Re: Help: How is password hashed in Oracle?

joebayer wrote:
> I am using Oracle 9206.
>
> One of the requests from my manager is asking me to provide all the users
> who is using the user_name as their password.
>
> But in DBA_USERS, password column is hashed, how could I get that list?
>
> I remember in Oracle, password is hashed by dbms_system.hash, or something
> like that, could anybody provide some help?
>
> Thanks
>
>

Why not do this:

spool test_password.sql
SELECT 'CONNECT '||username||'/'||username FROM dba_users; spool off
spool test_password.out
@test_password
spool off

This will attempt to connect to every user with the password as their username. Review the test_password.out file to see if you were able to connect.

Once you know who is not using a "good" password, get the issue fixed. Then implement a password verification function to ensure that this never happens again.

HTH,
Brian

-- 
===================================================================

Brian Peasland
oracle_dba_at_nospam.peasland.net
http://www.peasland.net

Remove the "nospam." from the email address to email me.


"I can give it to you cheap, quick, and good.
Now pick two out of the three" - Unknown