oracle數據庫安全基線自動檢測腳本

#!/bin/bash

#version 2.1 此腳本在rhel，centos，oel系統均已測試通過，適用於9i 10g 11g。但未在aix，solaris，unix測試，如果遇到問題請自行微調。

#Author: jn
#Date: 2016.8
HOSTNAME=`hostname`
echo $HOSTNAME > orack.res.lst
SQLPLUS=$ORACLE_HOME/bin/sqlplus

$SQLPLUS "/ as sysdba" << EOF
-------  設置行寬、葉寬  ----------
set line 150
set pagesize 1000
set feed off
spool orack.res.lst
-------  腳本開始運行的時間  ------------
select 'Started On ' || to_char(sysdate,'yyyy-mm-dd hh24:mi:ss') started_time from dual;
-------  Oracle的版本  ------------
select banner from v\$version;
#select banner from v$version;
------- 查看Oracle登錄認證方式 ----------
show parameter remote_login_passwordfile
------- 查看 oracle 用戶密碼HASH值 -----------
select name,password from user\$;
select name,password from user\$ where name in ( select username from dba_users where account_status='OPEN');
-------  查看出於Active狀態的帳號  ------------
col username for a20
col profile for a20
select username,profile from dba_users where account_status='OPEN';

set line 150
set pagesize 1000
col profile for a20
col resource_name for a30
col resource for a25
col limit for a30
select * from dba_profiles;
select * from dba_profiles where profile='DEFAULT';
-------  查看是否開啓了資源限制  ------------
show parameter resource_limit
-------查看審計開啓情況-----
show parameter audit
-------  查看密碼方面的限制  ------------
col resource_name for a40
col limit for a20
col profile for a40
select resource_name,limit,profile from dba_profiles where resource_type='PASSWORD';
------- 查看哪些用戶具有DBA權限  ---------------
col grantee for a15
col granted_role for a15
col admin_option for a15
col default_role for a15
select * from dba_role_privs where grantee in ( select username from dba_users where account_status='OPEN') and granted_role='DBA' order by grantee;
------- 查詢視圖dba_tab_privs被授予了public角色和執行權限表的數量 -------
select count(*) table_name from dba_tab_privs where grantee='PUBLIC' and privilege='EXECUTE' and table_name in ('UTL_FILE', 'UTL_TCP', 'UTL_HTTP', 'UTL_SMTP', 'DBMS_LOB', 'DBMS_SYS_SQL', 'DBMS_JOB');
------- 查看激活用戶的配置情況 -------
select * from dba_profiles where profile in (select profile from dba_users where account_status='OPEN') and  limit NOT IN('DEFAULT','UNLIMITED','NULL');
------- 查看第三方審計工具的安裝情況 -------
SELECT * FROM V\$OPTION WHERE PARAMETER = 'Oracle Database Vault';
#SELECT * FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';
------- 查看oracle最大連接數-------
show parameter processes;
------- 查看非系統用戶角色被授予dba的用戶的數量 -------
select count(a.username) from  dba_users a left join dba_role_privs b on a.username = b.grantee where granted_role = 'DBA' and a.username not in ('SYS','SYSMAN','SYSTEM');
------- 查看數據庫會話 -------
show parameter sessions;
------- 當sql92_security被設置成TRUE時，對錶執行UPDATE/DELETE操作時會檢查當前用戶是否具備相應表的SELECT權限 --------
show parameter sql92_security;
------- O7_DICTIONARY_ACCESSIBILITY參數控制對數據字典的訪問.設置爲true,如果用戶被授予瞭如select any table等any table權限,用戶即使不是dba或sysdba用戶也可以訪問數據字典，建議爲false -------
show parameter O7_DICTIONARY_ACCESSIBILITY;
spool off
EOF

# Oracle Port Number
echo -e "\n\n" >> orack.res.lst
echo "----------Port 1521 in listener.ora----------" >> orack.res.lst
echo "" >> orack.res.lst
LISTEN_ORA=$ORACLE_HOME/network/admin/listener.ora
SQLNET_ORA=$ORACLE_HOME/network/admin/sqlnet.ora
if [ -f $LISTEN_ORA ];then
   grep 1521 $LISTEN_ORA >> orack.res.lst
else
   echo "File $LISTEN_ORA Is Not Exists!!!" >> orack.res.lst
fi

# Listener Password
echo -e "\n" >> orack.res.lst
echo "----------Listener Password in listener.ora----------" >> orack.res.lst
echo "" >> orack.res.lst
if [ -f $LISTEN_ORA ];then
   grep -i PASSWORDS_LISTENER $LISTEN_ORA >> orack.res.lst
else
   echo "File $LISTEN_ORA Is Not Exists!!!" >> orack.res.lst
fi

# SQLNET TIMEOUT
echo -e "\n" >> orack.res.lst
echo "----------sqlnet timeout in sqlnet.ora----------" >> orack.res.lst
echo "" >> orack.res.lst
if [ -f $SQLNET_ORA ];then
   grep -i SQLNET.EXPIRE_TIME $SQLNET_ORA >> orack.res.lst
else
   echo "File $SQLNET_ORA Is Not Exists!!!" >> orack.res.lst
fi

# SQLNET Trusted IP 
echo -e "\n" >> orack.res.lst
echo "----------sqlnet trusted IP in sqlnet.ora----------" >> orack.res.lst
echo "" >> orack.res.lst
if [ -f $SQLNET_ORA ];then
   egrep -i "tcp.validnode_checking|tcp.invited_nodes|tcp.excluded_nodes" $SQLNET_ORA >> orack.res.lst
else
   echo "File $SQLNET_ORA Is Not Exists!!!" >> orack.res.lst
fi

echo -e "\n\n" >> orack.res.lst
echo "==========================  End On `date`  ==========================" >> orack.res.lst