STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026: STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:SV-270526r1115966_rule
V-270526
SRG-APP-000516-DB-000363
O19C-00-009400
CAT II
10
Disable use of the REMOTE_LOGIN_PASSWORDFILE where remote administration is not authorized by specifying a value of NONE.
If authorized, restrict use of a password file to exclusive use by each database by specifying a value of EXCLUSIVE.
From SQL*Plus:
alter system set REMOTE_LOGIN_PASSWORDFILE = 'EXCLUSIVE' scope = spfile;
OR
alter system set REMOTE_LOGIN_PASSWORDFILE = 'NONE' scope = spfile;
The above SQL*Plus command will set the parameter to take effect at next system startup.
Restrict ownership and permissions on the Oracle password file to exclude world (Unix) or everyone (Windows).
More information regarding the ORAPWD file and the REMOTE_LOGIN_PASSWORDFILE parameter can be found here:
https://docs.oracle.com/en/database/oracle/oracle-database/19/refrn/REMOTE_LOGIN_PASSWORDFILE.html
To verify the current status of the REMOTE_LOGIN_PASSWORDFILE parameter:
If using a non-CDB database:
From SQL*Plus:
select value from v$parameter where upper(name) = 'REMOTE_LOGIN_PASSWORDFILE';
If the value returned does not equal 'EXCLUSIVE' or 'NONE', this is a finding.
If using a CDB database:
From SQL*Plus:
To verify the current status of the remote_login_passwordfile parameter use the SQL statement:
column name format a25
column parameter_value format a25
SELECT name, inst_id, con_id, value AS PARAMETER_VALUE
FROM sys.gv_$parameter
WHERE name = 'REMOTE_LOGIN_PASSWORDFILE'
ORDER BY 1;
In any instance or container, if the PARAMETER_VALUE is set to SHARED, or to a value other than EXCLUSIVE or NONE, that is a finding.
Check the security permissions on password file within the OS.
On Unix Systems:
ls -ld $ORACLE_HOME/dbs/orapw${ORACLE_SID}
Substitute ${ORACLE_SID} with the name of the ORACLE_SID for the database.
If permissions are granted for world access, this is a finding.
On Windows Systems (from Windows Explorer), browse to the %ORACLE_HOME%\database\directory.
Select and right-click on the PWD%ORACLE_SID%.ora file, select Properties, then select the Security tab.
Substitute %ORACLE_SID% with the name of the ORACLE_SID for the database.
If permissions are granted to everyone, this is a finding.
If any account other than the database management system (DBMS) software installation account is listed, this is a finding.
V-270526
False
O19C-00-009400
To verify the current status of the REMOTE_LOGIN_PASSWORDFILE parameter:
If using a non-CDB database:
From SQL*Plus:
select value from v$parameter where upper(name) = 'REMOTE_LOGIN_PASSWORDFILE';
If the value returned does not equal 'EXCLUSIVE' or 'NONE', this is a finding.
If using a CDB database:
From SQL*Plus:
To verify the current status of the remote_login_passwordfile parameter use the SQL statement:
column name format a25
column parameter_value format a25
SELECT name, inst_id, con_id, value AS PARAMETER_VALUE
FROM sys.gv_$parameter
WHERE name = 'REMOTE_LOGIN_PASSWORDFILE'
ORDER BY 1;
In any instance or container, if the PARAMETER_VALUE is set to SHARED, or to a value other than EXCLUSIVE or NONE, that is a finding.
Check the security permissions on password file within the OS.
On Unix Systems:
ls -ld $ORACLE_HOME/dbs/orapw${ORACLE_SID}
Substitute ${ORACLE_SID} with the name of the ORACLE_SID for the database.
If permissions are granted for world access, this is a finding.
On Windows Systems (from Windows Explorer), browse to the %ORACLE_HOME%\database\directory.
Select and right-click on the PWD%ORACLE_SID%.ora file, select Properties, then select the Security tab.
Substitute %ORACLE_SID% with the name of the ORACLE_SID for the database.
If permissions are granted to everyone, this is a finding.
If any account other than the database management system (DBMS) software installation account is listed, this is a finding.
M
5672