The Oracle REMOTE_OS_ROLES parameter must be set to FALSE.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-270524 | SRG-APP-000516-DB-000363 | O19C-00-009200 | SV-270524r1064850_rule | 2025-02-14 | 1 |
| Description |
|---|
| Setting REMOTE_OS_ROLES to TRUE allows operating system groups to control Oracle roles. The default value of FALSE causes roles to be identified and managed by the database. If REMOTE_OS_ROLES is set to TRUE, a remote user could impersonate another operating system user over a network connection. DOD requires the REMOTE_OS_ROLES to be set to FALSE. |
| ℹ️ Check |
|---|
| To verify the current status of the remote_os_roles parameter use the SQL statement: COLUMN name format a20 COLUMN parameter_value format a20 SELECT p.name, p.con_id, p.value AS PARAMETER_VALUE FROM sys.v_$parameter p WHERE vp.name = 'remote_os_roles' ORDER BY 1; For every standalone instance or container database, if the PARAMETER_VALUE is not FALSE, that is a finding. |
| ✔️ Fix |
|---|
| Set the parameter to FALSE for all instances. If using Oracle Multitenant, set the value to FALSE for the container database and all pluggable databases will be set to FALSE as well. ALTER SYSTEM SET remote_os_roles = FALSE scope=spfile; sid='container_name' is optional Restart the database for the change to take effect. |