need full
DBA privileges.
 METRIC: The SYSDBA privilege is only granted to users who
need SYSDBA privileges.
 METRIC: The “… ANY …” privileges are only granted to users
who need those privileges.
 METRIC: All activities of users connecting with the SYSDBA
role are audited.
 METRIC: All activities of users who have the DBA role are
audited.
 METRIC: All usage of “…ANY…” privileges is audited.
Jibe Consulting

67
 HOW TO CHECK:
 To see which users have the DBA role:
 http://www.petefinnigan.com/who_has_role.sql
Jibe Consulting

68
 To see which users have the SYSDBA role:
select * from v$pwfile_users;
 To see which users have “…ANY…” privileges:
select grantee, count(*) num_any_privs from
dba_sys_privs
where privilege like '% ANY %'
group by grantee;
Jibe Consulting

69
 If you wish to delve deeper into specific privileges, you can
use the script:
‣ http://www.petefinnigan.com/who_has_priv.sql
 To check to see what is currently being audited:
 select * from dba_stmt_audit_opts;
 select * from dba_priv_audit_opts;
 select * from dba_obj_audit_opts;
Jibe Consulting

70
 To audit the SYSDBA activities, see MOS note 174340.1:
Audit SYS user Operations. This additional SYS auditing
can be enabled by setting the INIT.ORA parameter:
 AUDIT_SYS_OPERATIONS = TRUE.
 To audit activities of users who have the DBA role,
determine which users have the DBA role, then activate
auditing for those users:
 audit all privileges by <user> by access;
Jibe Consulting

71
 To audit the use of “…ANY…” privileges:
 Get a list of the “… ANY …” privileges:
select name from system_privilege_map
where name like '% ANY %';
 Enable auditing for the use of each of those privileges.
Here is a SQL statement that will generate the appropriate
AUDIT statements:
select 'audit ' || name || ';' sql_stmt
from system_privilege_map
Jibe Consulting

72
 To disable auditing for certain “… ANY …” privileges:
select 'noaudit ' || name || ';' sql_stmt
from system_privilege_map
Jibe Consulting

73
 “The topic of PUBLIC privileges is part of Oracle's overall
secure-by-default initiative that started with Oracle
Database 9i. New in the Oracle Database 11g release are
granular authorizations for numerous PL/SQL network
utility packages granted to PUBLIC. If you have upgraded
from a previous release of Oracle Database, and your
applications depend on PL/SQL network utility packages
such as UTL_TCP, UTL_SMTP, UTL_MAIL, UTL_HTTP AND
UTL_INADDR the following error may occur when you try
to run the application:
Jibe Consulting

74
 METRIC: Execute permission for UTL_ networking
packages has been revoked from PUBLIC.
 METRIC: UTL_FILE_DIR does not include any wildcards.
 METRIC: UTL_FILE_DIR does not include sensitive or
protected directories.
 METRIC: The UTL_FILE_DIR init.ora parameter is not
used.
 METRIC: UTL_FILE access is controlled via DIRECTORY
objects.
Jibe Consulting

75
 HOW TO CHECK:
select * from dba_tab_privs
where table_name in
('UTL_TCP','UTL_SMTP','UTL_INADDR','UTL_HTTP','UTL_MAIL'
)
and grantee = 'PUBLIC';
 This should return no rows.
Jibe Consulting

76
 show parameter utl_file_dir
 The value of this INIT.ORA parameter should be blank.
 select * from dba_directories;
 This should return rows.
Jibe Consulting

77
 When granting permissions on run-time facilities such as
the Oracle Java Virtual Machine (OJVM), grant permissions
to the explicit or actual document root file path. This code
can be changed to use the explicit file path.
Jibe Consulting

78
 dbms_java.grant_permission
('SCOTT','SYS:java.io.FilePermission','<<ALL
FILES>>','read');
 dbms_java.grant_permission
('SCOTT','SYS:java.io.FilePermission','<<actual directory
path>>','read');
Jibe Consulting

79
 METRIC: Additional File I/O runtime privileges for Java
use specific directory paths.
Jibe Consulting

80
 HOW TO CHECK:
 select * from dba_java_policy
 where type_name like '%File%';
Jibe Consulting

81
 There are also Java permissions for network access. Here
is a SQL statement that shows the existing Java
permissions:
select * from dba_java_policy
where type_name like '%Socket%‘;
 As an increased security measure, DBAs may wish to
restrict these Java permissions also.
Jibe Consulting

82
 “Oracle recommends verifying that the database
initialization parameter REMOTE_OS_AUTHENT is
set to FALSE. Setting the value to FALSE creates a
more secure configuration by enforcing server-
based authentication of clients connecting to an
Oracle database. The default setting for this
parameter is FALSE and it should not be changed.”
Jibe Consulting

83
 METRIC: INIT.ORA parameter remote_os_authent
is FALSE.
Jibe Consulting

84
 HOW TO CHECK:
 show parameter remote_os_authent
Jibe Consulting

85
 “Limit the number of users with operating system access
on the Oracle Database host. Oracle recommends
restricting the ability to modify the default file and
directory permissions for the Oracle Database home
(installation) directory or its contents. Even privileged
operating system users and the Oracle owner should not
modify these permissions, unless instructed otherwise by
Oracle.
Jibe Consulting

86
 Restrict usage of symbolic links on the operating system.
When providing a path or file to the Oracle database,
neither the file nor any part of the path should be
modifiable by an un-trusted user. The file and all
components of the path should be owned by the DBA or
another trusted operating system account.”
Jibe Consulting

87
 METRIC: Number of users with OS access to database
server is limited.
 METRIC: Restrict OS-level access to files with sensitive
content.
 METRIC: Files underneath $ORACLE_HOME can only be
modified by DBAs.
 METRIC: Nodes above $ORACLE_HOME can only be
modified by administrators.
Jibe Consulting

88
 METRIC: Components of file paths to database files are
only modifiable by a trusted user.
 METRIC: Components of file paths to database files are
owned by a trusted user.
 METRIC: Use of symbolic links is restricted.
Jibe Consulting

89
 HOW TO CHECK:
 Review /etc/passwd with the DBA, to ensure that the
number of users with OS level access is limited.
Jibe Consulting

90
 Scripts to check ownership and permissions of
$ORACLE_HOME files:
 find $ORACLE_HOME ! -user oracle -print | xargs ls -ld
 find $ORACLE_HOME ! -group oinstall -print | xargs ls -ld
 find $ORACLE_HOME -perm -2 ! –type l -print | xargs ls -ld
Jibe Consulting

91
 Navigate up the filepath, and do an “ls -ld" to determine if
the node is modifiable by untrusted personnel.
Jibe Consulting

92
 Ensure that the database datafiles are not readable by
persons with non-DBA privileges.
select name from v$controlfile
union select member from v$logfile
union select name from v$datafile
union select name from v$tempfile;
 Then, examine the ownership and permissions on the
individual files.
Jibe Consulting

93
 “The Oracle Listener should be properly configured
for optimal security. Oracle Database 10g Release 1
and higher uses local OS authentication as the
default authentication mode. This mode requires the
Oracle Net administrator to be a member of the local
DBA group.
Jibe Consulting

94
 You should also consider using a firewall. Proper use
of a firewall will reduce exposure to security related
information including port openings and other
configuration information located behind the
firewall. Oracle Net supports a variety of firewalls.”
Jibe Consulting

95
 METRIC: Listeners prior to 10g have access
controlled via a password.
 METRIC: Listeners 10g or later do not have a
password.
 METRIC: Firewalls are used to limit SQL*Net
connections from trusted clients only
Jibe Consulting

96
 HOW TO CHECK:
 Run:
‣ lsnrctl status
 Look for:
‣ Security ON: Local OS Authentication
Jibe Consulting

97
 “The default configuration for external procedures
no longer requires a network listener to work with
Oracle Database and EXTPROC agent. The EXTPROC
agent is spawned directly by Oracle Database and
eliminates the risks that extproc might be spawned
by Oracle Listener, unexpectedly. This default
configuration is recommended for maximum
security.
Jibe Consulting

98
 Having your EXTPROC agent spawned by Oracle
Listener is necessary if you use:
‣ Multi-threaded Agent
‣ Oracle Database in MTS mode on Windows
‣ AGENT clause of the LIBRARY specification or AGENT IN
clause of the PROCEDURE specification such that you can
redirect external procedures to a different EXTPROC agent.
Jibe Consulting

99
 METRIC: Listener configuration files do not have
EXTPROC configured.
 METRIC: If EXTPROC functionality is required, is has
been configured securely.
 METRIC: EXTPROC_DLLS=ONLY has been used instead
of EXTPROC_DLLS=ALL.
 METRIC: A separate listener, running as an
unprivileged user, is used for EXTPROC.
 METRIC: Audit who has the CREATE LIBRARY
privileges
Jibe Consulting

100
 HOW TO CHECK:
 Review the SQL*Net Listener configuration files:
‣ Are EXTPROC entries present?
‣ If so, is EXTPROC_DLLS=ONLY (used instead of
EXTPROC_DLLS=ALL)?
‣ Is EXTPROC functionality provided via a separate listener?
‣ Is the separate listener running as an unprivileged user?
Jibe Consulting

101
 “When the ADMIN_RESTRICTIONS_LISTENER is set
to ON (Default) runtime changes to the listener
parameters is disabled. To make changes, the
LISTENER.ORA file must be modified and manually
reloaded.”
Jibe Consulting

102
 METRIC: The SQL*Net Listener
ADMIN_RESTRICTIONS parameter is set to ON.
Jibe Consulting

103
 HOW TO CHECK:
 Review the listener.ora file. You should see:
‣ ADMIN_RESTRICTIONS_{listener name} = ON
 If it is not set, you can edit the listener.ora file
manually.
Jibe Consulting

104
 “Use the Oracle Net valid note checking security
feature to allow or deny access to Oracle server
processes from network clients with specified IP
address. To use this feature, set the following
protocol.ora (Oracle Net configuration file)
parameters:
‣ tcp.validnode_checking = YES
‣ tcp.excluded_nodes = {list of IP addresses}
‣ tcp.invited_nodes = {list of IP addresses}
Jibe Consulting

105
 The first parameter turns on the feature whereas
the latter parameters respectively deny or allow
specific client IP address from making connections
to the Oracle listener.”
Jibe Consulting

106
 METRIC: SQL*Net valid node checking is used to
limit access to the SQL*Net listener.
Jibe Consulting

107
 HOW TO CHECK:
 Review the
$ORACLE_HOME/network/admin/sqlnet.ora file.
 See if these parameter are set.
Jibe Consulting

108
 Oracle recommends limiting client connections from
authorized clients only. This can be activated via the
Database Access Control parameters
(TCP.VALIDNODE_CHECKING,
TCP.EXCLUDED_NODES, and TCP.INVITED_NODES).
This configuration can be done using Oracle Net
Manager.
Jibe Consulting

109
 Resources:
 http://download.oracle.com/docs/cd/B19306_01/
network.102/b14212/profile.htm#sthref868
 See MOS note 462933.1 (“What is Validnode
Verification and How to Use It”) for details.
Jibe Consulting

110
 “Both UNIX and Windows platforms provide a
variety of operating system services, most of which
are not necessary for most deployments. Such
services include FTP, TFTP, TELNET and so forth. Be
sure to close both the UDP and TCP ports for each
service that is being disabled. Disabling one type of
port and not the other does not make the operating
system more secure.”
Jibe Consulting

111
 METRIC: Unencrypted UNIX services are
disabled on the server
Jibe Consulting

112
 HOW TO CHECK:
 Check which services are enabled on the server. For
Unix, look at /etc/inetd.conf. This will tell you if any
unencrypted services are enabled.
Jibe Consulting

113
 “Consider encrypting network traffic between
clients, databases and application servers. Oracle
supports both SSL using X.509v3 certificates as well
as native network encryption without certificates.”
Jibe Consulting

114
 METRIC: SQL*Net traffic is encrypted
Jibe Consulting

115
 Where do the special SQL*Net values go?
‣ Server-side values go in listener.ora
‣ Client-side values go in sqlnet.ora
Jibe Consulting

116
 TRACE_LEVEL_ORCL = OFF
 #### TRACE_LEVEL_ORCL = SUPPORT
 SQLNET.ENCRYPTION_SERVER = REQUESTED
 SQLNET.CRYPTO_CHECKSUM_SERVER = REQUESTED
 SQLNET.ENCRYPTION_CLIENT=REQUESTED
 SQLNET.CRYPTO_CHECKSUM_CLIENT=REQUESTED
Jibe Consulting

117
 TRACE_LEVEL_CLIENT = OFF
 TRACE_LEVEL_SERVER = OFF
 #### TRACE_LEVEL_CLIENT = SUPPORT
 #### TRACE_LEVEL_SERVER = SUPPORT
 SQLNET.ENCRYPTION_SERVER=REQUIRED
 SQLNET.CRYPTO_CHECKSUM_SERVER=REQUIRED
 SQLNET.ENCRYPTION_CLIENT=REQUIRED
 SQLNET.CRYPTO_CHECKSUM_CLIENT=REQUIRED
Jibe Consulting

118
 “Always apply relevant security patches for both the
operating system and Oracle. Periodically check the Oracle
Technology Network (OTN) security site for details on
security alerts released by Oracle. Also check Oracle
Worldwide Supports services site, MOS, for detailed on
available and upcoming security related patches and
application specific secure configuration information.”
Jibe Consulting

119
 METRIC: The latest CPU security patches are applied in
a timely fashion.
Jibe Consulting

120
 HOW TO CHECK:
 Use “opatch lsinventory” to get a list of patches that have
been applied, and look up those patches on MOS. Then,
you will know which patches have been applied.
Jibe Consulting

121
 “If you believe that you have found a security
vulnerability in the Oracle Database, submit an
service request to Oracle Worldwide Support
Services using MOS, or email a complete description
of the problem including product version and
platform, together with any scripts and examples to
the following address:
‣ secalert_us@oracle.com”
Jibe Consulting

122
 METRIC: If the DBAs find a security vulnerability,
they report it to Oracle.
Jibe Consulting

How to Protect Your Oracle Database from Hackers

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to How to Protect Your Oracle Database from Hackers (20)

Recently uploaded (20)

How to Protect Your Oracle Database from Hackers