UCF STIG Viewer Logo

The Oracle REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.


Overview

Finding ID Version Rule ID IA Controls Severity
V-61431 O121-BP-022200 SV-75921r2_rule Medium
Description
The REMOTE_LOGIN_PASSWORDFILE setting of "NONE" disallows remote administration of the database. The REMOTE_LOGIN_PASSWORDFILE setting of "EXCLUSIVE" allows for auditing of individual DBA logons to the SYS account. If not set to "EXCLUSIVE", remote connections to the database as "internal" or "as SYSDBA" are not logged to an individual account.
STIG Date
Oracle Database 12c Security Technical Implementation Guide 2018-09-18

Details

Check Text ( C-62321r3_chk )
From SQL*Plus:

select value from v$parameter where upper(name) = 'REMOTE_LOGIN_PASSWORDFILE';

If the value returned does not equal 'EXCLUSIVE' or 'NONE', this is a finding.
Fix Text (F-67347r2_fix)
Disable use of the REMOTE_LOGIN_PASSWORDFILE where remote administration is not authorized by specifying a value of NONE.

If authorized, restrict use of a password file to exclusive use by each database by specifying a value of EXCLUSIVE.

From SQL*Plus:

alter system set REMOTE_LOGIN_PASSWORDFILE = 'EXCLUSIVE' scope = spfile;

OR

alter system set REMOTE_LOGIN_PASSWORDFILE = 'NONE' scope = spfile;

The above SQL*Plus command will set the parameter to take effect at next system startup.