Enforcing Password Strength and Profile Settings in Amazon RDS for Oracle

Managing the security of database users is essential for safeguarding sensitive data. Amazon RDS for Oracle provides tools and procedures to enforce password strength and manage profile settings effectively. This article outlines the process of creating custom password policies, setting up profiles, and managing password encryption for Oracle users on Amazon RDS.

Profiles and Password Management in Oracle

Oracle Database uses profiles to enforce resource limits and password policies for user accounts. With Amazon RDS, you can create and customize profiles and leverage custom password verification functions to enforce robust password policies.

Setting Up Custom Password Verification

Amazon RDS for Oracle supports the rdsadmin.rdsadmin_password_verify.create_verify_function procedure to create password verification functions. These functions enforce specific password requirements for database users.

Parameters of `create_verify_function`

The create_verify_function procedure allows you to specify password rules. Below are the parameters:

Parameter	Type	Default	Description
`p_verify_function_name`	`varchar2`	—	The name of the custom function (required).
`p_min_length`	`number`	8	Minimum password length.
`p_max_length`	`number`	256	Maximum password length.
`p_min_letters`	`number`	1	Minimum number of letters.
`p_min_uppercase`	`number`	0	Minimum number of uppercase letters.
`p_min_lowercase`	`number`	0	Minimum number of lowercase letters.
`p_min_digits`	`number`	1	Minimum number of digits.
`p_min_special`	`number`	0	Minimum number of special characters.
`p_min_different_chars`	`number`	3	Minimum different characters from the old password.
`p_disallow_username`	`boolean`	`true`	Disallow the username in the password.
`p_disallow_reverse`	`boolean`	`true`	Disallow the reverse of the username.
`p_disallow_db_name`	`boolean`	`true`	Disallow the database or server name.
`p_disallow_simple_strings`	`boolean`	`true`	Disallow simple strings as passwords.
`p_disallow_whitespace`	`boolean`	`false`	Disallow whitespace characters in the password.
`p_disallow_at_sign`	`boolean`	`false`	Disallow the `@` character in the password.

Example: Creating a Custom Password Verification Function

The following example creates a password verification function named CUSTOM_PASSWORD_FUNCTION with specific password policies:

BEGIN
    rdsadmin.rdsadmin_password_verify.create_verify_function(
        p_verify_function_name => 'CUSTOM_PASSWORD_FUNCTION', 
        p_min_length           => 12, 
        p_min_uppercase        => 2, 
        p_min_digits           => 1, 
        p_min_special          => 1, 
        p_disallow_at_sign     => true
    );
END;
/

This function enforces:

A minimum password length of 12 characters.
At least 2 uppercase letters, 1 digit, and 1 special character.
Disallowing the @ character in passwords.

Viewing and Managing Custom Password Functions

To view the contents of a password function, query the DBA_SOURCE view:

COL TEXT FORMAT a150

SELECT TEXT 
  FROM DBA_SOURCE 
 WHERE OWNER = 'SYS' 
   AND NAME = 'CUSTOM_PASSWORD_FUNCTION' 
 ORDER BY LINE;

To assign the function to a user profile, use the ALTER PROFILE command:

sqlCopyEditALTER PROFILE DEFAULT LIMIT PASSWORD_VERIFY_FUNCTION CUSTOM_PASSWORD_FUNCTION;

To check which profiles are associated with a specific verification function, query the DBA_PROFILES view:

SELECT * 
  FROM DBA_PROFILES 
 WHERE RESOURCE_NAME = 'PASSWORD' 
   AND LIMIT = 'CUSTOM_PASSWORD_FUNCTION';

Setting and Managing Password Encryption

Password encryption is another critical layer of security. Oracle RDS supports encrypted password storage using Oracle’s native capabilities.

Steps to Enable Password Encryption:

Ensure Database Compatibility: Verify that your database supports the SHA-2 hashing algorithm for password encryption.
Set Encryption Algorithm:
- Use the PASSWORD_VERSION parameter in Oracle to determine which encryption algorithms are enabled.
- Modify the parameter as required using SQL:

sqlCopyEditALTER SYSTEM SET SEC_CASE_SENSITIVE_LOGON = TRUE;

Enforce Password Expiry: Rotate passwords regularly to minimize risks.

Best Practices for Password Security in RDS

Enable Strong Password Policies: Use custom password verification functions to enforce complexity rules.
Regularly Audit Profiles: Periodically review profiles to ensure compliance with security standards.
Automate Monitoring: Use Amazon RDS event notifications to alert administrators about security violations, such as repeated failed login attempts.
Restrict Access: Limit privileged account access to reduce the risk of compromised credentials.

Conclusion

Enforcing password strength and managing user profiles in Amazon RDS for Oracle helps protect sensitive data and ensures compliance with organizational security policies. By leveraging Oracle’s profile management features and Amazon RDS procedures like create_verify_function, you can define robust password policies tailored to your environment’s needs.