Pete Finnigan's Oracle Security Weblog

I was browsing the web this afternoon and found, or rather re-found Tim's two part paper Unravelling the sweater - Oracle Database Security so I sat down and re-read them both.

These are two great papers that explain the basics of how to take preliminary actions in securing your Oracle database. http://www.evdbt.com/UnravelingTheSweater1.pdf - (broken link) The first part talks about the nature of the problem and good old default users and passwords. Tim goes on to talk about the basic levels of privileges available to default users or users created with absolute minimum privileges such as just CREATE SESSION. Tim highlights the age old issue in Oracle that a basic user can see a huge amount of objects and do a huge amount of things in the database. he goes on to talk about guessing passwords and then about a shell script called oraprobe.sh that takes a database TNS connect string and attempts to connect to the database by guessing accounts. If it gets in with a default account it then lists all users and tries again to connect with as them. Tim also talks about strengthening passwords and the password features.

The second part moves away from the database in layer terms and talks about the Oracle SQL*Net, Net*8 or Oracle Net as its known. Tim discusses the basic issues with the listener and TNS and the fact that in general it’s wide open. He goes on to discuss the listener service and listener control utility and how to protect it against hackers by simple configuration techniques. Tim also introduces the second of his excellent Oracle security scripts, tnsprobe.sh. The script can be used to look for Oracle databases. It expects an IP address and then enumerates whether an Oracle listener is active and then if it finds one it lists the database services. It then calls oraprobe.sh for each database found.

This pair of papers and scripts is an excellent introduction to the basics of Oracle security and anyone contemplating the security of their database could do worse then read them and test the scripts.