Oracle Database11g 增加了一组新参数以加强数据库的默认安全性。这些参数是系统范围的静态参数。
（1）使用区分大小写的口令以加强安全性
新参数SEC_CASE_SENSITIVE_LOGON使您可以设置区分大小写的用户口令。Oracle 建议保留默认设置TRUE。将此参数设置为FALSE 可指定不区分大小写的口令以实现向后兼容性。
ALTER SYSTEM SETSEC_CASE_SENSITIVE_LOGON = FALSE
注：禁用区分大小写会使口令在强力攻击面前变得更脆弱。
（2）防止拒绝服务(DoS) 攻击
SEC_PROTOCOL_ERROR_FURTHER_ACTION参数：指定了要对客户机连接执行的操作：继续、断开连接或延迟接受请求。
SEC_PROTOCOL_ERROR_TRACE_ACTION参数：指定了监视操作：NONE、TRACE、LOG 或ALERT。
（3）防止强力攻击
新的初始化参数SEC_MAX_FAILED_LOGIN_ATTEMPTS的默认设置为10，表示在连接尝试达到指定次数后会自动断开连接。即使未启用口令概要文件，也会强制实施此参数。
此参数可以防止程序连接到数据库，然后成百上千次地尝试口令以通过验证。
SEC_PROTOCOL_ERROR_FURTHER_ACTION
SEC_PROTOCOL_ERROR_FURTHER_ACTION specifies the further execution of a server
process when receiving bad packets from a possibly malicious client.
Values:
■ CONTINUE
The server process continues execution. The database server may be subject to a
Denial of Service (DoS) if bad packets cont inue to be sent by a malicious client.
■ (DELAY,integer)
The client experiences a delay of integer seconds before the server process accepts
the next request from the same client co nnection. Malicious cl ients are prevented
from excessive consumption of server resources while legitimate clients experience
a degradation in performance but can continue to function.
■ (DROP, integer)
The server forcefully terminates the client connection after integer cumulative bad
packets. The server protects itself at the ex pense of the client (for example, a client
transaction may be lost). The client may reconnect and attempt the same
operation.
Property Description
Parameter type Integer
Default value 10
Modifiable No
Range of values 1 to unlimited
Basic No
Property Description
Parameter type String
Syntax SEC_PROTOCOL_ERROR_FURTHER_ACTION = { CONTINUE |
(DELAY,integer) | (DROP, integer) }
Default value CONTINUE
Modifiable ALTER SESSION , ALTER SYSTEM
Basic No
SEC_PROTOCOL_ERROR_TRACE_ACTION
1-154 Oracle Database Reference
SEC_PROTOCOL_ERROR_TRACE_ACTION
SEC_PROTOCOL_ERROR_TRACE_ACTION specifies the action th at the database should
take when bad packets are received from a possibly malicious client.
Values:
■ NONE
The database server ignores the bad packets and does not generate any trace files
or log messages.
■ TRACE
A detailed trace file is generated when bad packets are received, which can be
used to debug any problems in client/server communication.
■ LOG
A minimal log message is printed in the alert logfile and in the server trace file. A
minimal amount of disk space is used.
■ ALERT
An alert message is sent to a DBA or monitoring console.
