Re: internal accepts any password

From: Sean M <smckeownNO_at_BACKSIESearthlink.net>
Date: Mon, 15 Apr 2002 15:56:18 GMT
Message-ID: <3CBAF824.23CF2B0E@BACKSIESearthlink.net>

dsmcd wrote:
>
> Using DBA Studio or SQLPlus Worksheet at the server, I can
> connect as internal using any password. Any combination of
> keystrokes will do. It's a rather disturbing thing to watch.
> Using the same tools on client stations requires the proper
> password.

Sounds like you have your db setup for OS authentication, meaning you needn't provide any password at all when connecting internal. Oracle isn't checking the password against a password file, it's only checking which OS group/privs you have. So any password (or none) will do, as long as you're on the db server host with the right privs (or a client machine with a secure connection, if that's configured).

Regards,
Sean Received on Mon Apr 15 2002 - 10:56:18 CDT