Oracle FAQ Your Portal to the Oracle Knowledge Grid

Home -> Community -> Usenet -> c.d.o.server -> Re: Project lockdown - opinion solicitation

Re: Project lockdown - opinion solicitation

From: hpuxrac <>
Date: Mon, 27 Aug 2007 15:04:08 -0700
Message-ID: <>

On Aug 27, 8:41 am, EdStevens <> wrote:
> On Aug 26, 1:01 pm, hpuxrac <> wrote:
> > On Aug 24, 1:31 pm, EdStevens <> wrote:
> > > On advice last week, I have downloaded the "Project Lockdown" document
> > > and begun reviewing it. I get a very uneasy feeling about his
> > > suggestion to remove the SUID bit from the Oracle executables.
> > > Searching through this ng I find a lot of issues stemming from not
> > > leaving the file permissions just as they are created when following
> > > installation instructions to the letter.
> > > It seems to me this could cause a lot of nagging problems. It also
> > > seems that if your ORACLE_HOME is on a box where issuance of os user
> > > accounts is limited to DBAs and SAs the ability to exploit the SUID
> > > would be extremely limited.
> > > Am I missing something?
> > Never heard of project lockdown.
> > The SUID bit really mostly comes into play for oracle client type
> > installs.
> > It's not a bad idea at all to have multiple oracle installs on a given
> > server and have the oracle server software not to be used at all by
> > people needing client functionality.
> > Talk to your auditors and request an audit of the oracle environment.
> > Let them give some guidance and flavor those recommendations with your
> > oracle expertise.
> > Rinse and repeat.
> This document (from Oracle , BTW) goes far beyond our written secruity
> requirements. I really don't have access to our auditors (they are
> very much higher in the organization and only come for a site visit
> every few years. I've never met an auditor in any organization who
> understood the first thing about Oracle. They all 'manage by magazine
> article.'-

Any attempts that are made to work on improving the database security area without the involvement of IT management and the auditors are questionable to me. If you work at a public company and the auditors aren't involved with the database area that seems very strange.

I took a brief look at the "Project Lockdown" day 1 activities. Very quickly you see this item ...

The content provided here is for instructional purposes only and is not validated by Oracle; use it at your own risk! Under no circumstances should you consider it to be part of a consulting or services offering.

So it's not an oracle project by any means.

There are certainly some good and valid points but anything in this area must be approached carefully.

What is the impact for example on the throughput of batch jobs if they can't make bequeath connections? Wonder if Cary Millsap ever had anything written up in this area ( kidding of course look at his first case study in Chapter 12 ). Are there other potential problems? Hmmm. Should all the batch jobs be owned by oracle or the dba or oinstall groups? Does that cause other issues like the ability to change data files being used for batch processing that are going in and back to oracle? Hmmm.

That's just some of my thoughts on the question regarding the SUID bit recommendations. Arup did a credible job writing up what he did but there are other things that fall out from any set of recommendations.

Whatever anyone does with a strategy in this area make sure it is carefully and completely exercised on low impact test systems.

Perhaps one thing that everything should at least consider is asking your management if "we" could bring in oracle consulting for security related work. Received on Mon Aug 27 2007 - 17:04:08 CDT

Original text of this message