Home » RDBMS Server » Server Administration » sys password changed by system (Windows)
sys password changed by system [message #444103] Thu, 18 February 2010 12:55 Go to next message
cristi_Buc
Messages: 12
Registered: February 2010
Location: Bucharest
Junior Member
Here is an article to show a case when SYS password is changed by SYSTEM:

http://www.oracle-home.ro/Oracle_Database/Maintenance/System-can-change-sys-password.html

This behavior is not working on all the environments.

[Updated on: Thu, 18 February 2010 12:58]

Report message to a moderator

Re: sys password changed by system [message #444106 is a reply to message #444103] Thu, 18 February 2010 12:59 Go to previous messageGo to next message
Michel Cadot
Messages: 64103
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
Completly useless article.
Now I understand your 5 previous weak answers, the purpose was just to put a link to your site.

Regards
Michel

[Updated on: Thu, 18 February 2010 13:00]

Report message to a moderator

Re: sys password changed by system [message #444107 is a reply to message #444106] Thu, 18 February 2010 13:00 Go to previous messageGo to next message
cristi_Buc
Messages: 12
Registered: February 2010
Location: Bucharest
Junior Member
Why ?
Re: sys password changed by system [message #444108 is a reply to message #444107] Thu, 18 February 2010 13:01 Go to previous messageGo to next message
Michel Cadot
Messages: 64103
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
In what it is useful?
Anyone knows how to change the password of a user.

Regards
Michel
Re: sys password changed by system [message #444109 is a reply to message #444107] Thu, 18 February 2010 13:02 Go to previous messageGo to next message
cristi_Buc
Messages: 12
Registered: February 2010
Location: Bucharest
Junior Member
You are right, but I want to understand why this is happening. How is possible for another user to change sys password ? Or is that link wrong ? It looks ok.
Re: sys password changed by system [message #444110 is a reply to message #444109] Thu, 18 February 2010 13:04 Go to previous messageGo to next message
cristi_Buc
Messages: 12
Registered: February 2010
Location: Bucharest
Junior Member
Yes, but ... not connected to the DB as a user <> from sys ...
Re: sys password changed by system [message #444111 is a reply to message #444110] Thu, 18 February 2010 13:09 Go to previous messageGo to next message
Michel Cadot
Messages: 64103
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
Anyone that has ALTER USER privilege can do it.

Database SQL Reference
ALTER USER

The only interesting question is "when and why it is not possible, if sometimes it is not possible".

Regards
Michel

[Updated on: Thu, 18 February 2010 13:09]

Report message to a moderator

Re: sys password changed by system [message #444113 is a reply to message #444111] Thu, 18 February 2010 13:49 Go to previous messageGo to next message
cristi_Buc
Messages: 12
Registered: February 2010
Location: Bucharest
Junior Member
You can change the sys password in 10.2 if REMOTE_LOGIN_PASSWORDFILE is set to EXCLUSIVE or NONE.

ALTER USER privilege is found in the DBA role. DBA role is granted to the SYSTEM by default => SYSTEM can change SYS password by default.

Changing SYS password by SYSTEM is possible, and you send me the link to the documentation which underline that this is possible. This is possible, but I find it as a security issue ... What is your opinion ?

Thanks,
Cristi

[Updated on: Thu, 18 February 2010 14:00]

Report message to a moderator

Re: sys password changed by system [message #444144 is a reply to message #444113] Thu, 18 February 2010 21:01 Go to previous messageGo to next message
ramoradba
Messages: 2454
Registered: January 2009
Location: AndhraPradesh,Hyderabad,I...
Senior Member
> I find it as a security issue

It depends on your security implementations.....
Who asked/suggested you to grant all un neccesary privileges and roles to a normal one.
More over if you feel like that you should really read the Oracle documents they will suggest you well...

sriram Smile
Re: sys password changed by system [message #444155 is a reply to message #444113] Thu, 18 February 2010 23:24 Go to previous messageGo to next message
Michel Cadot
Messages: 64103
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
Quote:
This is possible, but I find it as a security issue ... What is your opinion ?

It depends on your environment and policy.
In ours, parameter is set to NONE, SYS password is set to a random 30 characters string, so no one but those that have a local account in OS dba group can connect as SYS.
In addition, no one as DBA role and SYSTEM account is locked.
However, our dbas have of course ALTER USER privilege (through another role) to do their job but they are not allowed to change SYS password (this is logged) and more this is useless for them.

Regards
Michel
Re: sys password changed by system [message #444174 is a reply to message #444144] Fri, 19 February 2010 01:28 Go to previous message
cristi_Buc
Messages: 12
Registered: February 2010
Location: Bucharest
Junior Member
sriram, SYSTEM is not a normal user, you know ...

Michel, thanks for your response (It's clear for me now). Much appreciated.

Cristi
Previous Topic: Oracle Patch Application
Next Topic: indexes to be rebuild
Goto Forum:
  


Current Time: Sat Dec 03 14:09:49 CST 2016

Total time taken to generate the page: 0.16236 seconds