Re: Security Problem

Insoo Kang wrote:
>
> We have an application that allows you to delete and update records in
> a table. The problem is that a same user can login using sqlplus and
> delete the entire records in a table. In order to prevent this, I
> came up with the following scheme: revoke table access privilege if
> a user is connecting via sqlplus or any other applications.
>
> I can write a trigger that sends a message to a pro*c application that
> revokes table access privilege, but the problem is that v$session is a
> view not a table so I can't write a trigger based on v$session view.
> Does anybody have a suggestion how I can accomplish this whether it be
> through a trigger or some other means?
>
> --Insoo

Have you considered using the PRODUCT_USER_PROFILE table to restrict users when using SQL*Plus? If you run the PUPBLD.SQL script it will create the above table and you can disable commands, (temporarily) revoke role privileges, etc.

-- 
~~~~ Rob Quiles                         rquiles_at_tacticsus.com
~~~ Tactics, Inc.                      rquiles_at_sprintmail.com
~~ Atlanta/Charlotte/Memphis/Orlando
~ http://www.tacticsus.com