3 Securing Oracle Database User Accounts

3.1 About Securing Oracle Database User Accounts

Oracle Database 2 Day DBA describes the fundamentals of creating and administering user accounts, including how to manage user roles, what the administrative accounts are, and how to use profiles to establish a password policy.

After you create user accounts for your site, you can use the procedures in this section to further secure these accounts by following these methods:

• Safeguarding predefined database accounts. When you install Oracle Database, it creates a set of predefined accounts. You should secure these accounts as soon as possible by changing their passwords. You can use the same method to change all passwords, whether they are with regular user accounts, administrative accounts, or predefined accounts. This guide also provides guidelines on how to create the most secure passwords.

• Managing database accounts. You can expire, lock, and unlock database accounts.

• Managing passwords. You can manage and protect passwords by using the tools provided with Oracle Database, such as initialization parameters.

3.2 Predefined User Accounts Provided by Oracle Database

When you install Oracle Database, the installation process creates a set of predefined accounts. These accounts are in the following categories:

• Predefined Administrative Accounts

• Predefined Non-Administrative User Accounts

• Predefined Sample Schema User Accounts

3.3 Expiring and Locking Database Accounts

Oracle Database 2 Day DBA explains how you can use Database Control to unlock database accounts. You also can use Database Control to expire or lock database accounts.

When you expire the password of a user, that password no longer exists. If you want to unexpire the password, you change the password of that account. Locking an account preserves the user password, as well as other account information, but makes the account unavailable to anyone who tries to log in to the database using that account. Unlocking it makes the account available again.

To expire and lock a database account:

1. Start Database Control.

   See Oracle Database 2 Day DBA for instructions about how to start Database Control.

2. Log in with administrative privileges.

   For example:

   
   Description of the illustration login.gif
   
   

   The Database Home page appears.

3. Click Server to display the Server subpage.

4. In the Security section, click Users.

   The Users page lists the user accounts created for the current database instance. The Account Status column indicates whether an account is expired, locked, or open.

5. In the Select column, select the account you want to expire, and then click Edit.

   The Edit User page appears.

6. Do one of the following:

   • To expire a password, click Expire Password now.

     To unexpire the password, enter a new password in the Enter Password and Confirm Password fields. See "Requirements for Creating Passwords" for password requirements.

   • To lock the account, select Locked.

7. Click Apply.

3.4 Requirements for Creating Passwords

When you create a user account, Oracle Database assigns a default password policy for that user. The password policy defines rules for how the password should be created, such as a minimum number of characters, when it expires, and so on. You can strengthen passwords by using password policies.

Oracle Database Security Guide provides guidelines for securing passwords. At a minimum, passwords must meet the following requirements:

• The password contains no fewer than eight characters.

• The password is not the same as the user name, nor is it the user name spelled backward or with numeric characters appended.

• The password is not the same as the server name or the server name with the numbers 1–100 appended.

• The password is not too simple, for example, welcome1, database1, account1, user1234, password1, oracle, oracle123, computer1, abcdefg1, or change_on_install.

• The password includes at least 1 numeric and 1 alphabetic character.

• The password differs from the previous password by at least 3 letters.

3.5 Finding and Changing Default Passwords

In Oracle Database 11g Release 1 (11.1), database user accounts, including administrative accounts, are installed without default passwords. During installation, you either create a password the account (always an administrative account), or Oracle Database installs the default accounts, such as those in the sample schemas, locked with their passwords expired.

If you have upgraded from a previous release of Oracle Database, you may have database accounts that have default passwords. These are default accounts that are created when you create a database, such as the HR, OE, and SCOTT accounts.

Security is most easily compromised when a default database user account still has a default password after installation. This is particularly true for the user account SCOTT, which is a well known account that may be vulnerable to intruders. Find accounts that use default passwords and then change their passwords.

To find and change default passwords:

1. Log into SQL*Plus with administrative privileges.

   sqlplus system
   Enter password: password
   

2. Select from the DBA_USERS_WITH_DEFPWD data dictionary view.

   SELECT * FROM DBA_USERS_WTIH_DEFWD;
   

   The DBA_USERS_WITH_DEFPWD lists the accounts that still have user default passwords. For example:

   USERNAME
   ------------
   SCOTT
   

3. Change the password for the accounts the DBA_USERS_WITH_DEFPWD data dictionary view lists.

   PASSWORD SCOTT
   Changing password for SCOTT
   New password: password
   Retype new password: password
   Password changed
   

   Replace password with a password that is secure, according to the guidelines listed in "Requirements for Creating Passwords".

   Alternatively, you can use the ALTER USER SQL statement to change the password:

   ALTER USER SCOTT IDENTIFIED BY password;
   

You can use Database Control to change a user account passwords (not just the default user account passwords) if you have administrative privileges. Individual users can also use Database Control to change their own passwords.

To use Database Control to change the password of a database account:

1. Start Database Control.

   See Oracle Database 2 Day DBA for instructions about how to start Database Control.

2. Enter an administrator user name and password (for example, SYSTEM), and then click Login.

3. Click Server to display the Server subpage.

4. In the Security section, click Users.

   The Users page lists the user accounts created for the current database instance. The Account Status column indicates whether an account is expired, locked, or open.

5. In the Select column, select the account you want to change, and then click Edit.

   The Edit User page appears.

6. Enter a new password in the Enter Password and Confirm Password fields.

7. Click Apply.

3.6 Changing the Default Administrative User Passwords

You can use the same or different passwords for the SYS, SYSTEM, SYSMAN, and DBSNMP administrative accounts. Oracle recommends that you use different passwords for each. In any Oracle Database environment (production or test), assign strong, secure, and distinct passwords to these administrative accounts. If you use Database Configuration Assistant to create a new database, then it requires you to create passwords for the SYS and SYSTEM accounts.

Similarly, for production environments, do not use default passwords for any administrative accounts, including SYSMAN and DBSNMP. Oracle Database 11g Release 1 (11.1) does not install these accounts with default passwords, but if you have upgraded from an earlier release of Oracle Database, you may still have accounts that use default passwords. You should find and change these accounts by using the procedures in "Finding and Changing Default Passwords".

At the end of database creation, Database Configuration Assistant displays a page that requires you to enter and confirm new passwords for the SYS and SYSTEM user accounts.

3.7 Enforcing Password Management

Apply basic password management rules (such as password length, history, complexity, and so forth) to all user passwords. Oracle Database has password policies enabled for the default profile. "Requirements for Creating Passwords" provides guidelines for creating password policies. Table 3-4 lists initialization parameters that you can set to enforce password management.

You can find information about user accounts by querying the DBA_USERS view. This view contains a column for passwords, but for stronger security, Oracle Database encrypts (disguises) the data in this column. The DBA_USERS view provides useful information such as the user account status, whether or not the account is locked, and password versions. You can query DBA_USERS as follows:

sqlplus SYSTEM
Enter password: password
Connected.
SQL> SELECT * FROM DBA_USERS;

Oracle also recommends, if possible, using Oracle Advanced Security (an option to Oracle Database Enterprise Edition) with network authentication services (such as Kerberos), token cards, smart cards, or X.509 certificates. These services provide strong authentication of users, and provide better protection against unauthorized access to Oracle Database.

3.8 Initialization Parameters Used to Secure User Accounts

Table 3-4 lists initialization parameters that you can set to better secure user accounts.

To modify an initialization parameter, see "Modifying the Value of an Initialization Parameter". For detailed information about initialization parameters, see Oracle Database Reference andOracle Database Administrator's Guide.