Ensure 'SQLNET.ENCRYPTION_SERVER' Is Set To 'REQUIRED'

高级别 1自动化oracle-db

说明

The SQLNET.ENCRYPTION_SERVER parameter determines whether the server side of a database connection enforces network encryption. When set to REQUIRED, this parameter mandates that all data transmitted between the client and the database is encrypted, preventing the server from connecting if encryption cannot be established. This setting ensures that sensitive data remains protected during ... The last uncommented setting in sqlnet.ora must equal REQUIRED (case-insensitive, spaces ignored). Default: ACCEPTED Reads the file from $TNS_ADMIN, or $ORACLE_HOME/network/admin when TNS_ADMIN is unset (Linux/UNIX hosts); fails when neither directory exists.

检查方式

审计方法: Shell 命令

shell

d="${TNS_ADMIN:-${ORACLE_HOME:?ORACLE_HOME not set}/network/admin}"; [ -d "$d" ] || { echo "missing $d"; exit 1; }; f="$d/sqlnet.ora"; [ -f "$f" ] || { echo "noncompliant: $f not found"; exit 0; }; v=$(grep -Ei '^[[:space:]]*SQLNET\.ENCRYPTION_SERVER[[:space:]]*=' "$f" | tail -n 1 | sed 's/^[^=]*=//' | tr -d ' \t\r' | tr '[:lower:]' '[:upper:]'); [ "$v" = "REQUIRED" ] && echo compliant || echo "noncompliant: ${v:-not set}"

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

To remediate this recommendation, set SQLNET.ENCRYPTION_SERVER to REQUIRED.

属性

操作系统: 任意
标签: oracle-dbdatabaseoraclenetworkencryption
参考: CIS Oracle Database 23ai Benchmark v1.1.0 - 2.2.7 Ensure 'SQLNET.ENCRYPTION_SERVER' Is Set To 'REQUIRED'

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target oracle-db