Disable "/as sysdba"

Hi,
I need disable "/as sysdba" Authentication in windows server 2003. only given sys as sysdba and password only allow.

by doing this below.
change or add the parameter in the sqlnet.ora file to none
sqlnet.authentication_services = (NONE)
expect correct password no one can access;
try this
then Check;
SQL> SELECT * FROM V$PWFILE_USERS;
try this:-
conn sys/any_password(or)word as sysdba
eg:
conn sys/oracle as sysdba;
connected
conn any_normal_User/pwd as sysdba;
show user;
after changing the sqlnet.ora parameter to none try.
conn any_normal_user/pwd as sysdba;
conn sys/any_pwd as sysdba;
conn sys/correct_pwd as sysdba;
refer the link:
Re: block /as sysdba
Re: changing password for the sys user

Similar Messages

SYS password/Linux OS

hi,
I am new at oracle 10g on linux o/s
My problem is that without giving password i can connect to my database as sysdba. I want that only one password for sysdba ... i can ceate password file but when i create password file then also my problem is not solved as i can connect to database as sysdba without giving password .. i dont know what to do ....help me please ..any one

On any Oracle system this is why maintaining the security of the box is critically important: if someone gets access to the system (via an account in the dba group, or root or other administrative account), they can get into the database.
Lock the server down from a management perspective. This is the default behavior and it would be unwise to change it unless you're in the most robust Operations group I've ever heard of... in which case there'd be no reason to anyway. :) (see point above)
There was a bug I ran into using one of the filesystemio_options parameters on SLES 9 which effectively disabled the sysdba access altogether, but that isn't really a solution either... there may be options in the sqlnet.ora which you can use to restrict the sysdba authentication (I've never used it on non-Windows), but it really doesn't solve the root issue: secure the box, especially as the oracle user (or root) can simply modify this file anyway.
Geoff
EDIT and PS: remote users will require a username and password to access the database, the CONNECT / AS SYSDBA connection only works from the local box.
Message was edited by:
gfalk

Database Vault on RAC

Dear DBAs,
Is it possible to install a new Oracle home for VAULT on a RAC struc. using the existing clusterware handling 3 instances ?
The fact of installing a new clusterware on the same RAC is strange .
Please your help .
Regards

Hi,
You have 2 options to work around the SYSDBA ISSUE :
1. You can disable all of the default Command roles and REALMS - I do it any way on a Database Vault Deployment, I want to full control over the database vault roles and realms.
2. Database vault manual - 9.5.1 Step 1: Enable Logins for the SYSDBA Role - shows you how disable the SYSDBA enforcement (See CUT&PASTE at the bottom of this message)
Checkout my site - [http://www.dbsnaps.com/groups/oracle_security] for useful information about database vault.
9.5.1 Step 1: Enable Logins for the SYSDBA :
To enable the ability to log in using the SYSDBA role:
1. Log in using the Oracle software owner account (usually oracle) to the computer where Oracle Database is installed.
2. Go to the following directory, which is the default location for password files:
cd $ORACLE_HOME/dbs
3. Run the orapwd utility to create two copies of the password file: one with SYSDBA enabled and the second with SYSDBA disabled.
This way, you can enable or disable SYSDBA in the future by simply using the appropriate password file.
First, create a password file that disables SYSDBA:
orapwd file=$ORACLE_HOME/dbs/orapwdSID.sysdba_closed password=pwd nosysdba=y
Do not enter spaces around the equal (=) character.
Next, create a password file that enables SYSDBA:
orapwd file=$ORACLE_HOME/dbs/orapwdSID.sysdba_open password=pwd nosysdba=n
For more information on running orapwd, see "Enable or Disable Connections with the SYSDBA Privilege" in Oracle Database Vault Installation Guide.
4. Copy the password file to the $ORACLE_HOME/dbs directory, which is where Oracle Database checks for the password file.
cp –p orapwdSID.sysdba_open orapwdSID
When you are ready to disable the SYSDBA, you can enter the following command:
cp –p orapwdSID.sysdba_closed orapwdSID

Disable login as sysdba without password

Hi,
we are hosting our environment externally with a hosting company and wanted to know if there was anyway of disabling (from within the database) login "/ as sysdba" without having to provide a password.
The scenario we are trying to avoid is a malicious OS administrator putting themselves into the dba/ora_dba group and then setting the sqlnet.ora parameter SQLNET.AUTHENTICATION_SERVICES = (NTS) and then being able to login to the database without out having to provide a password and being able to view very sensitive data??
any help much appreciated.

It sounds like you have a managed hosting company. You need to discuss with the hosting company what types of access they need in order to perform their management functions and limit the admins at the hosting company to an account that does not allow them to add them selves to the dba/ora_dba group or perform any other functions that you do not wish them to perform.

How can I disable Connect / AS SYSDBA

Hi,
How can I disable
CONNECT / AS SYSDBA
Regards

1) Oracle version?
2) OS?
3) Looks like you're using OS authentication method. Switch to password-file method, and set a meaningful password for sys. You'll need the users which should not login as sysdba out of the OSDBA group, since OS authentication has priority over password file authentication. To setup password file authentication, you'll need the parameter REMOTE_LOGIN_PASSWORDFILE at "EXCLUSIVE". You'll also need to create a password file ("ORAPWD FILE=filename PASSWORD=password ENTRIES=max_users").
HTH
Daniel

Best practice to secure database during patching/upgrade-Vault disabled

I have a highly confidential system and to protect the data in the DB, I intend to use Oracle Vault. In my company, we have centralized services and therefore, the oracle Unix owner and sysdba are owned by this group, not the application dba that "knows" the system (me).
The problem I have is what would be the best way to protect my data from the sysdba user during the window that Vault is disabled?
I thougth maybe I could un-mount and file protect the tablespace from the Unix oracle user during the upgrade process, but the tablespace could be outdated when I remount it after the patch. I am not sure how I might patch it seperatley. I am thinking I might export and drop the schema during the patching, then load it back in when vault is enabled again. This will work for a year or so, but I envision the databases getting too large to do this efficiently.
Does anyone have any thoughts on how I might protect the data in this scenario?
Edited by: user4714217 on Oct 20, 2008 11:06 AM for clarity

Hi,
I did not understood your question properly, but the thing which I understood is like you do not want any other user to access the database when your security vault is disabled.
At that time you can
1) Start the database in restrict mode (only a sysdba can do it).
2) Change the password/lock the user till the time your patching activity is going (any user with dba role can do it, so might be not so useful)
Regards
Anurag Tibrewal

Unable to grant sysdba to user

Hi,
On my PC i am using Redhat 5. when I grant sysdba privilege to user hr it gives an error.
SQL> grant sysdba to hr;
grant sysdba to hr
ERROR at line 1:
ORA-01994: GRANT failed: password file missing or disabled
I check the password file is in place in the folder HOME/dbs. what can be the problem.
Plz help
Thanx

It works for me.
bcm@bcm-laptop:~$ sqlplus
SQL*Plus: Release 11.2.0.1.0 Production on Mon Nov 1 10:39:30 2010
Copyright (c) 1982, 2009, Oracle. All rights reserved.
Enter user-name: / as sysdba
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> grant sysdba to hr;
Grant succeeded.Either you are mistaken or Oracle is.
Either you have an error of omission or error of commission, but without knowing what you have & what you do, no advice is possible.
Is COPY & PASTE broken for you?
Post results of
SELECT * from v$version;

ORAENV file to be disabled

Hi,
Oracle Version:10.2.0.3
Operating system: Linux
Here i have a doubt .I was unable to connect to database with oracle OS user until i run the oraenv file .
How can i disable oraenv file in order to connect to the database with out running the oraenv file.
Please help me.
Thanks & Regards,
Poorna Prasad.S

Hi,
Here is the output for my .batch_profile for oracle user
oracle@virqts1ora001{Primary}:pavs:/home/oracle
$ cat .bash_profile
# .bash_profile
# Get the aliases and functions
if [ -f ~/.bashrc ]; then
        . ~/.bashrc
fi
# User specific environment and startup programs
PATH=$PATH:$HOME/bin:/usr/bin
export PATH
unset USERNAME
export ORACLE_BASE=/home/oracle/oracle
ORACLE_SID=pavs
PS1=`whoami`@`uname -n |awk -F. '{print $1"{Primary}"}'`':${ORACLE_SID}:${PWD}
$ '
# <-- Alias -->
alias sysdba='sqlplus "/ as sysdba"'
alias cdump='cd $ORACLE_BASE/admin/$ORACLE_SID/cdump'
alias dpdump='cd $ORACLE_BASE/admin/$ORACLE_SID/dpdump'
alias scripts='cd $ORACLE_BASE/$ORACLE_SID/scripts'
alias pfile='cd $ORACLE_BASE/admin/$ORACLE_SID/pfile'
alias udump='cd $ORACLE_BASE/admin/$ORACLE_SID/udump'
alias adump='cd $ORACLE_BASE/admin/$ORACLE_SID/adump'
alias bdump='cd $ORACLE_BASE/admin/$ORACLE_SID/bdump'
alias standby='cd $ORACLE_BASE/admin/$ORACLE_SID/standby'
alias monitor='cd /home/oracle/rdbae/bbc4.30-bbpe'
alias archive='cd /u02/arch/PAVS'
echo '***************************************** '
echo '***            List of alias          *** '
echo '***************************************** '
aliasand here is the output for UTPALA user .batch_profile .
oracle@virqts1ora001{Primary}:pavs:/home/oracle
$ su - utpala
Password:
[utpala@virqts1ora001 ~]$ cat .bash_profile
# .bash_profile
# Get the aliases and functions
if [ -f ~/.bashrc ]; then
        . ~/.bashrc
fi
# User specific environment and startup programs
PATH=$PATH:$HOME/bin:/home/oracle/oracle/product/10.2.0/db_1/bin
ORACLE_HOME=/home/oracle/oracle/product/10.2.0/db_1/
export ORACLE_HOME
export PATH
unset USERNAME
[utpala@virqts1ora001 ~]$Thanks & Regards,
Poorna Prasad.S

Two instances installation, grant sysdba failed because passwd file

Hi
I have a two instances Oracle 11g installation.
Instance 1: ORATEST
Instance 2: ORADESA
So, i want add SYSDBA grant to ORADESA system user.
[oracle@oracletesting dbs]$ echo $ORACLE_SID
ORADESA
[oracle@oracletesting dbs]$ echo $ORACLE_HOME
/u01/app/oracle/product/11.2.0.3/desa/dbhome_1
[oracle@oracletesting dbs]$ sqlplus /nolog
SQL> conn /as sysdba
Connected.
SQL> show parameter password;
NAME TYPE VALUE
remote_login_passwordfile string EXCLUSIVE
SQL> grant sysdba to system;
grant sysdba to system
ERROR at line 1:
ORA-01994: GRANT failed: password file missing or disabled
Ok, i recreate passwd file.
[oracle@oracletesting dbs]$ rm $ORACLE_HOME/dbs/orapworaDESA
[oracle@oracletesting dbs]$ orapwd file=$ORACLE_HOME/dbs/orapworaDESA password=xxx entries=5
[oracle@oracletesting dbs]$ ls -all
total 84
drwxr-xr-x. 2 oracle oinstall 4096 Mar 28 10:57 .
drwxr-xr-x. 71 oracle oinstall 4096 Mar 7 16:23 ..
-rw-rw----. 1 oracle oinstall 1544 Mar 26 15:45 hc_oradesa.dat
-rw-rw----. 1 oracle oinstall 1544 Mar 28 10:20 hc_ORADESA.dat
-rw-r--r--. 1 oracle oinstall 2851 May 15 2009 init.ora
-rw-r--r--. 1 oracle oinstall 68 Mar 26 15:45 initORADESA.ora
-rw-r-----. 1 oracle oinstall 24 Mar 26 11:17 lkORADESA
-rw-r-----. 1 oracle oinstall 2048 Mar 28 10:57 orapworaDESA
-rw-r--r--. 1 oracle oinstall 48880 Mar 26 14:15 rmdup_oradesa.dat
-rw-r-----. 1 oracle oinstall 3584 Mar 26 15:14 spfileoradesa.ora
[oracle@oracletesting dbs]$ sqlplus /nolog
SQL*Plus: Release 11.2.0.3.0 Production on Thu Mar 28 10:59:54 2013
Copyright (c) 1982, 2011, Oracle. All rights reserved.
SQL> conn /as sysdba
Connected.
SQL> grant sysdba to system;
grant sysdba to system
ERROR at line 1:
ORA-01994: GRANT failed: password file missing or disabled
Obviously something is wrong, but I do not know.
Thanks

[oracle@oracletesting dbs]$ rm $ORACLE_HOME/dbs/orapworaDESA
[oracle@oracletesting dbs]$ orapwd file=$ORACLE_HOME/dbs/orapworaDESA password=xxx entries=5
[oracle@oracletesting dbs]$ ls -all
total 84
drwxr-xr-x. 2 oracle oinstall 4096 Mar 28 10:57 .
drwxr-xr-x. 71 oracle oinstall 4096 Mar 7 16:23 ..
-rw-rw----. 1 oracle oinstall 1544 Mar 26 15:45 hc_oradesa.dat
-rw-rw----. 1 oracle oinstall 1544 Mar 28 10:20 hc_ORADESA.dat
-rw-r--r--. 1 oracle oinstall 2851 May 15 2009 init.ora
-rw-r--r--. 1 oracle oinstall 68 Mar 26 15:45 initORADESA.ora
-rw-r-----. 1 oracle oinstall 24 Mar 26 11:17 lkORADESA
-rw-r-----. 1 oracle oinstall 2048 Mar 28 10:57 orapworaDESA
-rw-r--r--. 1 oracle oinstall 48880 Mar 26 14:15 _rm_dup_oradesa.dat
-rw-r-----. 1 oracle oinstall 3584 Mar 26 15:14 spfileoradesa.oraYour password file format is wrong. It should be "orapwSID" and yours is "orapworaSID" which is wrong.
Thanks,
Navneet

How to disable RECYCLE BIN functionality on Oracle 10g R2

Hi,
I installed Oracle 10g R2 in windows 2003, then log in SQL * plus with sys as sysdba, try to use the following command to disable the RECYCLE BIN functionality which is new feature in Oracle 10g R2.
SQL> alter system set "_RECYCLEBIN"=FALSE SCOPE=BOTH;
I got the error: illegal option for ALTER SYSTEM
What do I miss? any comments are appreciative.
Grace

SQL> alter system set recyclebin=off;
System altered.
SQL> alter system set recyclebin=on;
System altered.
SQL>Best regards
Maxim

Getting error when I tried to give sysdba to user1 in oracle 10g on solaris

Hi,
I have created a password file orapw<sid>.ora under dbs directory and set the remote_login_passwordfile=exclusive. I am getting the below error when I tried to give sysdba to user1.
ORA-01994 Grant Failed : Password file missing or disabled.
Kindly share your knowledge in this regards.
Thanks,
KarthicK

1. drop the current password file if exists
2 Recreate the password file. The user that will create the password file must be in OS DBA group
Be sure that the user has XWR privileges on that file.
give an fully pathname for the password file, under dbs directory ( not mandatory, but i prefer )
3. recreate the password file and grant privilege to user user1
Let we know

Password file and sysdba grant in 10g on AIX ...

Hi,
I am very familiar with password file, orapwd ...
I installed oracle 10gR2 database on AIX, created a password file using orapwd (file name orapwdSID.ora under $ORACLE_HOME/dbs), set remote_login_passwordfile='EXCLUSIVE' in init.ora file.
1 - When I select * from v$pwfile_users; I get 0 rows !!!
2 - When I try to grant sysdba to an_user; I get ORA-01994: GRANT failed: password file missing or disabled
Cause: The operation failed either because the INIT.ORA parameter REMOTE_LOGIN_PASSWORDFILE was set to NONE or else because the password file was missing.
Action: Create the password file using the orapwd tool and set the INIT.ORA parameter REMOTE_LOGIN_PASSWORDFILE to EXCLUSIVE.
any idea.
thanks.

Hi,
I do not think so that this is a solution. because setting "Shared" means that all databases uses the same password file and only one user "SYS" is in this file (sysdba privilege) ...
Not what I am looking for !
regards.

Cannot disable stats job

SQL> conn / as sysdba
Connected.
SQL> exec DBMS_SCHEDULER.DISABLE('GATHER_STATS_JOB');
BEGIN DBMS_SCHEDULER.DISABLE('GATHER_STATS_JOB'); END;
ERROR at line 1:
ORA-27476: "SYS.GATHER_STATS_JOB" does not exist
ORA-06512: at "SYS.DBMS_ISCHED", line 3429
ORA-06512: at "SYS.DBMS_SCHEDULER", line 2395
ORA-06512: at line 1
SQL> select * from v$version;
BANNER
Oracle Database 11g Release 11.1.0.7.0 - 64bit Production
PL/SQL Release 11.1.0.7.0 - Production
CORE    11.1.0.7.0      Production
TNS for Linux: Version 11.1.0.7.0 - Production
NLSRTL Version 11.1.0.7.0 - Production

SQL> col LOG_USER format a10
SQL> col WHAT format a50
SQL> select JOB,LOG_USER,LAST_DATE,BROKEN,FAILURES,WHAT,NEXT_DATE from dba_jobs;
       JOB LOG_USER   LAST_DATE B   FAILURES
WHAT                                               NEXT_DATE
        27 SYS        15-FEB-10 N          0
wksys.wk_job.invoke(22,44);                        22-FEB-10
        26 SYS        18-FEB-10 N          0
wksys.wk_job.invoke(22,24);                        18-FEB-10
         1 SYSMAN     18-FEB-10 N          0
EMD_MAINTENANCE.EXECUTE_EM_DBMS_JOB_PROCS();       18-FEB-10
       JOB LOG_USER   LAST_DATE B   FAILURES
WHAT                                               NEXT_DATE
      4001 SYS        18-FEB-10 N          0
wwv_flow_cache.purge_sessions(p_purge_sess_older_t 18-FEB-10
hen_hrs => 24);
      4002 SYS        18-FEB-10 N          0
wwv_flow_mail.push_queue(wwv_flow_platform.get_pre 18-FEB-10
ference('SMTP_HOST_ADDRESS'),wwv_flow_platform.get
_preference('SMTP_HOST_PORT'));
       JOB LOG_USER   LAST_DATE B   FAILURES
WHAT                                               NEXT_DATE
        46 SYSMAN     18-FEB-10 N          0
EMD_MAINTENANCE.EXECUTE_EM_DBMS_JOB_PROCS();       18-FEB-10

If sga_target set explicitly, result cache become disabled

hi all,
I am using 11g R2 and automatic memory management. I realized something. if I explicitly declare sga_target parameter in parameter file, result cache become disabled.
as you know if you use automatic memory management, sga_target is set to 0 automatically already but if I write that to the parameter file than whatever I set for result_cache_max_size parameter, instance always opens with result_cache_max_size=0 (I saw that in alert log).
is there any reason for that ?
here is my pfile contents.
orcl.__db_cache_size=922746880
orcl.__java_pool_size=33554432
orcl.__large_pool_size=16777216
orcl.__oracle_base='C:\app\paranoyakX'#ORACLE_BASE set from environment
orcl.__pga_aggregate_target=838860800
orcl.__sga_target=1258291200
orcl.__shared_io_pool_size=0
orcl.__shared_pool_size=251658240
orcl.__streams_pool_size=16777216
*.audit_file_dest='C:\app\paranoyakX\admin\orcl\adump'
*.audit_trail='DB_EXTENDED'
*.compatible='11.2.0.0.0'
*.control_files='C:\app\paranoyakX\oradata\orcl\control01.ctl','C:\app\paranoyakX\flash_recovery_area\orcl\control02.ctl'
*.db_16k_cache_size=0
*.db_4k_cache_size=0
*.db_block_size=8192
*.db_domain='oracle.com'
*.db_flashback_retention_target=1000
*.db_keep_cache_size=0
*.db_name='orcl'
*.db_recovery_file_dest='C:\app\paranoyakX\flash_recovery_area'
*.db_recovery_file_dest_size=10737418240
*.diagnostic_dest='C:\app\paranoyakX'
*.dispatchers='(PROTOCOL=TCP) (SERVICE=orclXDB)'
*.memory_max_target=34359738368
*.memory_target=2097152000
*.nls_language='TURKISH'
*.nls_territory='TURKEY'
*.open_cursors=300
*.pga_aggregate_target=528482304
*.processes=150
*.remote_login_passwordfile='EXCLUSIVE'
*.resource_limit=TRUE
*.undo_tablespace='UNDOTBS1'
*.result_cache_max_size=5000000
*.sga_target=0

I would suggest that you pay more attention to documentation and don't jump to conclusion in a haste. Just because the parameter result_cache_max_size is set to 0, it does not mean that the result cache in itself is disabled. This is the maximum size of the result cache. See below,
[oracle@edbar2p0-orcl ~]$ sqlplus / as sysdba
SQL*Plus: Release 11.2.0.1.0 Production on Thu Jul 14 08:35:00 2011
Copyright (c) 1982, 2009, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
With the Partitioning, Automatic Storage Management, OLAP, Data Mining
and Real Application Testing options
SQL> sho parameter result
NAME                                 TYPE        VALUE
client_result_cache_lag              big integer 3000
client_result_cache_size             big integer 0
result_cache_max_result              integer     5
result_cache_max_size                big integer 1184K
result_cache_mode                    string      MANUAL
result_cache_remote_expiration       integer     0
SQL> show parameter sga
NAME                                 TYPE        VALUE
lock_sga                             boolean     FALSE
pre_page_sga                         boolean     FALSE
sga_max_size                         big integer 460M
sga_target                           big integer 0
SQL> set autot trace exp
selSQL> ect /*+ result_cache */ * from scott.dept;
Execution Plan
Plan hash value: 3383998547
| Id | Operation          | Name                       | Rows | Bytes | Cost (
%CPU)| Time     |
|   0 | SELECT STATEMENT   |                            |     4 |    80 |     3
(0)| 00:00:01 |
|   1 | RESULT CACHE      | 1c13q1afp56bq0jpnmysvywx7g |       |       |
     |          |
|   2 |   TABLE ACCESS FULL| DEPT                       |     4 |    80 |     3
(0)| 00:00:01 |
Result Cache Information (identified by operation id):
   1 - column-count=3; dependencies=(SCOTT.DEPT); name="select /*+ result_cache
*/ * from scott.dept"
SQL> exit
Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
With the Partitioning, Automatic Storage Management, OLAP, Data Mining
and Real Application Testing optionsThe value for the result_cache parameter is automatically set by oracle depending on either you have Memory_target/SGA_TARGET or Shared_Pool parameter set. Please see oracle documentation for more information.
HTH
Aman....

Connect anything/anything as sysdba

We are using Oracle V8174 on Windown 2K platform. How do you prevent the logon from sqlplus like Connect x/y as sysdba? Looks like Oracle do not check your id/pwd and just let anyone logon in as SYS... Are we not setting something right in the database?
following are some of the info setup in my database:
NAME TYPE VALUE
remote_archive_enable string true
remote_dependencies_mode string TIMESTAMP
remote_listener string
remote_login_passwordfile string EXCLUSIVE
remote_os_authent boolean FALSE
remote_os_roles boolean FALSE
USERNAME SYSDB SYSOP
SYS TRUE TRUE
Any information you may have is appreciated?

Find a solution in metalink:
By default in 8.1.x, a new database uses Windows NT Native Authentication by having the following already set in the "sqlnet.ora" file: SQLNET.AUTHENTICATION_SERVICES = (NTS) This allows any privileged user defined in the NT user group (named ORA_<sid>DBA) to login to database without providing a password. To disable this feature and force all users to provide a password, simply comment out the above in the sqlnet.ora file: #SQLNET.AUTHENTICATIONSERVICES = (NTS) [NOTE:77665.1] NT Connecting Without a Password as a Privileged Database User Oracle8i Administrator's Guide Release 8.1 Chapter 1
I just commented out the SQLNET.AUTHENTICATION_SERVICES = (NTS) in sqlnet.ora file, which forces all users to provide a valid password during the login.
Manu, thanks for your response....

Disable "/as sysdba"

Similar Messages

Maybe you are looking for