STIGQter: STIG Summary: Oracle Database 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021: STIGQter: STIG Summary: Oracle Database 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:SV-237725r667207_rule
V-237725
SRG-APP-000516-DB-000363
O121-C2-013800
CAT II
10
For accounts managed by Oracle, issue the statement:
ALTER PROFILE profile_name LIMIT inactive_account_time 35;
Or
Change the profile for the DBMS account to ORA_STIG_PROFILE (which has the inactive_account_time parameter set to 35):
ALTER USER user_name PROFILE ora_stig_profile;
An alternate method is to create a script or store procedure that runs once a day.
Write a SQL statement to determine accounts that have not logged in within 35 days:
Example:
select username from dba_audit_trail where action_name = 'LOGON'
group by username having max(timestamp) < sysdate - 36
And then disable all accounts that have not logged in within 35 days.
If all user accounts are managed and authenticated by the OS or an enterprise-level authentication/access mechanism, and not by Oracle, this is not a finding.
For accounts managed by Oracle, check DBMS settings to determine if accounts are automatically disabled by the system after 35 days of inactivity.
In Oracle 12c, Oracle introduced a new security parameter in the profile called INACTIVE_ACCOUNT_TIME. The INACTIVE_ACCOUNT_TIME parameter specifies the number of days permitted the account will be in OPEN state since the last login, after that will be LOCKED if no successful logins happens after the specified duration.
Check to see what profile each user is associated with, if any, with this query:
select username, profile from dba_users order by 1,2;
Then check the profile to see what the inactive_account_time is set to in the table dba_profiles; the inactive_account_time is a value stored in the LIMIT column, and identified by the value inactive_account_time in the RESOURCE_NAME column.
SQL>select profile, resource_name, resource_type, limit from dba_profiles where upper(resource_name) = 'INACTIVE_ACCOUNT_TIME';
If the INACTIVE_ACCOUNT_TIME parameter is set to UNLIMITED (default) or it is set to more than 35 days, this is a finding.
If INACTIVE_ACCOUNT_TIME is not a parameter associated with the profile then check for a script or an automated job that is run daily that checks the audit trail or other means to make sure every user account has logged in within the last 35 days. If one is not present, this is a finding.
V-237725
False
O121-C2-013800
If all user accounts are managed and authenticated by the OS or an enterprise-level authentication/access mechanism, and not by Oracle, this is not a finding.
For accounts managed by Oracle, check DBMS settings to determine if accounts are automatically disabled by the system after 35 days of inactivity.
In Oracle 12c, Oracle introduced a new security parameter in the profile called INACTIVE_ACCOUNT_TIME. The INACTIVE_ACCOUNT_TIME parameter specifies the number of days permitted the account will be in OPEN state since the last login, after that will be LOCKED if no successful logins happens after the specified duration.
Check to see what profile each user is associated with, if any, with this query:
select username, profile from dba_users order by 1,2;
Then check the profile to see what the inactive_account_time is set to in the table dba_profiles; the inactive_account_time is a value stored in the LIMIT column, and identified by the value inactive_account_time in the RESOURCE_NAME column.
SQL>select profile, resource_name, resource_type, limit from dba_profiles where upper(resource_name) = 'INACTIVE_ACCOUNT_TIME';
If the INACTIVE_ACCOUNT_TIME parameter is set to UNLIMITED (default) or it is set to more than 35 days, this is a finding.
If INACTIVE_ACCOUNT_TIME is not a parameter associated with the profile then check for a script or an automated job that is run daily that checks the audit trail or other means to make sure every user account has logged in within the last 35 days. If one is not present, this is a finding.
M
4059