Re: Security problem with SQLPLUS.

From: Michael S. Abbey <masint_at_istar.ca>
Date: 1998/03/10
Message-ID: <3505c11a.80024429@news.istar.ca>#1/1

On Tue, 10 Mar 1998 20:46:12 GMT, Chinmoyee Deshpande <Chin.Deshpande_at_mci.com> wrote:

>when I use SQLPLUS scott/Tiger @test.sql from a UNIX window to connect
>to the database my password and username is getting exposed if someone
>types ps -ef |grep sql. to check all processes. This is a big security
>flaw. How can I fix this problem.
>Thanks,
>-Chin Deshpande
>
>

Chin ...

There are a number of ways to fix this ....

1. Put the username and password in line 1 of the SQL script then invoke program with command "sqlplus @test.sql"
2. Use operating system authentication as documented in the DB Admin Guide so that you can issue the command "sqlplus / @test.sql".

Michael

+------------------------------------
+  Michael S. Abbey    Ottawa Canada
+  Co-author of Oracle8: A Beginner's Guide

+ and 5 other works in the Oracle Press Series

+------------------------------------

Received on Tue Mar 10 1998 - 00:00:00 CST