數(shù)據(jù)庫基本加固方案

1、本文所有信息為中興通訊股份有限公司內(nèi)部信息，未經(jīng)允許，不得外傳第本文所有信息為中興通訊股份有限公司內(nèi)部信息，未經(jīng)允許，不得外傳第 頁，共17頁技術文件技術文件名稱：Oracle數(shù)據(jù)庫基本加固方案技術文件編號：版本：V1.2.1文件質(zhì)量等級：共17頁（包括封面）擬制審核會簽標準化批準中興通訊股份有限公司修改記錄文件編號版本號擬制人/修改人擬制/修改日期更改理由主要更改內(nèi)容（寫要點即可）1.0王華剛2009/04/15無無1.1王華剛2009/06/01補充內(nèi)容補充修改密碼有效期90天之前要改密碼問題1.2王華剛2009/06/15配置編號配置加固項編號1.2.1王華剛2009/07/02更新配置

2、編號更新配置編號注1:每次更改歸檔文件（指歸檔到事業(yè)部或公司檔案室的文件）時，需填寫此表。注2：文件第一次歸檔時，“更改理由”、“主要更改內(nèi)容”欄寫“無”。Oracle系統(tǒng)基本加固方案目錄TOC o 1-5 h z（包括封面）1修改記錄2 HYPERLINK l bookmark2 1概述4內(nèi)部適用性說明4外部引用說明4術語和定義4符號和縮略語4 HYPERLINK l bookmark4 2Oracle安全配置操作指導5ZTE-Oracle-E01Oracle組件安裝5ZTE-Oracle-EM01-01Oracle最小組件安裝5ZTE-Oracle-E02帳號安全加固操作5ZTE-Orac

3、le-EH02-01刪除鎖定無用帳號5ZTE-Oracle-EM02-02操作系統(tǒng)dba組只有oracle（或還有oinstall）用戶6 HYPERLINK l bookmark15 ZTE-Oracle-EH02-03修改默認密碼并使用強密碼7 HYPERLINK l bookmark17 ZTE-Oracle-EL02-04設置口令生存期為90天（可選）7 HYPERLINK l bookmark19 ZTE-Oracle-EL02-05禁止重復密碼7ZTE-Oracle-EL02-06配置當用戶連續(xù)認證失敗次數(shù)超過6次（不含6次），鎖定該用戶使用的賬號（可選）8ZTE-Oracle-E

4、L02-07設置只有sysdba權限的用戶才可以訪問數(shù)據(jù)字典8ZTE-Oracle-E03審計要求（可選）8ZTE-Oracle-EL03-01審計方案8 HYPERLINK l bookmark40 ZTE-Oracle-E04數(shù)據(jù)庫連接安全9ZTE-Oracle-EL04-01設定listener密碼（可選，確定對雙機切換的影響）9 HYPERLINK l bookmark31 ZTE-Oracle-EM04-02配置訪問listener的白名單9 HYPERLINK l bookmark33 ZTE-Oracle-EL04-03配置連接超時斷開（可選）9 HYPERLINK l book

5、mark35 ZTE-Oracle-EL04-04加密數(shù)據(jù)庫網(wǎng)絡連接（可選）10ZTE-Oracle-E05日志配置10ZTE-Oracle-EL05-01打開登錄日志10ZTE-Oracle-E06數(shù)據(jù)庫安全組件配置11 HYPERLINK l bookmark42 ZTE-Oracle-EL06-01使用DataVault選件（可選，待補充）11ZTE-Oracle-EL05-02使用虛擬私有數(shù)據(jù)庫和標簽安全選件（可選，待補充）112.7ZTE-Oracle-E07安裝驗證過的數(shù)據(jù)庫補丁11ZTE-Oracle-EH07-01安裝經(jīng)過驗證的最新數(shù)據(jù)庫補丁11 HYPERLINK l boo

6、kmark47 3附錄11 HYPERLINK l bookmark49 Oracle用戶帳號速查11Oracle系統(tǒng)基本加固方案1概述內(nèi)部適用性說明本方案是在業(yè)務研究院網(wǎng)絡安全規(guī)范中各項要求的基礎上，提出Oracle數(shù)據(jù)庫安全配置指南，針對通用規(guī)范中所列的配置要求，給出了在0蹊化數(shù)據(jù)庫上的具體配置方法。外部引用說明中國移動設備通用安全功能和配置規(guī)范中國移動數(shù)據(jù)庫設備安全功能規(guī)范中國移動Oracle數(shù)據(jù)庫安全配置規(guī)范術語和定義符號和縮略語縮寫英文描述中文描述DBADatabaseAdministrator數(shù)據(jù)庫管理員VPDVirtualPrivateDatabase虛擬專用數(shù)據(jù)庫OLSOrac

7、leLabelSecurityOracle標簽安全本文件中的字體標識如下：藍色斜體在具體執(zhí)行時需要替換的內(nèi)容檢查/加固項編碼意義如下：公司名稱-操作系統(tǒng)-條目性質(zhì)風險級別數(shù)字編號-小項數(shù)字編號條目性質(zhì)中：S意為檢查；E意為加固風險級別中：H意為高風險；M意為中等風險；L意為低風險，風險級別僅存于具體條目中2Oracle安全配置操作指導ZTE-Oracle-E01Oracle組件安裝ZTE-Oracle-EM01-01Oracle最小組件安裝項目給出使用到的組件列表：Oracle版本Oracle組件WAP網(wǎng)關彩信短信Oracle9iOracle10gZTE-Oracle-E02帳號安全加固操作Z

8、TE-Oracle-EH02-01刪除鎖定無用帳號鎖定：SQLalteruserusernameaccountlock;刪除：SQLdropuserusernamecascade;刪除用戶WAP網(wǎng)關彩信短信SCOTTANONYMOUSCTXSYSDBSNMP可以鎖定/刪除DIPDMSYSEXFSYSHRLBACSYSMDDATAMDSYSMGMT_VIEWODMQSWKPROXYWKSYSODM_MTROLAPSYSORDPLUGINSOEORDSYSOUTLN可以鎖定/刪除SHSI_INFORMTN_SCHEMAWMSYS可以鎖定/刪除XDBTSMSYSWK_TESTSYSMANRMANQS

9、_WSQS_OSQS_ESQS_CSQS_CBADMQS_CBPMQS_ADMZTE-Orade-EM02-02操作系統(tǒng)dba組只有oracle（或還有oinstall）用戶具體操作請參考相關操作系統(tǒng)加固方案ZTE-Orade-EH02-03修改默認密碼并使用強密碼建立密碼驗證函數(shù)，內(nèi)容如下verify.pawtLrgql執(zhí)行腳本不會對原有密碼造成影響，因此還需要再修改密碼：SQLAlterusersysidentifiedbypasswordSQLAlterusersystemidentifiedbypasswordSQLAlteruser業(yè)務用戶identifiedbypassword需要

10、修改密碼的業(yè)務用戶列表：業(yè)務需要修改口令的用戶WAP網(wǎng)關sys、system、其他業(yè)務補充，必須修改帳號密碼才能進行下一步設定密碼生存期的操作彩信sys、system、其他業(yè)務補充，必須修改帳號密碼才能進行下一步設定密碼生存期的操作短信sys、system、其他業(yè)務補充，必須修改帳號密碼才能進行下一步設定密碼生存期的操作修改用戶密碼后，需要進行的其他操作：業(yè)務修改用戶密碼后的操作說明WAP網(wǎng)關彩信短信如果有雙機環(huán)境，修改sys/system密碼，注意雙機切換腳本的有效性。ZTE-Oracle-EL02-04設置口令生存期為90天（可選）SQLalterproLIMITPASSWORD_LIFE

11、_TIME90說明：在修改profile之前，必須進行2.2.3中的修改密碼操作，如果不修改，可能在限定密碼生存期之后登錄失敗ZTE-Oracle-EL02-05禁止重復密碼SQLalterproLIMITPASSWORD_REUSE_MAX5ZTE-Oracle-EL02-06配置當用戶連續(xù)認證失敗次數(shù)超過6次（不含6次），鎖定該用戶使用的賬號（可選）SQLalterproLIMITFAILED_LOGIN_ATTEMPTS6ZTE-Orade-EL02-07設置只有sysdba權限的用戶才可以訪問數(shù)據(jù)字典使用pfile的情況：修改pfile文件參數(shù)O7_DICTIONARY_ACCESSI

12、BILITY=false配置后重新啟動數(shù)據(jù)庫生效使用spfile的情況：SQLAltersystemsetO7_DICTIONARY_ACCESSIBILITY=FALSEscope=spfile配置后重新啟動數(shù)據(jù)庫生效說明，pfile文件默認位置如下：Unix：$ORACLE_HOME/dbs/initSID.oraWindows：%ORACLE_HOME%DATABASEinitSID.oraSID為Oracle數(shù)據(jù)庫標識符ZTE-Oracle-E03ZTE-Oracle-EL03-01審計方案aoracle審計功能的使用與注意事項.doc業(yè)務需要審計的表需要審計的操作WAP網(wǎng)關ZTE-O

13、racle-E04ZTE-Oracle-EL04-01設定listener密碼(可選，確定對雙機切換的影響)$lsnrctlLSNRCTLchange_passwordOldpassword:NotdisplayedNewpassword:NotdisplayedReenternewpassword:NotdisplayedConnectingto(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOSTo=raclehost)(PORT=1521)(IP=IPADDR)PasswordchangedforLISTENERThecommandcompletedsucce

14、ssfully注意配置listener對雙機切換的影響。ZTE-Oracle-EM04-02配置訪問listener的白名單$vi$ORACLE_HOME/network/admin/sqlnet.ora設置或修改參數(shù)：tcp.validnode_checking=yestcp.invited_nodes=(ip1,ip2)注意在tcp.invited_nodes參數(shù)中，一定要有本機的ip地址或者localhostZTE-Oracle-EL04-03配置連接超時斷開(可選)$vi$ORACLE_HOME/network/admin/sqlnet.ora設置或修改參數(shù)：SQLNET.EXPIRE

15、_TIME=10ZTE-Orade-EL04-04加密數(shù)據(jù)庫網(wǎng)絡連接（可選）Windows環(huán)境下，選擇開始菜單中的OracleNetManager,Unix環(huán)境中，在Oracle用戶下，執(zhí)行：$netmgr.在OracleNetManager中選擇“OracleAdvancedSecurity”。.然后選擇Encryption。.選擇Client或Server選項。.選擇加密類型。.輸入加密種子（可選）。.選擇加密算法（可選）。.保存網(wǎng)絡配置，sqlnet.ora被更新。注意，Oracle服務器選擇Server，Oracle客戶端選擇Client，服務器客戶端都需要配置。2.5ZTE-Orac

16、le-E052.5.1ZTE-Oracle-EL05-01打開登錄日志ZTE-Oracle-E06數(shù)據(jù)庫安全組件配置ZTE-Oracle-EL06-01使用DataVault選件（可選，待補充）ZTE-Oracle-EL05-02使用虛擬私有數(shù)據(jù)庫和標簽安全選件（可選，待補充）ZTE-Oracle-E07安裝驗證過的數(shù)據(jù)庫補丁ZTE-Oracle-EH07-01安裝經(jīng)過驗證的最新數(shù)據(jù)庫補丁Oracle數(shù)據(jù)庫版本W(wǎng)AP網(wǎng)關彩信短信Oracle9iOracleOracleOracleOracle10g3附錄3.1.1Oracle用戶帳號速查用戶名默認密碼描述syschange_on_install

17、AllofthebasetablesandviewsforthedatabasesdatadictionaryarestoredintheschemaSYS.ThesebasetablesandviewsarecriticalfortheoperationofOracle.Tomaintaintheintegrityofthedatadictionary,tablesintheSYSschemaaremanipulatedonlybyOracle;theyshouldneverbemodifiedbyanyuserordatabaseadministrator,andnooneshouldcr

18、eateanytablesintheschemaoftheuserSYS.TheDBAshouldchangethepasswordforSYSimmediatelyafterdatabasecreation!systemManagerTheSYSTEMusernamecreatesadditionaltablesandviewsthatdisplayadministrativeinformation,andinternaltablesandviewsusedbyOracletools.NevercreateintheSYSTEMschematablesofinteresttoindividu

19、alusers.SYSTEMisalittlebitweakeruserthanSYS,forexample,ithasnoaccesstosocalledX$tables(theveryinternalstructuretablesofOracle).Althoughinreallifeyoumaybeinasituationwhensomeproductorwhateveryouwanttocreateobjectsinabovementionedusersschemas.Beflexible,dontsacrifaceaproductonlybecauseitwillcreatesome

20、objectsinSYSorSYSTEMschemaTheDBAshouldchangethepasswordforSYSTEMimmediatelyafterdatabasecreation!sysmanThedefaultsuperuseraccountusedtosetupandadministerenterprisemanager.Thepasswordissetwhenthedatabaseisinstalled.dbsnmpdbsnmpSupportsOracleSNMP(SimpleNetworkManagementProtocol).TheOracleIntelligentAg

21、entrequiresadatabaselogonforeachSIDthatitmanages.BydefaultthisaccountiscalledDBSNMPandthepasswordisDBSNMP.Theaccountnameand/orpasswordSHOULDbechangedfromthedefaultbutyouwillneedtomakeafewadditionalmodifications.Intheexamplesbelow,youwillneedtoreplaceanyinformationwithbracketswiththeinformationfromyo

22、ursystem.RemoveallJobsandEventscurrentlyregisteredagainstthisdatabase.StoptheIntelligentAgentOracle7-Oracle8i%lsnrctldbsnmp_stopOracle9i%agentctlstopEditthe$ORACLE_HOME/network/admin/snmp_rw.orafile.Addthefollowingparameter:SNMP.CONNECT.NAME=SNMP.CONNECT.PASSWORD=Thevariableistheexactlistingofthedat

23、abasenameasitappearsinthesnmp_ro.orafile.Ifisthedefault(DBSNMP),thereisnoneedtospecifytheuserhere.Onlythepasswordisrequired.OnUNIX,setthefollowingpermissionontheSNMP_RW.ORAfile:%chmod600snmp_rw.oraChangetheDBSNMPpasswordonthedatabase.YoucanuseeitherSecurityManager,Sqlplus,orServerManager.IfyouuseSQL

24、PlusorServerManager,youcanissuethefollowingcommand:SQLalteruserdbsnmpidentifiedby;5.StopandrestarttheIntelligentAgent.outlnoutlnOracle8iaddstheOUTLNuserschematosupportPlanStability.TheOUTLNuseractsasaplacetocentrallymanagemetadataassociatedwithstoredoutlines.ThisuserhasDBArole.Itisusedforplanstabili

25、tyie.tokeepthesameexecutionplansforthesamequeriesevenifyoursystemconfigurationorstatisticschanges.ExecutionplanswillbethesameindifferentOraclereleaseswithdifferentoptimizers.TheDBAshouldeitherlocktheuseraccountorchangethepasswordfortheOUTLNuserimmediatelyafterdatabasecreation!mdsysmdsysSupportsOracl

26、eSpatial.OracleSpatialisanintegratedsetoffunctionsandproceduresthatenablesspatialdatatobestored,accessed,andanalyzedquicklyandefficientlyinanOracle8idatabase.Thespatialattributeofaspatialfeatureisthegeometricrepresentationofitsshapeinsomecoordinatespace.Thisisreferredtoasitsgeometry.TheDBAshouldeith

27、erlocktheuseraccountorchangethepasswordfortheMDSYSuserimmediatelyafterdatabasecreation!ordsysordsysSupportsOracle8iTimeSeries.Oracle8iTimeSeries(inpreviousreleasescalledtheOracle8TimeSeriesCartridge)isanextensiontoOracle8ithatprovidesstorageandretrievaloftimestampeddatathroughobjecttypes.Oracle8iTim

28、eSeriesisabuildingblockforapplicationsratherthanbeinganend-userapplicationinitself.Itconsistsofdatatypesalongwithrelatedfunctionsformanagingandprocessingtimeseriesdata.TheDBAshouldeitherlocktheuseraccountorchangethepasswordfortheORDSYSuserimmediatelyafterdatabasecreation!ordpluginsordpluginsSupports

29、OracleinterMedia.OracleinterMediaisasingleproductthatenablesOracle8itostore,manage,andretrievetext,documents,geographiclocationinformation,images,audio,andvideoinanintegratedfashionwithotherenterpriseinformation.OracleinterMediaextendsOracle8ireliability,availability,anddatamanagementtotextandmultim

30、ediacontentinInternet,electroniccommerce,andmedia-richapplicationsaswellasonlineInternet-basedgeocodingservicesforlocatorapplications.TheDBAshouldeitherlocktheuseraccountorchangethepasswordfortheORDPLUGINSuserimmediatelyafterdatabasecreation!ctxsysctxsysSupportsOracleConTextCartridge.Oracle8ConTextC

31、artridgeprovidespowerfulsearch,retrieval,andviewingcapabilitiesfortextstoredinanOracle8database.Inaddition,ConTextprovidesadvancedlinguisticprocessingofEnglish-languagetext.TheDBAshouldeitherlocktheuseraccountorchangethepasswordfortheCTXSYSuserimmediatelyafterdatabasecreation!dssysdssysDynamicServic

32、esSecuredWebService.DynamicServicesEngine(DSEngine)allowscreation,aggregationanddeploymentofservicesfromavarietyofcontentsources.Atthemoment,DynamicServicessupportscontentaccessfromdatabases(SQL/PLSQL)aswellasInternetapplications(HTTP/HTTPS).DSEnginecaninterpretXMLandHTMLcontentalongwiththeresultset

33、sreturnedfromdatabaseaccess.DSEngineisintegratedwithOraclePortalviaaWebProvidermechanism.ThisintegrationallowsalltheservicesregisteredwithDSEnginetobeaccessibleasportlets.TheDBAshouldeitherlocktheuseraccountorchangethepasswordfortheDSSYSuserimmediatelyafterdatabasecreation!perfstatperfstatOracleStat

34、isticsPackage(STATSPACK)userthatsupersedesUTLBSTAT/UTLESTAT.ThePERFSTATuserwillholdallofthetablesandpackagesfortheperformancediagnostictoolSTATSPACK.CreatedBy:$ORACLE_HOME/rdbms/admin/spcusr.sqlWKPROXYchange_on_installUsedtosupportOraclesUltrasearchoption.Thisfeature(anduser)wasintroducedinOracle9i.

35、TheuseraccountISNOTlockedbydefaultisonlyassignedtheCREATESESSIONprivilege.Nonetheless,thisaccountisnotlockedbydefaultandOraclehighlyrecommendsthatthisdefaultpasswordbechanged.CreatedBy:$ORACLE_HOME/ultrasearch/admin/wk0csys.sqlWKSYSchange_on_installUsedtosupportOraclesUltrasearchoption.Thisfeature(a

36、nduser)wasintroducedinOracle9i.TheuseraccountISNOTlockedbydefaultandasyoucanseebelow,isgrantedthehighlyprivilegedroleofDBA.GiventhatthisuserisgrantedtheDBAroleandisnotlockedbydefault,Oraclehighlyrecommendsthatthisdefaultpasswordbechanged.ThissupportaccountisassignedthefollowingprivilegesinOracle9i:C

37、ONNECTRESOURCEDBAALLPRIVILEGESCTXAPPCREATEPUBLICSYNONYMDROPPUBLICSYNONYMCREATEANYVIEWDROPANYVIEWCREATEANYTABLEDROPANYTABLECREATEANYINDEXDROPANYINDEXCREATEANYSEQUENCEDROPANYSEQUENCECREATEANYTRIGGERDROPANYTRIGGERJAVAUSERPRIVJAVASYSPRIVSELECTONSYS.USER$SELECTONSYS.V_$PARAMETERSELECTONSYS.GV_$INSTANCESE

38、LECTONSYS.V_$DATABASESELECTONSYS.DBA_CONSTRAINTSSELECTONSYS.DBA_JOBSSELECTONSYS.DBA_DB_LINKSSELECTONSYS.DBA_ROLE_PRIVSSELECTONSYS.DBA_LOCKSELECTONSYS.DBMS_LOCK_ALLOCATEDSELECTONSYS.PROCEDURE$SELECTONSYS.DBA_TABLESSELECTONSYS.DBA_VIEWSSELECTONSYS.DBA_TAB_COLUMNSEXECUTEONSYS.DBMS_LOCKEXECUTEONSYS.DBMS

39、_PIPEEXECUTEONSYS.DBMS_REGISTRYThedefaulttablespaceforthisuserwillbeDRSYSwhileitstemporarytablespacewillbeTEMP.CreatedBy:$ORACLE_HOME/ultrasearch/admin/wk0install.sqlwk_proxywk_proxyUsedforultrasearch.wmsyswmsysUsedtostoreallthemetadatainformationforOracleWorkspaceManager.ThisuserwasintroducedinOrac

40、le9iand(likemostOracle9isupportingaccounts)islockedbydefault.TheuseraccountislockedbecausewewantthepasswordtobepublicbutrestrictaccesstotheaccounttotheSYSschema.So,tounlocktheaccount,DBAprivilegesarerequired.CreatedBy:$ORACLE_HOME/rdbms/admin/owmctab.plbmtssysUsedforMicrosofttransactionserversupport

41、.XDBchange_on_installUsedtosupportSQLXMLmanagement:XMLDB.Thisuserisgrantedtworoles:RESOURCEandJAVAUSERPRIV.Oraclerecommendschangingthepasswordforthisuseraftercreation.ThisuserisconfiguredwithadefaulttablespaceofXDBandatemporarytablespaceofTEMP.CreatedBy:$ORACLE_HOME/rdbms/admin/catqm.sqlANONYMOUSIDE

42、NTIFIEDBYVALUESanonymousUsedtosupportSQLXMLmanagement:XMLDB.AllowsHTTPaccesstoOracleXMLDB.ThisusershouldonlybeusedforHTTPlogins.Theaccountislockedneartheendofthecatqm.sqlscript.odmodmUsedtosupportOracleDataMining.InOracle9i,thisuserisgrantedtheroles:SELECT_CATALOG_ROLE,HS_ADMIN_ROLE,AQ_USER_ROLE”.Or

43、aclerecommendschangingthedefaultpasswordastheaccountISNOTlockedaftercreation.ThedefaulttablespaceforthisuserisODMwithtemporarytablespaceTEMP.TheODMtablespaceispopulatedwithsegmentsfromusersODMandODM_MTR.CreatedBy:$ORACLE_HOME/dm/admin/dmcrt.sqlODM_MTRmtrpwUsedtosupportOracleDataMining.InOracle9i,thi

44、suserisgrantedSELECT_CATALOG_ROLEandHS_ADMIN_ROLEOraclerecommendschangingthedefaultpasswordastheaccountISNOTlockedaftercreation.ThedefaulttablespaceforthisuserisODMwithtemporarytablespaceTEMP.TheODMtablespaceispopulatedwithsegmentsfromusersODMandODM_MTR.CreatedBy:$ORACLE_HOME/dm/admin/dmcrt.sqlOLAPS

45、YSmtrpwThisuseriscreateifOLAPoptionisinstalledandisusedtocreateOLAPmetadatastructures.InOracle9i,thisuserisgrantedSELECT_CATALOG_ROLEandHS_ADMIN_ROLE.Oraclerecommendschangingthedefaultpassword.ThedefaulttablespaceforthisuserisODMwithtemporarytablespaceTEMP.TheODMtablespaceispopulatedwithsegmentsfrom

46、usersODMandODM_MTR.CreatedBy:$ORACLE_HOME/dm/admin/dmcrt.sqlTRACESVRtraceOracleTraceserver.SupportsOracleTraceforOEMinOracle7.OracleTraceisusedtocollectawidevarietyofdata,suchasperformancestatistics,diagnosticdata,systemresourceusage,andbusinesstransactiondetails.REPADMINManagedbyDBAwhenuseriscreated.Replicationuser.ThisuserismanuallycreatedbytheDBA