Re: DBA Studio--Don't need password ?

In article <8uiql3$fbp$1_at_nnrp1.deja.com>,   xiaoyangw_at_my-deja.com wrote:
> Hi
>
> I installed a 8.1.6 for NT in a Win2000 server and
> find I can connect to a database via any username&password.
> what I do is as following:
> 1. start DBA Studio from start menu
> 2. check start DBA studio stand alone radio button
> 3. input any string as username & pass, such as 12345/56789
> 4. select role as SYSDBA
> 5 then I can conenct to my database and do everything
>
> if I connect to a database from OMS, I can not login as above.
> Can anyone tell me is this a bug? if not( I think it should not)
> How can I close this door ?
> regards
>
> simon
>
> Sent via Deja.com http://www.deja.com/
> Before you buy.
>

This is not a door, or it is a door you left open. You are probably logged in as administrator on that server. Which means you can connect / as sysdba *by design*. The only thing you could do is check whether you have OS_<SID>_DBA or OS_DBA groups on that NT box. As the special privileges apply to the administrator only, I'm not sure why that is a problem. Don't you trust people logging in as administrator? You can create extra hurdles by removing those groups. However, if an intruder wants to crack that database, he will do so anyway.

Regards,

--
Sybrand Bakker, Oracle DBA

All standard disclaimers apply
------------------------------------------------------------------------


Sent via Deja.com http://www.deja.com/
Before you buy.