2 Securing the Database Installation and Configuration

The O7_DICTIONARY_ACCESSIBILITY parameter prevents users who have the ANY system privilege from using those privileges on the data dictionary, that is, on objects in the SYS schema.

Oracle Database provides highly granular privileges. One such privilege, commonly referred to as the ANY privilege, should typically be granted to only application owners and individual database administrators. For example, you could grant the DROP ANY TABLE privilege to an application owner. You can protect the Oracle data dictionary from accidental or malicious use of the ANY privilege by turning on or off the O7_DICTIONARY_ACCESSIBILITY initialization parameter.

To enable data dictionary protection:

1. Access the Database home page.

   See Oracle Database 2 Day DBA for more information.

2. From the Administration menu, select Initialization Parameters.

   If the Database Login page appears, then log in as SYS with the SYSDBA role selected.

3. In the Initialization Parameters page, from the list, search for O7_DICTIONARY_ACCESSIBILITY.

   In the Name field, enter O7_ (the letter O), and then click Go. You can enter the first few characters of a parameter name. In this case, O7_ displays the O7_DICTIONARY_ACCESSIBILTY parameter.

4. Set the value for O7_DICTIONARY_ACCESSIBILTY to FALSE.

5. Click Apply.

6. Restart the Oracle Database instance.

   sqlplus sys as sysdba
   Enter password: password
   
   SQL> SHUTDOWN IMMEDIATE
   SQL> STARTUP 
   

To configure network encryption:

1. On the server computer, start Oracle Net Manager.

   • UNIX: From $ORACLE_HOME/bin, enter the following at the command line:

     netmgr
     

   • Windows: From the Start menu, click All Programs. Then, click Oracle - HOME_NAME, Configuration and Migration Tools, and then Net Manager

2. From the Oracle Net Configuration navigation tree, expand Local, and then select Profile.

   
   Description of the illustration netmgr_profile.gif

3. From the list, select Network Security.

   
   Description of the illustration netmgr_adv_sec.gif

4. Under Network Security, select the Encryption tab.

   The Encryption settings pane appears.

   
   Description of the illustration netmgr_encrypt.gif

5. Enter the following settings:

   • Encryption: From the list, select SERVER to configure the network encryption for the server. (For the client computer, you select CLIENT.)

   • Encryption Type: Select from the following values to specify the actions of the server (or client) when negotiating encryption and integrity:

     • accepted: Service will be active if the other side of the connection specifies either required or requested, and there is a compatible algorithm available on the receiving database; it will otherwise be inactive.

     • rejected: Service must not be active, and the connection will fail if the other side requires any of the methods in this list.

     • requested: Service will be active if the other side of the connection specifies either accepted, required, or requested, and there is a compatible algorithm available on the other side. Otherwise, the service is inactive.

     • required: Service must be active, and the connection will fail if the other side specifies rejected, or if there is no compatible algorithm on the other side.

   • Encryption Seed: Enter a random string of up to 256 characters. Oracle Database uses the encryption seed to generate cryptographic keys. This is required when either encryption or integrity is enabled.

     If you choose to use special characters such as a comma [,] or a right parenthesis [)] as a part of the Encryption Seed parameter, enclose the value within single quotation marks.

   • Available Methods: Select one or more of the following algorithms, and use the move button (>) to move them to the Selected Methods list. The order in which they appear in the Selected Methods list determines the preferred order for negotiation. That is, the first algorithm listed is selected first, and so on.

     • AES256: Advanced Encryption Standard (AES). AES was approved by the National Institute of Standards and Technology (NIST) to replace Data Encryption Standard (DES). AES256 enables you to encrypt a block size of 256 bits.

     • RC4_256: Rivest Cipher 4 (RC4), which is the most commonly used stream cipher that protects protocols such as Secure Sockets Layer (SSL). RC4_256 enables you to encrypt up to 256 bits of data.

     • AES192: Enables you to use AES to encrypt a block size of 192 bits.

     • 3DES168: Triple Data Encryption Standard (TDES) with a three-key option. 3DES168 enables you to encrypt up to 168 bits of data.

     • AES128: Enables you to use AES to encrypt a block size of 128 bits.

     • RC4_128: Enables you to use RC4 to encrypt up to 128 bits of data.

     • 3DES112: Enables you to use Triple DES with a two-key (112 bit) option.

     • DES: Data Encryption Standard (DES) 56-bit key. Note that National Institute of Standards and Technology (NIST) no longer recommends DES.

     • RC4_40: Enables you to use RC4 to encrypt up to 40 bits of data. (Not recommended.)

     • DES40: Enables you to use DES to encrypt up to 40 bits of data. (Not recommended.)

6. From the File menu, select Save Network Configuration, and then select Exit to exit Oracle Net Manager.

7. Repeat these steps for each client computer that connects to the server.

To find and change default passwords:

1. Log into the database instance with administrative privileges.

   sqlplus system
   Enter password: password
   

2. Select from the DBA_USERS_WITH_DEFPWD data dictionary view.

   SELECT * FROM DBA_USERS_WITH_DEFPWD;
   

   The DBA_USERS_WITH_DEFPWD lists the accounts that still have user default passwords. For example:

   USERNAME
   ------------
   SCOTT
   

3. Change the password for the accounts the DBA_USERS_WITH_DEFPWD data dictionary view lists.

   For example, to change the password for user SCOTT, enter the following:

   PASSWORD SCOTT
   Changing password for SCOTT
   New password: password
   Retype new password: password
   Password changed
   

   Replace password with a password that is secure, according to the guidelines listed in "Requirements for Creating Passwords". For greater security, do not reuse the same password that was used in previous releases of Oracle Database.

   Alternatively, you can use the ALTER USER SQL statement to change the password:

   ALTER USER SCOTT IDENTIFIED BY password;
   

To use Enterprise Manager to change the password of a database account:

1. Access the Database home page.

   See Oracle Database 2 Day DBA for more information.

2. From the Administration menu, select Security, then Users.

   If the Database Login page appears, then log in as an administrative user, such as SYS. User SYS must log in with the SYSDBA role selected.

   The Users page lists the user accounts created for the current database instance. The Account Status column indicates whether an account is expired, locked, or open.

3. In the Select column, select the account you want to change, and then click Edit.

4. In the Edit User page, enter a new password in the Enter Password and Confirm Password fields.

5. Click Apply.