Database Security Assessment Tool (DBSAT)
The Oracle Database Security Assessment Tool (DBSAT) is a command line tool that evaluates your environment and provides recommendations on how to mitigate risks. DBSAT runs from your Oracle database server itself. If Oracle security is important to your environment this is the tool to start with.
The examples here use oradb for the database name. Change this to match your environment.
- Ensure Python Version 2.6 or later installed.
- Ensure env vars set: ORACLE_BASE, ORACLE_HOME and ORACLE_SID
- From MOS go to Doc ID 2138254.1 to download dbsat.zip and copy to your database server /tmp directory.
Perform if already installed and upgrading to latest version.
su - mv /u01/app/dbsat /u01/app/dbsat_$(date "+%Y%m%d%H%M")
The above backup directory can be deleted after successful upgrade.
su - mkdir /u01/app/dbsat chown oracle:oinstall /u01/app/dbsat chmod 765 /u01/app/dbsat su - oracle cp /tmp/dbsat.zip /u01/app/dbsat/ cd /u01/app/dbsat/ unzip dbsat.zip
Do not delete dbsat.zip after unzipping!
Init the Collector
Format: dbsat collect <connect_string> <destination>
su - oracle mkdir /u01/app/dbsat/oradb cd /u01/app/dbsat ./dbsat collect -n "/ as sysdba" /u01/app/dbsat/oradb Creates\updates: oradb.json
Create Report Files
Format: dbsat report [-a] [-n] [-x <section>] <pathname>
su - oracle cd /u01/app/dbsat ./dbsat report -n /u01/app/dbsat/oradb
Report files are created in the following formats:
For more examples and a listing of all the parameters go here.
Appendix: Using Ecryption Session Example
mkdir /u01/app/dbsat/oradb cd /u01/app/dbsat oracle> ./dbsat collect system/mypassword@ORADB /u01/app/dbsat/oradb Enter password: Verify password: adding: oradb.json (deflated 89%) zip completed successfully.
The the security files are encrypted. The password prompted for is required to unencrypt it.