Oracle Apps DBA stuff: Secure Configuration Guide for Oracle E-Business Suite 11i

Secure Configuration Guide for Oracle E-Business Suite 11i [ID 189367.1]

		Modified 02-OCT-2011 Type WHITE PAPER Status PUBLISHED

Secure Configuration Guide for Oracle E-Business Suite 11i

This document provides practical advice for secure configuration of the Oracle E-Business Suite 11i.

Secure Configuration Guide for Oracle E-Business Suite 11i. Version 3.1.0 (PDF)

The document contains the following sections:

Overview
- Keep software up to date
- Restrict network access to critical services
- Follow the principle of least privilege
- Monitor system activity
- Keep up to date on latest security information
Oracle TNS Listener Security
- Harden operating environment
- Add IP restrictions or enable Valid Node Checking
- Specify connection timeout
- Enable encryption of network traffic
- Potentially Enable TNS Listener password
- Enable admin restrictions
- Enable TNS Listener logging
Oracle Database Security
- Harden operating environment
- Disable XDB
- Review database links
- Remove operating system trusted remote logon
- Implement two profiles for password management
- Change default installation passwords
- Restrict access to SQL trace files
- Remove operating system trusted remote roles
- Limit file system access within PL/SQL
- Limit dictionary access
- Revoke unnecessary grants to APPLSYSPUB
- Configure the database for auditing
- Audit database connections
- Audit database schema changes
- Audit other activities
- Audit administrators and their actions
- Review audit records
- Maintain audit records
- Secure audit records
Oracle Application Tier Security
- Harden operating environment
- Harden Apache configuration
- Configure modplsql
- Remove unneeded DAD configurations
- Enable modplsql custom authorization
- Restrict modplsql web administration
- Restrict Web accessibility of plsql Procedures
- Configure logging
Oracle E-Business Suite Security
- Harden operating environment
- Strike passwords from adpatch logs
- Set Workflow notification mailer SEND_ACCESS_KEY to N
- Set Tools environment variables
- Use SSL (HTTPS) between browser and web server
- Use External Webtier if exposing any part of EBS to the internet
- Use Terminal Services for client-server programs
- Change passwords for seeded application user accounts
- Tighten logon and session profile options
- Create new user accounts safely
- Create shared responsibilities instead of shared accounts
- Configure Concurrent Manager for safe authentication
- Activate Server Security
- Create DBC Files
- Review and limit Responsibilities and Permissions
- Set other security related profile options
- Restrict responsibilities by web server trust level
- Set Sign-On audit level
- Monitor system activity with OAM
- Retrieve audit records using Reports
- Retrieve audit records using SQL
- Purge audit records
- Review data tracked (no Reports available)
- Configuring audit trail
- Generate and identify audit trail objects
- Choose tables to audit
- Retrieve audit records using SQL
- Purge audit records
- References on E-Business Suite auditing
Desktop Security
- Configure browser
- Update browser
- Turn off AutoComplete
- Set policy for unattended PC sessions
Operating Environment Security
- Cleanup file ownership and access
- Cleanup file permissions
- Lockdown operating system libraries and programs
- Filter IP packets
- Prevent spoofing
- Eliminate telnet, FTP and R-Service Daemons
- Verify network configuration
- Monitor for attacks
- Configure accounts securely
- Limit root access
- Manage user accounts
- Secure NFS
- Secure operating system Devices
- Use Only Secure executables
- Secure file access
Extras for Experts
- Detect and Prevent Duplicate User Sessions
- Customize Password Validation
- Encrypt Credit Cards
- Advanced Security Option/Networking Option (ASO/ANO)
- Advanced Security Option/Transparent Data Encryption (ASO/TDE)
- Practice Safe Cloning
- Hardening External Procedure (EXTPROC) Services
Appendix A: Running Web Scanning Tools
Appendix B: Sensitive Administrative Pages
Appendix C: Database Schemas found in Oracle E-Business Suite
Appendix D: Processes used by Oracle E-Business Suite
Appendix E: Ports used by Oracle E-Business Suite
Appendix F: Sample Linux Hardening of the Application Tier
Appendix G: References & More Resources