Oracle FAQ Your Portal to the Oracle Knowledge Grid
HOME | ASK QUESTION | ADD INFO | SEARCH | E-MAIL US
 

Home -> Community -> Usenet -> c.d.o.server -> Re: Restricting user access to a database?

Re: Restricting user access to a database?

From: Mark D Powell <Mark.Powell_at_eds.com>
Date: 15 Jul 2003 07:13:47 -0700
Message-ID: <2687bb95.0307150613.4146c578@posting.google.com>


tim.kearsley_at_milton-keynes.gov.uk (Tim Kearsley) wrote in message news:<725736ef.0307150247.72d6f12e_at_posting.google.com>...
> Hi all,
>
> We have a situation here where a number of users access an Oracle
> 8.1.7.2 database running on AIX 4.3.3 on RS6000 hardware. The clients
> use PCs running an Oracle Forms application on Windows 2000.
>
> Suddenly, out of the blue, management has got worried about users
> making "unauthorised" access to the database by running SQLPlus and
> issuing their own queries (or updates, inserts etc.). I've therefore
> been asked as to how users' access can be restricted to just using the
> application.
>
> I have responded initially by making the point that if the client PCs
> have suitable ODBC drivers installed (and I believe they do) then
> access could be by a whole range of applications - Microsoft's Word,
> Excel and Access are obvious candidates.
>
> So, the question:
>
> Do you see any way of restricting the users to only accessing the
> database through the "authorised" application? I don't believe
> de-installing ODBC and SQLPLus on every client is an option and I
> don't see how anything can be done at the server end. After all, a
> SQLNet connection is all the database sees and I presume it doesn't
> "know" whether that connection originates from a Forms application or
> SQLPlus or anything else?
>
> Any thoughts very welcome.
>
> Regards,
>
> Tim Kearsley
> Database Manager
> Milton Keynes Council

Tim, look at the v$session.program column. You could code a database logon event trigger to check the program in use. Depending on your exact circumstances you could then request kills for sessions that do not meet requiremts for the values in machine (source of connection), program (what is being run), username (oracle user id), osuser (OS user id), and/or other applicable columns. You cannot issue an alter system kill session from the event trigger against the current session, but will have to dbms_jobs, a deamon program etc... to issue the command.

This problem has been discussed several time in metalink and might be worth a check at the Oracle support archives: metalink.oracle.com

HTH -- Mark D Powell --

 running running certain programs such as SQLPlus and Received on Tue Jul 15 2003 - 09:13:47 CDT

Original text of this message

HOME | ASK QUESTION | ADD INFO | SEARCH | E-MAIL US