Document TypeㅣTechnical Information
CategoryㅣSecurity
Applicable Product VersionsㅣTibero6, Tibero7
Document NumberㅣTSETI019
Overview
| Category | Check Item | Importance | Code |
|---|---|---|---|
| Option Management | Adjust so that the Role of application program or DBA accounts is not set to Public | High | D-08 |
| Set OS ROLES, REMOTE_OS_AUTHENTICATION, REMOTE_OS_ROLES to FALSE | High | D-09 | |
| Password verification function is set and applied | Medium | D-19 | |
| Restriction of unauthorized Object Owners | Low | D-20 | |
| Restriction on unauthorized use of GRANT OPTION | Medium | D-21 | |
| Set database resource limit function to TRUE | Low | D-22 |
This document describes the security vulnerability mitigation measures for the "Option Management - Password Verification Function is Set and Applied (D-19)" item.
Inspection Content and Purpose
- Check whether the PASSWORD_VERIFY_FUNCTION value that verifies password complexity is set.
- By setting the PASSWORD_VERIFY_FUNCTION value, basic password policies are applied to strengthen security for login and enhance the stability of stored data.
Inspection Criteria
| Criteria | Description |
|---|---|
| Good | When password verification function is used for validation |
| Vulnerable | When password verification function is not set |
Precautions Before Action
Check Basic Account List
The default accounts created during Tibero installation are as follows. Depending on the DB version, additional or removed accounts may exist.
| Account Name | Password | Remarks |
| SYS | tibero | Account cannot be deleted DBA privileges required |
| SYSCAT | syscat | Account cannot be deleted |
| SYSGIS | sysgis | Account cannot be deleted |
| OUTLN | outln | Account cannot be deleted |
| TIBERO | tmax | Account can be deleted |
| TIBERO1 | tmax | Account can be deleted Does not exist from version T7 and above |
| SYSBACKUP | tibero | Account cannot be deleted Exists in some versions of T6FS07 (patch 301647 available) and from T7 and above |
| LBACSYS | lbacsys | Account cannot be deleted Exists from T7 and above |
Check Connected Systems
It is necessary to check the DB accounts used in connected systems in advance.
Password Verification Functions
These are functions related to password verification. There are VERIFY_FUNCTION, VERIFY_FUNCTION2, and NULL_VERIFY_FUNCTION for password verification. VERIFY_FUNCTION2 can be used if a specific patch is applied, so please refer to this.
| Type | Description | ||||||||
| PASSWORD_VERIFY_FUNCTION | Specifies the function that checks the validity of the password string when changing the password By default, the NULL_VERIFY_FUNCTION is applied
|
Method
Setting
- Check profile before operation
set lines 400 col profile for a20 col resource_name for a30 col resource_type for a20 col limit for a40 select * from dba_profiles where RESOURCE_TYPE = 'PASSWORD'; PROFILE RESOURCE_NAME RESOURCE_TYPE LIMIT -------------------- ------------------------------ -------------------- ---------------------------------------- DEFAULT FAILED_LOGIN_ATTEMPTS PASSWORD UNLIMITED DEFAULT PASSWORD_LIFE_TIME PASSWORD UNLIMITED DEFAULT PASSWORD_REUSE_TIME PASSWORD UNLIMITED DEFAULT PASSWORD_REUSE_MAX PASSWORD UNLIMITED DEFAULT PASSWORD_VERIFY_FUNCTION PASSWORD NULL_VERIFY_FUNCTION DEFAULT PASSWORD_LOCK_TIME PASSWORD 1 DEFAULT PASSWORD_GRACE_TIME PASSWORD 0 DEFAULT LOGIN_PERIOD PASSWORD UNLIMITED
- Modify PASSWORD_VERIFY_FUNCTION value
ALTER PROFILE [PROFILE NAME] LIMIT [RESOURCE NAME] [SETTING VALUE]; ex) ALTER PROFILE DEFAULT LIMIT PASSWORD_VERIFY_FUNCTION VERIFY_FUNCTION;
- Check profile after operation
set lines 400 col profile for a20 col resource_name for a30 col resource_type for a20 col limit for a40 select * from dba_profiles where RESOURCE_TYPE = 'PASSWORD'; PROFILE RESOURCE_NAME RESOURCE_TYPE LIMIT -------------------- ------------------------------ -------------------- ---------------------------------------- DEFAULT FAILED_LOGIN_ATTEMPTS PASSWORD UNLIMITED DEFAULT PASSWORD_LIFE_TIME PASSWORD UNLIMITED DEFAULT PASSWORD_REUSE_TIME PASSWORD UNLIMITED DEFAULT PASSWORD_REUSE_MAX PASSWORD UNLIMITED DEFAULT PASSWORD_VERIFY_FUNCTION PASSWORD VERIFY_FUNCTION DEFAULT PASSWORD_LOCK_TIME PASSWORD 1 DEFAULT PASSWORD_GRACE_TIME PASSWORD 0 DEFAULT LOGIN_PERIOD PASSWORD UNLIMITED
Revert
- Revert profile
ALTER PROFILE [PROFILE NAME] LIMIT [RESOURCE NAME] [SETTING VALUE]; ex) ALTER PROFILE DEFAULT LIMIT PASSWORD_VERIFY_FUNCTION NULL_VERIFY_FUNCTION;