Re: Question about OPS$LOGIN and Oracle Passwords

In article <24727_at_suned1.Nswses.Navy.MIL>, lev_at_ipxed5.nswses.navy.mil (Lloyd E Vancil) wrote:
>
> In article <1992Dec14.200952.22697_at_netcom.com> sjs_at_netcom.com (Stephen Schow) writes:
> >We routinely use the OPS$LOGIN feature of Oracle for all of our users. This
> >way they don't have to worry about anything once they are logged onto the
> >UNIX machine. They just type program / to run it with their UNIX login info.
> >
> >Question:
> >
> >When we create a new user as follows:
> >
> > grant connect to ops$user identified by bogus;
> >
> >and we actually use the word 'bogus' as the oracle password.
> >
 [stuff omitted]  

> >Could a user go into sql*plus with any convienient name and type
> >
> > connect ops$user/bogus
> >
> >to get into that user's oracle accoun
>
>
> Emphatically YES
>
>
> This is a known security hole in the OPS$ user under oracle 6..
 [stuff omitted]>
> Since the OPS$ password need only be used once, in the
> grant command, the dba should be free to use any valid
> password, as long as it follows 2 conventions
> 1. the dba should be THE ONLY PERSON TO KNOW IT.
> 2. each one is unique (within reason here folks)

I disagree with #1. There is no reason for the dba to know these passwords, either. If a DBA really needs to know somebody's password, they can always
change it to something known, then change it back.

You can use a script to set the password to a random value. Or, you can use the VALUES clause to set the encoding of the password, so that the actual password is not known by anyone.

Glad to hear this is fixed in ORACLE 7. Received on Tue Dec 22 1992 - 17:40:53 CET