STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017: STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:SV-24928r2_rule
V-2562
Oracle minimum object auditing
DO3610-ORACLE11
CAT II
10
The only application objects auditing required is for use of the RENAME privilege on database objects.
Configure auditing on RENAME privilege use by default for newly created objects.
From SQL*Plus:
audit rename on default by access;
If application objects have already been created, the audit rename on object statement should be issued for all application objects.
From SQL*Plus:
audit rename on [application object name] by access;
Enable auditing of access and activity on audit trail data stored in the database.
From SQL*Plus:
audit update, delete on AUD$ by access;
NOTE: The audit table is by default in the SYSTEM schema, but may have been moved to another schema.
From SQL*Plus:
select count(*) from all_def_audit_opts where ren = 'A/A';
If the count of 0 is returned, this is a Finding.
Check for required auditing of the audit table as follows:
From SQL*Plus:
select upd, del, object_type from dba_obj_audit_opts
where object_name = 'AUD$';
If the record returned is of object type TABLE and upd(ate) and del(ete) are not = 'A/A', this is a Finding.
If the record type VIEW is returned and upd and del are = ‘A/A’, this is NOT a Finding.
Otherwise, if the record type VIEW is returned and upd and del are NOT = 'A/A', then the underlying table must be checked for update and delete auditing as follows:
From SQL*Plus:
set long 1000
set wrap on
select text from dba_views where view_name = 'AUD$';
Review the text returned and locate the “from table_owner.table_name”. This should be located at the end of the text returned.
Replace table_owner and table_name in the select statement below with the values returned above.
From SQL*Plus:
select upd, del from dba_obj_audit_opts
where owner = 'table_owner' and object_name = 'table_name';
If the value of upd(ate) and del(ete) returned above is NOT equal to 'A/A', this is a Finding.
V-2562
False
DO3610-ORACLE11
From SQL*Plus:
select count(*) from all_def_audit_opts where ren = 'A/A';
If the count of 0 is returned, this is a Finding.
Check for required auditing of the audit table as follows:
From SQL*Plus:
select upd, del, object_type from dba_obj_audit_opts
where object_name = 'AUD$';
If the record returned is of object type TABLE and upd(ate) and del(ete) are not = 'A/A', this is a Finding.
If the record type VIEW is returned and upd and del are = ‘A/A’, this is NOT a Finding.
Otherwise, if the record type VIEW is returned and upd and del are NOT = 'A/A', then the underlying table must be checked for update and delete auditing as follows:
From SQL*Plus:
set long 1000
set wrap on
select text from dba_views where view_name = 'AUD$';
Review the text returned and locate the “from table_owner.table_name”. This should be located at the end of the text returned.
Replace table_owner and table_name in the select statement below with the values returned above.
From SQL*Plus:
select upd, del from dba_obj_audit_opts
where owner = 'table_owner' and object_name = 'table_name';
If the value of upd(ate) and del(ete) returned above is NOT equal to 'A/A', this is a Finding.
M
Database Administrator
1367