O121-BP-022000 - The Oracle REMOTE_OS_ROLES parameter must be set to FALSE.


Setting REMOTE_OS_ROLES to TRUE allows operating system groups to control Oracle roles. The default value of FALSE causes roles to be identified and managed by the database. If REMOTE_OS_ROLES is set to TRUE, a remote user could impersonate another operating system user over a network connection.


Document remote OS roles in the System Security Plan.

If not required, disable use of remote OS roles.

From SQL*Plus:

alter system set remote_os_roles = FALSE scope = spfile;

The above SQL*Plus command will set the parameter to take effect at next system startup.

See Also


Item Details


References: 800-53|CM-6b., CAT|I, CCI|CCI-000366, Rule-ID|SV-219831r903017_rule, STIG-ID|O121-BP-022000, STIG-Legacy|SV-75917, STIG-Legacy|V-61427, Vuln-ID|V-219831

Plugin: OracleDB

Control ID: c5e3abda0927871cbb40671820bc7f42b9b552c292bc05678e22a4e1faee7202