Pete Finnigan's Oracle security weblog

[Previous entry: "License Plate scanners and SQL Injection"] [Next entry: "Oracle Authentication Process and password algorithm"]

Howard's DORIS script is available again - some security comments from me

Post to del.icio.us   Post to Furl  

I noticed today that Howard's Dizwell-Oracle Reliable Installation Script (DORIS) version 1.0a shell script is available again for download. This is a useful script and great for installing Oracle on Linux without resorting to reading loads of "how-to" sites.

Howard also made some brief notes available in his blof entry titled "Doris redux" and includes there a note that the reader/user of the script can edit themselves to change the default DBNAME used of lin10 or lin11. I posted some further comments that may be useful to anyone that should download the script if they are particularly interested in security. This is repeated here as for completeness

"I see in your brief notes that the user of the script is advised to change the default database name assigned by the script, i.e. lin10 or lin11. This is important as there are a number of "guesser" tools out there and it wont be long before lin10 and lin11 are added to their dictionaries, they are in mine already.

Also worth pointing out for your readers is the usefulness of changing the software owner name from "oracle" - this would require editing of the doris script of course by the reader. This is importnat. I do a lot of database security audits for clients and I am seeing an increasing number of attempts to connect to servers by guessing the OS username of "oracle". Default names give attackers a head start, unfortunately.

The same, but to a much lesser extent applies to the default name "dba", obviously it cannot be an advantage to guess it, but the script could be improved to allow the segregation of duties afforded by the creation of an OSDBA and OSOPER Unix/Linux group. I have to say I never see any database where this is done, having the OSOPER group/alias allows the creation of an OS account that can be assigned this group, who can then stop and start the database but is actually only connected as PUBLIC not SYS. Its easy to fix after the fact also by editing the $ORACLE_HOME/rdbms/lib/config.c or .s (Real Unix) and relinking."

There has been 1 Comment posted on this article