O19C-00-018700 - Oracle Database must disable accounts when the accounts have expired.

Information

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality, which reduce the attack surface of the system.

Solution

Configure the DBMS to disable accounts when the accounts have expired.

The user profile, ORA_STIG_PROFILE, has been provided to satisfy the STIG requirements pertaining to the profile parameters. Oracle recommends that this profile be customized with any site-specific requirements and assigned to all users where applicable. Note: It remains necessary to create a customized replacement for the password validation function, ORA12C_STRONG_VERIFY_FUNCTION, if relying on this technique to verify password complexity.

The defaults for ORA_STIG_PROFILE are set as follows:
Resource Name Limit
------------- ------
COMPOSITE_LIMIT DEFAULT
SESSIONS_PER_USER DEFAULT
CPU_PER_SESSION DEFAULT
CPU_PER_CALL DEFAULT
LOGICAL_READS_PER_SESSION DEFAULT
LOGICAL_READS_PER_CALL DEFAULT
IDLE_TIME 15
CONNECT_TIME DEFAULT
PRIVATE_SGA DEFAULT
FAILED_LOGIN_ATTEMPTS 3
PASSWORD_LIFE_TIME 60
PASSWORD_REUSE_TIME 365
PASSWORD_REUSE_MAX 10
PASSWORD_VERIFY_FUNCTION ORA12C_STRONG_VERIFY_FUNCTION
PASSWORD_LOCK_TIME UNLIMITED
PASSWORD_GRACE_TIME 5

Change the value of PASSWORD_LIFE_TIME (along with the other parameters, where relevant) from UNLIMITED to 60 and then assign users to the profile.
ALTER PROFILE ORA_STIG_PROFILE LIMIT PASSWORD_LIFE_TIME 60;

To assign the user to the profile do the following:
ALTER USER <username> PROFILE ORA_STIG_PROFILE;

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_19c_V1R1_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(3), CAT|II, CCI|CCI-003627, Rule-ID|SV-270586r1065036_rule, STIG-ID|O19C-00-018700, Vuln-ID|V-270586

Plugin: OracleDB

Control ID: 4ec9eeadb775407d544bb0b1f6c87855f4791f91689b7c331fe6429a26d3b08f