The Oracle OS_ROLES parameter should be set to FALSE.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2519	DO0240-ORACLE11	SV-24881r2_rule		Low

Description
The OS_ROLES parameter specifies whether Oracle roles are defined and managed by the DBMS or by the host operating system. To maintain and support the separation of duties between host system administration and DBMS administration, the DBMS must be configured to use only roles defined and managed by the DBA. Separation of duties supports assignment of privileges by job function and supports accountability.

Description

The OS_ROLES parameter specifies whether Oracle roles are defined and managed by the DBMS or by the host operating system. To maintain and support the separation of duties between host system administration and DBMS administration, the DBMS must be configured to use only roles defined and managed by the DBA. Separation of duties supports assignment of privileges by job function and supports accountability.

STIG	Date
Oracle Database 11g Instance STIG	2016-12-14

Details

Check Text ( C-29433r2_chk )
From SQL*Plus: select value from v$parameter where name = 'os_roles'; If the value returned is not FALSE, this is a Finding.

Fix Text (F-26462r1_fix)
From SQLPlus: alter system set os_roles = FALSE scope = spfile; The above SQLPlus command will set the parameter to take effect at next system startup.