Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

Oracle Database 11g Instance STIG

The Oracle Database 11g Instance STIG (V9 R1) has 94 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

94STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V9 · R1

CurrentPublished Wed Oct 27 2021

The Oracle REMOTE_OS_ROLES parameter should be set to FALSE.

Oracle Database 11g Instance STIG

Assessment Title

Rule Text

Description

Discussion Text

Setting REMOTE_OS_ROLES to TRUE allows operating system groups to control Oracle roles. The default value of FALSE causes roles to be identified and managed by the database. If REMOTE_OS_ROLES is set to TRUE, a remote user could impersonate another operating system user over a network connection.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-2555

Rule

SV-24916r2_rule

Severity

high

Rule Version

DO3539-ORACLE11

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From SQL*Plus:

  select value from v$parameter where name = 'remote_os_roles';

If the returned value is not FALSE or not documented in the System Security Plan as required, this is a Finding.

Implementation Procedure

Fix Text

Document remote OS roles in the System Security Plan.

If not required, disable use of remote OS roles.

From SQL*Plus:

  alter system set remote_os_roles = FALSE scope = spfile;

The above SQL*Plus command will set the parameter to take effect at next system startup.

STIG check 61 of 94 in the Oracle Database 11g Instance STIG checklist

← Previous · V-2554The Oracle REMOTE_OS_AUTHENT parameter should be set to FALSE.Next · V-2556 →The Oracle SQL92_SECURITY parameter should be set to TRUE.