How to block Sql Plus sessions in Oracle 10g

Question

Hi,
I want to block all sql plus sessions in oracle 10g, as we have a application and we need each and every one to use this application not the sql plus session.
Kindly update us as soon as possible. and also thanks in advanced.

Answer 1

Understand the concept Karl, but a layered defense seldom works in the IP world. If I manage to get through the firewall, then how can you prevent me access, at IP level, at any other ISO stack layer? If you manage to get through, then your firewall policies could just be too weak :) at least you must have some kind of an IDS infrastructure in place..
what I mean is, you can have infinite number of threats.. and this will be part of your Risk Analysis. Determining all possible threats to the assets, what are being protected and their associated value, and predicting the rate of occurrence.... with all of these you could probably come up with contingency plans and incident response.. And most of all, you should not ignore the fact that people are creative, ingenious, and curious, and they'll prove this to you by testing your security implementations. So you'll have to periodically evaluate your security.. that's why there are audits.. Also, you must balance Security, Performance, Usability, and your Budget.
Yes, you can argue that if the entire firewall goes down (thus no IP defense), then something like DBV (or even denying IPs in sqlnet) can provide some defense. But is that not then a case of too little too late? It's better too little too late, than no protection at all... Imagine if there's no DBV, or if you have not implemented the concept of "Least Privilege"? or if the backups and exports are not encrypted? That would be more devastating.. that's the importance of database security options and features in providing "defense in depth"
I question just what purpose and how effective IP packet security is at higher layers. It can never substitute doing this instead at firewall level. Well, it's not all about network security. All facets must be considered and the inter-relationships should be understand. Like the core information security and access management, physical and personnel security, training them, etc... And all of these are equally important in providing a secure ecosystem
As for security that relies on the client to pass secure data (like executable name or o/s user name)... all this can easily be spoofed. Even if the app and Oracle driver are somehow digitally signed and these signatures can be verified on the server side, we only need to look at Vista to see how secure this really would be. Microsoft attempted to encrypt every single h/w and s/w layer from the physical DVD track to the pixel on the monitor.. and this was defeated. And this was done as o/s kernel level. It is less complex to hack at driver level and even trivial to do it at application level.Security is about risk management. Blocking SQL*Plus does not negate the risk of SQL from the wild being run on a production server. For example, the client is a VB client using ODBC. It is easy to create a proxy that accepts the ODBC connection from the VB client and proxy the OCI packets to the real Oracle server. Now you have a man-in-the-middle than can inspect every single SQL call made to Oracle, and inject any PL/SQL or SQL code it wants.
Security is far beyond writing a login trigger to deny SQL*Plus sessions and calling that a defense. >
Yes I agree with you. That's why there are independent organizations and regulating bodies that provides security best practices, to give us a headstart on comming up of strong security policies.
And one of my favorites is the one provided by IASE (sponsored by Defense Information Systems Agency) where there's lot of content regarding hardening and policies
http://iase.disa.mil/stigs/stig/index.html
http://iase.disa.mil/stigs/checklist/index.html
http://iase.disa.mil/stigs/SRR/index.html
- Karl Arao
http://karlarao.wordpress.com