Oracle Database must disable accounts when the accounts have expired.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-270586	SRG-APP-000700-DB-000100	O19C-00-018700	SV-270586r1065036_rule	2025-02-14	1

Description
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality, which reduce the attack surface of the system.

ℹ️ Check
Retrieve the settings for PASSWORD_LIFE_TIME for each profile with the query: SELECT * FROM SYS.DBA_PROFILES WHERE RESOURCE_NAME = 'PASSWORD_LIFE_TIME'; If the Oracle Database settings for PASSWORD_LIFE_TIME for any profile is greater than 60, this is a finding. If the database management system (DBMS) is not configured to disable accounts when the accounts have expired, this is a finding.

✔️ Fix
Configure the DBMS to disable accounts when the accounts have expired. The user profile, ORA_STIG_PROFILE, has been provided to satisfy the STIG requirements pertaining to the profile parameters. Oracle recommends that this profile be customized with any site-specific requirements and assigned to all users where applicable. Note: It remains necessary to create a customized replacement for the password validation function, ORA12C_STRONG_VERIFY_FUNCTION, if relying on this technique to verify password complexity. The defaults for ORA_STIG_PROFILE are set as follows: Resource Name Limit ------------- ------ COMPOSITE_LIMIT DEFAULT SESSIONS_PER_USER DEFAULT CPU_PER_SESSION DEFAULT CPU_PER_CALL DEFAULT LOGICAL_READS_PER_SESSION DEFAULT LOGICAL_READS_PER_CALL DEFAULT IDLE_TIME 15 CONNECT_TIME DEFAULT PRIVATE_SGA DEFAULT FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LIFE_TIME 60 PASSWORD_REUSE_TIME 365 PASSWORD_REUSE_MAX 10 PASSWORD_VERIFY_FUNCTION ORA12C_STRONG_VERIFY_FUNCTION PASSWORD_LOCK_TIME UNLIMITED PASSWORD_GRACE_TIME 5 Change the value of PASSWORD_LIFE_TIME (along with the other parameters, where relevant) from UNLIMITED to 60 and then assign users to the profile. ALTER PROFILE ORA_STIG_PROFILE LIMIT PASSWORD_LIFE_TIME 60; To assign the user to the profile do the following: ALTER USER <username> PROFILE ORA_STIG_PROFILE;

✔️ Fix

Configure the DBMS to disable accounts when the accounts have expired. The user profile, ORA_STIG_PROFILE, has been provided to satisfy the STIG requirements pertaining to the profile parameters. Oracle recommends that this profile be customized with any site-specific requirements and assigned to all users where applicable. Note: It remains necessary to create a customized replacement for the password validation function, ORA12C_STRONG_VERIFY_FUNCTION, if relying on this technique to verify password complexity. The defaults for ORA_STIG_PROFILE are set as follows: Resource Name Limit ------------- ------ COMPOSITE_LIMIT DEFAULT SESSIONS_PER_USER DEFAULT CPU_PER_SESSION DEFAULT CPU_PER_CALL DEFAULT LOGICAL_READS_PER_SESSION DEFAULT LOGICAL_READS_PER_CALL DEFAULT IDLE_TIME 15 CONNECT_TIME DEFAULT PRIVATE_SGA DEFAULT FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LIFE_TIME 60 PASSWORD_REUSE_TIME 365 PASSWORD_REUSE_MAX 10 PASSWORD_VERIFY_FUNCTION ORA12C_STRONG_VERIFY_FUNCTION PASSWORD_LOCK_TIME UNLIMITED PASSWORD_GRACE_TIME 5 Change the value of PASSWORD_LIFE_TIME (along with the other parameters, where relevant) from UNLIMITED to 60 and then assign users to the profile. ALTER PROFILE ORA_STIG_PROFILE LIMIT PASSWORD_LIFE_TIME 60; To assign the user to the profile do the following: ALTER USER <username> PROFILE ORA_STIG_PROFILE;