- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Questions to ask on an oracle security audit (mult...
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 01:36 AM
тАО09-27-2006 01:36 AM
Note: This covers HP-UX and Linux.
Here is what I have so far:
1) Is the oracle password not the same as the user id? Some other similar ones.
2) Run oracle's RDA tool. This provides a good system overview.
3) Run security_patch_check and then swlist to make sure they are all installed.
What else would you like asked on an audit.
I will wait till the thread cools off and provide solution points(8-10) for suggestions I accept.
Take time to think about your response because multiple answers will not get multiple bunnies.
Any reasonable repsonse will get something though.
SEP
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 01:40 AM
тАО09-27-2006 01:40 AM
Re: Questions to ask on an oracle security audit (multiple platforms)
Does Oracle have any specific security/hardening recommendations/patches. If so, I would ask if they have been implemented.
Pete
P.S. You may be able to guess that I don't know squat about Oracle - we're an Informix shop.
Pete
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 01:54 AM
тАО09-27-2006 01:54 AM
Re: Questions to ask on an oracle security audit (multiple platforms)
export ORACLE_SID=bla
export ORACLE_HOME=/opt/app/oracle/pro....
sqlplus ' / as sysdba'
I get connected. I think this is a security hole. Fix this ( I don't know how to). Also I would prefer listener to run on a diffrent port other than 1521 and with a password.
Regds,
Kaps
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 01:56 AM
тАО09-27-2006 01:56 AM
SolutionA whole site dedicated to Oracle Security Audits:
http://www.petefinnigan.com/tools.htm
At the actual DB level I would investigate:
Grants/Roles/Object priviledges, especially to public or with admin.
Data access ((Materialised) Views/Tables)
What Oracle audits on DML/DDL commands is running?
How are the backups/redo logs safeguarded?
At a more general level:
Who reviews the audit results/logs ?
Who is receiving the Oracle Security Alerts?
Who controls the listener/webserver configs?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 02:00 AM
тАО09-27-2006 02:00 AM
Re: Questions to ask on an oracle security audit (multiple platforms)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 02:05 AM
тАО09-27-2006 02:05 AM
Re: Questions to ask on an oracle security audit (multiple platforms)
In addition to the usual type of password questions (how often are they changed, are they aged, who has access to them), you might ask if they are running any scripts or programs where the Oracle username and password combination show up in the process table. Also, make sure they aren't storing the passwords in a plain text file for use by scripts and programs.
Are the filesystems and directories containing the Oracle data files and programs set with the correct permissions and ownership?
JP
P.S. Bonus question:
How many Oracle DBAs does it take to change a light bulb?
None. It's a hardware problem.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 02:07 AM
тАО09-27-2006 02:07 AM
Re: Questions to ask on an oracle security audit (multiple platforms)
Can oracle login directly?
Should be no - should have to login as real user the su to oracle.
Is Oracle password verification function enabled?
Should be yes
Do any regular users have SYSDBA privileges?
Should be no
Do Oracle users have passwords that expire?
Should be yes
Rgds...Geoff
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 02:15 AM
тАО09-27-2006 02:15 AM
Re: Questions to ask on an oracle security audit (multiple platforms)
Are the tns listener admin accounts password protected (lsnrctl tool)?
For Windows people: Did you turn off the default http (Apache) services that Oracle installed for you (whether you wanted it or not)? Double check for this on the Windows Client systems?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 02:19 AM
тАО09-27-2006 02:19 AM
Re: Questions to ask on an oracle security audit (multiple platforms)
I especially like the website. After reviewing the site that post looks like a 10.
How many Oracle DBA's does it take to screw in a light bulb?
Answer: More than we budgeted for.
SEP
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-27-2006 05:07 AM
тАО09-27-2006 05:07 AM
Re: Questions to ask on an oracle security audit (multiple platforms)
Also, what type of disaster recovery is implemented? Data Guard allows you to run multiple standby databases. Are the standby databases at other sites?