Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently using Oracle 11g on RHEL 5.

I want to disable OS authentication administration on my database because of the security issue. When OS admin user login to OS, and they issue "sqlplus /", they can login to my database. How can I disable this?

Regards,

Sarith

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

This is governed by several things. Generally the default is not to be able to do this. If your users can do this, then it is because your database and users have been set up to allow it.

OS Authentication only works when you have an OS user name compatible with a database account name that has been set up as IDENTIFIED EXTERNALLY By compatible, I mean it has the appropriate OS Authentication prefix.

By default an OS user 'fred' would connect to a database account 'OP$fred'. If such an account doesn't exist, he can't connect. If the account exists but wasn't set with IDENTIFIED EXTERNALLY he can't connect.

It is worth noting that, for some situations, it is a secure mechanism. For example, if you set up cron jobs under OS user 'batch', then you can have a database account for that user which can only be connected to by that OS account. The general alternative to that is having a username/password stored in a config file. Inevitably that file gets read by someone who shouldn't read it, backed up to an insecure location....

Assuming you do want to block them, simply do an ALTER USER batch ACCOUNT LOCK or ALTER USER batch IDENTIFIED BY password;

Note: There is a separate issue about users in the dba group being able to connect with the '/ AS SYSDBA' clause. The simple answer to that is to remove such users from the dba group. If they have sudo/root access, just ask them nicely not to do it. If that doesn't work, you can try AUDIT to track what they do, and get your manager involved.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.