前言
數(shù)據(jù)庫安全配置中,需要做相關(guān)的安全加固工作。以確認(rèn)數(shù)據(jù)庫的安全,但是,有些時候,操作不當(dāng)或者數(shù)據(jù)庫業(yè)務(wù)賬號修改密碼后,而程序的連接數(shù)據(jù)庫的配置封裝在jar里,如果jar內(nèi)的連接數(shù)據(jù)庫的配置信息沒有做相應(yīng)的修改的話。就會對數(shù)據(jù)庫的此業(yè)務(wù)賬號造成嚴(yán)重的后果。
本文將詳細(xì)介紹關(guān)于Oracle 11g安全加固的相關(guān)內(nèi)容,分享出來供大家參考學(xué)習(xí),下面話不多說了,來一起看看詳細(xì)的介紹吧
1.安全加固的檢查方向
1.1.sysdba用戶遠(yuǎn)程登錄限制(查看Oracle登錄認(rèn)證方式)
檢查:
show parameter remote_login_passwordfile
整改:
alter system set remote_login_passwordfile = NONE scope=spfile;
注:需要重啟庫生效。
1.2.是否開啟了資源限制
show parameter resource_limit
alter system set resource_limit = true;
1.3.登錄失敗的帳號鎖定策略
select * from dba_profiles order by 1;
關(guān)注FAILED_LOGIN_ATTEMPTS的設(shè)定值
1.4.數(shù)據(jù)庫用戶帳號檢查
檢查:
select username,profile from dba_users where account_status='OPEN';
整改:
鎖定用戶:alter user 用戶名> lock;
刪除用戶:drop user 用戶名> cascade;
1.5.范例數(shù)據(jù)庫帳號
是否存在默認(rèn)的范例數(shù)據(jù)庫賬號scott等,可以考慮刪除scott賬號
1.6.dba權(quán)限賬戶檢查
select * from dba_role_privs where granted_role='DBA';
1.7.數(shù)據(jù)庫賬戶口令加密存儲
11g數(shù)據(jù)里面的賬戶口令本來就是加密存儲的。
1.8.數(shù)據(jù)庫密碼安全性校驗函數(shù)
select limit from dba_profiles where profile='DEFAULT' and resource_name='PASSWORD_VERIFY_FUNCTION';
1.9.設(shè)定信任IP集
只需在服務(wù)器上的文件$ORACLE_HOME/network/admin/sqlnet.ora中設(shè)置以下行:
tcp.validnode_checking = yes
tcp.invited_nodes = (ip1,ip2…)
1.10.超時的空閑遠(yuǎn)程連接是否自動斷開
根據(jù)實際需要設(shè)置合適的數(shù)值。
在$ORACLE_HOME/network/admin/sqlnet.ora中設(shè)置下面參數(shù):
2.安全加固檢查safeCheck.sh
#!/bin/bash
#name:safeCheck.sh
#function:to create a safe check report.
#usage: oracle用戶登錄,執(zhí)行 sh safeCheck.sh > /tmp/safeCheck.log
#logon database
sqlplus -S / as sysdba EOF
--format
prompt ============================
prompt == format
prompt ============================
prompt
set linesize 140 pagesize 50
col username for a30
col profile for a30
col resource_name for a30
col limit for a30
--check
prompt ============================
prompt == 1.sysdba用戶遠(yuǎn)程登錄限制
prompt ============================
prompt
show parameter remote_login_passwordfile
prompt 結(jié)果應(yīng)為none.
prompt ======================
prompt == 2.resource_limit
prompt ======================
prompt
show parameter resource_limit
prompt 結(jié)果應(yīng)為true.
prompt ===========================
prompt == 3.登錄失敗的帳號鎖定策略
prompt ===========================
prompt
select * from dba_profiles order by 1;
prompt 關(guān)注FAILED_LOGIN_ATTEMPTS參數(shù)
prompt ===========================
prompt == 4.數(shù)據(jù)庫用戶帳號檢查
prompt ===========================
prompt
select username,profile from dba_users where account_status='OPEN';
prompt 正常使用的用戶列表
prompt ==========================
prompt == 5.范例數(shù)據(jù)庫帳號
prompt ==========================
prompt
select * from all_users order by created;
prompt 關(guān)注有無示例賬戶scott
prompt ===========================
prompt == 6.dba權(quán)限賬戶檢查
prompt ===========================
prompt
prompt ===========================
prompt == 7.數(shù)據(jù)庫賬戶口令加密存儲
prompt ===========================
prompt
prompt =============================
prompt == 8.數(shù)據(jù)庫密碼安全性校驗函數(shù)
prompt =============================
prompt
select limit from dba_profiles where profile='DEFAULT' and resource_name='PASSWORD_VERIFY_FUNCTION';
prompt 結(jié)果應(yīng)該不為null
--logoff database
EOF
# check the files
echo ===================
echo == 9.設(shè)定信任IP集
echo ===================
echo
more $ORACLE_HOME/network/admin/sqlnet.ora
#添加如下
#tcp.validnode_checking = yes
#tcp.invited_nodes = (ip1,ip2…)
echo ===================================
echo == 10.超時的空閑遠(yuǎn)程連接是否自動斷開
echo ===================================
echo
#根據(jù)實際需要設(shè)置合適的數(shù)值。
more $ORACLE_HOME/network/admin/sqlnet.ora
#添加如下一行
#SQLNET.EXPIRE_TIME=10
3.安全加固執(zhí)行safeExec.sh
#!/bin/bash
#name:safeExec.sh
#function:to execute the script for safe.
#usage: oracle用戶登錄,執(zhí)行 sh safeExec.sh > /tmp/safeExec.log
#logon database
sqlplus -S / as sysdba EOF
--format
prompt ============================
prompt == format
prompt ============================
set linesize 140 pagesize 50
col username for a30
col profile for a30
col resource_name for a30
col limit for a30
--execute
prompt ============================
prompt == 1.sysdba用戶遠(yuǎn)程登錄限制
prompt ============================
alter system set remote_login_passwordfile=none scope=spfile;
prompt ======================
prompt == 2.resource_limit
prompt ======================
alter system set resource_limit=true;
prompt ===========================
prompt == 3.登錄失敗的帳號鎖定策略
prompt ===========================
alter profile default limit FAILED_LOGIN_ATTEMPTS 10;
prompt ===========================
prompt == 4.數(shù)據(jù)庫用戶帳號檢查
prompt ===========================
--select username,profile from dba_users where account_status='OPEN';
prompt I think I have nothing to do in this step.
prompt ===========================
prompt == 5.范例數(shù)據(jù)庫帳號
prompt ===========================
prompt 是否刪除范例scott用戶?
--drop user scott cascade;
prompt ===========================
prompt == 6.dba權(quán)限賬戶檢查
prompt ===========================
prompt I think I have nothing to do in this step.
prompt ===========================
prompt == 7.數(shù)據(jù)庫賬戶口令加密存儲
prompt ===========================
prompt 11g版本,數(shù)據(jù)庫層面就是加密的嘛~
prompt =============================
prompt == 8.數(shù)據(jù)庫密碼安全性校驗函數(shù)
prompt =============================
prompt 執(zhí)行創(chuàng)建安全性校驗函數(shù)的腳本
@?/rdbms/admin/utlpwdmg.sql
--logoff database
EOF
# check the files
echo ===================
echo == 9.設(shè)定信任IP集
echo ===================
more $ORACLE_HOME/network/admin/sqlnet.ora
#添加如下
#tcp.validnode_checking = yes
#tcp.invited_nodes = (ip1,ip2…)
echo ===================================
echo == 10.超時的空閑遠(yuǎn)程連接是否自動斷開
echo ===================================
#根據(jù)實際需要設(shè)置合適的數(shù)值。
more $ORACLE_HOME/network/admin/sqlnet.ora
#添加如下一行
#SQLNET.EXPIRE_TIME=10
針對第9和第10步驟中的sqlnet.ora配置文件示例:
注意:如果是ASM實例,sqlnet.ora配置文件是grid用戶下$ORACLE_HOME/network/admin/sqlnet.ora的。
SQLNET.EXPIRE_TIME=10
tcp.validnode_checking = yes
tcp.invited_nodes = (192.168.99.*)
總結(jié)
以上就是這篇文章的全部內(nèi)容了,希望本文的內(nèi)容對大家的學(xué)習(xí)或者工作具有一定的參考學(xué)習(xí)價值,如果有疑問大家可以留言交流,謝謝大家對腳本之家的支持。
您可能感興趣的文章:- oracle 11g數(shù)據(jù)庫安全加固注意事項
- Oracle數(shù)據(jù)庫安全策略分析(一)
- Oracle數(shù)據(jù)庫安全策略分析 (三)
- Oracle數(shù)據(jù)庫的安全策略
- Oracle數(shù)據(jù)庫安全策略分析(二)
- Oracle監(jiān)聽口令及監(jiān)聽器安全詳解
- Oracle數(shù)據(jù)庫安全策略
- Oracle數(shù)據(jù)安全面面觀
- Oracle數(shù)據(jù)庫的安全策略
- 提升Oracle用戶密碼安全性的策略