Ensuring data security within your organization is crucial if you are to remain compliant against the increasing data security regulations, as well as ensuring that you maintain a good relationship with your customers. Protecting your customer's information and ensuring full confidence in your data security measures will put you in good stead for protection against data loss and data security breaches.
Oracle DBSAT is a powerful tool that will help you to achieve your data security compliance by analyzing data, configurations, users, entitlements, and security policies and identifying where sensitive data resides to uncover security risks and improve the security posture of Oracle Database within an organization.
Oracle DBSAT runs on the following Operating Systems:
Oracle DBSAT runs on Oracle Database versions and editions:
To gather all necessary data, run the Oracle DBSAT Collector on the server that hosts the database. The Collector uses operating system commands to gather process and file system information that the database alone cannot provide. Besides, the Oracle DBSAT Collector must be run as an OS user with read permissions on files and directories under ORACLE_HOME using SQL*Plus (through Oracle Database or Instant Client) to collect and process file system data using OS commands.
The Reporter is a Java program and requires the Java Runtime Environment (JRE) 1.8 (jdk8-u172) or later to run.
The Discoverer is a Java program and requires the Java Runtime Environment (JRE) 1.8 (jdk8-u172) or later to run.
The Discoverer collects metadata from database dictionary views and matches them against the patterns specified to discover sensitive data. The Discoverer must connect to the database as a user with sufficient privileges to select from these views.
For this article, I’m using an Oracle Linux 7 Machine and an Oracle Database 21c Enterprise Edition with a CDB Database called ORCL and a Pluggable database called ORCLPDB.
$ sqlplus / as sysdba
alter session set container=ORCLPDB;
create user dbsat_user identified by dbsat_password;
grant create session to dbsat_user;
grant select_catalog_role to dbsat_user;
grant select on sys.registry$history to dbsat_user;
grant read on sys.dba_audit_mgmt_config_params to dbsat_user;
grant select on sys.dba_users_with_defpwd to dbsat_user;
grant read on sys.dba_credentials to dbsat_user;
grant execute on sys.dbms_sql to dbsat_user;
grant audit_viewer to dbsat_user; // 12c and later
grant capture_admin to dbsat_user;// 12c and later covers sys.dba_priv_captures, sys.priv_capture$, sys.capture_run_log$
--If Database Vault is enabled, connect as DV_OWNER to run this command
grant DV_SECANALYST to dbsat_user;
$ cd /home/oracle/dbsat
$ ./dbsat collect <database_connect_string> <output_file>
I will use:
database_connect_string: dbsat_user@orclpdb
output_file: dbsat_out
[oracle@ol-stby1 dbsat]$ ./dbsat collect dbsat_user@orclpdb dbsat_out
Database Security Assessment Tool version 3.1 (Jan 2024)
This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.
Connecting to the target Oracle database...
SQL*Plus: Release 21.0.0.0.0 - Production on Tue Apr 9 15:11:18 2024
Version 21.3.0.0.0
Copyright (c) 1982, 2021, Oracle. All rights reserved.
Enter password:
Connected to:
Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
Version 21.3.0.0.0
Setup complete.
SQL queries complete.
Warning: Exit status 256 from OS rule: dbcs_status
OS commands complete.
Disconnected from Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
Version 21.3.0.0.0
DBSAT Collector completed successfully.
Calling /u01/app/oracle/product/21.0.0/dbhome_1/bin/zip to encrypt dbsat_out.json...
Enter password:
Verify password:
adding: dbsat_out.json (deflated 86%)
zip completed successfully.
Note: DBSAT can display warnings informing that some checks were skipped. These can be safely ignored as the execution proceeds. Some reasons to skip checks include wrong permissions, missing .ora files, not applicable to that target type, and more.
If you do not want to encrypt the file, invoke the dbsat collect script with the -n option. But, this is not recommended.
We will need the output file generated by the Collector.
I got the following result:
openjdk version "11.0.22" 2024-01-16 LTS
| Parameter | |
| -a | Runs the report for all database accounts (including locked and schema only accounts) |
| -n | Specifies no encryption |
| -g | Shows all grants, including common grants, in a pluggable database |
| -u | Specify a user or list of users to exclude from a report |
| -x |
Excludes a section or list of sections from the report: Valid sections are:
|
I will use only the output file:
output_file: dbsat_out
[oracle@ol-stby1 dbsat]$ ./dbsat report dbsat_out
Database Security Assessment Tool version 3.1 (Jan 2024)
This tool is intended to assist you in securing your Oracle database system. You are solely responsible for your system and the effect and results of the execution of this tool (including, without limitation, any damage or data loss). Further, the output generated by this tool may include potentially sensitive system configuration data and information that could be used by a skilled attacker to penetrate your system. You are solely responsible for ensuring that the output of this tool, including any generated reports, is handled in accordance with your company's policies.
DBSAT Reporter ran successfully.
Calling /usr/bin/zip to encrypt the generated reports...
Enter password:
Verify password:
zip warning: dbsat_out_report.zip not found or empty
adding: dbsat_out_report.txt (deflated 76%)
adding: dbsat_out_report.html (deflated 83%)
adding: dbsat_out_report.xlsx (deflated 1%)
adding: dbsat_out_report.json (deflated 81%)
zip completed successfully.
This is the file in HTML format:
You will also get the report in xlsx, JSON, and txt format.
The Discoverer executes SQL queries and collects data from the system to be assessed based on the settings specified in the configuration and pattern files.
I got the following result:
openjdk version "11.0.22" 2024-01-16 LTS
| Parameter | |
| -n | Specifies no encryption. |
| -c | Specifies the name of the configuration file used for Discoverer. |
| output_file | Specifies the full or relative path name to create the .zip file. Do not add an extension. |
For the configuration file, navigate to the Discover/conf directory. Make a copy of the sample_dbsat.config file and rename the file to match your site–specific requirements.
As a minimum, you will need the following parameters in the conf file:
[Database]
DB_HOSTNAME = <hostname>
DB_PORT = <port>
DB_SERVICE_NAME = <db_service_name>
I will use:
[Database]
DB_HOSTNAME = ol-stby1
DB_PORT = 1521
DB_SERVICE_NAME = orclpdb
DBSAT Discover ran successfully.
Calling /usr/bin/zip to encrypt the generated reports...
Enter password:
Verify password:
adding: PDB1_discover.html (deflated 86%)
adding: PDB1_discover.csv (deflated 86%)
Zip completed successfully.