OraFAQ Forum: Security » Login as sysdba

Home » RDBMS Server » Security » Login as sysdba

Show: Today's Messages :: Polls :: Message Navigator
E-mail to friend

Login as sysdba [message #224968]

Fri, 16 March 2007 03:28

sellafrica
Messages: 68
Registered: July 2005
Location: Braynston

Member

Good Morning.

Is it possible to make sure that one cannot log in like this without a password? If so how.

Thank you in advance

oracle@linux2:~> sqlplus "/as sysdba"
SQL*Plus: Release 9.2.0.1.0 - Production on Thu Mar 15 10:40:51 2007
Copyright (c) 1982, 2002, Oracle Corporation. All rights reserved.
Connected to:
Oracle9i Release 9.2.0.1.0 - Production
JServer Release 9.2.0.1.0 - Production
SQL>

Report message to a moderator

Re: Login as sysdba [message #224974 is a reply to message #224968]

Fri, 16 March 2007 04:06

Mahesh Rajendran
Messages: 10706
Registered: March 2002
Location: oracleDocoVille

Senior Member
Account Moderator

Search the forum before posting.
The topic is been discussed many many times.
To startwith, any OS user in DBA group could login without password.

Report message to a moderator

Re: Login as sysdba [message #226772 is a reply to message #224974]

Mon, 26 March 2007 08:57

sellafrica
Messages: 68
Registered: July 2005
Location: Braynston

Member

Thanks,

SO any use of the password file or setting remote loggin to exclusive will not avoid this?

Report message to a moderator

Re: Login as sysdba [message #226783 is a reply to message #226772]

Mon, 26 March 2007 09:15

Michel Cadot
Messages: 68453
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

Database Vault is the only way.

Report message to a moderator

Re: Login as sysdba [message #226801 is a reply to message #226772]

Mon, 26 March 2007 10:02

ebrian
Messages: 2794
Registered: April 2006

Senior Member

A search of the board should have revealed this.

Report message to a moderator

Re: Login as sysdba [message #226802 is a reply to message #226801]

Mon, 26 March 2007 10:04

Michel Cadot
Messages: 68453
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

On Windows, but the OP works with Linux.

Regards
Michel

Report message to a moderator

Re: Login as sysdba [message #226803 is a reply to message #226802]

Mon, 26 March 2007 10:22

ebrian
Messages: 2794
Registered: April 2006

Senior Member

Michel Cadot wrote on Mon, 26 March 2007 11:04

On Windows, but the OP works with Linux.

Not true. Works for *NIX too. Just need to create a sqlnet.ora file and add that parameter.

Report message to a moderator

Re: Login as sysdba [message #227037 is a reply to message #226803]

Tue, 27 March 2007 03:29

sellafrica
Messages: 68
Registered: July 2005
Location: Braynston

Member

Hi.

Is it any different on 10g because the default is NONE for sqlnet.authentication_services

sqlnet.authentication_services
#
# Syntax: A single value or a list from {beq, none, all, kerberos5,
# cybersafe, radius}
# Default: NONE
#
# Enables one or more authentication services. If
# Oracle Advanced Security has been installed with Kerberos5
# support, using (beq, kerberos5) would enable authentication via
# Kerberos.

Report message to a moderator

Re: Login as sysdba [message #227042 is a reply to message #226803]

Tue, 27 March 2007 03:36

Michel Cadot
Messages: 68453
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

Quote:

Not true. Works for *NIX too.

Thanks for the correction.

Regards
Michel

Report message to a moderator

Re: Login as sysdba [message #227066 is a reply to message #227037]

Tue, 27 March 2007 04:25

ebrian
Messages: 2794
Registered: April 2006

Senior Member

sellafrica wrote on Tue, 27 March 2007 04:29

Is it any different on 10g because the default is NONE for sqlnet.authentication_services

No different on 10g.

If a sqlnet.ora file exists, it will check to see if the parameter sqlnet.authentication_services itself is there. If it's there and nothing is specified, then it will default to NONE.

Report message to a moderator

Re: Login as sysdba [message #227088 is a reply to message #227066]

Tue, 27 March 2007 05:45

Michel Cadot
Messages: 68453
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

I disagree with this.
If I don't have such statement or if value is not set I can connect "/ as sysdba".
If I put it set to NONE I no more can.
My conclusion is that default is not NONE.

> tail -1 sqlnet.ora
sqlnet.authentication_services =
> sqlplus / as sysdba

SQL*Plus: Release 10.2.0.3.0 - Production on Tue Mar 27 12:43:51 2007

Copyright (c) 1982, 2006, Oracle.  All Rights Reserved.

Connected to an idle instance.

SQL>

Regards
Michel

Report message to a moderator

Re: Login as sysdba [message #227090 is a reply to message #227088]

Tue, 27 March 2007 05:53

ebrian
Messages: 2794
Registered: April 2006

Senior Member

Worked on 10.2.0.1.

Try to include parentheses:

sqlnet.authentication_services = ()

As specified in docs, default is NONE.

[Updated on: Tue, 27 March 2007 05:56]

Report message to a moderator

Re: Login as sysdba [message #227103 is a reply to message #227090]

Tue, 27 March 2007 06:09

Michel Cadot
Messages: 68453
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

Ah! OK, works with "()".

Btw, "None" in the "Default" paragraph of the documentation does not mean that the default is "NONE" but there is no default as in the sentence "Default: there is none". See the other parameters, values are in lower case with "code" font. "None" is in mixed case and with the default font.

Regards
Michel

Report message to a moderator

Re: Login as sysdba [message #227117 is a reply to message #227103]

Tue, 27 March 2007 06:26

ebrian
Messages: 2794
Registered: April 2006

Senior Member

Michel Cadot wrote on Tue, 27 March 2007 07:09

Btw, "None" in the "Default" paragraph of the documentation does not mean that the default is "NONE" but there is no default as in the sentence "Default: there is none". See the other parameters, values are in lower case with "code" font. "None" is in mixed case and with the default font.

This is one of those cases where it depends on what you have configured in the sqlnet.ora file.

The parameter is ignored, ie. None of the authentication methods are considered when SQLNET.AUTHENTICATION_SERVICES is not set or set inappropriately in the sqlnet.ora file.

However, when the parameter is set in the file appropriately and there are no authentication methods listed, NONE is the default.

Typical Oracle documentation !!

Report message to a moderator

Re: Login as sysdba [message #227119 is a reply to message #227117]

Tue, 27 March 2007 06:28

Michel Cadot
Messages: 68453
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

Mad

Smile

Michel

Report message to a moderator

Previous Topic:	pasword protected sysdba...Urgent!!!!!
Next Topic:	external_name from dba_users

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Wed May 31 14:11:30 CDT 2023