Re: User Security Question

On 2 Nov, 17:32, HectorTYC <rufus_mi..._at_btinternet.com> wrote:
> Database version: 9.2.0.6.0
> OS = Solaris 8
>
> I currently work for an organisation that continually shoots itself in
> the foot with the large amount of unauthorised changes it makes to the
> production database of the main business application. These changes
> are being made by a motley bunch of devlopers, support analysts ...
> pretty much anyone who feels like it really.
>
> To make matters worse they are doing this using the main schema
> account (please excuse me if I mangle terminology, I'm not a DBA) used
> by the application itself, thus leaving no audit trail of who has made
> these changes. All show as being the application that has made the
> change, rather than some nut with Toad and a cavalier attitude as is
> more often the case. Worse; tracing (?) is not turned on so that info
> is even more limited than it could be.
>
> I am aware of how bad this is m'kay (on any number of levels) but
> until I can persuade/force the organisation to plough resource into
> what is quite a large undertaking, simply changing the password is an
> appealing but not viable option.
>
> As an interim measure I am resigning myself to attempting to force
> people not to use this account using policy and a mixture of begging
> and loud tutting, however I'd be interested to see if anyone out there
> has any clever suggestions as to how I could stop people using the
> application user account without making changes to the account or
> incurring any DB downtime. I did wonder if it was possible to allow
> connections by this user from only a list of trusted sources but our
> DBA thinks this isn't possible.

An all too common problem, I'm afraid. I'm in the process of attempting to introduce best practice at the organisation I work for at the moment too. I feel your pain :)

Generally speaking, only the application written for the database should be logging into a production system. I would get your DBA to look into database logon triggers. Your DBA could write a PL/SQL procedure that checks what application is logging in to the database (e.g. TOAD.EXE, as in your case) and print an appropriate error message before closing the connection. This method isn't foolproof - a determined hacker could simply rename the TOAD executable, for example, but it could well be a start for you.

Good luck.

HTH -g Received on Fri Nov 02 2007 - 14:15:33 CDT