13 Managing User Accounts and Access

Topics

13.1 About Oracle Audit Vault and Database Firewall Administrative Accounts

When administrators log in to Oracle Audit Vault and Database Firewall, they have access only to administrative functions, whereas auditors have access only to the auditing functions.

Oracle Audit Vault and Database Firewall has three types of administrative user accounts:

Audit Vault Server Super Administrator:
- Manages system-wide settings
- Creates user accounts for super administrators and administrators
- Has access to all secured targets and secured target groups
- Grants access to secured targets or secured target groups to administrators
Audit Vault Server Administrator: Has access to specific secured targets or secured target groups granted by a super administrator. Administrators cannot manage system-wide settings.
Database Firewall Administrator: Has access to the Database Firewall administrative interface. The Database Firewall has only one administrator.

After installing Oracle Audit Vault and Database Firewall, a post-installation configuration page lets you create and specify passwords for one super administrator account and one super auditor account for the Audit Vault Server, and one administrator account for the Database Firewall.

Thereafter, the Audit Vault Server super administrator can create other administrative users, and the super auditor can create other auditor users, for the server.

This chapter describes managing user accounts and passwords for the Oracle Audit Vault and Database Firewall administrator user interfaces.

13.2 Security Technical Implementation Guides and Implementation for User Accounts

Oracle Audit Vault and Database Firewall follow STIG rules for user accounts.

Oracle Audit Vault and Database Firewall follows the Security Technical Implementation Guides (STIG) and implementation rules for user accounts.

The default Oracle Audit Vault and Database Firewall user accounts must have custom passwords.
The number of consecutive failed login attempts is 3.
When a user exceeds the maximum number of unsuccessful login attempts, the account is locked until a super administrator releases it.
Account lockouts will persist until a super administrator resets the user account.

13.3 Configuring Administrative Accounts for the Audit Vault Server

Topics

13.3.1 Guidelines for Securing the Oracle Audit Vault and Database Firewall User Accounts

As a best practice, you should use the installed Audit Vault and Database Firewall user accounts only as back-up accounts. Add new user accounts, with unique user names and passwords, for the users who are responsible for the day-to-day Oracle Audit Vault and Database Firewall operations.

Note:

Audit Vault and Database Firewall does not accept user names with quotation marks. For example, "jsmith" would not be a valid user name for an Oracle Audit Vault and Database Firewall user account, or an account created on a secured target for use by Oracle Audit Vault and Database Firewall.

13.3.2 Creating Administrative Accounts for the Audit Vault Server

Audit Vault Ser ver super administrators can create both super administrator and administrator user accounts.

To create an administrative account in the Audit Vault Server:

Log in to the Audit Vault Server as a super administrator.
Click the Settings tab.

The Manage Admins page appears by default, and displays existing users and the secured targets or groups to which they have access.
Click Create.
Enter the User Name and Password, and re-type the password in the appropriate fields.

Note:

Oracle Audit Vault and Database Firewall does not accept user names with quotation marks, such as "jsmith".
In the Type drop-down list, select Admin or Super Admin.
Click Save.

The new user is listed in the Manage Admins page.

See Also:

About Oracle Audit Vault and Database Firewall Administrative Accounts for explanation on roles.

13.3.3 Viewing the Status of Administrator User Accounts

As a s uper administrator, you can view the status of administrator accounts by clicking the Settings tab. The Manage Admins page lists all administrator and super administrator accounts, their status, and password expiry dates.

13.3.4 Changing a User Account Type for the Audit Vault Server

You can change an administrative account type from administrator to super administrator, or vice versa.

Note that if you change a user's account type from administrator to super administrator, that user will have access to all secured targets and secured target groups.

To change a user account type in Oracle AVDF:

Log in to the Audit Vault Server as a super administrator.
Click the Settings tab.

The Manage Admins page appears by default, and displays existing users and the secured targets or groups to which they have access.
Click the name of the user account you want to change.
In the Modify Admin page, in the Type section, click Change.
In the Type drop-down list, select the new administrator type.
If you changed the type from Super Admin to Admin, grant or revoke access to any secured targets or groups as necessary for this user:
1. Select the secured targets or groups to which you want to grant or revoke access.
2. Click Grant Access or Revoke Access.
  
  A check mark indicates access granted. An X indicates access revoked.
3. Repeat steps a and b if necessary.
Click Save.

13.3.5 Unlocking a User Account

An Oracle Audit Vault and Database Firewall ad ministrator account is locked after at least 3 failed login attempts. A super administrator must unlock user accounts.

To unlock an administrator account in Oracle Audit Vault and Database Firewall:

Log in to the Audit Vault Server console as a super administrator.
Click the Settings tab.

The Manage Admins page appears by default, and displays existing users.
Click the name of the user account you want to unlock.
In the Modify Admin page, click Unlock.

See Also:

Logging in to the Audit Vault Server Console UI

13.3.6 Deleting an Audit Vault Server Administrator Account

To delete an Audit Vault Server administrator user account:

Log in to the Audit Vault Server as a super administrator.
Click the Settings tab.

The Manage Admins page appears by default, and displays existing users and the secured targets or groups to which they have access.
Select the users you want to delete, and then click Delete.

13.4 Configuring sudo Access for Users

Topics

13.4.1 About Configuring sudo Access

The sudo command enables a trusted user to have administrative access to a system without having to log in using the root user password.

When users have been given sudo access, they can precede an administrative command with sudo, and then be prompted to enter their password. Once authenticated, and assuming that the command is permitted, the command is executed as if it had been run by the root user.

13.4.2 Configuring sudo Access for a User

You must have root privileges to configure sudo access for a user.

Log in to the system as the root user.
Create a normal user account using the useradd command.

For example, to create a normal user account for the user psmith:
```
# useradd psmith
```

Set a password for the user using the passwd command.

For example:

# passwd psmith
Changing password for user psmith.
New password: new_password
Retype new password: new_password
passwd: all authentication tokens updated successfully

Run the visudo utility to edit the /etc/sudoers file.
```
# visudo
```
The sudoers file defines the policies that the sudo command applies.
Find the lines in the sudoers file that grant access to users in the wheel group when enabled.
```
## Allows people in group wheel to run all commands
# %wheel        ALL=(ALL)       ALL
```
Remove the comment character (#) at the start of the second line, which begins with %wheel.

This enables the configuration option.
Save your changes and exit the editor.
Add the user account that you created earlier to the wheel group using the usermod command.

For example:
```
usermod -aG wheel psmith
```
Test that the updated configuration enables the user that you created to run commands using sudo.
1. Use the su command to switch to the new user account that you created.
```
# su psmith
```
2. Use the groups command to verify that the user is in the wheel group.
```
$ groups
psmith wheel
```
3. Use the sudo command to run the whoami command.
  
  Because this is the first time that you have run a command using sudo from this user account, the banner message is displayed. You will be prompted to enter the password for the user account.
```
$ sudo whoami
```
  The following output should appear:
```
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
  #1) Respect the privacy of others.
  #2) Think before you type.
  #3) With great power comes great responsibility.
```
  Enter the password when prompted:
```
[sudo] password for psmith: password
root
```
  The last line of the output is the user name that is returned by the whoami command. If sudo access has been configured correctly, then this value is root.

13.5 Managing User Access Rights to Secured Targets or Groups

Topics

13.5.1 About Managing User Access Rights

Super administrators have access to all secured targets and secured target groups, and can grant access to specific targets and groups to administrators.

You can control access to secured targets or groups in two ways:

Modify a secured target or group to grant or revoke access for one or more users.
Modify a user account to grant or revoke access to one or more secured targets or groups.

13.5.2 Controlling Access Rights by User

To control which secured targets or groups are accessible by a user:

Log in to the Audit Vault Server as a super administrator.
Click the Settings tab.

The Manage Admins page appears by default, and displays existing users and the secured targets or groups to which they have access.
Click the name of the user account you want to modify.

The Modify Admin page appears.
In the Targets and Groups section, select the secured targets or secured target groups to which you want to grant or revoke access for this user.
Click Grant Access or Revoke Access.

A check mark indicates access granted. An "x" indicates access revoked.
If necessary, repeat steps 4 and 5.
Click Save.

13.5.3 Controlling Access Rights by Secured Target or Group

To control which users have access to a secured target or group:

Log in to the Audit Vault Server as a super administrator.
Click the Settings tab, and then click Manage Access Rights.
Click the name of the secured target or secured target group for which you want to define access rights.

The Modify Access for... page appears, listing user access rights to this secured target or group. Super administrators have access by default.
In the Modify Access page, select the users for which you want to grant or revoke access to this secured target or group.
Click Grant Access or Revoke Access.

A check mark indicates access granted. An "x" indicates access revoked.
If necessary, repeat steps 4 and 5.
Click Save.

13.6 Changing User Passwords in Oracle Audit Vault and Database Firewall

Topics

13.6.1 Password Requirements

You should have a policy in place for changing passwords for the Audit Vault and Database Firewall user accounts. For example, you may require that users change their passwords on a regular basis, such as every 120 days, and that they create passwords that are not easily guessed.

Requirements for Passwords Containing Unicode Characters

If your password contains unicode characters (such as non-English characters with accent marks), the password requirement is that it:

Be between 8 and 30 characters long.

Requirements for English-Only (ASCII) Passwords

If you are using English-only, ASCII printable characters, Oracle AVDF requires that passwords:

Be between 8 and 30 characters long.
Contain at least one of each of the following:
- Lowercase letters: a-z.
- Uppercase letters: A-Z.
- Digits: 0-9.
- Punctuation marks: comma (,), period (.), plus sign (+), colon(:), exclamation mark (!), and underscore (_)
Not contain double quotes ("), back space, or control characters.

In addition, Oracle recommends that passwords:

Not be the same as the user name.
Not be an Oracle reserved word.
Not be an obvious word (such as welcome, account, database, and user).
Not contain any repeating characters.

13.6.2 Changing the Audit Vault Server Administrator User Password

When your Oracle Audit Vault and Database Firewall user passwords expires, you will be prompted to create a new one. However, you can change your password at any time.

Changing Your Own Password

To change your Audit Vault Server user password:

Log in to the Audit Vault Server as an administrator.
Click the Settings tab, and then click Change Password.
Type your Current Password, New Password, and then re-type the new password in the appropriate fields.

Ensure that the password is a custom password.
Click Save.

Changing the Password of Another Administrator

If you are a super administrator, you can change the password of administrators.

To change the password of another administrator:

Log in to the Audit Vault Server as a super administrator.
Click the Settings tab.
In the Manage Admins page, click the name of the administrator.
In the Change Password section, fill the New Password and Re-enter New Password fields, and then click Save.

Ensure that the password is a custom password.

13.6.3 Changing the Database Firewall Administrator Password

To change the Database Firewall administrator Password:

Log in to the Database Firewall.
In the Users menu, click List.
In the Users List, click the user name whose password you want to change.
Enter and confirm your new password in the Password and Password Confirmation fields.

Ensure that the password is a custom password.
In the User Password field, enter your old password (the one you are changing).
Click Save.
See Also:
- Logging in to the Database Firewall Console UI
- Password Requirements