Compare database password verification both database and Linux

Question

Hi Friends,
oracle11g2 apply database profile with password verification function in Password Management. But some DBA claims apply linux shell script to verify oracle account password during database connection.
Please let me know which methods (database profile with verification function; linux shell script) is best?
each methods benefit and disadvantage in security control? or more information
Thanks
newdba

Answer 1

Oradb wrote:
If consultant does this task for us. which methods is best and reason?It doesn't matter who is implementing it.
If a shell script is enforcing password complexity, you would have to guarantee that no application ever did a password change without calling the script. That seems highly unlikely. Someone will want to change their password using SQL*Plus. Someone will want to change their password via TOAD or some other GUI. Someone will want to change their password using some other front end. A password verification function in the database will be invoked in all of these cases. A shell script will not. Unless you have an exceedingly expensive consultant that is an expert in shell scripting who has no experience whatsoever with PL/SQL and unless you can guarantee that no one today or in the future will want to use any of the established APIs to change their password rather than calling the shell script, use a password verification function.
Of course, if you want to get really technical, you could create a password verification function that, in turn, calls out to an operating system shell script. That would be a hugely overcomplicated architecture but it can be done.
Justin