這期內(nèi)容當(dāng)中小編將會給大家?guī)碛嘘P(guān)oracle策略安全加固的示例分析，文章內(nèi)容豐富且以專業(yè)的角度為大家分析和敘述，閱讀完這篇文章希望大家可以有所收獲。
創(chuàng)新互聯(lián)公司專業(yè)為企業(yè)提供察布查爾錫伯網(wǎng)站建設(shè)、察布查爾錫伯做網(wǎng)站、察布查爾錫伯網(wǎng)站設(shè)計、察布查爾錫伯網(wǎng)站制作等企業(yè)網(wǎng)站建設(shè)、網(wǎng)頁設(shè)計與制作、察布查爾錫伯企業(yè)網(wǎng)站模板建站服務(wù)，十余年察布查爾錫伯做網(wǎng)站經(jīng)驗(yàn)，不只是建網(wǎng)站，更提供有價值的思路和整體網(wǎng)絡(luò)服務(wù)。
alter profile default limit password_verify_function null;
alter profile default limit PASSWORD_LIFE_TIME unlimited;
alter profile default limit FAILED_LOGIN_ATTEMPTS 6;
alter profile default limit PASSWORD_REUSE_MAX 5;
alter profile default limit PASSWORD_GRACE_TIME 7;
賬號管理：
一、口令生存期
(1).oracle用戶登錄系統(tǒng)。
(2).sqlplus / as sysdba登陸數(shù)據(jù)庫.
(3).查看當(dāng)前開啟用戶及其profile
sql>select username,profile from dba_users where account_status='OPEN';
(4).將所有開啟用戶的profile中的PASSWORD_LIFE_TIME設(shè)置為期望數(shù)值
sql>alter profile default limit PASSWORD_LIFE_TIME 90; #
二、避免賬號共享
select count(username) from dba_users t where t.account_status = 'OPEN' and default_tablespace not in('SYSTEM','SYSAUX');
(1).創(chuàng)建用戶:
sql>create user
保證系統(tǒng)中存在兩個以上能夠登錄數(shù)據(jù)庫的賬號.
三、檢查是否配置最大認(rèn)證失敗次數(shù)
(1).oracle用戶登錄系統(tǒng)。
(2).sqlplus / as sysdba登陸數(shù)據(jù)庫.
(3).查看當(dāng)前開啟用戶及其profile
sql>select username,profile from dba_users where account_status='OPEN';
(4).將所有開啟用戶的profile中的FAILED_LOGIN_ATTEMPTS設(shè)置為期望數(shù)值
sql>alter profile default limit FAILED_LOGIN_ATTEMPTS 6; #
四、限制SYSDBA權(quán)限類用戶遠(yuǎn)程登錄
(1).oracle用戶登錄系統(tǒng)。
(2).sqlplus / as sysdba登陸數(shù)據(jù)庫。
(3).執(zhí)行alter system set REMOTE_LOGIN_PASSWORDFILE=NONE SCOPE=SPFILE;
(4).shutdown immediate.
(5).startup.
補(bǔ)充說明
此配置影響遠(yuǎn)程以Sql*Net方式對數(shù)據(jù)庫的管理
此配置也可能使某些第三方ORACLE管理工具不正常
五、檢查是否設(shè)置記住歷史密碼次數(shù)
(1).oracle用戶登錄系統(tǒng)。
(2).sqlplus / as sysdba登陸數(shù)據(jù)庫.
(3).查看當(dāng)前開啟用戶及其profile
sql>select username,profile from dba_users where account_status='OPEN';
(4).將所有開啟用戶的profile中的PASSWORD_REUSE_MAX設(shè)置為期望數(shù)值
sql>alter profile default limit PASSWORD_REUSE_MAX 5; #
六、檢查口令強(qiáng)度設(shè)置
(1).oracle用戶登錄系統(tǒng)
(2).修改Oracle自帶的默認(rèn)文件$ORACLE_HOME/rdbms/admin/utlpwdmg.sql創(chuàng)建verify_function函數(shù)
(注:utlpwdmg.sql中已經(jīng)對口令長度,是否包含字母、數(shù)字、特殊字符驗(yàn)證)。
1)#vi $ORACLE_HOME/rdbms/admin/utlpwdmg.sql
將以下內(nèi)容:
IF length(password) < 4 THEN
raise_application_error(-20002, 'Password length less than 4');
END IF;
修改為
IF length(password) < 8 THEN
raise_application_error(-20002, 'Password length less than 8');
END IF;
2)修改utlpwdmg.sql里面最后面的部分配置:
ALTER PROFILE DEFAULT LIMIT
PASSWORD_LIFE_TIME 60
PASSWORD_GRACE_TIME 10
PASSWORD_REUSE_TIME 1800
PASSWORD_REUSE_MAX UNLIMITED
FAILED_LOGIN_ATTEMPTS 3
PASSWORD_LOCK_TIME 1/1440
PASSWORD_VERIFY_FUNCTION verify_function;
為
ALTER PROFILE DEFAULT LIMIT
PASSWORD_VERIFY_FUNCTION verify_function;
注:oracle10g口令不區(qū)分大小寫,oracle11g口令區(qū)分大小寫。
utlpwdmg.sql設(shè)置完畢
(3).conn / as sysdba登陸數(shù)據(jù)庫后,執(zhí)行
sql>@$ORACLE_HOME/rdbms/admin/utlpwdmg.sql
alter profile default limit password_verify_function verify_function_11G;
alter profile default limit password_verify_function null;
七、檢查是否記錄安全事件日志
(1).登錄數(shù)據(jù)庫。
(2).建表LOGON_TABLE
CREATE TABLE LOGON_TABLE(LOG_CONTEXT varchar(4000),LOG_DATE timestamp);
(3).建觸發(fā)器
CREATE TRIGGER TRI_LOGON AFTER LOGON ON DATABASE BEGIN INSERT INTO LOGON_TABLE VALUES (SYS_CONTEXT('USERENV', 'SESSION_USER'), SYSDATE); END;
/
(注意:最后必須要輸入斜杠)
八、檢查是否設(shè)置DBA組用戶數(shù)量限制-LINUX
(1).使用 userdel 命令刪除多余的DBA組中的操作系統(tǒng)用戶,DBA組中只留一個Oracle安裝用戶
九、修改默認(rèn)賬戶的密碼-oracle11g
SELECT * FROM DBA_USERS_WITH_DEFPWD;
alter user dip identified by dip1;
alter user mdsys identified by mdsys1;
alter user spatial_wfs_admin_usr identified by spatial_wfs_admin_usr1;
alter user ctxsys identified by ctxsys1;
alter user olapsys identified by olapsys1;
alter user outln identified by outln1;
alter user spatial_csw_admin_usr identified by spatial_csw_admin_usr1;
alter user exfsys identified by exfsys1;
alter user oracle_ocm identified by oracle_ocm1;
alter user scott identified by scott1;
alter user mddata identified by mddata1;
alter user username identified by username1;
alter user ordplugins identified by ordplugins1;
alter user ordsys identified by ordsys1;
alter user appqossys identified by appqossys1;
alter user orddata identified by orddata1;
alter user xdb identified by xdb1;
alter user si_informtn_schema identified by si_informtn_schema1;
alter user wmsys identified by wmsys1;
===============
alter user dip identified by dip1;
alter user mdsys identified by mdsys1;
alter user spatial_wfs_admin_usr identified by spatial_wfs_admin_usr1;
alter user ctxsys identified by ctxsys1;
alter user olapsys identified by olapsys1;
alter user outln identified by outln1;
alter user spatial_csw_admin_usr identified by spatial_csw_admin_usr1;
alter user exfsys identified by exfsys1;
alter user oracle_ocm identified by oracle_ocm1;
alter user dbsnmp identified by dbsnmp1;
alter user mddata identified by mddata1;
alter user ordplugins identified by ordplugins1;
alter user ordsys identified by ordsys1;
alter user appqossys identified by appqossys1;
alter user orddata identified by orddata1;
alter user xdb identified by xdb1;
alter user si_informtn_schema identified by si_informtn_schema1;
alter user wmsys identified by wmsys1;
十、口令到達(dá)終止時間后的寬限天數(shù)
(1).oracle用戶登錄系統(tǒng)。
(2).sqlplus / as sysdba登陸數(shù)據(jù)庫.
(3).查看當(dāng)前開啟用戶及其profile
sql>select username,profile from dba_users where account_status='OPEN';
(4).將所有開啟用戶的profile中的PASSWORD_GRACE_TIME設(shè)置為期望數(shù)值
sql>alter profile default limit PASSWORD_GRACE_TIME 7; #
========
口令策略
一、配置賬戶最小授權(quán)
select grantee,owner,table_name from dba_tab_privs where grantee='PUBLIC' and privilege='EXECUTE' and table_name in ('UTL_FILE','UTL_TCP','UTL_HTTP','UTL_SMTP','DBMS_LOB','DBMS_SYS_SQL','DBMS_JOB');
(1)以DBA身份登錄sqlplus，執(zhí)行：
set pagesize 500 linesize 500
select table_name from dba_tab_privs where grantee='PUBLIC' and privilege='EXECUTE' and table_name in ('UTL_FILE','UTL_TCP','UTL_HTTP','UTL_SMTP','DBMS_LOB','DBMS_SYS_SQL','DBMS_JOB');
(2)如撤銷不必要的public角色包執(zhí)行權(quán)限，執(zhí)行：
SQL>revoke execute on <程序包名稱> from public; #程序包名稱為步驟1的輸出
revoke execute on DBMS_LOB from public;
revoke execute on UTL_TCP from public;
revoke execute on UTL_HTTP from public;
revoke execute on UTL_FILE from public;
revoke execute on UTL_SMTP from public;
revoke execute on DBMS_JOB from public;
select grantee,granted_role from dba_role_privs where grantee='RPTUSER';
============
認(rèn)證授權(quán)
一、檢查是否記錄操作日志
(1).登錄數(shù)據(jù)庫。
(2).建表LOGON_TABLE
CREATE TABLE LOGON_TABLE(LOG_CONTEXT varchar(4000),LOG_DATE timestamp);
(3).建觸發(fā)器
CREATE TRIGGER TRI_LOGON AFTER LOGON ON DATABASE BEGIN INSERT INTO LOGON_TABLE VALUES (SYS_CONTEXT('USERENV', 'SESSION_USER'), SYSDATE); END;
/
(注意:最后必須要輸入斜杠)
二、檢查是否配置日志功能
(1).登錄數(shù)據(jù)庫。
(2).建表LOGON_TABLE
CREATE TABLE LOGON_TABLE(LOG_CONTEXT varchar(4000),LOG_DATE timestamp);
(3).建觸發(fā)器
CREATE TRIGGER TRI_LOGON AFTER LOGON ON DATABASE BEGIN INSERT INTO LOGON_TABLE VALUES (SYS_CONTEXT('USERENV', 'SESSION_USER'), SYSDATE); END;
/
(注意:最后必須要輸入斜杠)
============
文件權(quán)限
一、 檢查是否為監(jiān)聽設(shè)置密碼-LINUX
PASSWORDS_LISTENER = 1DF5C2FD0FE9CFA2
(1).oracle用戶登錄系統(tǒng)。
(2).lsnrctl。
(3).change_password。
(4).set password
(5).save_config.(注意10g需要listener.ora中加入
LOCAL_OS_AUTHENTICATION_LISTENER = OFF)
上述就是小編為大家分享的oracle策略安全加固的示例分析了，如果剛好有類似的疑惑，不妨參照上述分析進(jìn)行理解。如果想知道更多相關(guān)知識，歡迎關(guān)注創(chuàng)新互聯(lián)行業(yè)資訊頻道。
重慶分公司
重慶分公司
