# 下载DBSAT工具
# 从Oracle官网下载最新版本的DBSAT工具
# https://www.oracle.com/security/database-security/dbsat/# 解压DBSAT工具
$ unzip dbsat.zip -d /oracle/tools/dbsat

# 授予执行权限
$ chmod +x /oracle/tools/dbsat/dbsat

# 查看DBSAT版本
$ /oracle/tools/dbsat/dbsat –version
Database Security Assessment Tool version 2.1.0

# 切换到oracle用户
$ su – oracle

# 收集数据库信息
$ /oracle/tools/dbsat/dbsat collect fgedudb fgedudb_collect

Database Security Assessment Tool version 2.1.0

Connecting to the target database…
Connected.

Collecting schema definitions…
Collecting user definitions…
Collecting role definitions…
Collecting privilege grants…
Collecting system parameters…
Collecting security relevant parameters…
Collecting audit configuration…
Collecting network configuration…
Collecting database links…
Collecting directory objects…
Collecting external procedures…
Collecting Java objects…
Collecting PL/SQL code…
Collecting job definitions…
Collecting materialized views…
Collecting synonyms…
Collecting triggers…
Collecting virtual private database policies…
Collecting transparent data encryption configuration…
Collecting data redaction policies…
Collecting database vault configuration…
Collecting label security configuration…

Collection completed successfully.
Generated output file: fgedudb_collect.json

# 分析数据库安全
$ /oracle/tools/dbsat/dbsat report fgedudb_collect

Database Security Assessment Tool version 2.1.0

Analyzing collected data…
Generating HTML report…
Generating text report…

Report generation completed successfully.
Generated output files:
fgedudb_collect_report.html
fgedudb_collect_report.txt

# 登录到数据库
$ sqlplus / as sysdba

# 检查用户密码策略
SQL> SELECT profile, resource_name, limit
FROM dba_profiles
WHERE resource_type = ‘PASSWORD’ AND profile = ‘DEFAULT’;PROFILE RESOURCE_NAME LIMIT
—————————— ——————————– —————————————-
DEFAULT FAILED_LOGIN_ATTEMPTS 10
DEFAULT PASSWORD_LIFE_TIME 180
DEFAULT PASSWORD_REUSE_TIME UNLIMITED
DEFAULT PASSWORD_REUSE_MAX UNLIMITED
DEFAULT PASSWORD_VERIFY_FUNCTION NULL
DEFAULT PASSWORD_LOCK_TIME 1
DEFAULT PASSWORD_GRACE_TIME 7

# 检查特权用户
SQL> SELECT username, account_status, created
FROM dba_users
WHERE username IN (‘SYS’, ‘SYSTEM’, ‘DBSNMP’, ‘SYSMAN’, ‘OUTLN’, ‘SYSDG’, ‘SYSBACKUP’, ‘SYSDBA’, ‘SYSKM’, ‘SYSRAC’);USERNAME ACCOUNT_STATUS CREATED
—————————— ——————————– ———
SYS OPEN 01-JAN-22
SYSTEM OPEN 01-JAN-22
DBSNMP OPEN 01-JAN-22
SYSMAN LOCKED 01-JAN-22
OUTLN OPEN 01-JAN-22
SYSDG OPEN 01-JAN-22
SYSBACKUP OPEN 01-JAN-22
SYSKM OPEN 01-JAN-22
SYSRAC OPEN 01-JAN-22

# 检查公开的对象权限
SQL> SELECT grantee, owner, table_name, privilege
FROM dba_tab_privs
WHERE grantee = ‘PUBLIC’ AND privilege IN (‘SELECT’, ‘INSERT’, ‘UPDATE’, ‘DELETE’, ‘EXECUTE’);# 检查数据库链路
SQL> SELECT db_link, username, host
FROM dba_db_links;# 检查目录对象
SQL> SELECT owner, directory_name, directory_path
FROM dba_directories;# 检查审计配置
SQL> SELECT parameter, value
FROM v$parameter
WHERE parameter LIKE ‘%audit%’;

# 检查数据库版本和补丁信息
SQL> SELECT * FROM v$version;BANNER BANNER_FULL BANNER_LEGACY CON_ID
——————————————————————————– ——————————————————————————– ——————————————————————————– ———-
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.3.0.0.0 Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production 0

# 检查补丁信息
SQL> SELECT * FROM dba_registry_sqlpatch;PATCH_ID PATCH_UID ACTION COMMENT STATUS DESCRIPTION BUNDLE_SERIES PATCH_DESCRIPTOR ACTION_TIME CON_ID
——– ———————————— —— ——————————————— ————— ——————————————— ————— ———————————- ——————- ———-
30557433 2207840543600878 APPLY Wrapper patch for DBBP SUCCESS Database Bundle Patch DBBP 19.3.0.0.200114_DBBP 15-JAN-20 0

# 修复弱密码策略
SQL> ALTER PROFILE DEFAULT LIMIT
PASSWORD_LIFE_TIME 90
PASSWORD_GRACE_TIME 7
PASSWORD_REUSE_TIME 365
PASSWORD_REUSE_MAX 5
FAILED_LOGIN_ATTEMPTS 5
PASSWORD_LOCK_TIME 1
PASSWORD_VERIFY_FUNCTION ora12c_strong_verify_function;Profile altered.

# 锁定未使用的特权用户
SQL> ALTER USER SYSMAN ACCOUNT LOCK;SQL> ALTER USER OUTLN ACCOUNT LOCK;User altered.

User altered.

# 撤销PUBLIC用户的不必要权限
SQL> REVOKE EXECUTE ON utl_file FROM PUBLIC;SQL> REVOKE EXECUTE ON utl_http FROM PUBLIC;SQL> REVOKE EXECUTE ON utl_smtp FROM PUBLIC;Revoke succeeded.

Revoke succeeded.

Revoke succeeded.

# 检查安全相关参数
SQL> SELECT parameter, value
FROM v$parameter
WHERE parameter IN (
‘audit_trail’, ‘remote_login_passwordfile’, ‘sec_case_sensitive_logon’,
‘sql92_security’, ‘o7_dictionary_accessibility’, ‘remote_os_authent’,
‘remote_os_roles’, ‘dbms_output_enabled’, ‘utl_file_dir’
);PARAMETER VALUE
——————————– ——————————————————————————–
audit_trail DB
remote_login_passwordfile EXCLUSIVE
sec_case_sensitive_logon TRUE
sql92_security FALSE
o7_dictionary_accessibility FALSE
remote_os_authent FALSE
remote_os_roles FALSE
dbms_output_enabled TRUE
utl_file_dir

# 优化安全参数配置
SQL> ALTER SYSTEM SET sql92_security = TRUE SCOPE = SPFILE;SQL> ALTER SYSTEM SET dbms_output_enabled = FALSE SCOPE = SPFILE;System altered.

System altered.

# 重启数据库使配置生效
SQL> SHUTDOWN IMMEDIATE;SQL> STARTUP;# 配置审计
SQL> ALTER SYSTEM SET audit_trail = ‘DB, EXTENDED’ SCOPE = SPFILE;System altered.

# 重启数据库使审计配置生效
SQL> SHUTDOWN IMMEDIATE;SQL> STARTUP;# 启用统一审计（如果使用Oracle 12c及以上版本）
SQL> EXEC DBMS_AUDIT_MGMT.INIT_CLEANUP(
audit_trail_type => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
default_cleanup_interval => 72
);PL/SQL procedure successfully completed.

# 检查数据加密配置
SQL> SELECT * FROM v$encryption_wallet;WRL_TYPE WRL_PARAMETER STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC
——————– ————————————————– ——————————– ——————– ——— ——– ———-
FILE /oracle/app/oracle/admin/fgedudb/wallet/ NOT_AVAILABLE UNKNOWN SINGLE NONE UNDEFINED

# 启用透明数据加密(TDE)
SQL> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE ‘/oracle/app/oracle/admin/fgedudb/wallet/’ IDENTIFIED BY “WalletPass123”;keystore altered.

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY “WalletPass123”;keystore altered.

SQL> ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY IDENTIFIED BY “WalletPass123” WITH BACKUP;keystore altered.

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY “WalletPass123″;keystore altered.

# 检查数据脱敏配置
SQL> SELECT * FROM redaction_policies;no rows selected

# 创建数据脱敏策略
SQL> BEGIN
DBMS_REDACT.ADD_POLICY(
object_schema => ‘FGEDU’,
object_name => ‘EMP’,
column_name => ‘SALARY’,
policy_name => ‘EMP_SALARY_REDACTION’,
function_type => DBMS_REDACT.FULL,
expression => ‘1=1’
);END;/PL/SQL procedure successfully completed.

# 检查访问控制配置
SQL> SELECT * FROM dba_vpd_policies;no rows selected

# 创建VPD策略
SQL> CREATE OR REPLACE FUNCTION fgedu_emp_vpd_policy(
schema_name IN VARCHAR2,
table_name IN VARCHAR2
) RETURN VARCHAR2 IS
v_user VARCHAR2(30);BEGIN
v_user := SYS_CONTEXT(‘USERENV’, ‘SESSION_USER’);IF v_user != ‘SYS’ AND v_user != ‘SYSTEM’ THEN
RETURN ‘DEPT_ID = (SELECT DEPT_ID FROM FGEDU.EMP WHERE EMP_ID = (SELECT EMP_ID FROM FGEDU.USERS WHERE USERNAME = ”’ || v_user || ”’))’;ELSE
RETURN NULL;END IF;END fgedu_emp_vpd_policy;/Function created.

SQL> EXEC DBMS_RLS.ADD_POLICY(
object_schema => ‘FGEDU’,
object_name => ‘EMP’,
policy_name => ‘EMP_DEPT_POLICY’,
function_schema => ‘SYS’,
policy_function => ‘fgedu_emp_vpd_policy’,
statement_types => ‘SELECT, INSERT, UPDATE, DELETE’
);PL/SQL procedure successfully completed.

# 识别高风险用户
SQL> SELECT username, account_status, created
FROM dba_users
WHERE account_status = ‘OPEN’ AND username NOT IN (‘SYS’, ‘SYSTEM’, ‘DBSNMP’);USERNAME ACCOUNT_STATUS CREATED
—————————— ——————————– ———
ORACLE OPEN 01-JAN-22
FGEDU OPEN 15-JAN-22
FGEDU_TEST OPEN 31-MAR-26

# 检查高风险权限
SQL> SELECT grantee, privilege
FROM dba_sys_privs
WHERE privilege IN (‘CREATE ANY TABLE’, ‘DROP ANY TABLE’, ‘ALTER ANY TABLE’, ‘GRANT ANY PRIVILEGE’, ‘GRANT ANY ROLE’)
ORDER BY grantee;GRANTEE PRIVILEGE
—————————— —————————————-
DBA ALTER ANY TABLE
DBA CREATE ANY TABLE
DBA DROP ANY TABLE
DBA GRANT ANY PRIVILEGE
DBA GRANT ANY ROLE
SYSTEM ALTER ANY TABLE
SYSTEM CREATE ANY TABLE
SYSTEM DROP ANY TABLE
SYSTEM GRANT ANY PRIVILEGE
SYSTEM GRANT ANY ROLE

# 检查数据库链路的安全配置
SQL> SELECT db_link, username, host
FROM dba_db_links;no rows selected

# 检查网络访问控制
SQL> SELECT * FROM v$listener_network;PROT TYPE STATUS LISTENER NAME
—– —- ———— —————- ———
IPC IPC READY LISTENER
TCP TCP READY LISTENER

# 配置监听器访问控制
# 编辑listener.ora文件
$ vi $ORACLE_HOME/network/admin/listener.ora

# 添加以下内容
VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON
TCP.VALIDNODE_CHECKING_LISTENER=YES
TCP.INVITED_NODES_LISTENER=(192.168.1.100, 192.168.1.101, localhost)

# 重启监听器
$ lsnrctl stop
$ lsnrctl start

# 使用DBSAT生成详细的安全评估报告
$ /oracle/tools/dbsat/dbsat report –html fgedudb_collect

# 查看报告内容
$ cat fgedudb_collect_report.txt | head -50

Database Security Assessment Tool Report
Version 2.1.0

Target Database: FGEDUDB
Collection Date: 2026-03-31 17:00:00
Report Date: 2026-03-31 17:05:00

================================================================================
SECURITY ASSESSMENT SUMMARY
================================================================================

Overall Risk Score: MEDIUM

Findings by Severity:
CRITICAL: 0
HIGH: 2
MEDIUM: 5
LOW: 10
INFORMATIONAL: 20

================================================================================
CRITICAL FINDINGS
================================================================================

None found.

================================================================================
HIGH FINDINGS
================================================================================

1. Weak Password Policy
– PASSWORD_VERIFY_FUNCTION is not set
– PASSWORD_REUSE_TIME is UNLIMITED
– PASSWORD_REUSE_MAX is UNLIMITED

2. Unused Privileged Accounts
– SYSMAN account is unlocked but not used
– OUTLN account is unlocked but not used

================================================================================
MEDIUM FINDINGS
================================================================================

1. Audit Configuration
– Audit trail is enabled but not set to EXTENDED

2. Public Privileges
– PUBLIC has EXECUTE privilege on UTL_FILE
– PUBLIC has EXECUTE privilege on UTL_HTTP
– PUBLIC has EXECUTE privilege on UTL_SMTP

3. Security Parameters
– SQL92_SECURITY is set to FALSE
– DBMS_OUTPUT_ENABLED is set to TRUE

4. Data Encryption
– Transparent Data Encryption (TDE) is not enabled

5. Access Control
– Virtual Private Database (VPD) is not implemented

# 根据报告提出改进建议
# 1. 加强密码策略，设置强密码验证函数
# 2. 锁定未使用的特权账户
# 3. 启用详细审计
# 4. 撤销PUBLIC用户的不必要权限
# 5. 优化安全参数配置
# 6. 启用透明数据加密
# 7. 实现虚拟私有数据库
# 8. 配置监听器访问控制