Detections
Analytics

DO3447-ORACLE11 - The Oracle OS_AUTHENT_PREFIX parameter should be changed from the default value of OPS$ - 'os_authent_prefix = OPS$'

Information

The OS_AUTHENT_PREFIX parameter defines the prefix for database account names to be identified EXTERNALLY by the operating system. When set to the special value of OPS$, accounts defined with the prefix of OPS$ may authenticate either with a password or with OS authentication. Use of more than one authentication method to access a single account results in a loss of accountability, that is, it is similar to a shared account. Setting this parameter to a value other than OPS$ prevents a shared usage of a single account.

Solution

Specify an operating system authenticated username prefix other than OPS$.

From SQL*Plus:

 alter system set os_authent_prefix = [prefix value] scope = spfile;

Compliant selections for [prefix value] are:
 a null string ('')
 a text value other than 'OPS$'

The above SQL*Plus command will set the parameter to take effect at next system startup.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

Item Details

References: CAT|III, Rule-ID|SV-24902r2_rule, STIG-ID|DO3447-ORACLE11, Vuln-ID|V-2531

Plugin: OracleDB

Control ID: 1f0a5cb50990b19093e9c6149c15f9b3e498148baede254fcd47f72080e4b7f7