CIS Oracle Database 19c Benchmark

File and directory permissions for $ORACLE_HOME should be set to Restrictive. Overly permissive access controls can allow unauthorized users to read, modify, or execute sensitive files, potentially compromising the Oracle Database 19c database server.

Incorrect permissions on $ORACLE_HOME could allow unauthorized reading, writing, or execution of critical files. Proper file permissions are a foundational control that prevents privilege escalation and data tampering.

ls -ld $ORACLE_HOME
find $ORACLE_HOME -perm /o+w -ls 2>/dev/null

chown -R oracle:oinstall $ORACLE_HOME
chmod -R o-rwx $ORACLE_HOME

File and directory permissions for $ORACLE_BASE should be set to Restrictive. Overly permissive access controls can allow unauthorized users to read, modify, or execute sensitive files, potentially compromising the Oracle Database 19c database server.

Incorrect permissions on $ORACLE_BASE could allow unauthorized reading, writing, or execution of critical files. Proper file permissions are a foundational control that prevents privilege escalation and data tampering.

ls -ld $ORACLE_BASE

chown oracle:oinstall $ORACLE_BASE
chmod 750 $ORACLE_BASE

File and directory permissions for Datafile should be set to Set Properly. Overly permissive access controls can allow unauthorized users to read, modify, or execute sensitive files, potentially compromising the Oracle Database 19c database server.

Incorrect permissions on Datafile could allow unauthorized reading, writing, or execution of critical files. Proper file permissions are a foundational control that prevents privilege escalation and data tampering.

SELECT name FROM v$datafile;
-- then check OS permissions on each file

chmod 640 /u01/app/oracle/oradata/<DB_NAME>/*.dbf

This recommendation verifies that the Latest Critical Patch Update Is Applied on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Latest Critical Patch Update Is Applied may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT action, version, comments FROM dba_registry_sqlpatch ORDER BY action_time DESC;
$ORACLE_HOME/OPatch/opatch lspatches

# Download and apply the latest CPU/RU from My Oracle Support
# Use OPatch/opatchauto:
$ORACLE_HOME/OPatch/opatch apply <PATCH_DIR>

Sample Schemas should be removed from the Oracle Database 19c database server when not required. Removing unnecessary components reduces the attack surface and limits the number of potential vulnerabilities that need to be managed.

Retaining Sample Schemas when it is not needed increases the attack surface. Unpatched or unused components are frequent targets for exploitation and should be removed as part of system hardening.

SELECT username FROM dba_users WHERE username IN
  ('SCOTT','HR','OE','SH','PM','IX','BI');

DROP USER SCOTT CASCADE;
DROP USER HR CASCADE;
DROP USER OE CASCADE;
DROP USER SH CASCADE;

This recommendation configures REMOTE_LOGIN_PASSWORDFILE to NONE on the Oracle Database 19c database server. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for REMOTE_LOGIN_PASSWORDFILE could weaken security controls or allow unintended behavior. Setting this to NONE ensures the Oracle Database 19c database server operates within a well-defined security boundary.

SELECT value FROM v$parameter WHERE name = 'remote_login_passwordfile';

ALTER SYSTEM SET remote_login_passwordfile = NONE SCOPE=SPFILE;
-- Restart required

When TRUE, Oracle trusts the OS authentication from remote clients which can be trivially spoofed.

Failure to rEMOTE_OS_AUTHENT Is FALSE may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT value FROM v$parameter WHERE name = 'remote_os_authent';

ALTER SYSTEM SET remote_os_authent = FALSE SCOPE=SPFILE;

This recommendation verifies that rEMOTE_OS_ROLES Is FALSE on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to rEMOTE_OS_ROLES Is FALSE may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT value FROM v$parameter WHERE name = 'remote_os_roles';

ALTER SYSTEM SET remote_os_roles = FALSE SCOPE=SPFILE;

This recommendation verifies that sEC_CASE_SENSITIVE_LOGON Is TRUE on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sEC_CASE_SENSITIVE_LOGON Is TRUE may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT value FROM v$parameter WHERE name = 'sec_case_sensitive_logon';

ALTER SYSTEM SET sec_case_sensitive_logon = TRUE SCOPE=SPFILE;

This recommendation verifies that o7_DICTIONARY_ACCESSIBILITY Is FALSE on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to o7_DICTIONARY_ACCESSIBILITY Is FALSE may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT value FROM v$parameter WHERE name = 'o7_dictionary_accessibility';

ALTER SYSTEM SET o7_dictionary_accessibility = FALSE SCOPE=SPFILE;

This recommendation verifies that sEC_MAX_FAILED_LOGIN_ATTEMPTS Is ≤ 5 on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sEC_MAX_FAILED_LOGIN_ATTEMPTS Is ≤ 5 may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT value FROM v$parameter WHERE name = 'sec_max_failed_login_attempts';

ALTER SYSTEM SET sec_max_failed_login_attempts = 5 SCOPE=SPFILE;

This recommendation verifies that the Listener Is Password-Protected or Uses OS Auth on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Listener Is Password-Protected or Uses OS Auth may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lsnrctl status
# Check SECURITY = ON in listener.ora

# In listener.ora:
SECURE_REGISTER_LISTENER = (IPC)
# Or set an admin password:
lsnrctl
LSNRCTL> change_password
LSNRCTL> save_config

This recommendation configures ADMIN_RESTRICTIONS_LISTENER to ON on the Oracle Database 19c database server. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for ADMIN_RESTRICTIONS_LISTENER could weaken security controls or allow unintended behavior. Setting this to ON ensures the Oracle Database 19c database server operates within a well-defined security boundary.

grep -i ADMIN_RESTRICTIONS $ORACLE_HOME/network/admin/listener.ora

# In listener.ora:
ADMIN_RESTRICTIONS_LISTENER = ON

This setting controls whether the Listener Logging is enabled on the Oracle Database 19c database server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via init.ora, sqlnet.ora, listener.ora, or SQL*Plus.

Without the Listener Logging enabled, the Oracle Database 19c database server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep -i LOG_FILE $ORACLE_HOME/network/admin/listener.ora

# In listener.ora:
LOGGING_LISTENER = ON
LOG_FILE_LISTENER = listener.log
LOG_DIRECTORY_LISTENER = $ORACLE_BASE/diag/tnslsnr/<host>/listener/trace

This recommendation verifies that eXTPROC Is Not in Use or Properly Secured on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to eXTPROC Is Not in Use or Properly Secured may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i EXTPROC $ORACLE_HOME/network/admin/listener.ora
grep -i EXTPROC $ORACLE_HOME/network/admin/tnsnames.ora

# Remove EXTPROC entries from listener.ora if not needed
# If needed, ensure extproc.ora restricts allowed DLLs:
SET EXTPROC_DLLS=ONLY:<allowed_dll_path>

This recommendation verifies that default Accounts Are Locked and Expired on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to default Accounts Are Locked and Expired may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT username, account_status FROM dba_users
WHERE username IN ('DBSNMP','OUTLN','MDSYS','CTXSYS','XDB','WMSYS','APEX_PUBLIC_USER')
AND account_status != 'EXPIRED & LOCKED';

ALTER USER DBSNMP ACCOUNT LOCK PASSWORD EXPIRE;
ALTER USER OUTLN ACCOUNT LOCK PASSWORD EXPIRE;
ALTER USER CTXSYS ACCOUNT LOCK PASSWORD EXPIRE;

This recommendation verifies that sYS and SYSTEM Passwords Are Changed from Defaults on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sYS and SYSTEM Passwords Are Changed from Defaults may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Attempt login with known default passwords:
# SYS/change_on_install, SYSTEM/manager

ALTER USER SYS IDENTIFIED BY <STRONG_PASSWORD>;
ALTER USER SYSTEM IDENTIFIED BY <STRONG_PASSWORD>;

This recommendation verifies that No Public Database Links is present on the Oracle Database 19c database server. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No Public Database Links leaves the Oracle Database 19c database server without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

SELECT db_link, owner FROM dba_db_links WHERE owner = 'PUBLIC';

DROP PUBLIC DATABASE LINK <LINK_NAME>;

This recommendation verifies that pASSWORD_LIFE_TIME Is ≤ 90 Days on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to pASSWORD_LIFE_TIME Is ≤ 90 Days may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT profile, resource_name, limit FROM dba_profiles
WHERE resource_name = 'PASSWORD_LIFE_TIME';

ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME 90;

This recommendation verifies that fAILED_LOGIN_ATTEMPTS Is ≤ 5 on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to fAILED_LOGIN_ATTEMPTS Is ≤ 5 may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT profile, resource_name, limit FROM dba_profiles
WHERE resource_name = 'FAILED_LOGIN_ATTEMPTS';

ALTER PROFILE DEFAULT LIMIT FAILED_LOGIN_ATTEMPTS 5;

This recommendation verifies that pASSWORD_LOCK_TIME Is ≥ 1 Day on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to pASSWORD_LOCK_TIME Is ≥ 1 Day may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT profile, resource_name, limit FROM dba_profiles
WHERE resource_name = 'PASSWORD_LOCK_TIME';

ALTER PROFILE DEFAULT LIMIT PASSWORD_LOCK_TIME 1;

A password verify function enforces complexity requirements such as minimum length, mixed case, and avoidance of dictionary words.

Failure to pASSWORD_VERIFY_FUNCTION Is Set may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT profile, resource_name, limit FROM dba_profiles
WHERE resource_name = 'PASSWORD_VERIFY_FUNCTION';

-- Run the built-in verification script:
@$ORACLE_HOME/rdbms/admin/catpvf.sql
ALTER PROFILE DEFAULT LIMIT PASSWORD_VERIFY_FUNCTION ora12c_verify_function;

This recommendation verifies that pASSWORD_REUSE_MAX Is ≥ 20 on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to pASSWORD_REUSE_MAX Is ≥ 20 may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT profile, resource_name, limit FROM dba_profiles
WHERE resource_name = 'PASSWORD_REUSE_MAX';

ALTER PROFILE DEFAULT LIMIT PASSWORD_REUSE_MAX 20;

This recommendation verifies that no Users Have 'ANY' Privileges Granted Directly on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to no Users Have 'ANY' Privileges Granted Directly may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT grantee, privilege FROM dba_sys_privs
WHERE privilege LIKE '%ANY%'
AND grantee NOT IN ('SYS','SYSTEM','DBA','IMP_FULL_DATABASE','EXP_FULL_DATABASE');

REVOKE <ANY_PRIVILEGE> FROM <USER>;

This recommendation verifies that dBA Role Is Not Granted to Non-Admin Users on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to dBA Role Is Not Granted to Non-Admin Users may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT grantee FROM dba_role_privs WHERE granted_role = 'DBA'
AND grantee NOT IN ('SYS','SYSTEM');

REVOKE DBA FROM <USER>;

UTL_FILE allows PL/SQL to read and write OS files. PUBLIC access creates a privilege escalation risk.

Failure to eXECUTE on UTL_FILE Is Revoked from PUBLIC may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT grantee, privilege FROM dba_tab_privs
WHERE table_name = 'UTL_FILE' AND grantee = 'PUBLIC';

REVOKE EXECUTE ON UTL_FILE FROM PUBLIC;

This recommendation verifies that eXECUTE on DBMS_SQL Is Revoked from PUBLIC on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to eXECUTE on DBMS_SQL Is Revoked from PUBLIC may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT grantee, privilege FROM dba_tab_privs
WHERE table_name = 'DBMS_SQL' AND grantee = 'PUBLIC';

REVOKE EXECUTE ON DBMS_SQL FROM PUBLIC;

This recommendation verifies that eXECUTE on DBMS_JAVA Is Revoked from PUBLIC on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to eXECUTE on DBMS_JAVA Is Revoked from PUBLIC may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT grantee FROM dba_tab_privs
WHERE table_name LIKE 'DBMS_JAVA%' AND grantee = 'PUBLIC';

REVOKE EXECUTE ON DBMS_JAVA FROM PUBLIC;
REVOKE EXECUTE ON DBMS_JAVA_TEST FROM PUBLIC;

This recommendation verifies that privileges Are Granted Through Roles, Not Directly on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to privileges Are Granted Through Roles, Not Directly may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT grantee, privilege FROM dba_sys_privs
WHERE grantee NOT IN (SELECT role FROM dba_roles)
AND grantee NOT IN ('SYS','SYSTEM');

# Create application-specific roles and grant privileges through them:
CREATE ROLE app_role;
GRANT SELECT ON schema.table TO app_role;
GRANT app_role TO <USER>;

This recommendation verifies that wITH ADMIN OPTION Is Not Granted to Non-DBA Users on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to wITH ADMIN OPTION Is Not Granted to Non-DBA Users may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT grantee, privilege, admin_option FROM dba_sys_privs
WHERE admin_option = 'YES'
AND grantee NOT IN ('SYS','SYSTEM','DBA');

REVOKE <PRIVILEGE> FROM <USER>;
GRANT <PRIVILEGE> TO <USER>;  -- re-grant without ADMIN OPTION

This setting controls whether Unified Auditing is enabled on the Oracle Database 19c database server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via init.ora, sqlnet.ora, listener.ora, or SQL*Plus.

Without Unified Auditing enabled, the Oracle Database 19c database server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

SELECT value FROM v$option WHERE parameter = 'Unified Auditing';

# Relink Oracle binary with unified auditing:
cd $ORACLE_HOME/rdbms/lib
make -f ins_rdbms.mk uniaud_on ioracle
# Restart database

This recommendation ensures that Logon/Logoff Events events are audited on the Oracle Database 19c database server. Comprehensive logging enables detection of security incidents, supports forensic investigation, and satisfies compliance and audit requirements.

Without adequate logging of Logon/Logoff Events, security incidents may go undetected and forensic investigation becomes difficult or impossible. Comprehensive audit trails are essential for compliance and incident response.

SELECT policy_name, audit_option FROM audit_unified_policies
WHERE audit_option LIKE '%LOGON%';

CREATE AUDIT POLICY logon_policy ACTIONS LOGON, LOGOFF;
AUDIT POLICY logon_policy;

This recommendation ensures that DDL Changes events are audited on the Oracle Database 19c database server. Comprehensive logging enables detection of security incidents, supports forensic investigation, and satisfies compliance and audit requirements.

Without adequate logging of DDL Changes, security incidents may go undetected and forensic investigation becomes difficult or impossible. Comprehensive audit trails are essential for compliance and incident response.

SELECT policy_name FROM audit_unified_policies
WHERE audit_option IN ('CREATE TABLE','ALTER TABLE','DROP TABLE','CREATE USER','ALTER USER','DROP USER');

CREATE AUDIT POLICY ddl_policy ACTIONS
  CREATE TABLE, ALTER TABLE, DROP TABLE,
  CREATE USER, ALTER USER, DROP USER,
  CREATE ROLE, ALTER ROLE, DROP ROLE,
  GRANT, REVOKE;
AUDIT POLICY ddl_policy;

This recommendation ensures that DBA Actions events are audited on the Oracle Database 19c database server. Comprehensive logging enables detection of security incidents, supports forensic investigation, and satisfies compliance and audit requirements.

Without adequate logging of DBA Actions, security incidents may go undetected and forensic investigation becomes difficult or impossible. Comprehensive audit trails are essential for compliance and incident response.

SELECT policy_name, enabled_option FROM audit_unified_enabled_policies
WHERE user_name = 'ALL USERS';

CREATE AUDIT POLICY dba_activity_policy
  ACTIONS ALL
  ONLY TOPLEVEL;
AUDIT POLICY dba_activity_policy BY SYS, SYSTEM;

This recommendation verifies that audit Trail Is Not Writable by Non-SYS Users on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to audit Trail Is Not Writable by Non-SYS Users may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT grantee, privilege FROM dba_tab_privs
WHERE table_name IN ('UNIFIED_AUDIT_TRAIL','AUD$')
AND privilege IN ('INSERT','UPDATE','DELETE');

REVOKE DELETE ON sys.aud$ FROM <USER>;
REVOKE INSERT ON sys.aud$ FROM <USER>;

This recommendation verifies that audit Records Are Archived and Purged Regularly on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to audit Records Are Archived and Purged Regularly may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT count(*) FROM unified_audit_trail;
-- Check if automated purge job exists:
SELECT * FROM dba_scheduler_jobs WHERE job_name LIKE '%AUDIT%';

-- Set retention to 90 days:
BEGIN
  DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(
    audit_trail_type => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
    last_archive_time => SYSTIMESTAMP - 90);
END;
/
-- Create purge job:
BEGIN
  DBMS_AUDIT_MGMT.CREATE_PURGE_JOB(
    audit_trail_type => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
    audit_trail_purge_interval => 24,
    audit_trail_purge_name => 'DAILY_AUDIT_PURGE',
    use_last_arch_timestamp => TRUE);
END;
/

Transparent Data Encryption (TDE) encrypts data at rest. A keystore must be configured before encrypting tablespaces or columns.

Failure to a Wallet/Keystore Is Configured for TDE may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT status, wallet_type FROM v$encryption_wallet;

ADMINISTER KEY MANAGEMENT CREATE KEYSTORE '/opt/oracle/wallet'
  IDENTIFIED BY <KEYSTORE_PASSWORD>;
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN
  IDENTIFIED BY <KEYSTORE_PASSWORD>;
ADMINISTER KEY MANAGEMENT SET KEY
  IDENTIFIED BY <KEYSTORE_PASSWORD> WITH BACKUP;

This recommendation verifies that auto-Login Wallet Is Not Used in Production on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to auto-Login Wallet Is Not Used in Production may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT wallet_type FROM v$encryption_wallet;
-- Should be PASSWORD, not AUTOLOGIN

# Use password-based keystore instead of auto-login:
ADMINISTER KEY MANAGEMENT DELETE AUTOLOGIN KEYSTORE;

This setting ensures that Sensitive Tablespaces uses encryption on the Oracle Database 19c database server. Encrypting data in transit and at rest protects sensitive information from interception and unauthorized disclosure.

Without encryption, Sensitive Tablespaces may transmit or store sensitive information in cleartext, exposing it to interception, eavesdropping, or tampering. Encryption is a critical control for data confidentiality and integrity.

SELECT tablespace_name, encrypted FROM dba_tablespaces
WHERE contents = 'PERMANENT';

ALTER TABLESPACE <TS_NAME> ENCRYPTION ONLINE
  USING 'AES256' ENCRYPT;

This setting controls whether Native Network Encryption is enabled on the Oracle Database 19c database server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via init.ora, sqlnet.ora, listener.ora, or SQL*Plus.

Without Native Network Encryption enabled, the Oracle Database 19c database server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep -i SQLNET.ENCRYPTION_SERVER $ORACLE_HOME/network/admin/sqlnet.ora

# In sqlnet.ora:
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192)
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256)

This recommendation verifies that tLS Is Configured for Listener on the Oracle Database 19c database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to tLS Is Configured for Listener may leave the Oracle Database 19c database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i SSL $ORACLE_HOME/network/admin/listener.ora
grep -i WALLET_LOCATION $ORACLE_HOME/network/admin/sqlnet.ora

# In listener.ora — add TCPS endpoint:
LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCPS)(HOST = <HOST>)(PORT = 2484))
    )
  )
SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY = /opt/oracle/wallet)))

Prevents clients using older, weaker password verifiers from connecting.

An improperly configured value for SQLNET.ALLOWED_LOGON_VERSION_SERVER could weaken security controls or allow unintended behavior. Setting this to 12a ensures the Oracle Database 19c database server operates within a well-defined security boundary.

grep -i SQLNET.ALLOWED_LOGON_VERSION $ORACLE_HOME/network/admin/sqlnet.ora

# In sqlnet.ora:
SQLNET.ALLOWED_LOGON_VERSION_SERVER = 12a
SQLNET.ALLOWED_LOGON_VERSION_CLIENT = 12a