Oracle ebs r12

Best Practices for Securing Oracle E-Business Suite Release 12
Oracle Corporation
Version 1.0.0

Latest version of this document available under Metalink Note 403537.1.

Revision History
Version 1.0.0 Release Date Feb 2007 Descriptions Initial version for Release 12, based on 11i version ML 189367.1

Copyright © 2007 Oracle. All rights reserved. Primary Authors: Erik Graversen, JamesNurthen Contributors: David Kerr, George Buzsaki, Deepak Louis, Andy Philips, Ashok Subramanian, Rajiv Muthyala, Remi Aimsuphanimit, Emily Nordhagen. Excerpts of documents [IntA, IntB] reproduced with permission from Integrigy Corporation. This document is provided for informational purposes only and the information herein is subject to change without notice. Please report any errors herein toOracle Corporation by filing a documentation bug against product code 510, component SEC_COMP. Oracle Corporation does not provide any warranties covering and specifically disclaims any liability in connection with this document. Oracle is a registered trademark. Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA 94065 U.S.A. Worldwide Inquiries: 650.506.7000 Fax 650.506.7200Worldwide Support: http://www.oracle.com/support

ii

Best Practices for Securing Oracle E-Business Suite Release 12

Table of Contents

Overview...............................................................................................................................................................1
System Wide Advice Changes from 11i Hardening Network Authentication AuthorizationAudit Hardening Authentication Authorization Audit Hardening Authorization Audit Hardening Network Authentication Authorization Audit Advanced Audit Hardening Hardening Network Authentication Authorization Maintenance Detect and Prevent Duplicate User Sessions Customize Password Validation Advanced Security/Networking Option (ASO/ANO) Configure Listener on a Non-Default TCP Port Hardening ExternalProcedure (EXTPROC) Services 2 3 5 5 6 7 8 9 9 10 12 15 16 16 17 18 19 22 24 26 29 31 32 33 34 34 37 37 37 38 38

Oracle TNS Listener Security...............................................................................................................................5

Oracle DatabaseSecurity......................................................................................................................................9

Oracle Application Tier Security........................................................................................................................15

E-Business Suite Security...................................................................................................................................17

DesktopSecurity.................................................................................................................................................29 Operating Environment Security ........................................................................................................................31

Extras for Experts...............................................................................................................................................37

Appendix A: Security Setup Forms....................................................................................................................43 Appendix B: Security Setup Forms That Accept SQL Statement......................................................................45 Appendix C: Database Schemas Shipped with E-Business Suite......................................................................47 Appendix D: Processes Used by E-Business Suite.............................................................................................51 Appendix E: Ports Used by E-Business Suite ....................................................................................................53 Appendix F: Sample Linux Hardening of the...