TMA-ORACLE-DB-5.2

Ensure the 'LOGON' AND 'LOGOFF' Actions Audit Is Enabled

높음레벨 1자동oracle-db

설명

Oracle database users log on to the database to perform their work. Enabling this unified audit causes logging of all LOGON actions, whether successful or unsuccessful, issued by the users regardless of the privileges held by the users to log into the database. In addition, LOGOFF and LOGOFF BY CLEANUP action audit captures logoff activities. This audit action also captures logon/logoff to ... Run on the database host as the Oracle software owner with ORACLE_HOME, ORACLE_SID and PATH set; connects to the CDB root with 'sqlplus -S / as sysdba' (OS authentication) so CDB_/GV$ views cover all open PDBs.

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(sqlplus -S -L / as sysdba 2>/dev/null <<'EOF'
whenever sqlerror exit failure
set heading off feedback off pagesize 0 verify off echo off trimspool on define off
with cis_audit(con_id, audit_option) as (
  select c.con_id, ll.column_value from v$containers c, table(dbmsoutput_linesarray('LOGON','LOGOFF')) ll where c.open_mode = 'READ WRITE'),
audit_enabled as (
  select distinct aud.con_id, aud.audit_option from containers(audit_unified_policies) aud
  where aud.audit_option in ('LOGON','LOGOFF') and aud.audit_option_type = 'STANDARD ACTION'
  and exists (select 1 from containers(audit_unified_enabled_policies) e
    where e.success = 'YES' and e.failure = 'YES' and e.enabled_option = 'BY USER' and e.entity_name = 'ALL USERS'
    and e.policy_name = aud.policy_name and e.con_id = aud.con_id)
)
select count(*) from cis_audit c
where not exists (select 1 from audit_enabled e where e.audit_option = c.audit_option and e.con_id = c.con_id);
exit
EOF
) || exit 1
printf '%s\n' "$out"

예상 출력: 0

조치 방법

조치 방식: 가이드 또는 인프라 패치

Execute the following SQL statement to remediate this setting. Run the following query in the CDB and in each PDB: CREATE AUDIT POLICY CIS_CDB_LOGON_LOGOFF ACTIONS LOGON, LOGOFF ACTIONS COMPONENT=PROTOCOL HTTP, FTP, AUTHENTICATION; AUDIT POLICY CIS_CDB_LOGON_LOGOFF; Note: If you do not have CIS_CDB_LOGON_LOGOFF, please create one using the CREATE AUDIT POLICY statement. Refer to Section 8.2 where a PL/SQL block is provided to help create or modify the audit policy to remediate this item in both container and pluggable database.

속성

운영 체제: 모두
태그: oracle-dbdatabaseoracleloggingaudit
참고 자료: CIS Oracle Database 23ai Benchmark v1.1.0 - 5.2 Ensure the 'LOGON' AND 'LOGOFF' Actions Audit Is Enabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target oracle-db