DB / Oracle / 安装部署

Oracle 安全配置最佳实践

2026.09.06

Oracle 安全配置最佳实践

适用版本：Oracle Database 10g / 11g / 12c / 19c / 23ai 文档版本：v1.0 / 2026-07

1. 概述

Oracle 安全配置是数据库防护基础[1]：

详细见：Oracle 安全深度解析。

2. 最小权限

2.1 原则

- 最小权限
- 任务分离
- 默认账户

2.2 角色

-- 创建角色
CREATE ROLE app_read;
CREATE ROLE app_write;

-- 权限
GRANT SELECT ON employees TO app_read;
GRANT INSERT, UPDATE, DELETE ON employees TO app_write;

-- 用户
CREATE USER app_user IDENTIFIED BY ******
GRANT app_read TO app_user;

2.3 系统权限

-- 避免
GRANT DBA TO app_user;
GRANT ALL PRIVILEGES TO app_user;

-- 推荐
GRANT CREATE SESSION TO app_user;
GRANT CREATE TABLE TO app_user;

3. 账户管理

3.1 默认账户

-- 锁定
ALTER USER scott ACCOUNT LOCK;
ALTER USER outln ACCOUNT LOCK;

-- 修改密码
ALTER USER sys IDENTIFIED BY ******
ALTER USER system IDENTIFIED BY ******

3.2 Profile

CREATE PROFILE secure_profile LIMIT
  FAILED_LOGIN_ATTEMPTS 5
  PASSWORD_LIFE_TIME 90
  PASSWORD_REUSE_TIME 365
  PASSWORD_REUSE_MAX 5
  PASSWORD_LOCK_TIME 1
  PASSWORD_GRACE_TIME 7
  PASSWORD_VERIFY_FUNCTION ora12cv_strong_verify_function
  SESSIONS_PER_USER 10
  CPU_PER_SESSION 10000
  PRIVATE_SGA 1024K;

ALTER USER app_user PROFILE secure_profile;

3.3 密码函数

-- 12c+ 内置
ora12cv_strong_verify_function

-- 自定义
CREATE OR REPLACE FUNCTION my_verify (
  username VARCHAR2, password VARCHAR2, old_password VARCHAR2
) RETURN BOOLEAN IS
BEGIN
  IF LENGTH(password) < 12 THEN
    RETURN FALSE;
  END IF;
  -- 其他规则
  RETURN TRUE;
END;
/

ALTER PROFILE default LIMIT PASSWORD_VERIFY_FUNCTION my_verify;

4. 网络

4.1 IP 白名单

# sqlnet.ora
TCP.INVITED_NODES = (192.168.1.0/24)
TCP.EXCLUDED_NODES = (192.168.3.0/24)
TCP.VALIDNODE_CHECKING = yes

4.2 加密

# sqlnet.ora
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.ENCRYPTION_CLIENT = REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192)
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256)

详细见：Oracle 网络加密详解。

4.3 SSL/TLS

# listener.ora
LISTENER_SSL = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCPS)(HOST = oradb)(PORT = 1522)))

# sqlnet.ora
WALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY=/u01/wallet)))
SSL_CLIENT_AUTHENTICATION = TRUE
SSL_VERSION = 1.2

4.4 超时

SQLNET.INBOUND_CONNECT_TIMEOUT = 60
SQLNET.OUTBOUND_CONNECT_TIMEOUT = 60
SQLNET.EXPIRE_TIME = 10

5. TDE

5.1 Wallet

mkdir -p ******
chown oracle:oinstall /u01/wallet
ALTER SYSTEM SET wallet_root = '/u01/wallet' SCOPE=SPFILE;
ALTER SYSTEM SET tde_configuration = 'KEYSTORE_CONFIG=FILE' SCOPE=SPFILE;
SHUTDOWN IMMEDIATE;
STARTUP;

5.2 Keystore

ADMINISTER KEY MANAGEMENT CREATE KEYSTORE '/u01/wallet/tde' IDENTIFIED BY ******
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY ******
ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY ****** WITH BACKUP;

5.3 加密列

ALTER TABLE employees MODIFY (salary ENCRYPT);
ALTER TABLE employees ADD (credit_card VARCHAR2(50) ENCRYPT);

5.4 加密表空间

CREATE TABLESPACE secure_ts DATAFILE '/u01/oradata/secure01.dbf' SIZE 1G ENCRYPTION USING 'AES256' DEFAULT STORAGE (ENCRYPT);

详细见：Oracle 安全深度解析。

6. 审计

6.1 Unified Audit（12c+）

-- 启用
EXEC DBMS_AUDIT_MGMT.ENABLE_UNIFIED_AUDIT;

-- 验证
SELECT value FROM v$option WHERE parameter = 'Unified Auditing';

6.2 审计策略

-- 登录
AUDIT SESSION;

-- DDL
AUDIT TABLE BY scott;

-- DML
AUDIT INSERT, UPDATE, DELETE ON scott.employees BY ACCESS;

-- 系统权限
AUDIT SELECT ANY TABLE BY ACCESS;

6.3 查看

SELECT event_timestamp, db_user, action_name, object_name 
FROM unified_audit_trail 
ORDER BY event_timestamp DESC FETCH FIRST 10 ROWS ONLY;

6.4 维护

EXEC DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED, LAST_ARCHIVE_TIME => SYSTIMESTAMP - 30);

EXEC DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED, USE_LAST_ARCH_TIMESTAMP => TRUE);

7. VPD

7.1 策略

BEGIN
  DBMS_RLS.ADD_POLICY(
    object_schema => 'scott',
    object_name => 'employees',
    policy_name => 'emp_policy',
    function_schema => 'sys',
    policy_function => 'emp_sec_func',
    statement_types => 'select, insert, update, delete'
  );
END;
/

CREATE OR REPLACE FUNCTION emp_sec_func (
  schema_var VARCHAR2, table_var VARCHAR2
) RETURN VARCHAR2 IS
  v_user VARCHAR2(30);
BEGIN
  SELECT username INTO v_user FROM user_users;
  IF v_user LIKE 'HR_%' THEN
    RETURN 'dept_id = 10';
  ELSE
    RETURN '1=1';
  END IF;
END;
/

详细见：Oracle 安全深度解析。

8. Data Redaction

8.1 策略

BEGIN
  DBMS_REDACT.ADD_POLICY(
    object_schema => 'scott',
    object_name => 'employees',
    policy_name => 'redact_ssn',
    expression => '1=1',
    action => DBMS_REDACT.FULL,
    column_name => 'ssn',
    function_type => DBMS_REDACT.FULL
  );
END;
/

BEGIN
  DBMS_REDACT.ALTER_POLICY(
    object_schema => 'scott',
    object_name => 'employees',
    policy_name => 'redact_credit',
    action => DBMS_REDACT.ADD_COLUMN,
    column_name => 'credit_card',
    function_type => DBMS_REDACT.PARTIAL,
    function_parameters => 'VVV VV VVVV,VVV VV VVVV,*,1,5'
  );
END;
/

9. Database Vault

9.1 启用

EXEC DBMS_MACADM.ENABLE_DV;

9.2 Realm

BEGIN
  DBMS_MACADM.CREATE_REALM(
    realm_name => 'HR Realm',
    description => 'Protect HR data',
    enabled => DBMS_MACUTL.G_YES
  );
  
  DBMS_MACADM.ADD_OBJECT_TO_REALM(
    realm_name => 'HR Realm',
    object_owner => 'SCOTT',
    object_name => 'EMPLOYEES',
    object_type => 'TABLE'
  );
END;
/

10. 用户隔离

10.1 Schema

- 业务用户独立 Schema
- 不使用 SYS/SYSTEM
- 应用连接专用账户

10.2 PDB 隔离

- 应用 PDB
- 资源管理
- 权限隔离

详细见：Oracle 多租户 CDB/PDB 管理。

11. 补丁

11.1 RU

- 季度更新
- 安全补丁
- 及时

详细见：Oracle Patch RU 详细操作。

11.2 CPU

- Critical Patch Update
- 每季度
- 高危

12. 监控

12.1 失败登录

SELECT username, terminal, timestamp 
FROM dba_audit_session 
WHERE returncode != 0 
ORDER BY timestamp DESC;

12.2 权限

SELECT grantee, privilege 
FROM dba_sys_privs 
WHERE grantee NOT IN ('SYS', 'SYSTEM');

12.3 Data Safe

- OCI Data Safe
- 安全评估
- 脱敏
- 审计

详细见：Oracle Cloud 部署详解。

13. 合规

13.1 标准

- GDPR
- HIPAA
- PCI-DSS
- SOX

13.2 实施

- 审计
- 加密
- 访问控制
- 数据保留

14. 常见坑与排错

14.1 ORA-28000

- 账户锁定
- 解锁
- 密码策略

14.2 ORA-28001

- 密码过期
- 修改
- Profile

14.3 ORA-01017

- 密码错误
- 用户名
- 大小写

14.4 ORA-28365

- Wallet 未开
- ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN

15. 最佳实践

  1. 最小权限：基础
  2. 账户锁定：防护
  3. 密码策略：强密码
  4. 网络加密：传输
  5. TDE：存储
  6. 审计：监控
  7. VPD/Redaction：数据级
  8. Database Vault：高级
  9. 补丁：及时
  10. 合规：业务

16. 参考资料

[1] Oracle Database Security Guide 19c https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/