LSNR_DIRECT_ADMIN_NAMEPOLICYListener Direct Administration LSNR_DIRECT_ADMIN_DESCPOLICYEnsures that no runtime modifications to the listener configuration is allowed LSNR_DIRECT_ADMIN_IMPACTPOLICYAn attacker who has access to a running listener can perform runtime modifications (for example, SET operations) using the lsnrctl program. LSNR_DIRECT_ADMIN_RECOMMPOLICYAll listeners must have direct administration disabled. Set ADMIN_RESTRICTIONS_listener_name to ON in listener.ora. LSNR_HOST_NAME_NAMEPOLICYUse of Hostname in Listener.ora LSNR_HOST_NAME_DESCPOLICYEnsures that the listener host is specified as IP address and not hostname in the listener.ora LSNR_HOST_NAME_IMPACTPOLICYAn insecure Domain Name System (DNS) Server can be taken advantage of for mounting a spoofing attack. Name server failure can result in the listener unable to resolved the host. LSNR_HOST_NAME_RECOMMPOLICYHost should be specified as IP address in listener.ora. LSNR_LOG_FILE_OWN_NAMEPOLICYListener Logfile Owner LSNR_LOG_FILE_OWN_DESCPOLICYEnsures that the listener log file is owned by the Oracle software owner LSNR_LOG_FILE_OWN_IMPACTPOLICYThe information in the logfile can reveal important network and database connection details. Having a log file not owned by the Oracle software owner can expose them to public scrutiny with possible security implications. LSNR_LOG_FILE_OWN_RECOMMPOLICYThe listener logfile must be owned by Oracle software owner. ALLOWED_LOGON_VERSION_NAMEPOLICYAllowed Logon Version ALLOWED_LOGON_VERSION_DESCPOLICYEnsures that the server allows logon from clients with a matching version or higher only ALLOWED_LOGON_VERSION_IMPACTPOLICYSetting the parameter SQLNET.ALLOWED_LOGON_VERSION in sqlnet.ora to a version lower than the server version will force the server to use a less secure authentication protocol. ALLOWED_LOGON_VERSION_RECOMPOLICYSet the parameter SQLNET.ALLOWED_LOGON_VERSION in sqlnet.ora to the server's major version. Setting this value to older versions could expose vulnerabilities that may have existed in the authentication protocols. CLIENT_LOG_DIR_PERM_NAMEPOLICYOracle Net Client Log Directory Permission CLIENT_LOG_DIR_PERM_NAME_NTPOLICYOracle Net Client Log Directory Permission (Windows) CLIENT_LOG_DIR_PERM_DESCPOLICYEnsures that the client log directory is a valid directory owned by Oracle set with no permissions to public CLIENT_LOG_DIR_PERM_IMPACTPOLICYLog files provide information contained in an error stack. An error stack refers to the information that is produced by each layer in an Oracle communications stack as the result of a network error. The information in log files can reveal important network and database connection details. Allowing access to the log directory can expose the log files to public scrutiny. CLIENT_LOG_DIR_PERM_RECOMMPOLICYThe client log directory must be a valid directory owned by the Oracle set with no permissions to public. CLIENT_LOG_DIR_OWN_NAMEPOLICYOracle Net Client Log Directory Owner CLIENT_LOG_DIR_OWN_DESCPOLICYEnsures that the client log directory is a valid directory owned by Oracle set CLIENT_LOG_DIR_OWN_IMPACTPOLICYLog files provide information contained in an error stack. An error stack refers to the information that is produced by each layer in an Oracle communications stack as the result of a network error. The information in log files can reveal important network and database connection details. Allowing access to the log directory can expose the log files to public scrutiny. CLIENT_LOG_DIR_OWN_RECOMMPOLICYThe client log directory must be a valid directory owned by the Oracle set. SERV_LOG_DIR_PERM_NAMEPOLICYOracle Net Server Log Directory Permission SERV_LOG_DIR_PERM_NAME_NTPOLICYOracle Net Server Log Directory Permission (Windows) SERV_LOG_DIR_PERM_DESCPOLICYEnsures that the server log directory is a valid directory owned by Oracle set with no permissions to public SERV_LOG_DIR_PERM_IMPACTPOLICYLog files provide information contained in an error stack. An error stack refers to the information that is produced by each layer in an Oracle communications stack as the result of a network error. The information in log files can reveal important network and database connection details. Allowing access to the log directory can expose the log files to public scrutiny. SERV_LOG_DIR_PERM_RECOMMPOLICYThe server log directory must be a valid directory owned by the Oracle set with no permissions to public. SERV_LOG_DIR_OWN_NAMEPOLICYOracle Net Server Log Directory Owner SERV_LOG_DIR_OWN_DESCPOLICYEnsures that the server log directory is a valid directory owned by Oracle set SERV_LOG_DIR_OWN_IMPACTPOLICYLog files provide information contained in an error stack. An error stack refers to the information that is produced by each layer in an Oracle communications stack as the result of a network error. The information in log files can reveal important network and database connection details. Allowing access to the log directory can expose the log files to public scrutiny. SERV_LOG_DIR_OWN_RECOMMPOLICYThe server log directory must be a valid directory owned by the Oracle set. CLIENT_TRC_DIR_PERM_NAMEPOLICYOracle Net Client Trace Directory Permission CLIENT_TRC_DIR_PERM_NAME_NTPOLICYOracle Net Client Trace Directory Permission (Windows) CLIENT_TRC_DIR_PERM_DESCPOLICYEnsures that the client trace directory is a valid directory owned by Oracle set with no permissions to public CLIENT_TRC_DIR_PERM_IMPACTPOLICYTracing produces a detailed sequence of statements that describe network events as they are executed. Tracing an operation enables you to obtain more information on the internal operations of the components of Oracle Net Services than is provided in a log file. The information in this file can reveal important network and database connection details. Allowing access to the log directory can expose the log files to public scrutiny. CLIENT_TRC_DIR_PERM_RECOMMPOLICYThe client trace directory must be a valid directory owned by the Oracle set with no permissions to public. CLIENT_TRC_DIR_OWN_NAMEPOLICYOracle Net Client Trace Directory Owner CLIENT_TRC_DIR_OWN_DESCPOLICYEnsures that the client trace directory is a valid directory owned by Oracle set CLIENT_TRC_DIR_OWN_IMPACTPOLICYTracing produces a detailed sequence of statements that describe network events as they are executed. Tracing an operation enables you to obtain more information on the internal operations of the components of Oracle Net Services than is provided in a log file. The information in this file can reveal important network and database connection details. Allowing access to the log directory can expose the log files to public scrutiny. CLIENT_TRC_DIR_OWN_RECOMMPOLICYThe client trace directory must be a valid directory owned by the Oracle set. SERV_TRC_DIR_PERM_NAMEPOLICYOracle Net Server Trace Directory Permission SERV_TRC_DIR_PERM_NAME_NTPOLICYOracle Net Server Trace Directory Permission (Windows) SERV_TRC_DIR_PERM_DESCPOLICYEnsures that the server trace directory is a valid directory owned by Oracle set with no permissions to public SERV_TRC_DIR_PERM_IMPACTPOLICYTracing produces a detailed sequence of statements that describe network events as they are executed. Tracing an operation enables you to obtain more information on the internal operations of the components of Oracle Net Services than is provided in a log file. The information in this file can reveal important network and database connection details. Allowing access to the log directory can expose the log files to public scrutiny. SERV_TRC_DIR_PERM_RECOMMPOLICYThe server trace directory must be a valid directory owned by the Oracle set with no permissions to public. SERV_TRC_DIR_OWN_NAMEPOLICYOracle Net Server Trace Directory Owner SERV_TRC_DIR_OWN_DESCPOLICYEnsures that the server trace directory is a valid directory owned by Oracle set SERV_TRC_DIR_OWN_IMPACTPOLICYTracing produces a detailed sequence of statements that describe network events as they are executed. Tracing an operation enables you to obtain more information on the internal operations of the components of Oracle Net Services than is provided in a log file. The information in this file can reveal important network and database connection details. Allowing access to the log directory can expose the log files to public scrutiny. SERV_TRC_DIR_OWN_RECOMMPOLICYThe server trace directory must be a valid directory owned by the Oracle set. SQLNET_PERM_NAMEPOLICYRestrict Sqlnet.ora Permission SQLNET_PERM_NAME_NTPOLICYRestrict Sqlnet.ora Permission (Windows) SQLNET_PERM_DESCPOLICYEnsures that the sqlnet.ora file is not accessible to public SQLNET_PERM_IMPACTPOLICYIf sqlnet.ora is public readable a malicious user may attempt to read this hence could lead to sensitive information getting exposed .For example, log and trace destination information of the client and server. SQLNET_PERM_RECOMMPOLICYPublic should not be given any permissions on the sqlnet.ora file. LSNR_LOG_FILE_PERM_NAMEPOLICYListener Logfile Permission LSNR_LOG_FILE_PERM_NAME_NTPOLICYListener Logfile Permission (Windows) LSNR_LOG_FILE_PERM_DESCPOLICYEnsures that the listener logfile cannot be read by or written to by public LSNR_LOG_FILE_PERM_IMPACTPOLICYThe information in the logfile can reveal important network and database connection details. Allowing access to the log file can expose them to public scrutiny with possible security implications. LSNR_LOG_FILE_PERM_RECOMMPOLICYThe listener logfile must not allow public to read/write to it. Restrict the file permission to Oracle software owner and DBA group. LSNR_TRACE_DIR_PERM_NAMEPOLICYListener Trace Directory Permission LSNR_TRACE_DIR_PERM_NAME_NTPOLICYListener Trace Directory Permission (Windows) LSNR_TRACE_DIR_PERM_DESCPOLICYEnsures that the listener trace directory does not have public read/write permissions LSNR_TRACE_DIR_PERM_IMPACTPOLICYAllowing access to the trace directory can expose them to public scrutiny with possible security implications. LSNR_TRACE_DIR_PERM_RECOMMPOLICYThe listener trace directory must not allow public to read/write to it. Restrict the directory permission to Oracle software owner and DBA group. LSNR_TRACE_DIR_OWN_NAMEPOLICYListener Trace Directory Owner LSNR_TRACE_DIR_OWN_DESCPOLICYEnsures that the listener trace directory is a valid directory owned by Oracle software owner LSNR_TRACE_DIR_OWN_IMPACTPOLICYHaving a trace directory not owned by the Oracle software owner can expose the trace files to public scrutiny with possible security implications. LSNR_TRACE_DIR_OWN_RECOMMPOLICYThe listener trace directory must be owned by the Oracle software owner. LSNR_TRACE_FILE_OWN_NAMEPOLICYListener Trace File Owner LSNR_TRACE_FILE_OWN_DESCPOLICYEnsures that the listener trace directory is a valid directory owned by Oracle software owner LSNR_TRACE_FILE_OWN_IMPACTPOLICYHaving a trace directory not owned by the Oracle software owner can expose the trace files to public scrutiny with possible security implications. LSNR_TRACE_FILE_OWN_RECOMMPOLICYThe listener trace directory must be owned by the Oracle software owner. LSNR_TRACE_FILE_PERM_NAMEPOLICYListener Trace File Permission LSNR_TRACE_FILE_PERM_NAME_NTPOLICYListener Trace File Permission (Windows) LSNR_TRACE_FILE_PERM_DESCPOLICYEnsures that the listener trace file is not accessible to public LSNR_TRACE_FILE_PERM_IMPACTPOLICYAllowing access to the trace files can expose them to public scrutiny with possible security implications. LSNR_TRACE_FILE_PERM_RECOMMPOLICYThe listener trace file must not allow public to read/write to it. Restrict the file permission to Oracle software owner and DBA group. LSNR_PASSWD_NAMEPOLICYListener Password LSNR_PASSWD_DESCPOLICYEnsures that access to listener is password protected LSNR_PASSWD_IMPACTPOLICYWithout password protection, a user can gain access to the listener. Once someone has access to the listener, he/she can stop the listener. He/she can also set a password and prevent others from managing the listener. LSNR_PASSWD_RECOMMPOLICYAll listeners should be protected by a non-trivial password using the CHANGE_PASSWORD command. LSNR_LOG_STATUS_NAMEPOLICYListener Logging Status LSNR_LOG_STATUS_DESCPOLICYEnsures that listener logging is enabled. LSNR_LOG_STATUS_IMPACTPOLICYWithout listener logging attacks on the listener can go unnoticed. LSNR_LOG_STATUS_RECOMMPOLICYEnable listener logging by setting the LOG_STATUS parameter to ON. LSNR_DFLT_NAME_NAMEPOLICYListener Default Name LSNR_DFLT_NAME_DESCPOLICYEnsures that the default name of the listener is not used LSNR_DFLT_NAME_IMPACTPOLICYHaving a listener with the default name increases the risk of unauthorized access and denial of service attacks. LSNR_DFLT_NAME_RECOMPOLICYAvoid having a listener with the default name (LISTENER). LSNR_ORA_PERM_NAMEPOLICYListener.ora Permission LSNR_ORA_PERM_NAME_NTPOLICYListener.ora Permission (Windows) LSNR_ORA_PERM_DESCPOLICYEnsures that the file permissions for listener.ora are restricted to the owner of Oracle software LSNR_ORA_PERM_IMPACTPOLICYIf the listener.ora file is public readable, passwords may be extracted from this file. This can also lead to exposure of detailed information on the Listener, database, and application configuration. Also, if public has write permissions, a malicious user can remove any password that has been set on the listener. LSNR_ORA_PERM_RECOMMPOLICYListener.ora permissions should be restricted to the owner of Oracle software installation and DBA group. Sqlnetora_Inbound_Connect_Timeout_NAMEPOLICYOracle Net Inbound Connect Timeout Sqlnetora_Inbound_Connect_Timeout_IMPACTPOLICYWithout this parameter or assigning it with a higher value , a client connection to the database server can stay open indefinitely or for the specified duration without authentication. Connections without authentication can introduce possible denial-of-service attacks, whereby malicious clients attempt to flood database servers with connect requests that consume resources. Sqlnetora_Inbound_Connect_Timeout_DESCPOLICYEnsures that all incomplete inbound connections to Oracle Net has a limited lifetime Sqlnetora_Inbound_Connect_Timeout_RECOMMPOLICYSet the lowest possible value for the SQLNET.INBOUND_CONNECT_TIMEOUT parameter in sqlnet.ora. Ensure that the value of this parameter is higher than the value of INBOUND_CONNECT_TIMEOUT_listener_name parameter in the listener.ora file. Lsnrora_Inbound_Connect_Timeout_NAMEPOLICYListener Inbound Connect Timeout Lsnrora_Inbound_Connect_Timeout_IMPACTPOLICYThis limit protects the listener from consuming and holding resources for client connection requests that do not complete. A malicious user could use this to flood the listener with requests that result in a denial of service to authorized users. Lsnrora_Inbound_Connect_Timeout_DESCPOLICYEnsures that all incomplete inbound connections to Oracle Listener has a limited lifetime Lsnrora_Inbound_Connect_Timeout_RECOMMPOLICYSet the lowest possible value for the INBOUND_CONNECT_TIMEOUT_listener_name parameter in listener.ora. Ensure that the value of this parameter is lower than the value of SQLNET.INBOUND_CONNECT_TIMEOUT parameter in the sqlnet.ora file. Ssl_Server_DN_Match_NAMEPOLICYOracle Net SSL_SERVER_DN_MATCH Ssl_Server_DN_Match_IMPACTPOLICYIf ssl_server_dn_match parameter is disabled, then SSL performs the check but allows the connection, regardless if there is a match. Not enforcing the match allows the server to potentially fake its identity. Ssl_Server_DN_Match_DESCPOLICYEnsures ssl_server_dn_match is enabled in sqlnet.ora and in turn SSL ensures that the certificate is from the server Ssl_Server_DN_Match_RECOMMPOLICYEnable ssl_server_dn_match parameter in the sqlnet.ora file.