Guidelines for Securing a Database Installation and Configuration

Oracle provides guidelines to secure the database installation and configuration.

Changes were made to the default configuration of Oracle Database to make it more secure. The recommendations in this section augment the new, secure default configuration.

1. Before you begin an Oracle Database installation on UNIX systems, ensure that the umask value is 022 for the Oracle owner account.

2. Install only what is required.

   Options and Products: The Oracle Database CD pack contains products and options in addition to the database. Install additional products and options only as necessary. Use the Custom Installation feature to avoid installing unnecessary products, or perform a typical installation, and then deinstall options and products that are not required. There is no need to maintain additional products and options if they are not being used. They can always be properly installed, as required.

   Sample Schemas: Oracle Database provides sample schemas to provide a common platform for examples. If your database will be used in a production environment, then do not install the sample schema. If you have installed the sample schema on a test database, then before going to production, remove or relock the sample schema accounts.

3. During installation, when you are prompted for a password, create a secure password.

   Choose the password carefully, ensure that you change the default passwords, and change the default passwords of administrative users.

4. Immediately after installation, lock and expire default user accounts.

   For better security, you should lock and expire all default (predefined) user accounts.

Related Topics

• Oracle AI Database Administrator’s Reference for Linux and UNIX-Based Operating Systems

• Oracle AI Database Sample Schemas

• Guidelines for Securing Passwords

• Guidelines for Securing User Accounts and Privileges

Guideline for Securing Multitenant PDBs from the Root in a Linux Environment

In Linux, you can securely compartmentalize PDBs to manage their resources in containers called nests.

A database instance that runs on a host must have isolation and resource management with respect to other databases and applications running in the same host. You can use security isolation to shield this database instance (even from the root), so that a security breach in any application does not affect the database instance.

To use this feature, you create a container, called a nest, around the pluggable database (PDB) that you want to protect. The nests are hierarchical. Each nest exists in isolation from other nests, and enables the nest administrator to manage isolation and resource settings for the PDB contained within the nest. Each nest provides the following features:

• Isolation of operating system resources, such as pid, mount, and network

• Resource management for resources such as CPU, memory, and network

• File system isolation, in which you can control the visibility for various system level entities in a nest

• Secure computing, to filter, enable, or disable required system calls at the nest level

Related Topics

• Oracle AI Database Multitenant Administrator’s Guide