Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-5685 | DG0029-ORACLE11 | SV-24615r2_rule | ECAR-1 ECAR-2 ECAR-3 | Medium |
Description |
---|
Oracle auditing can be set to log audit data to the database or operating system files. Logging events to the database prevents operating system users from viewing the data, while logging events to operating system files prevents malicious database users from accessing the data. The value NONE disables auditing and is, therefore, not in compliance with policy. |
STIG | Date |
---|---|
Oracle Database 11g Instance STIG | 2015-03-26 |
Check Text ( C-1126r2_chk ) |
---|
From SQL*Plus: select value from v$parameter where name = 'audit_trail'; If the value returned is NONE, this is a Finding. |
Fix Text (F-22677r1_fix) |
---|
Enable database auditing. Select the desired audit trail format (external file or internal database table). From SQL*Plus: alter system set audit_trail= [audit trail format] scope=spfile; Compliant selections for [audit trail format] are (per MetaLink Note 30690.1): Oracle 11.1 – 11.2 = 'true', 'os' & 'db' (true = os for backward compatibility) Oracle 11.1 – 11.2 = 'db_extended', 'xml' & 'xml, extended' The above SQL*Plus command will set the parameter to take effect at next system startup. |