Re: Question re security

Just on this point:

"Using that port is
an open avenue for any hacker worth his/her salt to run a sniffer in a Linux node to get all Oracle pwds."

This is something I have wondered about. The oracle passwords are envcrypted during transmission by default with standard sqlnet setup. I checked this with a packet sniffer once to confirm this but I have wondered if this encryption is reliable. No pre-sharing of any keys has to be done before a client can connect to a db. So as part of the authentication does the server send the client a key which the client uses to encrypt the password? If this is the case the isn't this open to a man in the middle attack?

Would be interested to hear people opinions on this.

Thanks,
Fergal

--
http://www.freelists.org/webpage/oracle-l