Oracle Database security hardening (assessment, network, TLS, authentication, privileges, Unified Auditing, TDE)

This is not an installation guide: it finds and closes the gaps in a running Oracle 19c / 23ai (26ai) database (single instance, Oracle Restart or RAC; CDB/PDB). First the read-only Security assessment lists the findings by severity and tells you which card each one leads to; then you close the areas one by one or all of them in order: listener and TCP.VALIDNODE_CHECKING, firewall, TCPS (wallet) or native network encryption, the 12C password verifier and profiles, locking default accounts, role design and revoking UTL_* privileges from PUBLIC, Unified Auditing and AUDSYS cleanup, TDE, encrypted backups, the operating system and RU tracking. TDE and RMAN/Data Pump encryption require the Advanced Security license; everything else is license-free. At the end the assessment runs again.

Topology: Single instance / Oracle Restart / RAC (2–8 nodes), CDB + PDB; application server (client verification)

Scenarios

• Security assessment: what are my gaps? (read-only) — The first scan to run: accounts with default passwords and open accounts, old password verifiers, profiles, DBA/ANY privileges, UTL_ PL/SQL packages granted to PUBLIC, auditing, TDE, unencrypted sessions, listener and file permissions; it changes nothing.
• Full hardening (all areas in order) — Newly installed or never hardened database: all areas are applied in a safe order; the listener and the database are restarted once or twice (a maintenance window is required).
• Network and connections: who can connect from where? (listener, TCP.VALIDNODE_CHECKING, firewall) — The listener is open to every address, invited nodes are not defined, 1521/5500 are open to everyone. The listener is restarted (existing sessions are not affected).
• Encrypt connections (TCPS wallet or native network encryption) — Network traffic is unencrypted; TLS (TCPS, wallet, certificate, SSL_SERVER_DN_MATCH on the client) or certificate-less native encryption (SQLNET.ENCRYPTION_SERVER=REQUIRED). Both are license-free; the listener is restarted, existing sessions are not affected.
• Authentication and passwords (12C verifier, profiles, default accounts) — 10G/11G password verifiers, no password profile, accounts with default passwords or sample accounts open; personal DBA accounts. No downtime.
• Least privilege: roles, PUBLIC and the application account — DBA/RESOURCE/ANY privileges on the application account, UTL_FILE/UTL_TCP/UTL_HTTP granted to PUBLIC; schema owner, read/write roles and a privilege report. No downtime.
• Auditing: who did what? (Unified Auditing, AUDSYS cleanup) — The auditor wants records of logons, account changes and schema changes; unified audit policies, purging AUDSYS according to a retention period and forwarding records to syslog / a central server. Unified Auditing is license-free.
• Encrypt data at rest (TDE) — TDE against reading datafiles, backups or disk copies: WALLET_ROOT, keystore, master key, tablespace encryption (online). Requires the Advanced Security license; one restart for WALLET_ROOT.
• Backup security (RMAN encryption, password-free automation, permissions) — RMAN/Data Pump backups are unencrypted, scripts contain plain-text passwords, the backup directory is world-readable; RMAN encryption, ENCRYPTION_PWD_PROMPT, wallet (SEPS) and directory permissions. RMAN and Data Pump encryption require the Advanced Security license.
• Operating system side (oracle account, file permissions, core dumps, SELinux) — The oracle account has a password and can log in, permissions on the password file / network admin / wallet are loose, SELinux is disabled. The core dump limit takes effect in a new session / after a restart.
• Patches and version: am I on the latest RU? — Installed RU, datapatch status and support timeline; links to the RU patch guide for applying it. Read-only.

Before you start

• The oracle user's profile defines ORACLE_HOME=…, ORACLE_SID… (the instance name of each node)… and PATH; sqlplus / as sysdba works without a password (operating system authentication). The steps run in a login shell with sudo -iu oracle, so the profile is loaded.… The listener is managed from the Grid Infrastructure home (…) as ….… If non-ASCII characters in the output show up as ?, add export NLS_LANG=AMERICAN_AMERICA.AL32UTF8 to the profile (display only; no effect on the data).
• Two separate sessions are open on the server; one of them keeps sqlplus / as sysdba open. A local / as sysdba (bequeath) connection is not affected by the listener, the sqlnet.ora network rules or profiles: it is always the way back after a listener, invited nodes or encryption error. After every step that restricts access, test a new connection in a separate session (from the application server).
• Maintenance window: the listener will be restarted (new connections are refused for a few seconds, existing sessions are not affected)…; the static parameters WALLET_ROOT for TDE and UNIFIED_AUDIT_SYSTEMLOG for auditing require a database restart….… On RAC the database restart can be done node by node (rolling): srvctl stop instance -db … -node <node> / start.…
• TDE, RMAN backup encryption and Data Pump encryption require the Oracle Advanced Security license (Enterprise Edition + an option license; included in Oracle Cloud / Exadata Cloud). Without the license do not apply these steps; use disk-level encryption (LUKS) or storage encryption instead. Native Network Encryption and TLS, on the other hand, are license-free in all editions (since 11gR2).
• The list of applications connecting to the database, the addresses of the Data Guard/OEM/backup servers, and the client versions. The assessment step shows the current sessions.
• A current RMAN backup with a tested restore exists (RMAN backup strategy). A backup taken before TDE can be opened without the keystore; after TDE, new backups cannot be opened without a keystore backup.

Phases of the guide

• Security assessment (read-only) — List findings inside the database · Check the operating system and Net side
• Before you start: fallback point — Save the Net files and parameters · Dump users, profiles and privileges
• Privileges — 1. Diagnosis — Show the application accounts' privileges and the PL/SQL packages granted to PUBLIC
• Privileges — 2. Safety net — Find objects that depend on the PUBLIC grants
• Privileges — 3. Apply — Create the schema owner, the roles and the accounts · Grant table privileges to the roles · Revoke excess privileges from the application account · Revoke the UTL_* and dangerous PL/SQL package privileges from PUBLIC · Privilege report
• Privileges — 4. Verification — Verify the effective privileges of the application account · DDL attempt from the application server
• Authentication — 1. Diagnosis — Show account statuses, verifiers and profiles
• Authentication — 2. Safety net — Check the client versions
• Authentication — 3. Apply — Lock Oracle accounts with default passwords, sample accounts and unused accounts · Create the password profiles · Harden the DEFAULT profile in the CDB root · Enforce the 12C password verifier (sqlnet.ora) · Set passwords for the application accounts · Create the personal DBA account …
• Authentication — 4. Verification — Verify the account and verifier status · Test a login from the application server (new session)
• Network encryption — 1. Diagnosis — Show the encryption status of the sessions
• Network encryption — 3. Apply — Enforce native network encryption · Create the server wallet · Add the certificates returned by the CA to the wallet · Open the wallet to the listener owner… and copy it to the other nodes… · Write the TLS settings for the listener · Write the TLS settings for the database home …
• Network encryption — 4. Verification — Verify that a new connection is encrypted
• Network encryption — 5. Afterwards — Closing the unencrypted 1521 and renewing the certificate
• Network — 1. Diagnosis: who connects from where? — Show the listener and the connection sources
• Network — 3. Apply — Make the listener accept only allowed addresses (valid node checking) · Restart the listener · Open the ports in the firewall to allowed networks only
• Network — 4. Verification — Test the connection from the application server (new session)
• Audit — 1. Diagnosis — Show the audit mode, the policies and the AUDSYS size
• Audit — 3. Apply — Define and enable the audit policies · Move AUDSYS to a separate tablespace and schedule the purge · Enable the predefined policies and the purge in the CDB root · Write an audit summary to syslog (UNIFIED_AUDIT_SYSTEMLOG) · rsyslog: forward local3 to the central server · Restart rsyslog and restart the database
• Audit — 4. Verification — Make a change and see the record
• Operating system — 1. Diagnosis — oracle account, file permissions, core dumps and SELinux
• Operating system — 3. Apply — Lock the password of the oracle account · Fix the permissions of the password file and the Net files · Disable core dumps for the oracle user · Keep SELinux in Enforcing mode
• Operating system — 4. Verification — Verify the changes
• TDE — 1. Diagnosis — Show the keystore and tablespace encryption status
• TDE — 2. Safety net — Backup and space check before TDE
• TDE — 3. Apply — Set WALLET_ROOT · Restart the database for WALLET_ROOT · Create and open the keystore and set the master key · Copy the keystore to the other RAC nodes · Encrypt the tablespace · Back up the keystore
• TDE — 4. Verification — Verify the keystore and the encrypted tablespace
• Backup — 1. Diagnosis — Show the RMAN encryption setting and the status of the backups
• Backup — 3. Apply — Enable RMAN backup encryption · Test an encrypted backup · Encrypt Data Pump exports · Passwordless connections for scripts (Secure External Password Store) · Fix the backup and wallet directory permissions
• Patches and version — 1. Diagnosis — Show the installed RU and the datapatch status