← Back to Oracle Database 19c Security Technical Implementation Guide

V-270524

CAT II (Medium)

The Oracle REMOTE_OS_ROLES parameter must be set to FALSE.

Rule ID

SV-270524r1263630_rule

STIG

Oracle Database 19c Security Technical Implementation Guide

Version

V1R6

CCIs

CCI-000366

Discussion

Setting REMOTE_OS_ROLES to TRUE allows operating system groups to control Oracle roles. The default value of FALSE causes roles to be identified and managed by the database. If REMOTE_OS_ROLES is set to TRUE, a remote user could impersonate another operating system user over a network connection. DoW requires the REMOTE_OS_ROLES to be set to FALSE.

Check Content

To verify the current status of the remote_os_roles parameter use the SQL statement: 

sqlplus connect as sysdba

SELECT gp.inst_id, gp.con_id, gp.value AS PARAMETER_VALUE
FROM sys.gv_$parameter gp
WHERE gp.name = 'remote_os_roles'
ORDER BY 1;

For every standalone instance or container database, if the PARAMETER_VALUE is not FALSE, that is a finding.

Fix Text

Set the parameter to FALSE for all instances. If using Oracle Multitenant, set the value to FALSE for the container database and all pluggable databases will be set to FALSE as well.

sqlplus connect as sysdba

ALTER SYSTEM SET remote_os_roles=FALSE SCOPE=spfile SID='*';
SHUTDOWN IMMEDIATE;
STARTUP;

SID='*' is required if the database is a RAC database.

If the parameter value is different in different containers it cannot be brought into compliance using ALTER SYSTEM: Open a Service Request with Oracle Support.