Oracle英文版培訓(xùn)課件之Security：L03-InternalSecurity

InternalDatabaseSecurityObjectivesAftercompletingthislesson,youshouldbeabletodothefollowing:ApplytheprincipleofleastprivilegetothedatabaseApplysecuritypatches(CriticalPatchUpdate)

LockandexpiredefaultuseraccountsChangedefaultuserpasswordsCreatestrongpasswordsEnforcepasswordmanagementProtectthedatadictionaryDatabaseSecurity:ChecklistApplytheprincipleofleastprivilege:Installonlywhatisrequired.Hardentheoperatingsystem(OS).Maintaininstalledproducts.Managedefaultuseraccounts.Enforcepasswordmanagement.Protectthedatadictionary.RevokeunnecessaryprivilegesfromPUBLIC.Restrictthedirectoriesaccessiblebytheuser.Limituserswithadministrativeprivileges.Restrictremotedatabaseauthentication.Useotherdatabasesecurityfeatures.ReducingAdministrationEffortUserolestogroupusersbyjobfunction.Enableanddisablerolesasappropriate.Usesinglesign-on.InstallingOnlyWhatIsRequiredInstallonlytherequiredproductsandfeatures.Planyourinstallation:Determinewhatneedstobeinstalled.Youmayrequireacustominstallation.Youcanalwaysinstalladditionalproductslater.ApplyingSecurityPatchesUsetheCriticalPatchUpdateprocess.Applyallsecuritypatchesandworkarounds.SeetheOracleSecurityProductsWebsite.SYSandSYSTEMAccountsTheSYSaccount:IsgrantedtheDBAroleHasallprivilegeswithADMIN

OPTIONIsrequiredforstartup,shutdown,andsomemaintenancecommandsOwnsthedatadictionaryTheSYSTEMaccountisgrantedtheDBArole.Theseaccountsarenotusednormally.SYSOPERandSYSDBALockingandExpiringDefault

UserAccountsTheDatabaseConfigurationAssistant(DBCA)expiresandlocksallaccounts,except:SYSSYSTEMSYSMANDBSNMPForamanualinstallation,lockand

expireaccountsbyusing:ALTERUSERhrPASSWORDEXPIREACCOUNTLOCK;ChangingDefaultAccountPasswordsDefaultaccountsprovideeasyaccesstothedatabase.Changethepasswordonanyaccountthathasnotbeenlocked.TochangethepasswordoftheSHaccounttos9049gbnij,run:SQL>ALTERUSERshIDENTIFIEDBYs9049gbnij;Useraltered.SQL>EnforcingPasswordManagementUseapasswordverificationroutinetoenforceconstraintsontheuser’snewpassword.Theprofileidentifieswhichroutinetouse:Averificationroutineiscreatedbytheutlpwdmg.sqlscript.UsetheOracleAdvancedSecurityoptionforstrongauthentication.ALTERPROFILEall_usersLIMIT...PASSWORD_VERIFY_FUNCTIONverify_function;ProtectingtheDataDictionaryThedatadictionaryisprotectedbydefaultwiththeinitializationparameterset:ThisconfigurationpreventsuserswiththeANYsystemprivilegesfromaccessingdatadictionarybasetables.TheSELECT

ANY

DICTIONARYsystemprivilegeallowsreadaccesstothedictionaryonly.O7_DICTIONARY_ACCESSIBILITY=FALSESystemandObjectPrivilegesApplyingtheprincipleofleastprivilege:LimitobjectprivilegestoactualneedsDonotuseGRANT

ALL

ON

objectLimitsystemprivilegesDonotgranttheDBAroletousersEncapsulatesensitiveobjectsRestrictingtheDirectoriesAccessible

bytheUserDonotusetheUTL_FILE_DIRparameter.UsetheDIRECTORYobjects:AllowsgranularaccesstodirectorypathsbytheuserAllowsreadorwriteaccessseparatelyIslimitedtothedirectoriesthattheOracleprocesscanaccessExample:CREATEDIRECTORYlocalAS'/user/local/dbs';GRANTREAD,WRITEONDIRECTORYlocalTOscott;LimitingUserswithAdministrativePrivilegesRestrictthefollowingtypesofprivileges:GrantsofsystemandobjectprivilegesSYS-privilegedconnections:SYSDBAandSYSOPERDBA-typeprivileges,suchasDROP

ANY

TABLERestrictrun-timepermissions.Example:ListalluserswiththeDBArole:SQL>SELECTgranteeFROMdba_role_privs2WHEREgranted_role='DBA';GRANTEE------------------------------SYSSYSTEMSeparationofResponsibilitiesUserswithDBAprivilegesmustbetrusted,butseparationofresponsibilitiescan:PreventabuseoftrustAllowaudittrailstoprotectthetrustedpositionToimplementseparationoftrust:DBAresponsibilitiesmustbesharedAccountsmustneverbesharedDBAandsystemadministratormustbedifferentpeopleSYSOPERandSYSDBAresponsibilitiesmustbeseparated.

UsingOtherDatabaseSecurityFeaturesAuthenticatetheusersthroughthemiddletier.Usesecureapplicationroles.Usevirtualprivatedatabases.Audituseractivity,especiallyprivilegedactivity.Encryptcolumnsforadditionalprivacyprotection.SummaryInthislesson,youshouldhavelearnedhowto:Apply