Home » RDBMS Server » Security » How to add conditions to user passwords
How to add conditions to user passwords [message #273009] Mon, 08 October 2007 11:23 Go to next message
coolboy2005in
Messages: 12
Registered: July 2007
Location: Herndon
Junior Member
I have oracle 10g release 2. The OS is RHEL4.

I am facing a problem. For SOX compliance our security officer wants user password to have some conditions to make it tougher. So he is asking us about ways by which we can attach conditions to the user passwords. Something like:

The password should have at least 2 numbers, 1 special character and 1 or more character.

Thanks in advance...
Re: How to add conditions to user passwords [message #273030 is a reply to message #273009] Mon, 08 October 2007 15:36 Go to previous messageGo to next message
pablolee
Messages: 2655
Registered: May 2007
Location: Scotland
Senior Member
You are looking at profiles for this sort of thing
Re: How to add conditions to user passwords [message #273038 is a reply to message #273030] Mon, 08 October 2007 18:16 Go to previous messageGo to next message
coolboy2005in
Messages: 12
Registered: July 2007
Location: Herndon
Junior Member
Thanks but can you give me more detail like which parameter/DBMS_package if any is used for this operation.

Re: How to add conditions to user passwords [message #273039 is a reply to message #273009] Mon, 08 October 2007 18:28 Go to previous messageGo to next message
BlackSwan
Messages: 22905
Registered: January 2009
Senior Member
Is GOOGLE broken for you?
Results 1 - 10 of about 2,260,000 for oracle password profile
Re: How to add conditions to user passwords [message #273061 is a reply to message #273039] Tue, 09 October 2007 00:03 Go to previous messageGo to next message
Arju
Messages: 1554
Registered: June 2007
Location: Dhaka,Bangladesh. Mobile:...
Senior Member

anacedent wrote on Tue, 09 October 2007 05:28

Is GOOGLE broken for you?
Results 1 - 10 of about 2,260,000 for oracle password profile


But Google does not serve more than 1000 results for any query..

To see it search for any keyword and then go any page. now change the link

Suppose change from
http://www.google.com.bd/search?q=a&hl=en&start=40&sa=N
to

http://www.google.com.bd/search?q=a&hl=en&start=1000&sa=N
Re: How to add conditions to user passwords [message #273074 is a reply to message #273038] Tue, 09 October 2007 01:08 Go to previous messageGo to next message
Michel Cadot
Messages: 59422
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
CREATE PROFILE

Regards
Michel
Re: How to add conditions to user passwords [message #273078 is a reply to message #273009] Tue, 09 October 2007 01:15 Go to previous messageGo to next message
Arju
Messages: 1554
Registered: June 2007
Location: Dhaka,Bangladesh. Mobile:...
Senior Member

http://download.oracle.com/docs/cd/B19306_01/network.102/b14266/policies.htm#sthref934
Check Sample Password Verification Routine.
Re: How to add conditions to user passwords [message #273145 is a reply to message #273009] Tue, 09 October 2007 03:44 Go to previous messageGo to next message
rikfair
Messages: 22
Registered: October 2006
Location: UK
Junior Member
Hi, This article has a walkthrough on creating a password policy which enforces length and checks it contains alpha and numeric characters.

http://www.astral-consultancy.co.uk/cgi-bin/hunbug/doco.cgi?11140

Hope it helps.
Re: How to add conditions to user passwords [message #273217 is a reply to message #273145] Tue, 09 October 2007 10:09 Go to previous messageGo to next message
coolboy2005in
Messages: 12
Registered: July 2007
Location: Herndon
Junior Member
Thanks rikfair & Arju,

I knew about profile I was just looking for this info not everything about profile.

PASSWORD_VERIFY_FUNCTION: The function used to check password complexity.

I don't get the use of this forum as theoretically Google can give us everything (Remember it even searches oracle documentation).

Thanks for helping me guys and sorry to the geeks who found this topic stupid.
Re: How to add conditions to user passwords [message #273233 is a reply to message #273217] Tue, 09 October 2007 11:09 Go to previous messageGo to next message
Michel Cadot
Messages: 59422
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
Quote:

I knew about profile I was just looking for this info not everything about profile.

If you don't know password_verify_function and other password parameters in profile then you DON'T know profile and reading the whole will provide you with up to date information and learn you many things.

Regards
Michel
Re: How to add conditions to user passwords [message #273241 is a reply to message #273217] Tue, 09 October 2007 12:29 Go to previous message
pablolee
Messages: 2655
Registered: May 2007
Location: Scotland
Senior Member
Quote:

Thanks for helping me guys and sorry to the geeks who found this topic stupid.

coolboy. Exactly where do you get off insulting me (or trying to anyway - I'm proud to be a geek) and the others of this forum who refuse to spoon feed the lazy?! I supplied you with the required search topic which would answer your question. The tone of your op implied that you had no knowledge of Profiles. As Michel points out, if you knew about profiles then you wouldn't have needed to ask how:
Quote:

we can attach conditions to the user passwords. Something like:

The password should have at least 2 numbers, 1 special character and 1 or more character.


You would have known that Profiles would be where you should be looking for such a task. You clearly did not know this. Or presumably, since you know about profiles, it was just that you want spoon fed because you can't be bothered looking at some documentation.

Quote:

I don't get the use of this forum as theoretically Google can give us everything
patently untrue. Apart from the fact that you need to know what to search for, you will not always find the exact answer to your specific situation which may have special circumstances. We have no problem going down to the minutiae but you've got to show that you have at least put in a bit of effort and you're not just expecting others to do your work for you. You asked a very general question. You get a general answer. Read up on the topic you were pointed to, and if you have problems, come back and ask with the specifics of your lack of understanding. If your question is simply
"How do I perform this very general, commonly performed task which is well documented and relatively easily performed" Damn right I'm going to point you in no more than the right direction. If you come back and say
"I've performed these following tasks, I was expecting this result, but that isn't what I'm getting, I'm actually getting XYZ - here is the copy of my session to show what I'm taliking about" you will get both help and respect. At this point, from me, you will get neither.
Previous Topic: ORA-01031
Next Topic: system privilege
Goto Forum:
  


Current Time: Thu Oct 23 17:09:39 CDT 2014

Total time taken to generate the page: 0.09272 seconds