Re: Special characters in Oracle password
- From: Pete Finnigan <oracle_list@xxxxxxxxxxxxxxxxxxxxxxxxx>
- To: oracle-l@xxxxxxxxxxxxx
- Date: Tue, 12 Oct 2004 13:22:02 +0100
Hi,
If the password is not enclosed in quotes then it can include any
letter, any digit, "_", "#" or "$" characters. Only a letter can be used
in the first character, the other characters can be used after that. If
on the other hand you enclose the password in quotes then you can use
any character in any position. Lets see some examples:
Connected to:
Personal Oracle9i Release 9.2.0.1.0 - Production
With the Partitioning, OLAP and Oracle Data Mining options
JServer Release 9.2.0.1.0 - Production
SQL>
SQL> connect sys/a@sans as sysdba
Connected.
SQL> -- create a user with the valid character set
SQL> create user test01 identified by abc123_$#;
User created.
SQL> -- change his password again with the valid character set
SQL> alter user test01 identified by abc456#_$;
User altered.
SQL> -- try and create a user with a password that does not start
SQL> -- with a letter
SQL> create user test02 identified by 123abc#_$;
create user test02 identified by 123abc#_$
*
ERROR at line 1:
ORA-00988: missing or invalid password(s)
SQL> -- It fails as you should only be able to create a user with
SQL> -- a password starting with a letter
SQL> -- now try with a password starting with one of the three
SQL> -- special characters.
SQL> create user test02 identified by _123abc;
create user test02 identified by _123abc
*
ERROR at line 1:
ORA-00911: invalid character
SQL> -- another failure, this time an invalid character. Now try and
SQL> -- create a user with special characters but not valid ones.
SQL> create user test02 identified by abc123^*;
create user test02 identified by abc123^*
*
ERROR at line 1:
ORA-00922: missing or invalid option
SQL> -- OK, fails again as expected but this time a different error
SQL> -- message. Next try and create a user with any special characters
SQL> -- but this time enclosed in quotes. This should work.
SQL> create user test02 identified by "^*abc£";
User created.
SQL> -- it works as expected. Now try an alter user again with any
SQL> -- special characters.
SQL> alter user test02 identified by "%$ghj^";
User altered.
SQL> -- again it works as expected.
The above examples show that you can use letters, digits and _#$ without
quotes and any character with quotes both for create statements and also
for alter user statements. It is also possible to use control characters
in passwords to make it difficult to use the password on the command
line such as carriage returns.
Kind regards
Pete
--
Pete Finnigan (email:pete@xxxxxxxxxxxxxxxx)
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.
--
//www.freelists.org/webpage/oracle-l
Other related posts:
