Re: SQL*net and secuity

Dean Mah <dmah_at_acs.ucalgary.ca> writes:

> From the Oracle7 Server Administrator's Guide under the section
> Establishing Security Policies:
>

<Good security ideas snipped.>
>
> Also, in the past, when using SecurID, we were unable to set
> ORA_ENCRYPT_LOGIN to true and have authentication succeed. Encrypting
> the username and passcode seemed to conflict with SecurID and so the
> database would only accept logins when the username and passcode were
> sent in cleartext.

Only passwords are encrypted. Usernames are always sent in the clear.

For reasons having to do with the architecture of Oracle, SecurID passcodes cannot be encrypted. However, this shouldn't be a problem since passcodes change rapidly.

However, it is a small hole and we are working on a fix.

>
> I have since received a newer version of the Advanced Networking Option
> but have not tried it recently.

The problem is still there in the latest version of the Oracle client.

                                        Rick
                                        Rick Wessman
                                        Security and Directory Technologies
                                        Server Technologies
                                        Oracle Corporation
                                        rwessman_at_us.oracle.com