Contents

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

How to Use This Manual

• Organization of Policy Text
• Background Information on Policies

1 Automatic Storage Management (ASM) Policies

• 1.1 Disk Group Contains Disks of Significantly Different Sizes
• 1.2 Disk Group Contains Disks with Different Redundancy Attributes
• 1.3 Disk Group Depends on External Redundancy and Has Unprotected Disks
• 1.4 Disk Group with NORMAL or HIGH Redundancy Has Mirrored or Parity Protected Disks

2 BEA WebLogic Managed Server Policies

• 2.1 WebLogic Admin Port Enabled
• 2.2 WebLogic Performance Pack Enabled
• 2.3 WebLogic Production Mode Enabled

3 Calendar Server Policy

• 3.1 High Log Level

4 Cluster Database Policies

• 4.1 Configuration Policies
• • 4.1.1 Force Logging Disabled
  • 4.1.2 Installation of JAccelerator (NCOMP)
  • 4.1.3 Insufficient Number of Control Files
  • 4.1.4 Insufficient Number of Redo Logs
  • 4.1.5 Recovery Area Location Not Set
• 4.2 Security Policies - UNIX
• • 4.2.1 Access to ALL_SOURCE View
  • 4.2.2 Access to DBA Role Privileges View
  • 4.2.3 Access to DBA Roles View
  • 4.2.4 Access to DBA_SYS_PRIVS View
  • 4.2.5 Access to DBA_TAB_PRIVS View
  • 4.2.6 Access to DBA_USERS View
  • 4.2.7 Access to ROLE_ROLE_PRIVS View
  • 4.2.8 Access to STATS$SQL Summary Table
  • 4.2.9 Access to STATS$SQL Text Table
  • 4.2.10 Access to SYS.AUDIT$ Table
  • 4.2.11 Access to SYS.LINK$ Table
  • 4.2.12 Access to SYS.SOURCE$ Table
  • 4.2.13 Access to SYS.USER$ Table
  • 4.2.14 Access to SYS.USER_HISTORY$ Table
  • 4.2.15 Access to USER_ROLE_PRIVS View
  • 4.2.16 Access to USER_TAB_PRIVS View
  • 4.2.17 Control File Permission
  • 4.2.18 Default Passwords
  • 4.2.19 Excessive Allowed Failed Login Attempts
  • 4.2.20 Excessive PUBLIC EXECUTE Privileges
  • 4.2.21 Execute UTL_FILE Privileges to PUBLIC
  • 4.2.22 Oracle Home Datafile Permission
  • 4.2.23 Password Grace Time
  • 4.2.24 Password Life Time
  • 4.2.25 Password Locking Time
  • 4.2.26 Password Reuse Maximum
  • 4.2.27 Password Reuse Time
  • 4.2.28 Profiles with Excessive Allowed Failed Login Attempts
  • 4.2.29 PUBLIC EXECUTE Privileges to DBMS Job
  • 4.2.30 PUBLIC EXECUTE Privileges to DBMS LOB
  • 4.2.31 PUBLIC EXECUTE Privileges to DBMS SYS SQL
  • 4.2.32 System Privileges to Public
  • 4.2.33 Unlimited Tablespace Quota
  • 4.2.34 Use of Database Links with Cleartext Password
  • 4.2.35 Well Known Accounts
  • 4.2.36 Well Known Accounts (Status)
• 4.3 Security Policies - Windows
• • 4.3.1 Control File Permission (Windows)
  • 4.3.2 Oracle Home Datafile Permission (Windows)
• 4.4 Storage Policies
• • 4.4.1 Default Permanent Tablespace Set to a System Tablespace
  • 4.4.2 Default Temporary Tablespace Set to a System Tablespace
  • 4.4.3 Dictionary Managed Tablespaces
  • 4.4.4 Insufficient Redo Log Size
  • 4.4.5 Non-System Data Segments in a System Tablespace
  • 4.4.6 Non-Uniform Default Extent Size for Dictionary Managed Tablespaces
  • 4.4.7 Rollback in SYSTEM Tablespace
  • 4.4.8 Segment in Dictionary Tablespace with Extent Growth Policy Violation
  • 4.4.9 Tablespace Not Using Automatic Segment-Space Management
  • 4.4.10 Tablespaces Containing Rollback and Data Segments
  • 4.4.11 Users with a System Tablespace as Default Tablespace
  • 4.4.12 Users with Permanent Tablespace as Temporary Tablespace

5 Database Instance Policies

• 5.1 Configuration Policies
• • 5.1.1 Disabled Automatic Statistics Collection
  • 5.1.2 Force Logging Disabled
  • 5.1.3 Installation of JAccelerator (NCOMP)
  • 5.1.4 Insufficient Number of Control Files
  • 5.1.5 Insufficient Number of Redo Logs
  • 5.1.6 Not Using Automatic PGA Management
  • 5.1.7 Not Using Automatic Shared Memory Management
  • 5.1.8 Not Using Automatic Undo Management
  • 5.1.9 Not Using Latest Version of Optimizer
  • 5.1.10 Not Using Spfile
  • 5.1.11 Recovery Area Location Not Set
  • 5.1.12 Statistics Level Parameter Set to ALL
  • 5.1.13 Use of Non-Standard Initialization Parameters
• 5.2 Security Policies - UNIX
• • 5.2.1 Access to ALL_SOURCE View
  • 5.2.2 Access to DBA Role Privileges View
  • 5.2.3 Access to DBA Roles View
  • 5.2.4 Access to DBA_SYS_PRIVS View
  • 5.2.5 Access to DBA_TAB_PRIVS View
  • 5.2.6 Access to DBA_USERS View
  • 5.2.7 Access to ROLE_ROLE_PRIVS View
  • 5.2.8 Access to STATS$SQL Summary Table
  • 5.2.9 Access to STATS$SQL Text Table
  • 5.2.10 Access to SYS.AUDIT$ Table
  • 5.2.11 Access to SYS.LINK$ Table
  • 5.2.12 Access to SYS.SOURCE$ Table
  • 5.2.13 Access to SYS.USER$ Table
  • 5.2.14 Access to SYS.USER_HISTORY$ Table
  • 5.2.15 Access to USER_ROLE_PRIVS View
  • 5.2.16 Access to USER_TAB_PRIVS View
  • 5.2.17 Audit File Destination
  • 5.2.18 Background Dump Destination
  • 5.2.19 Control File Permission
  • 5.2.20 Core Dump Destination
  • 5.2.21 Default Passwords
  • 5.2.22 Default Table Space
  • 5.2.23 Excessive Allowed Failed Login Attempts
  • 5.2.24 Excessive PUBLIC EXECUTE Privileges
  • 5.2.25 Execute UTL_FILE Privileges to PUBLIC
  • 5.2.26 IFILE Referenced File Permission
  • 5.2.27 Initialization Parameter File Permission
  • 5.2.28 Log Archive Destination Owner
  • 5.2.29 Log Archive Destination Permission
  • 5.2.30 Log Archive Duplex Destination Owner
  • 5.2.31 Log Archive Duplex Destination Permission
  • 5.2.32 Naming Database Links
  • 5.2.33 Oracle Home Datafile Permission
  • 5.2.34 Oracle Home Executable Files Owner
  • 5.2.35 Oracle Home Executable Files Permission
  • 5.2.36 Oracle Home File Permission
  • 5.2.37 Password Grace Time
  • 5.2.38 Password Life Time
  • 5.2.39 Password Locking Time
  • 5.2.40 Password Reuse Maximum
  • 5.2.41 Password Reuse Time
  • 5.2.42 Profiles with Excessive Allowed Failed Login Attempts
  • 5.2.43 PUBLIC EXECUTE Privileges to DBMS Job
  • 5.2.44 PUBLIC EXECUTE Privileges to DBMS LOB
  • 5.2.45 PUBLIC EXECUTE Privileges to DBMS SYS SQL
  • 5.2.46 PUBLIC Trace Files
  • 5.2.47 Remote OS Authentication
  • 5.2.48 Remote OS Role
  • 5.2.49 Remote Password File
  • 5.2.50 Secure OS Audit Level
  • 5.2.51 Server Parameter File Permission
  • 5.2.52 System Privileges to Public
  • 5.2.53 Unlimited Tablespace Quota
  • 5.2.54 Use of Appropriate umask on UNIX Systems
  • 5.2.55 Use of Automatic Log Archival Features
  • 5.2.56 Use of Basic Audit Features
  • 5.2.57 Use of Database Links with Cleartext Password
  • 5.2.58 Use of Remote Listener Instances
  • 5.2.59 Use of SQL92 Security Features
  • 5.2.60 User Dump Destination
  • 5.2.61 User Temporary Table Space
  • 5.2.62 Using Externally Identified Accounts
  • 5.2.63 Utility File Directory Initialization Parameter Setting
  • 5.2.64 Utility File Directory Initialization Parameter Setting for Oracle9i Release 1 and Later
  • 5.2.65 Well Known Accounts
  • 5.2.66 Well Known Accounts (Status)
• 5.3 Security Policies - Windows
• • 5.3.1 Audit File Destination (Windows)
  • 5.3.2 Background Dump Destination (Windows)
  • 5.3.3 Control File Permission (Windows)
  • 5.3.4 Core Dump Destination (Windows)
  • 5.3.5 IFILE Referenced File Permission (Windows)
  • 5.3.6 Initialization Parameter File Permission (Windows)
  • 5.3.7 Log Archive Destination Permission (Windows)
  • 5.3.8 Log Archive Duplex Destination Permission (Windows)
  • 5.3.9 Oracle Home Datafile Permission (Windows)
  • 5.3.10 Oracle Home Executable Files Permission (Windows)
  • 5.3.11 Oracle Home File Permission (Windows)
  • 5.3.12 Server Parameter File Permission (Windows)
  • 5.3.13 Use of Windows NT Domain Prefix (Windows)
  • 5.3.14 User Dump Destination (Windows)
• 5.4 Storage Policies
• • 5.4.1 Default Permanent Tablespace Set to a System Tablespace
  • 5.4.2 Default Temporary Tablespace Set to a System Tablespace
  • 5.4.3 Dictionary Managed Tablespaces
  • 5.4.4 Insufficient Redo Log Size
  • 5.4.5 Non-System Data Segments in a System Tablespace
  • 5.4.6 Non-Uniform Default Extent Size for Dictionary Managed Tablespaces
  • 5.4.7 Rollback in SYSTEM Tablespace
  • 5.4.8 Segment in Dictionary Tablespace with Extent Growth Policy Violation
  • 5.4.9 Tablespace Not Using Automatic Segment-Space Management
  • 5.4.10 Tablespaces Containing Rollback and Data Segments
  • 5.4.11 Users with a System Tablespace as Default Tablespace
  • 5.4.12 Users with Permanent Tablespace as Temporary Tablespace

6 Host Policies

• 6.1 Configuration Policies
• • 6.1.1 Critical Patch Advisories for Oracle Homes
• 6.2 Security Policies
• • 6.2.1 Execute Stack
  • 6.2.2 Insecure Services
  • 6.2.3 NTFS File System
  • 6.2.4 Open Ports

7 Listener Policies

• 7.1 Security Policies - UNIX
• • 7.1.1 Allowed Logon Version
  • 7.1.2 Listener Default Name
  • 7.1.3 Listener Direct Administration
  • 7.1.4 Listener Log File Owner
  • 7.1.5 Listener Log File Permission
  • 7.1.6 Listener Logging Status
  • 7.1.7 Listener Password
  • 7.1.8 Listener Trace Directory Owner
  • 7.1.9 Listener Trace Directory Permission
  • 7.1.10 Listener Trace File Owner
  • 7.1.11 Listener Trace File Permission
  • 7.1.12 Listener.ora Permission
  • 7.1.13 Oracle Net Client Log Directory Owner
  • 7.1.14 Oracle Net Client Log Directory Permission
  • 7.1.15 Oracle Net Client Trace Directory Owner
  • 7.1.16 Oracle Net Client Trace Directory Permission
  • 7.1.17 Oracle Net Server Log Directory Owner
  • 7.1.18 Oracle Net Server Log Directory Permission
  • 7.1.19 Oracle Net Server Trace Directory Owner
  • 7.1.20 Oracle Net Server Trace Directory Permission
  • 7.1.21 Restrict sqlnet.ora Permissions
  • 7.1.22 Use of Hostname in Listener.ora
• 7.2 Security Policies - Windows
• • 7.2.1 Listener Log File Permission (Windows)
  • 7.2.2 Listener Trace Directory Permission (Windows)
  • 7.2.3 Listener Trace File Permission (Windows)
  • 7.2.4 Listener.ora Permission (Windows)
  • 7.2.5 Oracle Net Client Log Directory Permission (Windows)
  • 7.2.6 Oracle Net Client Trace Directory Permission (Windows)
  • 7.2.7 Oracle Net Server Log Directory Permission (Windows)
  • 7.2.8 Oracle Net Server Trace Directory Permission (Windows)
  • 7.2.9 Restrict sqlnet.ora Permissions (Windows)

8 OC4J Policy

• 8.1 OC4J Password Indirection

9 Oracle HTTP Server Policies

• 9.1 Configuration Policies
• • 9.1.1 HTTP Server HostNameLookups
  • 9.1.2 HTTP Server MaxKeepAliveRequests
• 9.2 Security Policies
• • 9.2.1 HTTP Server Access Logging
  • 9.2.2 HTTP Server Directory Indexing
  • 9.2.3 HTTP Server Dummy Wallet
  • 9.2.4 HTTP Server Owner And Setuid Bit
  • 9.2.5 HTTP Server SSL
  • 9.2.6 HTTP Server Writable Files

10 Web Cache Policies

• 10.1 Web Cache Access Logging
• 10.2 Web Cache Dummy Wallet
• 10.3 Web Cache Owner and Setuid Bit
• 10.4 Web Cache Writable Files