II - Mission Support Public
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000516-DB-000363
Group -
Access to default accounts used to support replication must be restricted to authorized DBAs.
Replication database accounts are used for database connections between databases. Replication requires the configuration of these accounts using the same username and password on all databases par...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Oracle instance names must not contain Oracle version numbers.
Service names may be discovered by unauthenticated users. If the service name includes version numbers or other database product information, a malicious user may use that information to develop a ...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Fixed user and public database links must be authorized for use.
Database links define connections that may be used by the local database to access remote Oracle databases. These links provide a means for a compromise to the local database to spread to remote da...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
A minimum of two Oracle control files must be defined and configured to be stored on separate, archived disks (physical or virtual) or archived partitions on a RAID device.
Oracle control files are used to store information critical to Oracle database integrity. Oracle uses these files to maintain time synchronization of database files as well as at system startup to ...Rule Low Severity -
SRG-APP-000516-DB-000363
Group -
A minimum of two Oracle redo log groups/files must be defined and configured to be stored on separate, archived physical disks or archived directories on a RAID device.
The Oracle redo log files store the detailed information on changes made to the database. This information is critical to database recovery in case of a database failure.Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle WITH GRANT OPTION privilege must not be granted to non-DBA or non-Application administrator user accounts.
An account permission to grant privileges within the database is an administrative function. Minimizing the number and privileges of administrative accounts reduces the chances of privileged accoun...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle REMOTE_OS_AUTHENT parameter must be set to FALSE.
Setting this value to TRUE allows operating system authentication over an unsecured connection. Trusting remote operating systems can allow a user to impersonate another operating system user and c...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle REMOTE_OS_ROLES parameter must be set to FALSE.
Setting REMOTE_OS_ROLES to TRUE allows operating system groups to control Oracle roles. The default value of FALSE causes roles to be identified and managed by the database. If REMOTE_OS_ROLES is s...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle SQL92_SECURITY parameter must be set to TRUE.
The configuration option SQL92_SECURITY specifies whether table-level SELECT privileges are required to execute an update or delete that references table column values. If this option is disabled (...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.
It is critically important to the security of your system that you protect your password file and the environment variables that identify the location of the password file. Any user with access to ...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
System privileges granted using the WITH ADMIN OPTION must not be granted to unauthorized user accounts.
The WITH ADMIN OPTION allows the grantee to grant a privilege to another database account. Best security practice restricts the privilege of assigning privileges to authorized personnel. Authorized...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
System Privileges must not be granted to PUBLIC.
System privileges can be granted to users and roles and to the user group PUBLIC. All privileges granted to PUBLIC are accessible to every user in the database. Many of these privileges convey cons...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Oracle roles granted using the WITH ADMIN OPTION must not be granted to unauthorized accounts.
The WITH ADMIN OPTION allows the grantee to grant a role to another database account. Best security practice restricts the privilege of assigning privileges to authorized personnel. Authorized pers...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Object permissions granted to PUBLIC must be restricted.
Permissions on objects may be granted to the user group PUBLIC. Because every database user is a member of the PUBLIC group, granting object permissions to PUBLIC gives all users in the database ac...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle Listener must be configured to require administration authentication.
Oracle listener authentication helps prevent unauthorized administration of the Oracle listener. Unauthorized administration of the listener could lead to DoS exploits; loss of connection audit dat...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
Application role permissions must not be assigned to the Oracle PUBLIC role.
Permissions granted to PUBLIC are granted to all users of the database. Custom roles must be used to assign application permissions to functional groups of application users. The installation of Or...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Oracle application administration roles must be disabled if not required and authorized.
Application administration roles, which are assigned system or elevated application object privileges, must be protected from default activation. Application administration roles are determined by ...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Connections by mid-tier web and application systems to the Oracle DBMS from a DMZ or external network must be encrypted.
Multi-tier systems may be configured with the database and connecting middle-tier system located on an internal network, with the database located on an internal network behind a firewall and the m...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Database job/batch queues must be reviewed regularly to detect unauthorized database job submissions.
Unauthorized users may bypass security mechanisms by submitting jobs to job queues managed by the database to be run under a more privileged security context of the database or host system. These q...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Unauthorized database links must not be defined and active.
DBMS links provide a communication and data transfer path definition between two databases that may be used by malicious users to discover and obtain unauthorized access to remote systems. Database...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Sensitive information from production database exports must be modified before import to a development database.
Data export from production databases may include sensitive data. Application developers do not have a need to know to sensitive data. Any access they may have to production data would be considere...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Only authorized system accounts must have the SYSTEM tablespace specified as the default tablespace.
The Oracle SYSTEM tablespace is used by the database to store all DBMS system objects. Other use of the system tablespace may compromise system availability and the effectiveness of host system acc...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Application owner accounts must have a dedicated application tablespace.
Separation of tablespaces by application helps to protect the application from resource contention and unauthorized access that could result from storage space reuses or host system access controls...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The directories assigned to the LOG_ARCHIVE_DEST* parameters must be protected from unauthorized access.
The LOG_ARCHIVE_DEST parameter is used to specify the directory to which Oracle archive logs are written. Where the DBMS availability and recovery to a specific point in time is critical, the prote...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle _TRACE_FILES_PUBLIC parameter if present must be set to FALSE.
The _TRACE_FILES_PUBLIC parameter is used to make trace files used for debugging database applications and events available to all database users. Use of this capability precludes the discrete assi...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.