OCA读书笔记(11) - 实现Oracle数据库审计

11 Implementing Oracle Database Auditing

描述DBA对于安全和审计的职责
使能标准的数据库审计
安全审计选项
查看审计信息
维护审计路径

最小权限原则
只在计算机上安装所需软件
只在计算机上激活所需服务
只允许需要访问的用户访问操作系统和数据库
限制对 root 或管理员帐户的访问
限制对 SYSDBA 和 SYSOPER 帐户的访问
只允许用户访问完成工作所需的数据库对象

O7_DICTIONARY_ACCESSIBILITY的作用：

1. 保护数据字典
演示：当参数为false时，即使赋予普通用户select any table的权限，普通用户也不能访问数据字典；当参数为true时，赋予普通用户同等权限，普通用户才可以访问数据字典。
sqlplus / as sysdba;
show parameter O7;
grant select any table to oe;
alter user oe account unlock identified by oe;

conn oe/oe;
select count(*) from dba_objects; --error

conn / as sysdba;
alter system set O7_DICTIONARY_ACCESSIBILITY=true scope=spfile;
startup force;
show parameter o7;

conn oe/oe;
select count(*) from dba_objects;

conn / as sysdba;
alter system set O7_DICTIONARY_ACCESSIBILITY=false scope=spfile;
startup force;

强制审计
对具有sysdba和sysoper的用户的登录行为进行审计,审计的内容存放的位置：audit_file_dest的值
sqlplus / as sysdba;
show parameter audit_file_dest

select spid from v$process where addr=(select paddr from v$session where sid=(select distinct sid from v$mystat))

cd $ORACLE_BASE/admin/orcl/adump
ls *<spid>*
vi orcl_ora_<spid>.aud

SYSDBA (and SYSOPER)审计
show parameter audit_sys
alter system set audit_sys_operations=true scope=spfile
startup force

ls *7689*
vi orcl_ ... aud
以上内容放置在操作系统文件。

标准数据库审计
show parameter audit_trail
11g 默认打开
审计信息放置在aud$中
desc aud$
查看：
desc dba_audit_trail

grant select any table to scott;
audit select any table by sott by session;

truncate table aud$;
select count(*) from dba_audit_trail;

conn scott/tiger;

conn / as sysdba;
select count(*) from dba_audit_trail;

select username, timestamp, ses_actions, obj_name, action_name, sql_text from dba_audit_trail where username='SCOTT';

alter ssytem set audit_trail=db,extended scope=spfile;
startup force;

noaudit select any table by scott;
audit update on scott.emp;

update scott.emp set sal=sal+100;
select username, timestamp, ses_actions, obj_name, action_name, sql_text from dba_audit_trail where username='HR';

SQL语句审计
AUDIT table;
audit table by hr whenever not successful;
系统权限审计
audit select any table, create any trigger;
audit select any table by hr by session;
对象权限审计
audit all on hr.employees;
audit update,delete on hr.employees by access;

细粒度审计(FGA)
对某个表的某一行或者某列或某行某列进行操作时才进行审计。
通过dbms_fga增加策略来开启细粒度审计，与标准审计没有关系。
dbms_fga.add_policy (
object_schema => 'HR',
object_name => 'EMPLOYEES',
policy_name => 'audit_emps_salary',
audit_condition=> 'department_id=10',
audit_column => 'SALARY,COMMISSION_PCT',
handler_schema => 'secure',
handler_module => 'log_emps_salary',
enable => TRUE,
statement_types => 'SELECT,UPDATE');

审计内容
fga_log$
dba_

conn scott/tiger;

删除审计
exec dbms_fga.drop_policy('scott','emp','audit_emp')

基于值的审计
通过触发器进行审计
创建一个存放审计数据的表

conn / as sysdba

create table system.audit_employees(os_user
varchar2(30),ins_date date,ip_address
varchar2(20),context varchar2(100));

创建触发器

create or replace trigger system.audit_salary
after update of salary on hr.employees
referencing new as new old as old
for each row
begin
if :old.salary != :new.salary then
insert into system.audit_employees
values(sys_context('userenv','os_user'),sysdate,sys_context('userenv','ip_address'),
:new.employee_id||' salary changed from '||:old.salary||' to '||:new.salary);
end if;
end;

验证：

conn hr/hr
update employees set SALARY=SALARY+1000 where EMPLOYEE_ID=190;
SQL> commit;

.bash_profile
userenv

conn system/a
SQL> select * from system.audit_employees;