Database Security Assessment Tool.

Database Security Assessment Tool.
The Oracle Database Security Assessment Tool (DBSAT) analyzes database configurations, users, their entitlements, security policies and identifies where sensitive data resides to uncover security risks and improve the security posture of Oracle Databases.
The Database Security Assessment Tool (DBSAT) consists of the following components:
1. Collector
2. Reporter
3. Discoverer
1. Collector.
The collector should be run on the database server.
Collector gathers information from the database and generates a JSON file containing all the information.
2. Reporter
DBSAT Reporter will take as input the file generated by the collector (json or zip file).
The Reporter and will produce one zip file containing three reports in different formats: HTML, spreadsheet, and text.
3. Discoverer
The discoverer is essentially a separate Java-based tool that checks for sensitive data in the database.
First you need to create a dbsat.config file. You can call it anything you want as you will be referencing it explicitly later.
1. DBSAT INSTALLATION:
Requirements:
1. DBSAT Tool zip.
2. Python 2.5 and above.
3. Java 1.8 and above.
A) Create specific DBSAT Directory.
mkdir DBSAT
cd /home/oracle/DBSAT
B) Move DBSAT Tool into the location and unzip.
pwd
/home/oracle/DBSAT
[oracle@ssssss DBSAT]$ unzip dbsat.zip
Archive:  dbsat.zip
  inflating: dbsat                   
  inflating: dbsat.bat               
  inflating: sat_reporter.py         
  inflating: sat_analysis.py         
  inflating: sat_collector.sql       
  inflating: xlsxwriter/app.py       
  inflating: xlsxwriter/chart_area.py  
  inflating: xlsxwriter/chart_bar.py  
  inflating: xlsxwriter/chart_column.py  
  inflating: xlsxwriter/chart_doughnut.py  
  inflating: xlsxwriter/chart_line.py  
  inflating: xlsxwriter/chart_pie.py  
  inflating: xlsxwriter/chart.py     
  inflating: xlsxwriter/chart_radar.py  
  inflating: xlsxwriter/chart_scatter.py  
  inflating: xlsxwriter/chartsheet.py  
  inflating: xlsxwriter/chart_stock.py  
  inflating: xlsxwriter/comments.py  
  inflating: xlsxwriter/compat_collections.py  
  inflating: xlsxwriter/compatibility.py  
  inflating: xlsxwriter/contenttypes.py  
  inflating: xlsxwriter/core.py      
  inflating: xlsxwriter/custom.py    
  inflating: xlsxwriter/drawing.py   
  inflating: xlsxwriter/format.py    
  inflating: xlsxwriter/__init__.py  
  inflating: xlsxwriter/packager.py  
  inflating: xlsxwriter/relationships.py  
  inflating: xlsxwriter/shape.py     
  inflating: xlsxwriter/sharedstrings.py  
  inflating: xlsxwriter/styles.py    
  inflating: xlsxwriter/table.py     
  inflating: xlsxwriter/theme.py     
  inflating: xlsxwriter/utility.py   
  inflating: xlsxwriter/vml.py       
  inflating: xlsxwriter/workbook.py  
  inflating: xlsxwriter/worksheet.py  
  inflating: xlsxwriter/xmlwriter.py  
  inflating: xlsxwriter/LICENSE.txt  
  inflating: Discover/bin/discoverer.jar  
  inflating: Discover/lib/ojdbc8.jar  
  inflating: Discover/lib/oraclepki.jar  
  inflating: Discover/lib/osdt_cert.jar  
  inflating: Discover/lib/osdt_core.jar  
  inflating: Discover/conf/sample_dbsat.config  
  inflating: Discover/conf/sensitive_en.ini  
Unzip was Completed , The following files are showing in the unzipped directory.
[oracle@ssssss DBSAT]$ ls -lrt
total 4880
-r-xr-xr-x. 1 oracle oracle   28216 Dec 21  2017 sat_analysis.py
-r-xr-xr-x. 1 oracle oracle  248371 Apr 13  2018 sat_reporter.py
-r-xr-xr-x. 1 oracle oracle   12839 May  1  2018 dbsat
-r-xr-xr-x. 1 oracle oracle   12771 May 18  2018 dbsat.bat
-r-xr-xr-x. 1 oracle oracle   43796 May 31  2018 sat_collector.sql
-rwxrw-r–. 1 oracle oracle 4630125 Jan 22 17:05 dbsat.zip
drwxrwxr-x. 2 oracle oracle    4096 Jan 22 17:05 xlsxwriter
drwxrwxr-x. 5 oracle oracle    4096 Jan 22 17:05 Discover
1. Running DBSAT Collector.
1.Specify the parameters.
$ dbsat collect <connect_string> <destination>
Example: $ dbsat collect system@PRDCLN /DBSAT
Database Security Assessment Tool version 2.0.2 (May 2018)
This tool is intended to assist in you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company’s policies.
Connecting to the target Oracle database…
SQL*Plus: Release 12.1.0.2.0 Production on Thu Jul 5 00:05:08 2018
Copyright (c) 1982, 2014, Oracle. All rights reserved.
Enter password:
Last Successful login time: Wed Jun 20 2018 23:51:14 +05:30
Connected to:
Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 – 64bit Production
With the Partitioning, OLAP, Advanced Analytics and Real Application Testing options
Setup complete.
SQL queries complete.
OS commands complete.
Disconnected from Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 – 64bit Production
With the Partitioning, OLAP, Advanced Analytics and Real Application Testing options
DBSAT Collector completed successfully.
Calling /u01/app/oracle/product/12.1.0.2/db_1/bin/zip to encrypt report.json…
Enter password:
Verify password:
adding:report.json (deflated 86%)
zip completed successfully.
2. Running DBSAT Collector.
$ ./dbsat report /DBSAT
[oracle@ssssss DBSAT]$ ./dbsat report /DBSAT
Database Security Assessment Tool version 2.0.2 (May 2018)
This tool is intended to assist in you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company’s policies.
Archive: report.zip
[report.zip] report.json password:
inflating: report.json
DBSAT Reporter ran successfully.
Calling /usr/bin/zip to encrypt the generated reports…
Enter password:
Verify password:
adding: report_report.txt (deflated 78%)
adding: report_report.html (deflated 84%)
adding: report_report.xlsx (deflated 3%)
adding: report_report.json (deflated 82%)
zip completed successfully.
3. Running the Discoverer.
Running the Discoverer
export JAVA_HOME=/usr/java/jdk1.8.0_178
[oracle@ssssss DBSAT]$ ./dbsat discover -c Discover/conf/dbsat.config PRODCLN
Database Security Assessment Tool version 2.0.2 (May 2018)
This tool is intended to assist in you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company’s policies.
Enter username: system
Enter password:
DBSAT Discover ran successfully.
Calling /usr/bin/zip to encrypt the generated reports…
Enter password:
Verify password:
zip warning: prime_report.zip not found or empty
adding: PRODCLN_discover.html (deflated 84%)
adding: PRODCLN_discover.csv (deflated 82%)
Zip completed successfully.
Unzip the Report
[oracle@ssssss DBSAT]$ ls -lrt
total 400
-r-xr-xr-x. 1 oracle oinstall 28216 Dec 21 2017 sat_analysis.py
-r-xr-xr-x. 1 oracle oinstall 248371 Apr 13 05:03 sat_reporter.py
-r-xr-xr-x. 1 oracle oinstall 12839 May 1 20:07 dbsat
-r-xr-xr-x. 1 oracle oinstall 12771 May 18 12:32 dbsat.bat
-r-xr-xr-x. 1 oracle oinstall 43796 May 31 14:53 dbsat_collector.sql
drwxr-xr-x. 5 oracle oinstall 4096 Jul 4 23:49 Discover
-r——–. 1 oracle oinstall 25095 Jul 5 00:34 dbsatsat_analysis.pyc
drwxr-xr-x. 2 oracle oinstall 4096 Jul 5 00:34 xlsxwriter
-rw——-. 1 oracle oinstall 68 Jul 5 01:27 discoverer.log
-rw——-. 1 oracle oinstall 9330 Jul 5 01:28 PRODCLN_report.zip
[oracle@ssssss DBSAT]$ unzip PRODCLN_report.zip
Archive: PRODCLN_report.zip
[prime_report.zip] PRODCLN_discover.html password:
inflating: PRODCLN_discover.html
inflating: PRODCLN_discover.csv
[oracle@ssssss DBSAT]$ ls -lrt
total 460
-r-xr-xr-x. 1 oracle oinstall 28216 Dec 21 2017 sat_analysis.py
-r-xr-xr-x. 1 oracle oinstall 248371 Apr 13 05:03 sat_reporter.py
-r-xr-xr-x. 1 oracle oinstall 12839 May 1 20:07 dbsat
-r-xr-xr-x. 1 oracle oinstall 12771 May 18 12:32 dbsat.bat
-r-xr-xr-x. 1 oracle oinstall 43796 May 31 14:53 sat_collector.sql
drwxr-xr-x. 5 oracle oinstall 4096 Jul 4 23:49 Discover
-r——–. 1 oracle oinstall 25095 Jul 5 00:34 sat_analysis.pyc
drwxr-xr-x. 2 oracle oinstall 4096 Jul 5 00:34 xlsxwriter
-rw——-. 1 oracle oinstall 68 Jul 5 01:27 discoverer.log
-rw——-. 1 oracle oinstall 41026 Jul 5 01:28 PRODCLN_discover.html
-rw——-. 1 oracle oinstall 13076 Jul 5 01:28 PRODCLN_discover.csv
-rw——-. 1 oracle oinstall 9330 Jul 5 01:28 PRODCLN_report.zip
  • January 23, 2019 | 20 views
  • Comments