lsnrSecure_NAMESecure Configuration for Oracle Listener lsnrSecure_DESCEnsures adherence with best-practice security configuration settings that help protect against database-related threats and attacks, providing a more secure operating environment for the Oracle database. lsnrSecure_SecurityKEYWORDSecurity LsnrOracleDirAndFilePerms_NAMEOracle Directory and File Permissions LsnrOracleDirAndFilePerms_DESCContains rules that ensure the permissions on the directories and files containing the Oracle software are sufficient. Access should be restricted, making it more difficult for an operating system user to attack the database. LsnrOracleDirAndFilePermsU_NAMEUnix Platform LsnrOracleDirAndFilePermsU_DESCContains rules that ensure the permissions on the directories and files containing the Oracle software are sufficient. OracleNetClientLogDirU_NAMEOracle Net Client Log Directory (LOG_DIRECTORY_CLIENT) OracleNetClientLogDirU_DESCEnsures access to directory referenced by the LOG_DIRECTORY_CLIENT sqlnet.ora parameter is restricted such that world has no permissions. OracleNetClientLogDirU_RATIONALEThe LOG_DIRECTORY_CLIENT sqlnet.ora parameter specifies the directory where client log files are written. A log file provides information to an administrator trying to troubleshoot network problems. The log file, by way of the error stack, shows the state of the software at various layers thus can reveal important network and database connection details. Access to the directory containing these files should be restricted in order to prevent exposing sensitive information. OracleNetClientLogDirU_FIXRestrict permissions to the directory referenced by the LOG_DIRECTORY_CLIENT parameter such that world has no permissions; that is, permissions should be set to 0770 or less. OracleNetClientTraceDirU_NAMEOracle Net Client Trace Directory (TRACE_DIRECTORY_CLIENT) OracleNetClientTraceDirU_DESCEnsures access to directory referenced by the TRACE_DIRECTORY_CLIENT sqlnet.ora parameter is restricted such that world has no permissions. OracleNetClientTraceDirU_RATIONALEThe TRACE_DIRECTORY_CLIENT sqlnet.ora parameter specifies the directory where client trace files are written. By showing a detailed sequence of statements that describe network events as they are executed, a trace file provides detailed information to an administrator trying to troubleshoot network problems. Access to the directory containing these files should be restricted in order to prevent exposing sensitive information. OracleNetClientTraceDirU_FIXRestrict permissions to the directory referenced by the TRACE_DIRECTORY_CLIENT parameter such that world has no permissions; that is, permissions should be set to 0770 or less. OracleNetServerLogDirU_NAMEOracle Net Server Log Directory (LOG_DIRECTORY_SERVER) OracleNetServerLogDirU_DESCEnsures access to directory referenced by the LOG_DIRECTORY_SERVER sqlnet.ora parameter is restricted such that world has no permissions. OracleNetServerLogDirU_RATIONALEThe LOG_DIRECTORY_SERVER sqlnet.ora parameter specifies the directory where database server log files are written. A log file provides information to an administrator trying to troubleshoot network problems. The log file, by way of the error stack, shows the state of the software at various layers thus can reveal important network and database connection details. Access to the directory containing these files should be restricted in order to prevent exposing sensitive information. OracleNetServerLogDirU_FIXestrict permissions to the directory referenced by the LOG_DIRECTORY_SERVER parameter such that world has no permissions; that is, permissions should be set to 0770 or less. OracleNetServerTraceDirU_NAMEOracle Net Server Trace Directory (TRACE_DIRECTORY_SERVER) OracleNetServerTraceDirU_DESCEnsures access to directory referenced by the TRACE_DIRECTORY_SERVER sqlnet.ora parameter is restricted such that world has no permissions. OracleNetServerTraceDirU_RATIONALEThe TRACE_DIRECTORY_SERVER sqlnet.ora parameter specifies the directory where database server trace files are written. By showing a detailed sequence of statements that describe network events as they are executed, a trace file provides detailed information to an administrator trying to troubleshoot network problems. Access to the directory containing these files should be restricted in order to prevent exposing sensitive information. OracleNetServerTraceDirU_FIXRestrict permissions to the directory referenced by the TRACE_DIRECTORY_SERVER parameter such that world has no permissions; that is, permissions should be set to 0770 or less. LsnrLogFileU_NAMEListener Log File (LOG_FILE_listener_name) LsnrLogFileU_DESCEnsures access to file referenced by the LOG_FILE_listener_name listener.ora parameter is restricted such that world has no permissions. LsnrLogFileU_RATIONALEThe LOG_FILE_listener_name listener.ora parameter specifies the file for the log file that is automatically generated for listener events. Access to this file should be restricted in order to prevent exposing sensitive information. LsnrLogFileU_FIXRestrict permissions to the directory referenced by the LOG_FILE_listener_name parameter such that world has no permissions; that is, permissions should be set to 0770 or less. LsnrTraceDirU_NAMEListener Trace Directory (TRACE_DIRECTORY_listener_name) LsnrTraceDirU_DESCEnsures access to directory referenced by the TRACE_DIRECTORY_listener_name listener.ora parameter is restricted such that world has no permissions. LsnrTraceDirU_RATIONALEThe TRACE_DIRECTORY_listener_name listener.ora parameter specifies the directory of the trace file. Access to the directory containing the trace file should be restricted in order to prevent exposing sensitive information. LsnrTraceDirU_FIXRestrict permissions to the directory referenced by the TRACE_DIRECTORY_listener_name parameter such that world has no permissions; that is, permissions should be set to 0770 or less. LsnrTraceFileU_NAMEListener Trace File (TRACE_FILE_listener_name) LsnrTraceFileU_DESCEnsures access to file referenced by the TRACE_FILE_listener_name listener.ora parameter is restricted such that world has no permissions. LsnrTraceFileU_RATIONALEThe TRACE_FILE_listener_name listener.ora parameter specifies the destination of the trace file. Access to the trace file should be restricted in order to prevent exposing sensitive information. LsnrTraceFileU_FIXRestrict permissions to the file referenced by the TRACE_FILE_listener_name parameter such that world has no permissions; that is, permissions should be set to 0770 or less. LsnrOracleDirAndFilePermsW_NAMEWindows Platform LsnrOracleDirAndFilePermsW_DESCContains rules that ensure the permissions on the directories and files containing the Oracle software are sufficient. OracleNetClientLogDirW_NAMEOracle Net Client Log Directory (LOG_DIRECTORY_CLIENT) OracleNetClientLogDirW_DESCEnsures access to directory referenced by the LOG_DIRECTORY_CLIENT sqlnet.ora parameter is restricted to the owner of the Oracle software. OracleNetClientLogDirW_RATIONALEThe LOG_DIRECTORY_CLIENT sqlnet.ora parameter specifies the directory where client log files are written. A log file provides information to an administrator trying to troubleshoot network problems. The log file, by way of the error stack, shows the state of the software at various layers thus can reveal important network and database connection details. Access to the directory containing these files should be restricted in order to prevent exposing sensitive information. OracleNetClientLogDirW_FIXRestrict permissions to the directory referenced by the LOG_DIRECTORY_CLIENT parameter to the owner of the Oracle software set and DBA group. Do not give any of the following permissions to any other users or user groups: DELETE, WRITE_DAC, WRITE_OWNER, CHANGE, ADD, or FULL. OracleNetClientTraceDirW_NAMEOracle Net Client Trace Directory (TRACE_DIRECTORY_CLIENT) OracleNetClientTraceDirW_DESCEnsures access to directory referenced by the TRACE_DIRECTORY_CLIENT sqlnet.ora parameter is restricted to the owner of the Oracle software. OracleNetClientTraceDirW_RATIONALEThe TRACE_DIRECTORY_CLIENT sqlnet.ora parameter specifies the directory where client trace files are written. By showing a detailed sequence of statements that describe network events as they are executed, a trace file provides detailed information to an administrator trying to troubleshoot network problems. Access to the directory containing these files should be restricted in order to prevent exposing sensitive information. OracleNetClientTraceDirW_FIXRestrict permissions to the directory referenced by the TRACE_DIRECTORY_CLIENT parameter to the owner of the Oracle software set and DBA group. Do not give any of the following permissions to any other users or user groups: DELETE, WRITE_DAC, WRITE_OWNER, CHANGE, ADD, or FULL. OracleNetServerLogDirW_NAMEOracle Net Server Log Directory (LOG_DIRECTORY_SERVER) OracleNetServerLogDirW_DESCEnsures access to directory referenced by the LOG_DIRECTORY_SERVER sqlnet.ora parameter is restricted to the owner of the Oracle software. OracleNetServerLogDirW_RATIONALEThe LOG_DIRECTORY_SERVER sqlnet.ora parameter specifies the directory where database server log files are written. A log file provides information to an administrator trying to troubleshoot network problems. The log file, by way of the error stack, shows the state of the software at various layers thus can reveal important network and database connection details. Access to the directory containing these files should be restricted in order to prevent exposing sensitive information. OracleNetServerLogDirW_FIXRestrict permissions to the directory referenced by the LOG_DIRECTORY_SERVER parameter to the owner of the Oracle software set and DBA group. Do not give any of the following permissions to any other users or user groups: DELETE, WRITE_DAC, WRITE_OWNER, CHANGE, ADD, or FULL. OracleNetServerTraceDirW_NAMEOracle Net Server Trace Directory (TRACE_DIRECTORY_SERVER) OracleNetServerTraceDirW_DESCEnsures access to directory referenced by the TRACE_DIRECTORY_SERVER sqlnet.ora parameter is restricted to the owner of the Oracle software. OracleNetServerTraceDirW_RATIONALEThe TRACE_DIRECTORY_SERVER sqlnet.ora parameter specifies the directory where database server trace files are written. By showing a detailed sequence of statements that describe network events as they are executed, a trace file provides detailed information to an administrator trying to troubleshoot network problems. Access to the directory containing these files should be restricted in order to prevent exposing sensitive information. OracleNetServerTraceDirW_FIXRestrict permissions to the directory referenced by the TRACE_DIRECTORY_SERVER parameter to the owner of the Oracle software set and DBA group. Do not give any of the following permissions to any other users or user groups: DELETE, WRITE_DAC, WRITE_OWNER, CHANGE, ADD, or FULL. LsnrLogFileW_NAMEListener Log File (LOG_FILE_listener_name) LsnrLogFileW_DESCEnsures access to file referenced by the LOG_FILE_listener_name listener.ora parameter is restricted to the owner of the Oracle software. LsnrLogFileW_RATIONALEThe LOG_FILE_listener_name listener.ora parameter specifies the file for the log file that is automatically generated for listener events. Access to this file should be restricted in order to prevent exposing sensitive information. LsnrLogFileW_FIXRestrict permissions to the file referenced by the LOG_FILE_listener_name parameter to the owner of the Oracle software set and DBA group. Do not give any of the following permissions to any other users or user groups: DELETE, WRITE_DAC, WRITE_OWNER, CHANGE, ADD, or FULL. LsnrTraceDirW_NAMEListener Trace Directory (TRACE_DIRECTORY_listener_name) LsnrTraceDirW_DESCEnsures access to directory referenced by the TRACE_DIRECTORY_listener_name listener.ora parameter is restricted to the owner of the Oracle software. LsnrTraceDirW_RATIONALEThe TRACE_DIRECTORY_listener_name listener.ora parameter specifies the directory of the trace file. Access to the directory containing the trace file should be restricted in order to prevent exposing sensitive information. LsnrTraceDirW_FIXRestrict permissions to the directory referenced by the TRACE_DIRECTORY_listener_name parameter to the owner of the Oracle software set and DBA group. Do not give any of the following permissions to any other users or user groups: DELETE, WRITE_DAC, WRITE_OWNER, CHANGE, ADD, or FULL. LsnrTraceFileW_NAMEListener Trace File (TRACE_FILE_listener_name) LsnrTraceFileW_DESCEnsures access to file referenced by the TRACE_FILE_listener_name listener.ora parameter is restricted to the owner of the Oracle software. LsnrTraceFileW_RATIONALEThe TRACE_FILE_listener_name listener.ora parameter specifies the destination of the trace file. Access to the trace file should be restricted in order to prevent exposing sensitive information. LsnrTraceFileW_FIXRestrict permissions to the file referenced by the TRACE_FILE_listener_name parameter to the owner of the Oracle software set and DBA group. Do not give any of the following permissions to any other users or user groups: DELETE, WRITE_DAC, WRITE_OWNER, CHANGE, ADD, or FULL. NetworkConfigSettings_NAMENetwork Configuration Settings NetworkConfigSettings_DESCContains rules that ensure network configuration parameter settings are secure. SecureLogonAuthenProtocolVersion_NAMESecure Logon Authentication Protocol Version (SQLNET.ALLOWED_LOGON_VERSION) SecureLogonAuthenProtocolVersion_DESCEnsures at a minimum 10g authentication protocols are used. SecureLogonAuthenProtocolVersion_RATIONALEThe SQLNET.ALLOWED_LOGON_VERSION sqlnet.ora parameter specifies which authentication protocols are allowed by the client or database. Once specified, each connection attempt is tested, and if the client or server does not meet the minimum version specified by its partner, authentication fails with an ORA-28040 error. The specified value represents database server versions. Any value lower than 10 could expose vulnerabilities that may have existed in previous version of the authentication protocols. SecureLogonAuthenProtocolVersion_FIXSet SQLNET.ALLOWED_LOGON_VERSION to at least 10.