Re: Question re security
- From: Fergal Taheny <ftaheny@xxxxxxxxx>
- To: dbvision@xxxxxxxxxxxx
- Date: Fri, 17 Jan 2014 09:19:27 +0000
Hi,
Just on this point:
"Using that port is
an open avenue for any hacker worth his/her salt to run a sniffer in a
Linux node to get all Oracle pwds."
This is something I have wondered about. The oracle passwords are
envcrypted during transmission by default with standard sqlnet setup. I
checked this with a packet sniffer once to confirm this but I have wondered
if this encryption is reliable. No pre-sharing of any keys has to be done
before a client can connect to a db. So as part of the authentication does
the server send the client a key which the client uses to encrypt the
password? If this is the case the isn't this open to a man in the middle
attack?
Would be interested to hear people opinions on this.
Thanks,
Fergal
Other related posts:
