Contents

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

How to Use This Manual

• Organization of Policy Text
• Background Information on Policies

1 Automatic Storage Management (ASM) Policies

• 1.1 Storage Policies
  • 1.1.1 Disk Group Contains Disks of Significantly Different Sizes
  • 1.1.2 Disk Group Contains Disks with Different Redundancy Attributes
  • 1.1.3 Disk Group Depends on External Redundancy and Has Unprotected Disks
  • 1.1.4 Disk Group with NORMAL or HIGH Redundancy Has Mirrored or Parity Protected Disks

2 Calendar Server Policy

• 2.1 Configuration Policies
  • 2.1.1 Calendar Log Level

3 Cluster Database Policies

• 3.1 Configuration Policies
  • 3.1.1 Force Logging Disabled
  • 3.1.2 Insufficient Number of Control Files
  • 3.1.3 Insufficient Number of Redo Logs
  • 3.1.4 Recovery Area Location Not Set
• 3.2 Security Policies - UNIX
  • 3.2.1 Access to %_CATALOG_%
  • 3.2.2 Access to ALL_SOURCE View
  • 3.2.3 Access to DBA_* Views
  • 3.2.4 Access to DBA_ROLE_PRIVS View
  • 3.2.5 Access to DBA_ROLES View
  • 3.2.6 Access to DBA_SYS_PRIVS View
  • 3.2.7 Access to DBA_TAB_PRIVS View
  • 3.2.8 Access to DBA_USERS View
  • 3.2.9 Access to ROLE_ROLE_PRIVS View
  • 3.2.10 Access to STATS$SQLTEXT Table
  • 3.2.11 Access to STATS$SQL_SUMMARY Table
  • 3.2.12 Access to SYS.AUD$ Table
  • 3.2.13 Access to SYS.LINK$ Table
  • 3.2.14 Access to SYS.SOURCE$ Table
  • 3.2.15 Access to SYS.USER$ Table
  • 3.2.16 Access to SYS.USER_HISTORY$ Table
  • 3.2.17 Access to USER_ROLE_PRIVS View
  • 3.2.18 Access to USER_TAB_PRIVS View
  • 3.2.19 Access to X_$ Views
  • 3.2.20 Audit Insert Failure
  • 3.2.21 Control File Permission
  • 3.2.22 Default Passwords
  • 3.2.23 Execute Privilege on SYS.DBMS_EXPORT_EXTENSION to PUBLIC
  • 3.2.24 Execute Privilege on SYS.DBMS_RANDOM Public
  • 3.2.25 Execute Privileges on DBMS_JOB to PUBLIC
  • 3.2.26 Execute Privileges on DBMS_LOB to PUBLIC
  • 3.2.27 Execute Privileges on DBMS_SYS_SQL to PUBLIC
  • 3.2.28 Granting SELECT ANY TABLE Privilege
  • 3.2.29 Limit OS Authentication
  • 3.2.30 Oracle Home Datafile Permission
  • 3.2.31 Password Complexity Verification Function Usage
  • 3.2.32 Password Grace Time
  • 3.2.33 Password Life Time
  • 3.2.34 Password Locking Time
  • 3.2.35 Password Reuse Max
  • 3.2.36 Password Reuse Time
  • 3.2.37 Profiles with Excessive Allowed Failed Login Attempts
  • 3.2.38 Proxy Account
  • 3.2.39 Restricted Privilege to Execute UTL_HTTP
  • 3.2.40 Restricted Privilege to Execute UTL_SMTP
  • 3.2.41 Restricted Privilege to Execute UTL_TCP
  • 3.2.42 System Privileges to Public
  • 3.2.43 Unlimited Tablespace Quota
  • 3.2.44 Use of Database Links with Cleartext Password
  • 3.2.45 Users with Excessive Allowed Failed Login Attempts
  • 3.2.46 Well Known Accounts
  • 3.2.47 Well Known Accounts (Status)
• 3.3 Security Policies - Windows
  • 3.3.1 Control File Permission (Windows)
  • 3.3.2 Oracle Home Datafile Permission (Windows)
• 3.4 Storage Policies
  • 3.4.1 Default Permanent Tablespace Set to a System Tablespace
  • 3.4.2 Default Temporary Tablespace Set to a System Tablespace
  • 3.4.3 Dictionary Managed Tablespaces
  • 3.4.4 Insufficient Redo Log Size
  • 3.4.5 Non-System Data Segments in a System Tablespace
  • 3.4.6 Non-System Users with System Tablespace as Default Tablespace
  • 3.4.7 Non-Uniform Default Extent Size for Dictionary Managed Tablespaces
  • 3.4.8 Rollback in SYSTEM Tablespace
  • 3.4.9 Segment with Extent Growth Policy Violation
  • 3.4.10 Tablespace Not Using Automatic Segment-Space Management
  • 3.4.11 Tablespaces Containing Rollback and Data Segments
  • 3.4.12 Users with Permanent Tablespace as Temporary Tablespace

4 Database Instance Policies

• 4.1 Configuration Policies
  • 4.1.1 Disabled Automatic Statistics Collection
  • 4.1.2 Force Logging Disabled
  • 4.1.3 Insufficient Number of Control Files
  • 4.1.4 Insufficient Number of Redo Logs
  • 4.1.5 Not Using Automatic PGA Management
  • 4.1.6 Not Using Automatic Undo Management
  • 4.1.7 Not Using Spfile
  • 4.1.8 Recovery Area Location Not Set
  • 4.1.9 STATISTICS_LEVEL Parameter Set to ALL
  • 4.1.10 TIMED_STATISTICS Set to FALSE
  • 4.1.11 Use of Non-Standard Initialization Parameters
• 4.2 Security Policies - UNIX
  • 4.2.1 Access to %_CATALOG_%
  • 4.2.2 Access to ALL_SOURCE View
  • 4.2.3 Access to DBA_* Views
  • 4.2.4 Access to DBA_ROLE_PRIVS View
  • 4.2.5 Access to DBA_ROLES View
  • 4.2.6 Access to DBA_SYS_PRIVS View
  • 4.2.7 Access to DBA_TAB_PRIVS View
  • 4.2.8 Access to DBA_USERS View
  • 4.2.9 Access to ROLE_ROLE_PRIVS View
  • 4.2.10 Access to STATS$SQLTEXT Table
  • 4.2.11 Access to STATS$SQL_SUMMARY Table
  • 4.2.12 Access to SYS.AUD$ Table
  • 4.2.13 Access to SYS.LINK$ Table
  • 4.2.14 Access to SYS.SOURCE$ Table
  • 4.2.15 Access to SYS.USER$ Table
  • 4.2.16 Access to SYS.USER_HISTORY$ Table
  • 4.2.17 Access to USER_ROLE_PRIVS View
  • 4.2.18 Access to USER_TAB_PRIVS View
  • 4.2.19 Access to X_$ Views
  • 4.2.20 Audit File Destination
  • 4.2.21 Audit Insert Failure
  • 4.2.22 Auditing of SYS Operations Enabled
  • 4.2.23 Background Dump Destination
  • 4.2.24 Control File Permission
  • 4.2.25 Core Dump Destination
  • 4.2.26 Data Dictionary Protected
  • 4.2.27 Default Passwords
  • 4.2.28 Enable Database Auditing
  • 4.2.29 Execute Privilege on SYS.DBMS_EXPORT_EXTENSION to PUBLIC
  • 4.2.30 Execute Privilege on SYS.DBMS_RANDOM Public
  • 4.2.31 Execute Privileges on DBMS_JOB to PUBLIC
  • 4.2.32 Execute Privileges on DBMS_LOB to PUBLIC
  • 4.2.33 Execute Privileges on DBMS_SYS_SQL to PUBLIC
  • 4.2.34 Execute Privileges on UTL_FILE to PUBLIC
  • 4.2.35 Granting SELECT ANY TABLE Privilege
  • 4.2.36 IFILE Referenced File Permission
  • 4.2.37 Initialization Parameter File Permission
  • 4.2.38 Limit OS Authentication
  • 4.2.39 Log Archive Destination Owner
  • 4.2.40 Log Archive Destination Permission
  • 4.2.41 Log Archive Duplex Destination Owner
  • 4.2.42 Log Archive Duplex Destination Permission
  • 4.2.43 Naming Database Links
  • 4.2.44 Oracle Agent SNMP Read-Only Configuration File Owner
  • 4.2.45 Oracle Agent SNMP Read-Only Configuration File Permission
  • 4.2.46 Oracle Agent SNMP Read-Write Configuration File Owner
  • 4.2.47 Oracle Agent SNMP Read-Write Configuration File Permission
  • 4.2.48 Oracle Home Datafile Permission
  • 4.2.49 Oracle Home Executable Files Owner
  • 4.2.50 Oracle Home Executable Files Permission
  • 4.2.51 Oracle Home File Permission
  • 4.2.52 Oracle HTTP Server Distributed Configuration File Owner
  • 4.2.53 Oracle HTTP Server Distributed Configuration Files Permission
  • 4.2.54 Oracle HTTP Server mod_plsql Configuration File Owner
  • 4.2.55 Oracle HTTP Server mod_plsql Configuration File Permission
  • 4.2.56 Oracle XSQL Configuration File Owner
  • 4.2.57 Oracle XSQL Configuration File Permission
  • 4.2.58 OS Roles
  • 4.2.59 Otrace Data Files
  • 4.2.60 Password Complexity Verification Function Usage
  • 4.2.61 Password Grace Time
  • 4.2.62 Password Life Time
  • 4.2.63 Password Locking Time
  • 4.2.64 Password Reuse Max
  • 4.2.65 Password Reuse Time
  • 4.2.66 Profiles with Excessive Allowed Failed Login Attempts
  • 4.2.67 Proxy Account
  • 4.2.68 Public Trace Files
  • 4.2.69 Remote OS Authentication
  • 4.2.70 Remote OS Role
  • 4.2.71 Remote Password File
  • 4.2.72 Restricted Privilege to Execute UTL_HTTP
  • 4.2.73 Restricted Privilege to Execute UTL_SMTP
  • 4.2.74 Restricted Privilege to Execute UTL_TCP
  • 4.2.75 Secure OS Audit Level
  • 4.2.76 Server Parameter File Permission
  • 4.2.77 SQL*Plus Executable Owner
  • 4.2.78 SQL*Plus Executable Permission
  • 4.2.79 System Privileges to Public
  • 4.2.80 Tkprof Executable Owner
  • 4.2.81 Tkprof Executable Permission
  • 4.2.82 Unlimited Tablespace Quota
  • 4.2.83 Use of Appropriate umask on UNIX Systems
  • 4.2.84 Use of Automatic Log Archival Features
  • 4.2.85 Use of Database Links with Cleartext Password
  • 4.2.86 Use of Remote Listener Instances
  • 4.2.87 Use of SQL92 Security Features
  • 4.2.88 User Dump Destination
  • 4.2.89 Users with Excessive Allowed Failed Login Attempts
  • 4.2.90 Using Externally Identified Accounts
  • 4.2.91 Utility File Directory Initialization Parameter Setting
  • 4.2.92 Utility File Directory Initialization Parameter Setting for Oracle9i Release 1 and Later
  • 4.2.93 Web Cache Initialization File Owner
  • 4.2.94 Web Cache Initialization File Permission
  • 4.2.95 Well Known Accounts
  • 4.2.96 Well Known Accounts (Status)
• 4.3 Security Policies - Windows
  • 4.3.1 Audit File Destination (Windows)
  • 4.3.2 Background Dump Destination (Windows)
  • 4.3.3 Control File Permission (Windows)
  • 4.3.4 Core Dump Destination (Windows)
  • 4.3.5 Domain Users Group Member of Local Users Group
  • 4.3.6 IFILE Referenced File Permission (Windows)
  • 4.3.7 Initialization Parameter File Permission (Windows)
  • 4.3.8 Installation on Domain Controller
  • 4.3.9 Installed Oracle Home Drive Permissions
  • 4.3.10 Log Archive Destination Permission (Windows)
  • 4.3.11 Log Archive Duplex Destination Permission (Windows)
  • 4.3.12 Oracle Agent SNMP Read-Only Configuration File Permission (Windows)
  • 4.3.13 Oracle Agent SNMP Read-Write Configuration File Permission (Windows)
  • 4.3.14 Oracle Home Datafile Permission (Windows)
  • 4.3.15 Oracle Home Executable Files Permission (Windows)
  • 4.3.16 Oracle Home File Permission (Windows)
  • 4.3.17 Oracle HTTP Server Distributed Configuration Files Permission (Windows)
  • 4.3.18 Oracle HTTP Server mod_psql Configuration File Permission (Windows)
  • 4.3.19 Oracle XSQL Configuration File Permission (Windows)
  • 4.3.20 Server Parameter File Permission (Windows)
  • 4.3.21 SQL*Plus Executable Permission (Windows)
  • 4.3.22 Tkprof Executable Permission (Windows)
  • 4.3.23 Use of Windows NT Domain Prefix (Windows)
  • 4.3.24 User Dump Destination (Windows)
  • 4.3.25 Web Cache Initialization File Permission (Windows)
  • 4.3.26 Windows Tools Permission
• 4.4 Storage Policies
  • 4.4.1 Default Permanent Tablespace Set to a System Tablespace
  • 4.4.2 Default Temporary Tablespace Set to a System Tablespace
  • 4.4.3 Dictionary Managed Tablespaces
  • 4.4.4 Insufficient Redo Log Size
  • 4.4.5 Non-System Data Segments in a System Tablespace
  • 4.4.6 Non-System Users with System Tablespace as Default Tablespace
  • 4.4.7 Non-Uniform Default Extent Size for Tablespaces
  • 4.4.8 Rollback in SYSTEM Tablespace
  • 4.4.9 Segment with Extent Growth Policy Violation
  • 4.4.10 Tablespace Not Using Automatic Segment-Space Management
  • 4.4.11 Tablespaces Containing Rollback and Data Segments
  • 4.4.12 Users with Permanent Tablespace as Temporary Tablespace

5 Host Policies

• 5.1 Configuration Policies
  • 5.1.1 Critical Patch Advisories for Oracle Homes
• 5.2 Security Policies
  • 5.2.1 Execute Stack
  • 5.2.2 Insecure Services
  • 5.2.3 NTFS File System
  • 5.2.4 Open Ports

6 Listener Policies

• 6.1 Security Policies - UNIX
  • 6.1.1 Allowed Logon Version
  • 6.1.2 Listener Default Name
  • 6.1.3 Listener Direct Administration
  • 6.1.4 Listener Log File Owner
  • 6.1.5 Listener Log File Permission
  • 6.1.6 Listener Logging Status
  • 6.1.7 Listener Password
  • 6.1.8 Listener Trace Directory Owner
  • 6.1.9 Listener Trace Directory Permission
  • 6.1.10 Listener Trace File Owner
  • 6.1.11 Listener Trace File Permission
  • 6.1.12 Listener.ora Permission
  • 6.1.13 Listner Inbound Connect Timeout
  • 6.1.14 Oracle Net Client Log Directory Owner
  • 6.1.15 Oracle Net Client Log Directory Permission
  • 6.1.16 Oracle Net Client Trace Directory Owner
  • 6.1.17 Oracle Net Client Trace Directory Permission
  • 6.1.18 Oracle Net Inbound Connect Timeout
  • 6.1.19 Oracle Net Server Log Directory Owner
  • 6.1.20 Oracle Net Server Log Directory Permission
  • 6.1.21 Oracle Net Server Trace Directory Owner
  • 6.1.22 Oracle Net Server Trace Directory Permission
  • 6.1.23 Oracle Net SSL_SERVER_DN_MATCH
  • 6.1.24 Restrict sqlnet.ora Permissions
  • 6.1.25 Sqlnet Expire Time
  • 6.1.26 Tcp Validnode Checking
  • 6.1.27 Use of Hostname in Listener.ora
• 6.2 Security Policies - Windows
  • 6.2.1 Listener Log File Permission (Windows)
  • 6.2.2 Listener Trace Directory Permission (Windows)
  • 6.2.3 Listener Trace File Permission (Windows)
  • 6.2.4 Listener.ora Permission (Windows)
  • 6.2.5 Oracle Net Client Log Directory Permission (Windows)
  • 6.2.6 Oracle Net Client Trace Directory Permission (Windows)
  • 6.2.7 Oracle Net Server Log Directory Permission (Windows)
  • 6.2.8 Oracle Net Server Trace Directory Permission (Windows)
  • 6.2.9 Restrict sqlnet.ora Permissions (Windows)

7 OC4J Policy

• 7.1 Configuration Policies
  • 7.1.1 Non-Shared Software Library Existence
• 7.2 Security Policies
  • 7.2.1 OC4J Password Indirection

8 OMS and Repository

• 8.1 Configuration Policies
  • 8.1.1 My Oracle Support Credentials

9 Oracle HTTP Server Policies

• 9.1 Configuration Policies
  • 9.1.1 HTTP Server HostNameLookups
  • 9.1.2 HTTP Server MaxKeepAliveRequests
• 9.2 Security Policies
  • 9.2.1 HTTP Server Access Logging
  • 9.2.2 HTTP Server Directory Indexing
  • 9.2.3 HTTP Server Dummy Wallet
  • 9.2.4 HTTP Server Owner And Setuid Bit
  • 9.2.5 HTTP Server SSL
  • 9.2.6 HTTP Server Writable Files

10 Oracle WebLogic Managed Server Policies

• 10.1 Configuration Policies
  • 10.1.1 WebLogic Admin Port Enabled
  • 10.1.2 WebLogic Performance Pack Enabled
  • 10.1.3 WebLogic Production Mode Enabled

11 Web Cache Policies

• 11.1 Security Policies
  • 11.1.1 Web Cache Access Logging
  • 11.1.2 Web Cache Dummy Wallet
  • 11.1.3 Web Cache Owner and Setuid Bit
  • 11.1.4 Web Cache Writable Files