Skip to content
  • About
Search
Close

Geodata Master

Oracle Database Technical Articles & GeoSpatial Data Technology

Tag: oracle database permissions

DBMS_PRIVILEGE_CAPTURE – Oracle 12c Database [Privilege Analysis]

April 5, 2016November 27, 2018 arcsdegeoLeave a comment

One of the most important Security Principals while maintain your Enterprise Database Landscape is implementing the “least privilege” principle. The least privilege principle is applied from IT Security level on any enterprise system and system administrators should regularly review and fix excessive privileges.

One of the very nice “security” features of Oracle 12c release, is the ability to track and capture privileges of running applications using the package (DBMS_PRIVILEGE_CAPTURE).

To simulate on a sandbox machine:

Remark: if you are going to use an account other than ‘SYS’, then you need to grant the account “CAPTURE_ADMIN” role.

  1. Create a privilege analysis policy, for example:

BEGIN

   DBMS_PRIVILEGE_CAPTURE.CREATE_CAPTURE(

   name => ‘MON_PRIV_DB’,

    type => DBMS_PRIVILEGE_CAPTURE.G_DATABASE

    );

    END;

   /

In my example I used (G_DATABASE) which implies to monitor and track all privilege for all accounts in the database except ‘SYS’ account. You have the ability to configure the policy to different things:

DBMS_PRIVILEGE_CAPTURE.G_ROLE : which track privielges on the context of of specific oracle database role.

DBMS_PRIVILEGE_CAPTURE.G_CONTECT: will track privileges based on conditions that are evaluated to ‘TRUE’.

DBMS_PRIVILEGE_CAPTURE.G_ROLE_AND_CONTECT : will track privileges for a role or a list of roles and if a condition is evaluated to ‘TRUE’.

 

  1. After creating the privilege analysis policy you will need to “enable” it, by executing the following:

exec DBMS_PRIVILEGE_CAPTURE.ENABLE_CAPTURE(name => ‘MON_PRIV_DB’);

 

Remark:  you can’t enable more than 2 privilege analysis policy.

Error reference: ORA-47934: Two privilege captures are already enabled

 

  1. After a while you can later on disable the policy (for example after 1-2 hours) by executing the following:

exec DBMS_PRIVILEGE_CAPTURE.DISABLE_CAPTURE(name => ‘MON_PRIV_DB’);

 

  1. Generate the results by executing the following:

exec DBMS_PRIVILEGE_CAPTURE.GENERATE_RESULT(name => ‘MON_PRIV_DB’);

 

  1. There are many views that you can query to find very useful information, for example:

* this query will list users with system privileges that are not being used by this account

select * from DBA_UNUSED_SYSPRIVS ;

 

  1. At the end you can DROP the capture policy (if you want to) by executing the following:

exec DBMS_PRIVILEGE_CAPTURE.DROP_CAPTURE(name => ‘MON_PRIV_DB’);

 

Update November 2018:

This feature is not anymore licensed as part of database vault, so you can use it if you have Oracle EE

resources:

https://docs.oracle.com/en/database/oracle/oracle-database/18/dblic/Licensing-Information.html#GUID-AB56CEE3-955E-4E56-8B44-6075E889C283

http://www.petefinnigan.com/weblog/archives/00001448.htm

 

 

Blog Stats

  • 641,841 hits

Recent Posts

  • Oracle Database Immutable Tables
  • Oracle datapump error ORA-39077: unable to subscribe agent KUPC$A_1_083325450472000
  • Oracle 19c Upgrade Error ORA-00119: invalid specification for system parameter DISPATCHERS
  • Oracle 21c New Feature in SQL*Plus – set jsonprint
  • Patching Oracle 21c database – October 2021 CPU [21.4.0.0.211019]
Follow Geodata Master on WordPress.com

Top Posts & Pages

  • Oracle Database Product Life Cycle Support 19c,18c, 12cR2 Long Term & Innovation Releases !
  • RMAN List Backup Summary command
  • Oracle PDB and when is DAPTATCH required to be executed
  • Oracle 19c (19.12) has introduced New Security Feature “Gradual Database Password Rollover”
  • Performing Import Data Pump with EXCLUDE=STATISTICS
  • sqlplus error for Oracle 12c in IBM AIX : rtld: 0712-001 Symbol CreateIoCompletionPort was referenced
  • INS-08101 Unexpected error while executing the action at state: 'SupportedOSCheck'
  • location of Oracle SQL Developer Connections File
  • Patching Oracle 19c Database in Windows OS
  • What does datapatch do ?

Archives

  • May 2022
  • March 2022
  • February 2022
  • January 2022
  • October 2021
  • August 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • April 2020
  • March 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • October 2018
  • September 2018
  • August 2018
  • July 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • January 2018
  • December 2017
  • November 2017
  • October 2017
  • September 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • April 2017
  • March 2017
  • February 2017
  • January 2017
  • December 2016
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • April 2016
  • February 2016
  • January 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • May 2015
  • April 2015
  • March 2015
  • February 2015
  • January 2015
  • December 2014
  • November 2014
  • October 2014
  • September 2014
  • August 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013

Recent Comments

Oracle Database Immu… on Oracle Database 19c Blockchain…
Rajesh on Oracle Database java component…
Oracle database Unif… on Exploring Oracle 12c Unified…
Bud on Oracle 21c New Feature in SQL*…
ChenAIQ on datapatch errors while Patchin…

Search in my blog

Follow Geodata Master on WordPress.com

Top Posts & Pages

  • Oracle Database Product Life Cycle Support 19c,18c, 12cR2 Long Term & Innovation Releases !
  • RMAN List Backup Summary command
  • Oracle PDB and when is DAPTATCH required to be executed
  • Oracle 19c (19.12) has introduced New Security Feature “Gradual Database Password Rollover”
  • Performing Import Data Pump with EXCLUDE=STATISTICS
  • sqlplus error for Oracle 12c in IBM AIX : rtld: 0712-001 Symbol CreateIoCompletionPort was referenced
  • INS-08101 Unexpected error while executing the action at state: 'SupportedOSCheck'
  • location of Oracle SQL Developer Connections File
  • Patching Oracle 19c Database in Windows OS
  • What does datapatch do ?

Blog Stats

  • 641,841 hits

Archives

  • May 2022
  • March 2022
  • February 2022
  • January 2022
  • October 2021
  • August 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • April 2020
  • March 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • October 2018
  • September 2018
  • August 2018
  • July 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • January 2018
  • December 2017
  • November 2017
  • October 2017
  • September 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • April 2017
  • March 2017
  • February 2017
  • January 2017
  • December 2016
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • April 2016
  • February 2016
  • January 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • May 2015
  • April 2015
  • March 2015
  • February 2015
  • January 2015
  • December 2014
  • November 2014
  • October 2014
  • September 2014
  • August 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
Blog at WordPress.com.
Back to top
  • Follow Following
    • Geodata Master
    • Join 27 other followers
    • Already have a WordPress.com account? Log in now.
    • Geodata Master
    • Customize
    • Follow Following
    • Sign up
    • Log in
    • Report this content
    • View site in Reader
    • Manage subscriptions
    • Collapse this bar