Re: Database user Oracle
- From: Jared Still <jkstill@xxxxxxxxx>
- To: smishra_97@xxxxxxxxx
- Date: Thu, 12 Nov 2009 09:30:14 -0800
On Wed, Nov 11, 2009 at 5:44 PM, Sanjay Mishra <smishra_97@xxxxxxxxx> wrote:
>
> Yes it is correct as the DBs are mostly 10g and I check and found that
> select password from dba_users where username='ORACLE'
> EXTERNAL
>
It comes to mind that you may want to check and see if remote authentication
is turned on:
select value from v$parameter
where name = 'remote_os_authent'
If the answer to that query is true, you need to find out ASAP why this user
exists.
If remote_os_authent = true, then any user anywhere on your network could
create a local oracle user on their PC and log on to the database without a
password.
That is assuming something other than windows.
It becomes a little more complicated on windows.
On windows the OSAUTH_PREFIX_DOMAIN registry entry would
also need to be set to FALSE on the server for this to happen.
If not set, then the username on the database would need to be
made up of the following values for remote authentication:
OS_AUTHENT_PREFIX: database parameter
DOMAIN_NAME
USERNAME
for example, OPS$ORACLE\SCOTT
that is assuming OS_AUTHENT_PREFIX is at the default value of "OPS$"
in your case it appears to be ""
IAC, you may want to review dba_audit_session to see just when
this user has been logging on, and where from.
Sorry to go on so long about this, just been using it this week.
Jared Still
Certifiable Oracle DBA and Part Time Perl Evangelist
Oracle Blog: http://jkstill.blogspot.com
Home Page: http://jaredstill.com
Other related posts:
