The DBMS must display an approved system use notification message or banner before granting access to the database.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-61811	O121-C3-005300	SV-76301r1_rule		Low

Description
Applications are required to display an approved system use notification message or banner before granting access to the system which provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The DBMS must display an authorized banner upon logon of interactive accounts unless the banner text was already displayed to the user via the operating system logon on the server on which the application resides. The banner is not required for non-interactive accounts. (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) the use of the system indicates consent to monitoring and recording. System use notification messages can be implemented in the form of warning banners displayed when individuals log on to the information system. System use notification is intended only for information system access including an interactive logon interface with a human user and is not intended to require notification when an interactive interface does not exist. Use this banner for desktops, laptops, and other devices accommodating banners of 1300 characters. The banner shall be implemented as a click-through banner at logon (to the extent permitted by the operating system), meaning it prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating "OK". "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If implementing the banner via Oracle's native support for this (as described in the Check and Fix), which has a limit on the number of characters, use the official abbreviated wording: "I've read & consent to terms in IS user agreem't."

Description

Applications are required to display an approved system use notification message or banner before granting access to the system which provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The DBMS must display an authorized banner upon logon of interactive accounts unless the banner text was already displayed to the user via the operating system logon on the server on which the application resides. The banner is not required for non-interactive accounts. (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) the use of the system indicates consent to monitoring and recording. System use notification messages can be implemented in the form of warning banners displayed when individuals log on to the information system. System use notification is intended only for information system access including an interactive logon interface with a human user and is not intended to require notification when an interactive interface does not exist. Use this banner for desktops, laptops, and other devices accommodating banners of 1300 characters. The banner shall be implemented as a click-through banner at logon (to the extent permitted by the operating system), meaning it prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating "OK". "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If implementing the banner via Oracle's native support for this (as described in the Check and Fix), which has a limit on the number of characters, use the official abbreviated wording: "I've read & consent to terms in IS user agreem't."

STIG	Date
Oracle Database 12c Security Technical Implementation Guide	2016-06-24

Details

Check Text ( C-62691r1_chk )
If all applications using the database (and having an interactive user interface) display a logon banner with the prescribed wording, and the operating system(s) hosting the database and database administrative tools display(s) a logon banner with the prescribed wording, this is not a finding. Open the SQLNET.ORA file in a text editor. If the SEC_USER_UNAUTHORIZED_ACCESS_BANNER parameter is not present, this is a finding. If the SEC_USER_UNAUTHORIZED_ACCESS_BANNER parameter exists but does not refer to an accessible file, this is a finding. If the SEC_USER_UNAUTHORIZED_ACCESS_BANNER parameter refers to an accessible file, but the file does not contain the prescribed wording, this is a finding. If the SEC_USER_AUDIT_ACTION_BANNER parameter is not present, this is a finding. If the SEC_USER_AUDIT_ACTION_BANNER parameter exists but does not refer to an accessible file, this is a finding. If the SEC_USER_AUDIT_ACTION_BANNER parameter refers to an accessible file, but the file does not contain the prescribed wording, this is a finding.

Check Text ( C-62691r1_chk )

If all applications using the database (and having an interactive user interface) display a logon banner with the prescribed wording, and the operating system(s) hosting the database and database administrative tools display(s) a logon banner with the prescribed wording, this is not a finding.

Open the SQLNET.ORA file in a text editor.

If the SEC_USER_UNAUTHORIZED_ACCESS_BANNER parameter is not present, this is a finding.

If the SEC_USER_UNAUTHORIZED_ACCESS_BANNER parameter exists but does not refer to an accessible file, this is a finding.

If the SEC_USER_UNAUTHORIZED_ACCESS_BANNER parameter refers to an accessible file, but the file does not contain the prescribed wording, this is a finding.

If the SEC_USER_AUDIT_ACTION_BANNER parameter is not present, this is a finding.

If the SEC_USER_AUDIT_ACTION_BANNER parameter exists but does not refer to an accessible file, this is a finding.

If the SEC_USER_AUDIT_ACTION_BANNER parameter refers to an accessible file, but the file does not contain the prescribed wording, this is a finding.

Fix Text (F-67727r1_fix)
Create a text file containing the prescribed wording. Ensure the file is accessible by the database owner. (Be aware that in Oracle there is a 512-byte limitation for the number of characters used for the banner text. This means that the abbreviated form of the wording must be used.) Open the SQLNET.ORA file in a text editor. If the SEC_USER_UNAUTHORIZED_ACCESS_BANNER parameter is not present, create it. If the SEC_USER_AUDIT_ACTION_BANNER parameter is not present, create it. Set both parameter values equal to the complete path of the banner file. Example: SEC_USER_UNAUTHORIZED_ACCESS_BANNER=/opt/oracle/admin/data/unauthwarning.txt Configure all applications that use the database and have an interactive user interface to display the banner upon logon.

Fix Text (F-67727r1_fix)

Create a text file containing the prescribed wording. Ensure the file is accessible by the database owner. (Be aware that in Oracle there is a 512-byte limitation for the number of characters used for the banner text. This means that the abbreviated form of the wording must be used.)

Open the SQLNET.ORA file in a text editor. If the SEC_USER_UNAUTHORIZED_ACCESS_BANNER parameter is not present, create it. If the SEC_USER_AUDIT_ACTION_BANNER parameter is not present, create it. Set both parameter values equal to the complete path of the banner file.

Example: SEC_USER_UNAUTHORIZED_ACCESS_BANNER=/opt/oracle/admin/data/unauthwarning.txt

Configure all applications that use the database and have an interactive user interface to display the banner upon logon.