Oracle 数据库安全评估（DBSAT）简明过程

下载DBSAT

从这里下载。

实际是从MOS中下载，即：Oracle Database Security Assessment Tool (DBSAT) (Doc ID 2138254.1)。

最新版本为3.1.0 (July 2024)，名为dbsat.zip，近45MB。

bash 复制代码

$ ls -lh dbsat.zip
-rw-rw-r-- 1 oracle oinstall 45M Mar 21 03:40 dbsat.zip

DBSAT支持的操作系统包括LInux，Windows，IBM AIX，HP-UX和Solaris。

支持的数据库为11.2.0.4或以上。

安装DBSAT

文档参见这里。

以oracle用户登入。

bash 复制代码

mkdir ~/dbsat
unzip dbsat.zip -d ~/dbsat

解压目录概况：

bash 复制代码

$ cd ~
[oracle@xy23ai ~]$ du -h dbsat
796K    dbsat/xlsxwriter
232K    dbsat/Discover/conf
4.5M    dbsat/Discover/lib
60K     dbsat/Discover/bin
4.8M    dbsat/Discover
50M     dbsat

可执行程序都在dbsat里，因此可加入到PATH路径。

bash 复制代码

export PATH=$PATH:/home/oracle/dbsat

使用 DBSAT

DBSAT 可生成2类报告：

Oracle 数据库安全评估报告
Oracle 数据库敏感数据评估报告

收集器（Collector）和报告器（Reporter）用于生成"Oracle 数据库安全评估报告"。收集器收集数据，报告器分析收集器收集的数据。其架构如下：

发现器生成"Oracle 数据库敏感数据评估报告"。其架构如下：

运行DBSAT，OS用户通常用oracle，数据库用户通常用system（也可以用一特定用户，但需要赋权）。

DBSAT语法概览：

bash 复制代码

$ ./dbsat --help

Database Security Assessment Tool version 3.1 (July 2024)

    Usage: dbsat collect [ -n ] <database_connect_string> <output_file>
           dbsat report [ -a ] [ -n ] [ -g ] [ -x <section> ] [ -u <user> ] <input_file>
           dbsat discover [ -n ] -c <config_file> <output_file>

    Options:
       -a  Report with all user accounts, including locked and schema-only,
           Oracle-supplied users
       -n  No encryption for output
       -g  Show all grants including Common Grants in a Pluggable Database
       -x  Specify sections to exclude from report (may be repeated for
           multiple sections)
       -u  Specify users to exclude from report
       -c  Configuration file for discoverer

运行收集器

收集器必须在包含数据库的服务器上运行，因为它会执行一些操作系统命令来收集无法从数据库中获取的进程和文件系统信息。此外，必须以对 ORACLE_HOME 下的文件和目录具有读取权限。

收集器大部分的数据都来自数据库的系统视图。

运行示例：

bash 复制代码

$ ./dbsat collect system@orclpdb output_orclpdb1

Database Security Assessment Tool version 3.1 (July 2024)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Connecting to the target Oracle database...


SQL*Plus: Release 19.0.0.0.0 - Production on Fri Mar 21 05:28:21 2025
Version 19.16.0.0.0

Copyright (c) 1982, 2022, Oracle.  All rights reserved.

Enter password:

Last Successful login time: Fri Mar 21 2025 04:11:55 +00:00

Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.16.0.0.0

Setup complete.
SQL queries complete.
Warning: Exit status 256 from OS rule: dbcs_status
/bin/cat: /u01/app/oracle/product/19c/dbhome_1/network/admin/cman.ora: No such file or directory
Warning: Exit status 256 from OS rule: cman.ora
/bin/cat: /u01/app/oracle/product/19c/dbhome_1/ldap/admin/fips.ora: No such file or directory
Warning: Exit status 256 from OS rule: fips1.ora
/bin/cat: /fips.ora: No such file or directory
Warning: Exit status 256 from OS rule: fips2.ora
/bin/ls: cannot access '/u01/app/oracle/product/19c/dbhome_1/rdbms/log/diag': No such file or directory
Warning: Exit status 512 from OS rule: diag_dest_home
OS commands complete.
Disconnected from Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.16.0.0.0
DBSAT Collector completed successfully.

Calling /u01/app/oracle/product/19c/dbhome_1/bin/zip to encrypt output_orclpdb1.json...

Enter password:加密输出zip包的口令
Verify password: 加密输出zip包的口令
  adding: output_orclpdb1.json (deflated 79%)
zip completed successfully.

这一步生成了一个zip包output_orclpdb1.zip，此zip包只包含一个json文件：

bash 复制代码

$ unzip -l output_orclpdb1.zip
Archive:  output_orclpdb1.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
   443823  03-21-2025 05:28   output_orclpdb1.json
---------                     -------
   443823                     1 file

运行报告器

收集完后，就可以根据收集的信息生成报告了。报告器的输入可以是JSON文件或经压缩的收集器输出文件。

报告器是一Java程序，因此必须先设置JAVA_HOME，示例如下：

bash 复制代码

$ java -version
java version "1.8.0_341"
Java(TM) SE Runtime Environment (build 1.8.0_341-b10)
Java HotSpot(TM) 64-Bit Server VM (build 25.341-b10, mixed mode)

$ export JAVA_HOME=/usr/java/jdk1.8.0_341-amd64

运行示例：

bash 复制代码

$ ./dbsat report output_orclpdb1

Database Security Assessment Tool version 3.1 (July 2024)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Archive:  output_orclpdb1.zip
[output_orclpdb1.zip] output_orclpdb1.json password: 解压收集器输出包的密码
  inflating: output_orclpdb1.json
DBSAT Reporter ran successfully.

Calling /usr/bin/zip to encrypt the generated reports...

Enter password: 压缩报告器输出包的密码
Verify password: 压缩报告器输出包的密码
        zip warning: output_orclpdb1_report.zip not found or empty
  adding: output_orclpdb1_report.txt (deflated 74%)
  adding: output_orclpdb1_report.html (deflated 83%)
  adding: output_orclpdb1_report.xlsx (deflated 2%)
  adding: output_orclpdb1_report.json (deflated 80%)
zip completed successfully.

此命令生成压缩包output_orclpdb1_report.zip。其内容如下：

bash 复制代码

$ unzip -l output_orclpdb1_report.zip
Archive:  output_orclpdb1_report.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
   152422  03-21-2025 05:35   output_orclpdb1_report.txt
   262187  03-21-2025 05:35   output_orclpdb1_report.html
    40085  03-21-2025 05:35   output_orclpdb1_report.xlsx
   192868  03-21-2025 05:35   output_orclpdb1_report.json
---------                     -------
   647562                     4 files

其中输出了4种格式的报告，内容相同，格式不同。建议使用HTML格式的报告。

运行发现器

发现器用来分析数据库敏感数据。发现器的全称应是敏感数据发现器。

和收集器和报告器不同，连接数据库的信息需写在Discover/conf目录下的配置文件中。

由于只需连接数据库，因此发现器运行的位置可以和数据库主机不同。

例如，你可以拷贝实例配置文件并修改：

bash 复制代码

cd Discover/conf
cp sample_dbsat.config custom_dbsat.config

需要修改的部分如下，其他参数使用默认：

bash 复制代码

TNS_ADMIN = /u01/app/oracle/product/19c/dbhome_1/network/admin
NET_SERVICE_NAME = orclpdb

运行示例：

bash 复制代码

$ ./dbsat discover -c Discover/conf/custom_dbsat.config orclpdb1

Database Security Assessment Tool version 3.1 (July 2024)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Enter username: system
Enter password:
DBSAT Discover ran successfully.
Calling /usr/bin/zip to encrypt the generated reports...

Enter password: 压缩输出文件的口令
Verify password: 压缩输出文件的口令
        zip warning: orclpdb1_report.zip not found or empty
  adding: orclpdb1_discover.html (deflated 72%)
  adding: orclpdb1_discover.csv (deflated 30%)
Zip completed successfully.

输出中包含2个文件：

bash 复制代码

$ unzip -l orclpdb1_report.zip
Archive:  orclpdb1_report.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
    11312  03-21-2025 06:12   orclpdb1_discover.html
      137  03-21-2025 06:12   orclpdb1_discover.csv
---------                     -------
    11449                     2 files

以下为基于Oracle 19c Sample schema生成的报告：