OWASP Backend Security Project Oracle Hardening - Revision history

Carlo.pelliccioni: /* Overview */

2008-10-29T14:52:55Z

‎Overview

Carlo.pelliccioni: /* Description */

2008-10-29T14:52:34Z

‎Description

Carlo.pelliccioni: /* Check Audit */

2008-10-20T10:05:20Z

‎Check Audit

Carlo.pelliccioni: /* Disable Audit */

2008-10-20T10:04:16Z

‎Disable Audit

Carlo.pelliccioni: /* Enable Audit */

2008-10-20T10:03:30Z

‎Enable Audit

Carlo.pelliccioni: /* Start Audit Service */

2008-10-20T10:02:09Z

‎Start Audit Service

Carlo.pelliccioni: /* Audit */

2008-10-20T10:01:17Z

‎Audit

Carlo.pelliccioni: /* Logging */

2008-10-20T10:00:10Z

‎Logging

Carlo.pelliccioni: /* External procedures */

2008-10-20T09:59:24Z

‎External procedures

Carlo.pelliccioni: /* Network address restriction */

2008-10-20T09:57:02Z

‎Network address restriction

← Older revision		Revision as of 14:52, 29 October 2008
Line 1:		Line 1:
	= Overview =		= Overview =
		+	== Installation security ==
		+
		+	This section is useful to understand how the installation could introduce vulnerabilities when it is not made “security oriented”.
		+
		+	=== Options and products ===
		+
		+	First of all an advanced installation should be performed to custom the installation process to install only the components required by application will connect to database.
		+
		+	=== Sample schemas ===
		+
		+	The installed schema should be reviewed, especially the sample schemas provided by Oracle base installation, and remove any schema not needed.
		+
		+	Example SQL to remove a schema:
		+
		+	SQL> DROP USER <user_name> CASCADE;

	= Description =		= Description =

← Older revision		Revision as of 14:52, 29 October 2008
Line 2:		Line 2:

	= Description =		= Description =
−
−	~~== Installation security ==~~
−
−	~~This section is useful to understand how the installation could introduce vulnerabilities when it is not made “security oriented”.~~
−
−	~~=== Options and products ===~~
−
−	~~First of all an advanced installation should be performed to custom the installation process to install only the components required by application will connect to database.~~
−
−	~~=== Sample schemas ===~~
−
−	~~The installed schema should be reviewed, especially the sample schemas provided by Oracle base installation, and remove any schema not needed.~~
−
−	~~Example SQL to remove a schema:~~
−
−	~~SQL> DROP USER <user_name> CASCADE;~~

	=== Initialization parameters ===		=== Initialization parameters ===

@@ Line 450: / Line 450: @@
 === Check Audit ===
-If you are using the database audit trail you should use the “SELECT” statement from the follow view to show the enabled audit:
+When using the database audit trail use the “SELECT” statement from the follow view to show the enabled audit:
 {| class="wikitable"

@@ Line 444: / Line 444: @@
 === Disable Audit ===
-To turning off an audit options you should use the statement “NOAUDIT”, such as:
+To turn off an audit option use the statement “NOAUDIT”, such as:
   SQL> NOAUDIT ALL PRIVILEGES;
 === Check Audit ===

@@ Line 428: / Line 428: @@
 === Enable Audit ===
-Once you start the audit service, you can choose to audit the sys operation by setting the AUDIT_SYS_OPERATION to TRUE. So that, Oracle Database audit connections to the database with administrator privileges, database startup and shutdown.
+Once you start the audit service, it is possible choose to audit the sys operation by setting the AUDIT_SYS_OPERATION to TRUE. So that, Oracle Database audit connections to the database with administrator privileges, database startup and shutdown.
-Then, you can enable other options, by using AUDIT SQL statement:
+Then, it is possible enable other options, by using AUDIT SQL statement:
 * Statement Auditing.

@@ Line 424: / Line 424: @@
 === Start Audit Service ===
-To start the audit service you should execute “cataudit.sql” as SYS account. Then, you should choose if you want store the audit record to DataBase or Operating System file by setting the parameter “AUDIT_TRAIL” to DB or OS.
+To start the audit service execute “cataudit.sql” as SYS account. Then, choose if it is wanted to store the audit record to DataBase or Operating System file by setting the parameter “AUDIT_TRAIL” to DB or OS. The database audit trail is a single table named SYS.AUD$, but there are predefined views that help to use the information in this table, while as regard operating system audit trail the audit records are written into the directory that you choose by setting the “AUDIT_FILE_DEST” parameter.
 === Enable Audit ===

@@ Line 420: / Line 420: @@
 == Audit ==
-To properly protect database access you should implement auditing of user database activities in order to  identify any suspicious activity or to check if an user has more privileges than expected.
+To properly protect database access the auditing of user database activities should be implemented in order to identify any suspicious activity or to check if an user has more privileges than expected.
 === Start Audit Service ===

@@ Line 411: / Line 411: @@
 === Logging ===
-To enable logging on the listener, you should use Net Manager utility or modify the listener.ora file on server machine.
+To enable logging on the listener, use Net Manager utility or modify the listener.ora file on server machine.
 At the end, the listener.ora file should contain the follow entries:

@@ Line 356: / Line 356: @@
 === External procedures ===
-The EXTPROC functionality used by PL/SQL component to make calls to the operating system and to load necessary library to execute external procedure, but if the Oracle Database server is not properly patched it even could allows unauthorized administrative access to the server machine through the Oracle Listener.
+The EXTPROC functionality is used by PL/SQL component to make calls to the operating system and to load necessary library to execute external procedure, but if the Oracle Database server is not properly patched it even could allow unauthorized administrative access to the server machine through the Oracle Listener. If the EXTPROC functionality is not required, it has to be disabled by editing the tnsname.ora and listener.ora files and removing the entries regarding this functionality.
 Example of entries to remove in tnsname.ora file:
@@ Line 389: / Line 388: @@
    […]
-After that you should restart the Oracle Net listener process.
+After that restart the Oracle Net listener process.
+Then check if the configuration take effect by using the operation status in LSNRCTL command, and review the configuration if the last command display the follow lines:
     Listening Endpoints Summary...
@@ Line 404: / Line 401: @@
 Otherwise, the configuration is correct!
-If, instead, the EXTPROC functionality is required in your environment, you should configure a Oracle Net Listener for PL/SQL EXTPROC with an IPC (recommended) or TCP protocol address.
+If, instead, the EXTPROC functionality is required in your environment, configure a Oracle Net Listener for PL/SQL EXTPROC with an IPC (recommended) or TCP protocol address.
-It is a good idea enforce the network address restrictions when you use the TCP protocol address.
+It is a good idea to enforce the network address restrictions when you use the TCP protocol address.
 === Inbound connection timeout ===

@@ Line 346: / Line 346: @@
     TCP.VALIDNODE_CHECKING = YES
-Then, to defines TCP/IP addresses that are allowed to connect to database add the follow line:
+Then, to define TCP/IP addresses that are allowed to connect to database add the follow line:
     TCP.INVITED_NODES = <list of IP addresses>