STIGQter: STIG Summary: Oracle Database 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021: STIGQter: STIG Summary: Oracle Database 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:SV-237735r708389_rule
V-237735
SRG-APP-000164-DB-000401
O121-C2-015200
CAT II
10
For user accounts managed by Oracle: Modify DBMS settings to force users to periodically change their passwords. For example, using PPPPPP to stand for a profile name:
ALTER PROFILE PPPPPP LIMIT PASSWORD_LIFE_TIME 35 PASSWORD_GRACE_TIME 0;
Do this for each profile applied to user accounts.
(Note: Although the DoD requirement is for a password change every 60 days, using a value of 35 facilitates the use of PASSWORD_LIFE_TIME as a means of locking accounts inactive for 35 days. But if “35� is not a practical or acceptable limit for password lifetime, set it to the standard DoD value of 60.)
Where a password lifetime longer than 60 is needed, document the reasons and obtain ISSO approval.
If all user accounts are authenticated by the OS or an enterprise-level authentication/access mechanism, and not by Oracle, this is not a finding.
Review DBMS settings to determine if passwords must be changed periodically. If not, this is a finding:
SELECT p1.profile,
CASE p1.limit WHEN 'UNLIMITED' THEN 'UNLIMITED' ELSE
CASE p2.limit WHEN 'UNLIMITED' THEN 'UNLIMITED' ELSE
CASE p3.limit WHEN 'UNLIMITED' THEN 'UNLIMITED' ELSE
CASE p4.limit WHEN 'UNLIMITED' THEN 'UNLIMITED' ELSE
TO_CHAR(DECODE(p1.limit, 'DEFAULT', p3.limit, p1.limit) + DECODE(p2.limit, 'DEFAULT', p4.limit, p2.limit))
END
END
END
END effective_life_time
FROM dba_profiles p1, dba_profiles p2, dba_profiles p3, dba_profiles p4
WHERE p1.profile=p2.profile
AND p3.profile='DEFAULT'
AND p4.profile='DEFAULT'
AND p1.resource_name='PASSWORD_LIFE_TIME'
AND p2.resource_name='PASSWORD_GRACE_TIME'
AND p3.resource_name='PASSWORD_LIFE_TIME' -- from DEFAULT profile
AND p4.resource_name='PASSWORD_GRACE_TIME' -- from DEFAULT profile
order by 1;
If the "effective_life_time" is greater than 60 for any profile applied to user accounts, and the need for this has not been documented and approved by the ISSO, this is a finding.
If the value is greater than 35 for any profile (not documented and approved by the ISSO), applied to user accounts, and the DBMS is configured to use Password Lifetime to disable inactive accounts, this is a finding.
V-237735
False
O121-C2-015200
If all user accounts are authenticated by the OS or an enterprise-level authentication/access mechanism, and not by Oracle, this is not a finding.
Review DBMS settings to determine if passwords must be changed periodically. If not, this is a finding:
SELECT p1.profile,
CASE p1.limit WHEN 'UNLIMITED' THEN 'UNLIMITED' ELSE
CASE p2.limit WHEN 'UNLIMITED' THEN 'UNLIMITED' ELSE
CASE p3.limit WHEN 'UNLIMITED' THEN 'UNLIMITED' ELSE
CASE p4.limit WHEN 'UNLIMITED' THEN 'UNLIMITED' ELSE
TO_CHAR(DECODE(p1.limit, 'DEFAULT', p3.limit, p1.limit) + DECODE(p2.limit, 'DEFAULT', p4.limit, p2.limit))
END
END
END
END effective_life_time
FROM dba_profiles p1, dba_profiles p2, dba_profiles p3, dba_profiles p4
WHERE p1.profile=p2.profile
AND p3.profile='DEFAULT'
AND p4.profile='DEFAULT'
AND p1.resource_name='PASSWORD_LIFE_TIME'
AND p2.resource_name='PASSWORD_GRACE_TIME'
AND p3.resource_name='PASSWORD_LIFE_TIME' -- from DEFAULT profile
AND p4.resource_name='PASSWORD_GRACE_TIME' -- from DEFAULT profile
order by 1;
If the "effective_life_time" is greater than 60 for any profile applied to user accounts, and the need for this has not been documented and approved by the ISSO, this is a finding.
If the value is greater than 35 for any profile (not documented and approved by the ISSO), applied to user accounts, and the DBMS is configured to use Password Lifetime to disable inactive accounts, this is a finding.
M
4059