Re: remote_os_authen and security

From: Thomas Kyte <tkyte_at_us.oracle.com>
Date: Tue, 23 Feb 1999 13:52:54 GMT
Message-ID: <36d9b1c6.88534415@192.86.155.100>

A copy of this was sent to Ton Raaijmakers <torgan_at_worldonline.nl> (if that email address didn't require changing) On Tue, 23 Feb 1999 08:52:12 +0100, you wrote:

><!doctype html public "-//w3c//dtd html 4.0 transitional//en">
><html>
>Our application builders uses the /  to  let users login into
>the database.
> For example runform50 / <form>
>They also set the parameter TWO_TASK. Inorder to use TWO_TASK you
> have to set remote_os_authen in the init.ora to yes.
>The result is, from any other host a user can login without a password.
> On a windows 95 pc you can set in your registry a username wich is
>know
> to Oracle, and you don't have to use a password.
>When the users are working from the Unix platform I don't have a problem
>with
> it, because the HAVE to login in Unix.
>If I set remote_os_authen to no then the TWO_TASK is not accepted.
>How can I solve this security issue?
>Thanks,
>Ton Raaijmakers
> Gemeente Dordrecht
>  
>  
>  
>  
>  </html>

Don't use remote_os_authent then... As you have noted, 'secure' little operating systems like win95 let you become whomever you want (don't even need the registry thing, just make up a new login name).

in a network environment where you do not have total control over the machines that can log into the server, don't use remote_os_authent.

The only time it is marginally secure is when

you have a database server
you have a series of client machines (eg: unix machines) that run your application. these machines are maintained by the data center and only the SA's can create accounts
you trust your SA's on these machines
you use the protcol.ora file to allow only THESE machines to connect over sqlnet to your listener.

in that way, a small set of trusted machines can use the / login over the network with remote_os_authent = true. any machine not in the protocol.ora list of allowed machines won't be able to sqlnet in even with a username and password.

Thomas Kyte
tkyte_at_us.oracle.com
Oracle Service Industries
Reston, VA USA

--
http://govt.us.oracle.com/ -- downloadable utilities

Opinions are mine and do not necessarily reflect those of Oracle Corporation Received on Tue Feb 23 1999 - 07:52:54 CST