oracledba.help

Database Security Assessment Tool (DBSAT)

<- Security

Overview

The Oracle Database Security Assessment Tool (DBSAT) is a command line tool that evaluates your environment and provides recommendations on how to mitigate risks. DBSAT runs from your Oracle database server itself. If Oracle security is important to your environment this is the tool to start with.

The examples here use oradb for the database name. Change this to match your environment.

Prerequisites

  • Ensure Python Version 2.6 or later installed. python -V
  • Ensure env vars set: ORACLE_BASE, ORACLE_HOME and ORACLE_SID
  • From MOS go to Doc ID 2138254.1 to download dbsat.zip and copy to your database server /tmp directory.

Preupgrade

Perform if already installed and upgrading to latest version.

 su -
 mv /u01/app/dbsat /u01/app/dbsat_$(date "+%Y%m%d%H%M")

The above backup directory can be deleted after successful upgrade.

Installation

 su -
 mkdir /u01/app/dbsat
 chown oracle:oinstall /u01/app/dbsat
 chmod 765 /u01/app/dbsat

 su - oracle
 cp /tmp/dbsat.zip /u01/app/dbsat/
 cd /u01/app/dbsat/
 unzip dbsat.zip

Do not delete dbsat.zip after unzipping!

Usage

Init the Collector

Format: dbsat collect <connect_string> <destination>

 su - oracle
 mkdir /u01/app/dbsat/oradb
 cd /u01/app/dbsat
 ./dbsat collect -n "/ as sysdba" /u01/app/dbsat/oradb
 Creates\updates: oradb.json

Create Report Files

Format: dbsat report [-a] [-n] [-x <section>] <pathname>

 su - oracle
 cd /u01/app/dbsat
 ./dbsat report -n /u01/app/dbsat/oradb

Output Files

Report files are created in the following formats:

  • .html
  • .json
  • .txt
  • .xlsx

Example: oradb_report.html

For more examples and a listing of all the parameters go here.


Appendix: Using Ecryption Session Example

Set Collector

 mkdir /u01/app/dbsat/oradb
 cd /u01/app/dbsat
 oracle> ./dbsat collect system/mypassword@ORADB /u01/app/dbsat/oradb

 Enter password:
 Verify password:
   adding: oradb.json (deflated 89%)
 zip completed successfully.

The the security files are encrypted. The password prompted for is required to unencrypt it.

<- Security