📋Steps in this guide1/13

Practical Steps I Took to Harden an Oracle Database Against Unauthorized Access

Learn practical steps to harden an Oracle database against unauthorized access, including user security, privileges, auditing, encryption, patching, and monitoring. A complete Oracle DBA security guide by Learnomate Technologies.

oracle configurationintermediate

by OracleDba

14 views

1. Securing Database Accounts

The first step was to audit all existing users. Actions taken: - Locked and expired unused or default accounts: Locked and expired unused or default accounts: - Enforced strong passwords using profiles: Enforced strong passwords using profiles: Assigned profile: This ensured: - Strong password complexity Strong password complexity - Automatic password expiration Automatic password expiration - Account lock after multiple failures Account lock after multiple failures

Code/Command (click line numbers to comment):

SELECT
username, account_status
FROM
dba_users;

ALTER
USER
scott ACCOUNT LOCK;
ALTER
USER
hr ACCOUNT LOCK;

CREATE
PROFILE secure_profile LIMIT
  FAILED_LOGIN_ATTEMPTS
5
PASSWORD_LIFE_TIME
60
PASSWORD_REUSE_TIME
365
PASSWORD_REUSE_MAX
5
PASSWORD_VERIFY_FUNCTION ora12c_verify_function;

ALTER
USER
app_user PROFILE secure_profile;

2. Principle of Least Privilege

I reviewed excessive privileges: Actions: - Removed unnecessary privileges: Removed unnecessary privileges: - Created custom roles: Created custom roles: This limited users to only what they really needed.

Code/Command (click line numbers to comment):

SELECT
*
FROM
dba_role_privs
WHERE
grantee
=
'APP_USER'
;
SELECT
*
FROM
dba_sys_privs
WHERE
grantee
=
'APP_USER'
;

REVOKE
DBA
FROM
app_user;

CREATE
ROLE app_read_role;
GRANT
SELECT
ON
schema.table1
TO
app_read_role;
GRANT
app_read_role
TO
app_user;

3. Restricting Network Access Using Oracle Listener

I controlled which IPs could connect to the database by editing : For IP restriction: This stopped unauthorized systems from even reaching the database.

Code/Command (click line numbers to comment):

1
2

tcp.validnode_checking = YES
tcp.invited_nodes = (192.168.1.10,192.168.1.20)

4. Encrypting Data Using TDE (Transparent Data Encryption)

To protect data at rest: Encrypt sensitive columns: Or full tablespace encryption: This ensured that even if someone accessed datafiles, the data would be unreadable.

Code/Command (click line numbers to comment):

ADMINISTER KEY MANAGEMENT
SET
KEYSTORE
OPEN
IDENTIFIED
BY
"wallet_password";
ADMINISTER KEY MANAGEMENT
SET
KEY IDENTIFIED
BY
"wallet_password"
WITH
BACKUP;

ALTER TABLE
employees MODIFY (salary ENCRYPT);

CREATE
TABLESPACE secure_ts
DATAFILE
'/u01/oradata/secure01.dbf'
SIZE
100
M
ENCRYPTION
USING
'AES256'
DEFAULT
STORAGE(ENCRYPT);

5. Enabling Auditing

I enabled Unified Auditing to track suspicious activities. To check logs: This helped in: - Tracking unauthorized access attempts Tracking unauthorized access attempts - Compliance reporting Compliance reporting - Forensic analysis Forensic analysis

Code/Command (click line numbers to comment):

AUDIT
CREATE
USER
;
AUDIT
DROP
USER
;
AUDIT
GRANT
ANY
PRIVILEGE;
AUDIT
ALTER
SYSTEM
;

SELECT
event_timestamp, dbusername, action_name
FROM
unified_audit_trail
ORDER
BY
event_timestamp
DESC
;

6. Protecting SYS and SYSTEM Users

- Changed default passwords Changed default passwords - Restricted login: Restricted login: Set: Only DBAs were allowed to use SYSDBA access.

Code/Command (click line numbers to comment):

ALTER
USER
SYS IDENTIFIED
BY
StrongPassword;
ALTER
USER
SYSTEM
IDENTIFIED
BY
StrongPassword;

ALTER
SYSTEM
SET
remote_login_passwordfile
=
EXCLUSIVE;

7. Securing Backup Files

RMAN backups were encrypted: Now every backup was protected even outside the server.

Code/Command (click line numbers to comment):

CONFIGURE ENCRYPTION
FOR
DATABASE
ON
;
CONFIGURE ENCRYPTION ALGORITHM
'AES256'
;

8. Disabling Unused Services & Features

Checked active services: Removed unnecessary services: Disabled unused packages and features wherever possible.

Code/Command (click line numbers to comment):

1
2
3

DBMS_SERVICE.DELETE_SERVICE(
'unused_service'
);

9. Patching the Database Regularly

Security vulnerabilities are fixed through CPU and PSU patches. Steps followed: - Check version: Check version: - Download latest patch from Oracle Support Download latest patch from Oracle Support - Apply using OPatch Apply using OPatch - Validate: Validate: This closed known security loopholes.

10. Restricting OS-Level Access

At OS level: - Only and users had access to Oracle directories Only and users had access to Oracle directories - Set strict permissions: Set strict permissions: No unauthorized Linux user could access database files.

Code/Command (click line numbers to comment):

chmod
-R 700 /u01/app/oracle
chown
-R oracle:oinstall /u01/app/oracle

11. Using Data Redaction & VPD (Optional Advanced Security)

For sensitive columns: This masked data for non-privileged users.

Code/Command (click line numbers to comment):

BEGIN
DBMS_REDACT.ADD_POLICY(
    object_schema
=
>
'HR'
,
    object_name
=
>
'EMPLOYEES'
,
    column_name
=
>
'SALARY'
,
    policy_name
=
>
'mask_salary'
,
    function_type
=
>
DBMS_REDACT.FULL);
END
;
/

12. Continuous Monitoring

I monitored: - Failed login attempts Failed login attempts - Audit logs Audit logs - Listener logs Listener logs - OS authentication logs OS authentication logs This ensured early detection of suspicious activities.

Final Thoughts

Hardening a database is not a one-time task; it’s a continuous responsibility. In real-world Oracle DBA work, I always follow this order: - Secure users Secure users - Restrict privileges Restrict privileges - Secure network Secure network - Encrypt data & backups Encrypt data & backups - Enable auditing Enable auditing - Patch regularly Patch regularly - Monitor continuously Monitor continuously These practical steps transformed the database from a “basic setup” into a secure, enterprise-grade environment resistant to unauthorized access. At Learnomate Technologies , we believe database security is not optional, it’s a responsibility every Oracle DBA must own.

Comments (0)

Please to add comments

No comments yet. Be the first to comment!