Skip Headers
Oracle® Database Vault Administrator's Guide
10g Release 2 (10.2)

B25166-29
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Master Index
Master Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

2 What to Expect After You Install Oracle Database Vault

This chapter contains:

See Also:

Appendix C, "Oracle Database Vault Security Guidelines" for guidelines on managing security in the Oracle Database configuration

Initialization and Password Parameter Settings That Change

When you install Oracle Database Vault, the installation process modifies several database initialization parameter settings to better secure your database configuration. If these changes adversely affect your organizational processes or database maintenance procedures, then contact Oracle Support for help in resolving the issue.

Table 2-1 describes the initialization parameter settings that Oracle Database Vault modifies. Initialization parameters are stored in the init.ora initialization parameter file, located in $ORACLE_HOME/srvm/admin. For more information about this file, see Oracle Database Administrator's Guide.

Table 2-1 Modified Database Initialization Parameter Settings

Parameter Default Value in Database New Value Set by Database Vault Impact of the Change

AUDIT_SYS_OPERATIONS

FALSE

TRUE

Enables the auditing of top-level operations directly issued by user SYS, and users connecting with SYSDBA or SYSOPER privilege.

For more information about AUDIT_SYS_OPERATIONS, see Oracle Database Reference.

OS_AUTHENT_PREFIX

ops$

Null string

Eliminates the addition of a prefix to operating system account names.

For more information about OS_AUTHENT_PREFIX, see Oracle Database SQL Reference.

OS_ROLES

Not configured.

FALSE

Disables the operating system to completely manage the granting and revoking of roles to users. Any previous grants of roles to users using GRANT statements do not change, because they are still listed in the data dictionary. Only the role grants made at the operating system-level to users apply. Users can still grant privileges to roles and users.

For more information about OS_ROLES, see Oracle Database SQL Reference.

REMOTE_LOGIN_PASSWORDFILE

EXCLUSIVE

EXCLUSIVE

Specifies whether Oracle Database checks for a password file. The EXCLUSIVE setting enforces the use of the password file, if you installed Oracle Database Vault into a database where REMOTE_LOGIN_PASSWORDFILE is not set to EXCLUSIVE.

For more information about REMOTE_LOGIN_PASSWORDFILE, see Oracle Database Reference.

REMOTE_OS_AUTHENT

FALSE

FALSE

Prevents remote clients from being authenticated with the value of the OS_AUTHENT_PREFIX parameter.

This prevents a remote user from impersonating another operating system user over a network connection.

For more information about REMOTE_OS_AUTHENT, see Oracle Database Security Guide.

REMOTE_OS_ROLES

FALSE

FALSE

Disables users who are connecting to the database through Oracle Net to have their roles authenticated by the operating system.

This includes connections through a shared server configuration, as this connection requires Oracle Net. This restriction is the default because a remote user could impersonate another operating system user over a network connection.

For more information about REMOTE_OS_ROLES, see Oracle Database Security Guide.

SQL92_SECURITY

FALSE

TRUE

Ensures that if a user has been granted the UPDATE and DELETE object privileges, then the user must also be granted the SELECT object privilege before being able to perform UPDATE or DELETE operations on tables that have WHERE or SET clauses.

For more information about SQL92_SECURITY, see Oracle Database SQL Reference.


How Oracle Database Vault Restricts User Authorizations

During installation of Oracle Database Vault, the installer prompts for two additional database account names. In addition, several database roles are created. These accounts are part of the separation of duties provided by Oracle Database Vault. One common audit problem that has affected several large organizations is the unauthorized creation of new database accounts by a database administrator within a production instance. Upon installation, Oracle Database Vault prevents anyone other than the Oracle Database Vault account manager or a user granted the Oracle Database Vault account manager role from creating users in the database.

Using New Database Roles to Enforce Separation of Duties

To meet regulatory, privacy and other compliance requirements, Oracle Database Vault implements the concept of separation of duty. Oracle Database Vault makes clear separation between the account management responsibility, data security responsibility, and database resource management responsibility inside the database. This means that the concept of a superprivileged user (for example, DBA) is divided among several new database roles to ensure no one user has full control over both the data and configuration of the system. Oracle Database Vault prevents the SYS user and other accounts with the DBA role and other system privileges from designated protected areas of the database called realms. It also introduces new database roles called the Oracle Database Vault Owner (DV_OWNER) and the Oracle Database Vault Account Manager (DV_ACCTMGR). These new database roles separate the data security and the account management from the traditional DBA role. You should map these roles to distinct security professionals within your organization.

See "Oracle Database Vault Roles" for detailed information about the roles created during the Oracle Database Vault installation. See also "Oracle Database Vault Accounts" for default accounts that are created and for suggestions of additional accounts that you may want to create.

Privileges That Are Revoked from Existing Users and Roles

When you install Oracle Database Vault, it revokes a set of privileges from several Oracle Database-supplied roles, as part of the separation of duty enhancement.

Table 2-2 lists privileges that Oracle Database Vault revokes from existing users and roles. Be aware that if you disable Oracle Database Vault, these privileges remain revoked. If your applications depend on these privileges, then grant them to application owner directly.

Table 2-2 Privileges Oracle Database Vault Revokes

User or Role Privilege That Is Revoked

DBA role

  • BECOME USER

  • SELECT ANY TRANSACTION

  • CREATE ANY JOB

  • CREATE EXTERNAL JOB

  • EXECUTE ANY PROGRAM

  • EXECUTE ANY CLASS

  • MANAGE SCHEDULER

  • DEQUEUE ANY QUEUE

  • ENQUEUE ANY QUEUE

  • MANAGE ANY QUEUE

IMP_FULL_DATABASE role

  • BECOME USER

  • MANAGE ANY QUEUE

EXECUTE_CATALOG_ROLE role

  • EXECUTE ON DBMS_LOGMNR

  • EXECUTE ON DBMS_LOGMNR_D

  • EXECUTE ON DBMS_LOGMNR_LOGREP_DICT

  • EXECUTE ON DBMS_LOGMNR_SESSION

  • EXECUTE ON DBMS_FILE_TRANSFER

PUBLIC user

  • EXECUTE ON UTL_FILE

SCHEDULER_ADMIN role

  • CREATE ANY JOB

  • CREATE EXTERNAL JOB

  • EXECUTE ANY PROGRAM

  • EXECUTE ANY CLASS

  • MANAGE SCHEDULER


Privileges That Are Prevented for Existing Users and Roles

The following privileges are prevented for all users and roles who have been granted these privileges, including users SYS and SYSTEM:

  • ALTER PROFILE

  • ALTER USER (but users can still use the ALTER USER statement to change their own passwords)

  • CREATE PROFILE

  • CREATE USER

  • DROP PROFILE

  • DROP USER

For better security and to maintain separation-of-duty standards, do not enable SYS or SYSTEM users the ability to create or manage user accounts.

How Oracle Database Vault Affects Oracle Database Auditing

This section contains:

AUD$ Table Moved from SYS to the SYSTEM Schema

In an Oracle Database Vault environment, when Oracle Label Security is enabled, the AUD$ table is moved from the SYS schema to the SYSTEM schema. The synonym SYS.AUD$ is created to refer to the SYSTEM.AUD$ table.

Tip:

For greater security, create a realm around the SYSTEM.AUD$ and SYS.FGA_LOG$ tables. See Chapter 4, "Configuring Realms," for more information about realms.

Modified AUDIT Statement Settings

When you install Oracle Database Vault, it configures several AUDIT settings in the database. See Oracle Database Audit Settings Created for Oracle Database Vault for more information.

Creating Oracle Virtual Private Database or Fine-Grained Auditing Policies

If users plan to create Oracle Virtual Private Database or fine-grained auditing policies, they must have the EXECUTE privilege on the DBMS_RLS PL/SQL package. When Oracle Database Vault is enabled, the SYS user no longer owns this package; the Oracle Database Vault administrator (DV_ADMIN) does. As the DV_ADMIN user, grant these users the EXECUTE privilege for the DBMS_RLS PL/SQL package.