TMA-ORACLE-DB-2.2.7

Ensure 'SQLNET.ENCRYPTION_SERVER' Is Set To 'REQUIRED'

높음레벨 1자동oracle-db

설명

The SQLNET.ENCRYPTION_SERVER parameter determines whether the server side of a database connection enforces network encryption. When set to REQUIRED, this parameter mandates that all data transmitted between the client and the database is encrypted, preventing the server from connecting if encryption cannot be established. This setting ensures that sensitive data remains protected during ... The last uncommented setting in sqlnet.ora must equal REQUIRED (case-insensitive, spaces ignored). Default: ACCEPTED Reads the file from $TNS_ADMIN, or $ORACLE_HOME/network/admin when TNS_ADMIN is unset (Linux/UNIX hosts); fails when neither directory exists.

점검 방법

감사 방식: 셸 명령

shell

d="${TNS_ADMIN:-${ORACLE_HOME:?ORACLE_HOME not set}/network/admin}"; [ -d "$d" ] || { echo "missing $d"; exit 1; }; f="$d/sqlnet.ora"; [ -f "$f" ] || { echo "noncompliant: $f not found"; exit 0; }; v=$(grep -Ei '^[[:space:]]*SQLNET\.ENCRYPTION_SERVER[[:space:]]*=' "$f" | tail -n 1 | sed 's/^[^=]*=//' | tr -d ' \t\r' | tr '[:lower:]' '[:upper:]'); [ "$v" = "REQUIRED" ] && echo compliant || echo "noncompliant: ${v:-not set}"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To remediate this recommendation, set SQLNET.ENCRYPTION_SERVER to REQUIRED.

속성

운영 체제: 모두
태그: oracle-dbdatabaseoraclenetworkencryption
참고 자료: CIS Oracle Database 23ai Benchmark v1.1.0 - 2.2.7 Ensure 'SQLNET.ENCRYPTION_SERVER' Is Set To 'REQUIRED'

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target oracle-db