# 1. 锁定默认账户
SQL> SELECT username, account_status FROM dba_users
WHERE username IN (‘SCOTT’,’HR’,’OE’,’PM’,’SH’);

USERNAME ACCOUNT_STATUS
——————– —————
SCOTT OPEN
HR OPEN

# 锁定不需要的账户
SQL> ALTER USER scott ACCOUNT LOCK;
SQL> ALTER USER hr ACCOUNT LOCK;

# 2. 修改默认密码
SQL> SELECT username FROM dba_users WHERE account_status = ‘OPEN’;

# 修改用户密码
SQL> ALTER USER system IDENTIFIED BY “Fgedu_2026!”;
SQL> ALTER USER sys IDENTIFIED BY “Fgedu_2026!”;

# 3. 配置密码策略
SQL> ALTER PROFILE DEFAULT LIMIT
PASSWORD_LIFE_TIME 90
PASSWORD_GRACE_TIME 7
PASSWORD_REUSE_TIME 365
PASSWORD_REUSE_MAX 12
FAILED_LOGIN_ATTEMPTS 6
PASSWORD_LOCK_TIME 1
PASSWORD_VERIFY_FUNCTION verify_function;

# 4. 检查密码复杂度
SQL> SELECT * FROM dba_profiles
WHERE resource_type = ‘PASSWORD’;

# 1. 检查DBA权限
SQL> SELECT grantee FROM dba_role_privs
WHERE granted_role = ‘DBA’;

GRANTEE
——————————
SYS
SYSTEM
FGEDU_ADMIN

# 2. 检查危险权限
SQL> SELECT grantee, privilege
FROM dba_sys_privs
WHERE privilege IN (‘ANY TABLE’,’ANY PROCEDURE’);

# 3. 收回不必要的权限
SQL> REVOKE SELECT ANY TABLE FROM fgedu_user;
SQL> REVOKE EXECUTE ANY PROCEDURE FROM fgedu_user;

# 4. 检查对象权限
SQL> SELECT grantee, owner, table_name, privilege
FROM dba_tab_privs
WHERE grantee NOT IN (‘SYS’,’SYSTEM’);

# 5. 检查角色权限
SQL> SELECT * FROM dba_role_privs
WHERE grantee NOT IN (‘SYS’,’SYSTEM’);

# 1. 配置sqlnet.ora
# 编辑 $ORACLE_HOME/network/admin/sqlnet.ora

SQLNET.AUTHENTICATION_SERVICES = (NTS,TCPS,BEQ)
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256,AES192,AES128)
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256,SHA1)

# 2. 配置listener.ora
# 编辑 $ORACLE_HOME/network/admin/listener.ora

LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCPS)(HOST = fgeduhost)(PORT = 2484))
(ADDRESS = (PROTOCOL = TCP)(HOST = fgeduhost)(PORT = 1521))
)
)

# 3. 配置IP限制
# 编辑 $ORACLE_HOME/network/admin/sqlnet.ora

TCP.EXCLUDED_NODES = (192.168.100.0/24)
TCP.INVITED_NODES = (192.168.1.0/24,localhost)

# 4. 重启监听
$ lsnrctl stop
$ lsnrctl start

# 5. 验证配置
$ lsnrctl status

# 1. 配置透明数据加密(TDE)
# 创建密钥库
SQL> ADMINISTER KEY MANAGEMENT
CREATE KEYSTORE ‘/oracle/app/oracle/wallet’
IDENTIFIED BY “Fgedu_2026!”;

# 打开密钥库
SQL> ADMINISTER KEY MANAGEMENT
SET KEYSTORE OPEN
IDENTIFIED BY “Fgedu_2026!”;

# 创建主密钥
SQL> ADMINISTER KEY MANAGEMENT
SET KEY
IDENTIFIED BY “Fgedu_2026!”
WITH BACKUP;

# 2. 加密表空间
SQL> CREATE TABLESPACE fgedu_secure
DATAFILE ‘/oradata/fgedudb/fgedu_secure01.dbf’ SIZE 1G
ENCRYPTION USING ‘AES256’
DEFAULT STORAGE(ENCRYPT);

# 3. 加密列
SQL> ALTER TABLE customers
MODIFY (credit_card ENCRYPT USING ‘AES256’);

# 4. 查看加密状态
SQL> SELECT * FROM v$encryption_wallet;
SQL> SELECT tablespace_name, encrypted FROM dba_tablespaces;
SQL> SELECT table_name, column_name FROM dba_encrypted_columns;

# 1. 启用审计
SQL> ALTER SYSTEM SET audit_trail=db,extended SCOPE=SPFILE;
SQL> SHUTDOWN IMMEDIATE;
SQL> STARTUP;

# 2. 审计用户登录
SQL> AUDIT CREATE SESSION;

# 3. 审计权限使用
SQL> AUDIT SELECT ANY TABLE BY ACCESS;
SQL> AUDIT EXECUTE ANY PROCEDURE BY ACCESS;

# 4. 审计特定操作
SQL> AUDIT ALTER USER BY ACCESS;
SQL> AUDIT CREATE USER BY ACCESS;
SQL> AUDIT DROP USER BY ACCESS;

# 5. 审计特定用户
SQL> AUDIT ALL BY fgedu_admin BY ACCESS;

# 6. 查看审计记录
SQL> SELECT * FROM dba_audit_trail
WHERE timestamp > SYSDATE – 1;

# 7. 查看审计选项
SQL> SELECT * FROM dba_stmt_audit_opts;
SQL> SELECT * FROM dba_priv_audit_opts;

# 1. 创建审计策略
SQL> BEGIN
DBMS_AUDIT_MGMT.CREATE_AUDIT_POLICY(
audit_policy_name => ‘FGEDU_SECURITY_POLICY’,
privilege_select_actions => TRUE,
privilege_dml_actions => TRUE,
privilege_ddl_actions => TRUE
);
END;
/

# 2. 启用审计策略
SQL> BEGIN
DBMS_AUDIT_MGMT.ENABLE_AUDIT_POLICY(
audit_policy_name => ‘FGEDU_SECURITY_POLICY’
);
END;
/

# 3. 查看审计策略
SQL> SELECT * FROM audit_unified_policies;

# 4. 查看审计记录
SQL> SELECT * FROM unified_audit_trail
WHERE event_timestamp > SYSDATE – 1;

# 5. 清理审计记录
SQL> BEGIN
DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(
audit_trail_type => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
use_last_arch_timestamp => TRUE
);
END;
/