oracle客户端跳过安全检查,oracle 安全检查步骤

我会带着你远行 2023-01-18 11:26 136阅读 0赞

数据库安不安全？有没有入侵？

检查主机登录信息，查看近期有无异常访问情况

last|tail -100

检查当前端口访问情况

netstat -ano

检查当前登录情况，有无异常用户访问

检查数据库是否安装最新补丁

$ORACLE\_HOME/OPatch/opatch lsinv

数据库默认侦听端口是否为默认的1521，为了提高安全性，推荐采用非默认端口

lsnrctl stat

查看侦听日志有无非法IP连接记录(建议查看最近10000条)

grep "HOST=.\*establish.\*\\\* 0" listener.log | awk -F'\*' '\{match($3,/\[0-9\]+\\.\[0-9\]+\\.\[0-9\]+\\.\[0-9\]+/); ip = substr($3,RSTART,RLENGTH);cnt\[ip\]+=1;last\[ip\]=$1;\}END \{for (i in cnt) printf "%-16s %9s %19s\\n",i,cnt\[i\],last\[i\];\}' | sort -k 1

检查数据库用户有无异常，建议锁定不用的用户并更改默认密码

set lin 200 pages 100

col username for a22

col PROFILE for a30

select username,account\_status,lock\_date,expiry\_date,profile,created from dba\_users order by 1;

检查用户权限是否符合最小化要求

col grantee for a30

select GRANTEE,PRIVILEGE from dba\_sys\_privs where grantee in (select username from dba\_users where account\_status='OPEN' and username not in ('SYS','SYSTEM')) order by 1;

col GRANTED\_ROLE for a30

select GRANTEE,GRANTED\_ROLE from dba\_role\_privs where grantee in (select username from dba\_users where account\_status='OPEN' and username not in ('SYS','SYSTEM')) order by 1;

col owner for a20

col table\_name for a30

col privilege for a20

select grantee,owner,table\_name,privilege from dba\_tab\_privs  where grantee in (select username from dba\_users where account\_status='OPEN' and username not in ('SYS','SYSTEM')) order by 1;

检查密码验证函数是否开启

col limit for a40

select \* from dba\_profiles where RESOURCE\_NAME='PASSWORD\_VERIFY\_FUNCTION';

检查密码最近一次修改日期

select name,to\_char(ptime,'yyyy-mm-dd hh24:mi:ss') pwd\_time from user$ where type\#=1 order by 2;

检查拥有DBA角色用户，禁止除了sys、system以外的普通用户拥有dba角色

select grantee from dba\_role\_privs where granted\_role='DBA';

检查数据库是否开启日志，日志内容是否完整

show parameter audit

检查数据库审计日志，查看有无异常访问(如果审计日志表aud$>30G，可能需要30分钟返回结果)

col obj\_name for a30

col SQL\_TEXT for a40