STIGQter: STIG Summary: Oracle Database 11.2g Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The DBMS must specify an account lockout duration that is greater than or equal to the organization-approved minimum.

DISA Rule

SV-238448r667518_rule

Vulnerability Number

V-238448

Group Title

SRG-APP-000516-DB-000363

Rule Version

O112-C2-004900

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure the DBMS settings to specify indefinite lockout duration:

ALTER PROFILE '&PROFILE_NAME' LIMIT PASSWORD_LOCK_TIME UNLIMITED;

Check Contents

The account lockout duration is defined in the profile assigned to a user.

To see what profile is assigned to a user, enter the query:

SELECT profile FROM dba_users WHERE username = '&USERNAME'

This will return the profile name assigned to that user.

Now check the values assigned to the profile returned from the query above:

SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE PROFILE LIKE '&PROFILE_NAME'

Check the settings for password_lock_time - this specifies how long to lock the account after the number of consecutive failed logon attempts reaches the limit. If the value is not UNLIMITED, this is a finding.

Vulnerability Number

V-238448

Documentable

False

Rule Version

O112-C2-004900

Severity Override Guidance

The account lockout duration is defined in the profile assigned to a user.

To see what profile is assigned to a user, enter the query:

SELECT profile FROM dba_users WHERE username = '&USERNAME'

This will return the profile name assigned to that user.

Now check the values assigned to the profile returned from the query above:

SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE PROFILE LIKE '&PROFILE_NAME'

Check the settings for password_lock_time - this specifies how long to lock the account after the number of consecutive failed logon attempts reaches the limit. If the value is not UNLIMITED, this is a finding.

Check Content Reference

M

Target Key

4057

Comments