A Oracle Database Vault Auditing Policies

A.1 About the Baseline Oracle Database Vault Auditing Policy

A baseline auditing policy is installed with Oracle Database Vault. This policy audits the following components:

• Access control configuration information that is stored in the oracle Database Vault database tables

• Information that is stored in the Oracle Catalog (rollback segments, tablespaces, and so on)

• The use of system privileges

• The Oracle Label Security configuration

A.2 Enabling Oracle Database Vault Auditing

Before you can capture the Oracle Database Vault audit information, you must enable the audit trail by setting the AUDIT_TRAIL initialization parameter to OS, which writes the audit trail record to an operating system file. The default setting for AUDIT_TRAIL is DB, which writes the audit trail record to the data dictionary. For security reasons, use OS instead, because it reduces the likelihood of a Denial of Service (DoS) attack. To set this parameter, log on to SQL*Plus with SYSDBA privileges, set AUDIT_TRAIL to OS, and then restart the database. For example:

sqlplus "sys / as sysdba"
Enter password: password
Connected.

SQL> ALTER SYSTEM SET AUDIT_TRAIL = OS SCOPE=SPFILE;
SQL> ALTER SYSTEM SET AUDIT_TRAIL_DEST = directory_path DEFERRED;
SQL> SHUTDOWN NORMAL;
SQL> STARTUP;

For more information about the AUDIT_TRAIL parameter, see Oracle Database Security Guide and Oracle Database Reference.

A.3 Oracle Database Vault Audit Policy Settings

Table A-1 shows the audit settings in the core database auditing policy used with Oracle Database Vault.

A.4 Oracle Database Vault Specific Audit Events

After you have enabled auditing, you can define a database audit policy for auditing system commands, users, objects, and so on. However, the database audit policy does not inherently support several Oracle Database Vault events.

Oracle Database Vault defines custom events that you can choose to audit. This enables you to audit events not protected by the database audit policy. For example, if the run-time access control processing of retrieving the identifier for a factor fails, the audit options for the factor may dictate that this event be audited.

A.5 Archiving the Oracle Database Vault Audit Trail

You can create an archive of the Oracle Database Vault audit trail by exporting the AUDIT_TRAIL$ system table, which is owned by DVSYS, to a dump file. You should periodically archive the audit trail to prevent it from growing too large.

To archive the Oracle Database Vault audit trail:

1. Ensure that Data Pump Export is installed.

   Log on to SQL*Plus with administrative privileges and then run the following query:

   sqlplus "sys/as sysdba"
   Enter password: password
   SQL> SELECT ROLE FROM DBA_ROLES WHERE ROLE LIKE '%FULL%'
   

   If the query does not return the EXP_FULL_DATABASE and IMP_FULL_DATABASE roles, then Data Pump Export is not installed. To install Data Pump Export, run either the catexp.sql or catalog.sql script. For example:

   SQL> @/opt/oracle/app/oracle/admin/catexp.sql;
   

   See Oracle Database Utilities for more information about the Export utility.

2. Disable Oracle Database Vault.

   See "Step 1: Disable Oracle Database Vault" for more information.

3. If the DVSYS account is locked, then unlock it.

   You need to have this account unlocked when you run the EXPDP export command. Ensure that you are still logged on as SYS, connecting AS SYSDBA.

   ALTER USER dvsys IDENTIFIED BY password ACCOUNT UNLOCK;
   

4. Confirm the location of the operating system audit trail.

   SHOW PARAMETER AUDIT_FILE_DEST
   
   NAME                 TYPE     VALUE
   -------------------  -------  ---------------------------------------
   audit_file_dest      string   /opt/oracle/app/oracle/admin/orcl/adump
   

   In general, you may want to keep your audit files in one location.

5. In SQL*Plus, create a directory object in which to generate the Oracle Database Vault audit trail. To do so, connect as SYS or as any user who has the CREATE DIRECTORY privilege.

   For example:

   CREATE DIRECTORY dv_audit_dir AS '/opt/oracle/app/oracle/admin/orcl/adump';
   

   Enclose the directory path in single quotation marks, not double quotation marks.

6. Grant read and write privileges on the directory object to user DVSYS.

   For example:

   GRANT READ, WRITE ON DIRECTORY dv_audit_dir TO dvsys; 
   

7. At the operating system command line, enter a command similar to the following to export the DVSYS.AUDIT_TRAIL$ audit table into a new dump file.

   EXPDP DVSYS/password \
   DIRECTORY=dv_audit_dir \
   TABLES=DVSYS.AUDIT_TRAIL$ \
   QUERY=DVSYS.AUDIT_TRAIL$:"WHERE timestamp < 2007-04-03:19:34:59" 
   DUMPFILE=dv_audit_031607.dmp
   

   In this specification:

   • DIRECTORY: Enter the directory object that you created in Step 5. Ensure that that the user who is running EXPDP (DVSYS in this example) has read and write permissions on this directory object. If you created the directory object, then you automatically have read and write permissions on it.

   • TABLES: Enter DVSYS.AUDIT_TRAIL$, the name of the audit trail table.

   • QUERY: Optional. This setting writes a subset of the audit table contents to the dump file, in this case, audit records that are less than the timestamp column value of 2007-04-03:19:34:59.

   • DUMPFILE: Enter the name of the dump file that you want to create. The default extension is .dmp, but you can use any extension. Ensure that the file name you specify is unique.

8. Purge the Oracle Database Vault audit trail table, now that you have archived it.

   For example, if you archived all audit trail records that are less than the timestamp column value of 2007-04-03:19:34:59, enter the following statement:

   DELETE FROM DVSYS.AUDIT_TRAIL$ WHERE timestamp < 2007-04-03:19:34:59;
   

   To completely purge the audit trail and remove the extents allocated to the audit trail table, enter the following statement:

   TRUNCATE TABLE DVSYS.AUDIT_TRAIL$;
   

9. Exit SQL*Plus.