Oracle 11g Security - Enabling default security settings

1.  Bring up the Database Configuration Assistant GUI. All that is typically required here is to log into the database system as the Oracle user and execute the dbca command—typically located at $ORACLE_HOME/bin/dbca. Click the Next button to bring up the Operations window.

2.  Select the Configure Database Options option and then click the Next button to bring up the Database window.

3.  Select the Database you’d like to configure and then click the Next button to bring up the Database Content window. A small popup window will appear that retrieves information from the database; no alarm needed.

4.  Click the Next button to bring up the Security Settings window.

5.  Depending on how you’ve created your database initially, the Security Settings screen could take on two different appearances; one screen image if you had configured the database with pre-11g default security settings and a second screen image if you actually have already configured your database to make use of the enhanced 11g default security settings.

• Pre-11g security settings screen image

With pre-11 g security settings, you can basically keep the pre-11g settings or opt to apply the enhanced 11g default security settings.



So, what exactly are we opting to effect if we enable the enhanced 11g default security settings? The 2 Day guide explicitly points out a few init.ora parameters and some defaults within the password profile. Here is what those fields look like if we use SQL*Plus. Just remember your output may vary depending on if you have explicitly modified any of these.

SQL> show parameter audit_trail
NAME                                 TYPE        VALUE
------------------------------------ ----------- --------
audit_trail                          string      NONE

SQL> show parameter O7_dictionary_accessibility
NAME                                 TYPE        VALUE
------------------------------------ ----------- --------
O7_DICTIONARY_ACCESSIBILITY          boolean     TRUE

SQL> show parameter remote_os_roles
NAME                                 TYPE        VALUE
------------------------------------ ----------- --------
remote_os_roles                      boolean     TRUE

SQL> SELECT * FROM DBA_PROFILES  
      WHERE profile       = 'DEFAULT'
        AND resource_type = 'PASSWORD';
PROFILE    RESOURCE_NAME                    RESOURCE LIMIT
---------- -------------------------------- -------- -------------
DEFAULT    FAILED_LOGIN_ATTEMPTS            PASSWORD 10
DEFAULT    PASSWORD_LIFE_TIME               PASSWORD UNLIMITED
DEFAULT    PASSWORD_REUSE_TIME              PASSWORD UNLIMITED
DEFAULT    PASSWORD_REUSE_MAX               PASSWORD UNLIMITED
DEFAULT    PASSWORD_VERIFY_FUNCTION         PASSWORD NULL
DEFAULT    PASSWORD_LOCK_TIME               PASSWORD UNLIMITED
DEFAULT    PASSWORD_GRACE_TIME              PASSWORD UNLIMITED

16 rows selected.

• 11g security settings screen image

With the 11g default security settings enabled you can either keep the current settings or opt to revert to pre-11g default security. Interesting here, that is not an option in the pre-11g security screen is, when we select to revert, there are two additional options to revert audit settings and revert password profiles. While I wouldn’t suggest this approach, if you wanted to revert only one of the options this is possible.

6.  Assuming that your database is using pre-11g security settings and you want to use the new enhanced 11g default security, select the option to Apply the enhanced 11g default security settings as recommended by Oracle. Then click the Next button to display the Connection Mode screen.

7.  Click the Finish button to initiate the changing of security settings.

8.  A small pop-up window will ask if you wish to have DBCA restart you database for you. This is an option you will have to make for yourself. I personally like to restart my database manually. Plus I can choose the time and not affect any other users on the system. So click the Yes or No button depending on your preference.

9.  Click the OK button to start the process of setting the security settings.

10.  Watch Oracle work. Don’t know if I would want to click that Stop button. There really isn’t much going on behind the scenes (in the way of setting parameters and profiles) so just let it run. Plus, I noticed that there is no indication within this process of when DBCA will actually be restarting the database. So Stopping or aborting the process could be more problematic than it is worth.

11.  When complete, Oracle will display a box asking if you want to perform any additional configuration changes. Click the No button and DBCA will exit.