Detections
Analytics

OH12-1X-000020 - OHS must have the OraLogMode set to Oracle Diagnostic Logging text mode to generate information to be used by external applications or entities to monitor and control remote access.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Remote access to the web server is any access that communicates through an external, non-organization-controlled network. Remote access can be used to access hosted applications or to perform management functions.

By providing remote access information to an external monitoring system, the organization can monitor for cyber attacks and monitor compliance with remote access policies. The organization can also look at data organization wide and determine an attack or anomaly is occurring on the organization which might not be noticed if the data were kept local to the web server.

Examples of external applications used to monitor or control access would be audit log monitoring systems, dynamic firewalls, or infrastructure monitoring systems.

Solution

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/httpd.conf with an editor.

2. Search for the 'OraLogMode' directive at the OHS server configuration scope.

3. Set the 'OraLogMode' directive to 'odl-text', add the directive if it does not exist.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_HTTP_Server_12-1-3_V2R1_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000067, Rule-ID|SV-221290r414555_rule, STIG-ID|OH12-1X-000020, STIG-Legacy|SV-78649, STIG-Legacy|V-64159, Vuln-ID|V-221290

Plugin: Unix

Control ID: 0ccfb76573dfa1a93c078714e066a4e209581128ff28838d55bbd0bf14ef8baf