Montly changes of schema owner passwords

Hi folks:
Our companies policy is to change schema owner password every month. We have over 200 database and 20 unix servers. Our old process is to go to every server and run some script to change the schema owner password by using a input file containing all the scehma name in each database. Now the process is getting more complicated with DATAGUARD.
I am thinking of storing all these info in a oracle table and have the password encrypted. So every month I can just run one script to change all the schema passwords. What do you think, how do you guys do it??

user4579454 wrote:
The reason DATAGUARD making it more complicated is because we have to change SYS password as well, thus we have to copy over the password file over from Primary to Secondary. We have locked all SYSTEM account in all databases already.Copying the pswd file should be pretty trivial to automate.
As for the others, I'd guess you have a mix of oracle users that are actual humans connecting to the database with their credentials, and oracle users that exist simply to own an application schema. For the first group (the actual humans), I just set password control parameters in the default profile. when their password expires, they are prompted to create a new one when they connect.
the handful of 'schema owning' accounts can be scripted, using a password generating utility to drive the process. For those accounts, does anyone have to actually know the passwords? Does anyone (including DBAs) ever really have a need to actually connect with those usernames? If not, then the process becomes even easier because you have no need to retain the passwords generated by the change script. And if the need to actually connect with one of those accounts exists on a sporadic basis, you could still script the periodic change, and manually change the password to a known value when needed.

Similar Messages

My ipod has had a previous owner How do I change my ipods email address so that when I try to down load anything it asks for the previous owners password but when I go to my account it says its my email my account but not when I try to download????

My ipod has had a previous owner How do I change my ipods email address so that when I try to down load anything it asks for the previous owners password but when I go to my account it says its my email my account but not when I try to download can anyone please help me ????Plus it still has some of the previous owners pictures and videos on it that I want to delete and can't????? Also is there a way to kill the apps that u have used throughout the day the battery doesn't last long at all ??????

- How did you dlete stuff from the iPod? If you have a 1G or 2G iPod and deleted the stuff by going to Settings>Genera.>Reset>Erase aall contents and settings without being connected to a power source, the battery dies before he erase was comleted since it can take hour.
- In any event try the following:
- Connect to a chaging sour for three hours.
- Reset the iPod and then connect to the computer and try to restore va iTunes.
Reset iPod touch: Hold down the On/Off button and the Home button at the same time for at
least ten seconds, until the Apple logo appears.
- Next try placing the iPod in recovery moe and then try to restore. For recovery mode:
iPhone and iPod touch: Unable to update or restore
- Last try DFU made and restore.
How to put iPod touch / iPhone into DFU mode « Karthik's scribblings

Formatting the encrypted hard drive or intalling OS again with PXE boot can change TPM owner password file?

Hello,
1) I realized that when MBAM bitlocker encryption start both Recovery key and TPM owner password file are send to MBAM server. If we change the computername of the notebook, we can find out Recovery key from MBAM server with the KeyID as we can read it from
computer screen, but we can not find out TPM owner password file with the existing new computername information from MBAM server, so we have to know old names of all computers but it is impossible. So we have to do decryption and clearing TPM than we
can again encrypted it with its new name. is it right?
2) We will going to deploy mbam encryption to our notebooks. But sometimes when a person quit the job his notebook can given to another person or new employee and based to our procedure when a notebook will given to another user it should installed
OS again with PXE boot. I would to know will it be enough to installing with this method again with a diffrent computer name or should I firstly clear its TPM than install OS with PXE to keep TPM owner password file missing as item 1?
I hope i can explain what i mean :)
Regards,
SibelM

I would suggest you to first decrypt the laptop and then follow the process:-
- Clear the TPM
- Encrypt the type.
- Check for the encryption behavior.
Cause I have found on some model that if the OS drive is encrypted, PXE boot fail on that machine even though I also did a direct PXE on an encrypted machine with clearing the TPM.
TPM ownership password is a hash file that gets generated with a set of algorithm. SO each time when you PXE boot, by clearing the TPM, the TPM hash password for the TPM will change. This has been done for security measures.
Gaurav Ranjan

HT1222 how can i change the old owners keychain password into mine

how can i change an old owners keychain password into mine so i can update software

Create a new keychain.
I'd generally suggest acquiring and wiping and installing the most recent version of OS X onto the system that it'll support, as you'll spend more time and effort undoing what was done before. You can usually get the proper distro with a call to Apple.
Given the iBook is PPC, you'll be limited to Leopard (10.5) at most, and possibly not that version.

I need help changing the previous owners id and password

I bought a use macbook Lion os-x 10.7.5 software. My apple id and password don't work because the previous owners password is still in there. I have tried to get to the Disc Utility by restarting and holding the control, alt/option and r keys but it just starts up to the normal screen. No disc utility. Any suggestions?
thanks, carl s

If you started holding the Option key, and only saw Macintosh HD rather than that and Recovery, then it seems that Recovery is missing or damaged on your computer. Some models of MacBook will start in Internet Recovery if you use Command Option R; although it seems that yours is not suitable.
If you are able to start in Single User mode (hold Command & S at the chime), then you may be able to follow the steps below to change the password. Print them out first, & make sure that you know the name of the user that you wish to change. This won't alter the AppleID name & password that were used to install previous software, so you may still need to erase & (re)install yourself; starting with the relevant install DVD(s) which are usually available from Apple for around $20, if you call with the serial number.
Start in Single User mode & wait for the :/ root#    prompt to appear
type        mount -uw /        then press enter (the slash is important)
again, wait for the :/ root#    prompt
type    passwd username
then press enter (swapping 'username' for the name you need to change the password for)
You should see
:/ root# passwd username
Changing password for username
New password:
You now type a password, which won't be shown onscreen, then press enter
then you should see
Retype new password:
type the same new password again, then press enter.
wait for the :/ root#    prompt, then type     reboot    & press enter

I just bought a used iPad 2, how do I change the previous owners info for the app store? Whenever I try to buy an app it asks for the previous owners password for the iTunes account. I have my own account Nd would like to use it.

Need help Changing the previous owners settings for the app store. I can't buy any apps. Because it asks for previous owners information.

I had this same problem, and it was erased.
For some really odd reason iPads sometimes retain the last user iTunes account on first visit to the iTunes store.
I am thinking it is actually the iTunes store recognising the iPad, and so 'helping' by showing the last log in settings.
So I would also recommend Erase All Content and Settings to start.
If that was done then what you need to do is log in, or create your own itunes account.
This is in Settings, Store.
create your own iTunes account (or log in with an old one).
Purchase something.
Then (as long as you don't have any app from the last owner on) it should never ask for the old account again.

OPS$, Schema Owner and dbs_ora_schema env variable.

HI All.
Have a situation where we've copied a system from one location to another using an online backup. The database is up and running (open) and lookin good.
However, when I goto start SAP, I get a ORA-1403 and ORA-1017 error on startup. As best as I can tell, the OPS$ mechanism created for the base system (before the online restore) is using SAPSID as the owner. However, the schema owner from the database we used for the recovery is SAPR3.
Now when the system goes to logon, OPS$ is looking to fetch SAPSID as the schema owner, but the effective schema owner is SAPR3. Rerunning the oradbusr. sql script as per note 361641 does not change anything.
<b>Issue is related to the environment variable "dbs_ora_schema" - it is currently set to SAPSID, but I need to change it to SAPR3. Can someone offer the proper syntax to change this value in AIX 5.3?</b>
Thanks,
Tim
Thanks!!
Message was edited by:
Tim Hild

Hello Tim,
What i apprehend is that the SAP<SCHEMA-ID> or the password for the same has changed. When u have copied the db of another SID the SAP<SCHEMA-ID> will be according to the earlier SID so it may required to be renamed as per the new SID and so also the naming services might have changed for which the listner may not work properly. Try to rename the SAP<SCHEMA-ID> and reset the password via brtools. The SQL wont work in case of changing the password of SAP<SCHEMA-ID> . First do it from SQL then reset the password again using Brtools.
Comparing tns.ora and listnr.ora files of both the systems will give u a fair idea on the prob.
In the sap server run BRTOLS from cmd prompt then proceed as follows
Brtools----->Choose Additional Functions--->Choose Change Password of DB user
Enter choice 2(Database User/Password)
In user prompt give sapc11 and in password prompt put the password u had changed earlier ie abc123.
Then enter c (for continue) u will be prompted for the new password
When u put the new password it wont be displayed in the prompt just type
Complete the entire guided process.
Hope this resolves your prob.
Regards.

How can I Change a User's password remotely

Hi all
I setup an iChat Server. I need to allow the users the ability to change their password without physically accessing the server (including via Remote Managment)
Thow some iChat(jabber) Clients support changing the password, the iChat Server does not appear to have this option.
Is there any way to remotely change a user's password ?
A possible solution would be to setup a Webpage allowing the user to logon and change the Password.
Is there any web managment tool on OS X Server for this ?
Any other sugestions?
Thanks,
Best regards

This is getting depressing. I've just speand most of a day getting the OID to support ldaps SSL protocol, since I read that a number of active directory services only allow password change if the connection is encrypted. Finally got my ldaps connection, but the NoPermissionException is still there. The user I'm signing on as is definitely has user security management permissions. I can't seem to modify attributes at all. I added my own optional attribute to the schema, but JNDI can't set it.
Perhaps the oracle LDAP library in jpdk might help, but I'm not hopeful. If I could find any API documentation I might be more moved to try, but I see no setPassword methods in the relavant classes. This just looks like a fairly thin wrapper for JNDI anyway.
Does anyone know where the API doc for oracle.ldap.* is? Has anyone got a password to change other than by the SSO's built in change password dialog?
I'm not hopeful. On these boards I've found many questions along these lines but, thus far, no answers.

How do I find out a former owners password?

How do I get a former owners password to install software?

I booted my Tiger 10.4.11 in single user mode via holding down the command + s when powering on.
/sbin/fsck -fy
/sbin/mount -uw /
passwd user-name
# returned without asking for new password.
# ( did not work )
# ->Start up some utility processes that are needed.
sh /etc/rc
passwd user-name
# asked for new password.
# (worked).
So, the working of passwd has changed over time.
Robert

Changing Login Name and Password

Greetings,
I gave my MacBook Pro to my brother and would like to change the computer owner name, login and password so it comes up as his computer. Where and hos do I do this?
Also, I did a Software Update and was prompted for my user id and password. I would like to change all of these for him. Can I get some help here?
Thank you!

The Computer Name is changed in Sharing preferences.
The owner's long name and account password can be changed in Accounts preferences.
To change the short or user name, however, requires an involved procedure. See the following article and use the last procedure called The Full Monty: Macworld | Changing the short username in Leopard. Alternatively, you can create a new admin user account for your brother with whatever long and short user name he desires. Then log into that new account and delete your old account.

Locking Schema Owner account in oracle

Hi
One of the oracle security policy recommendations is to lock the owning schema in the database. To overcome this issue I suggested to the developer that I can create a new access account with permissions to select ,insert,delete and update data on owning schema. But the developer is insisting that instead of creating that new account, should transfer the objects of the schema owner account to a new account and unlock the schema owner account this way he does not have to make changes to the application on his side...this did not make sense to me ,can some one please shed some light on this?

>
sorry , I meant that when we lock the schema owner ,connecting to the database with that account is denied. What I suggested is to create an access account with SUID priviliges on owning schema data. But the developer insists that I create a new account transfer the objects/data from schema owner to this new account and then unlock the schema owner account. This way he will not have to make changes on the application side,I was not entirely sure how it will benefit him by doing so
>
You still haven't stated what the actual issue is you are trying to address.
From the first post is seemed that your question was 'How can we implement the Oracle security recommendation to lock the application account without actually locking the application account'?
And your proposed solution is to create another account with exactly the same privileges as the schema owner and use that account instead.
That doesn't implement the recommendation. That is an attempt to circumvent the recommendation.
My advice is that if you don't want to actually implement Oracle's recommendation then don't implement it.
And if you do want to implement the recommendation then do so. But none of the options you are suggesting implement it they only circumvent it.
>
One of the oracle security policy recommendations is to lock the owning schema in the database
>
What is the citation for this statement? What reason was given for the recommendation?
One primary reason for using application users (rather than schema users) is to exert positive control over the functionality and data that the application has access to.
A schema owner has access to all objects owned by the schema. Applications typically don't need all of those privileges. A schema owner can create new objects and modify existing objects; applications seldom need to be able to do that.
Within a stored procedure a schema owner still has access to all of the schemas objects but other users/applications only have access granted directly to them and do not have access to objects granted only thru roles.
To properly implement the recommendation you need to create an application user and grant that user the roles and direct grants that are needed for the functionality and data that needs to be accessed. The result is two users: one has full access to the schema objects and the other has limited access. Application code should use the limited user credentials.
What you call the users is up to you. If you want to switch roles and make your current user the limited user and create a new user for the objects and move them all to the new schema go ahead.
But that is a lot of work and validation for you to have to do. The only change a developer should have to make to use a different user is to change the connection information. That should be very simple to do and if it is not it needs to be changed to make it simple.
Based only on the information you have provided it sounds like the developer is just lazy and wants you to have to do all of the work. So the developer needs to make their case as to why they can't just change connection settings and then management can make a decision about which method should be used.
Your work should be to create a new application account that specifically is NOT simply an account superuser but is only granted, either directly or via roles, the specific privileges that the application actually needs. My guess would be that no one actually knows or has documented what privileges are really needed so they just want them all.
The best contribution you could make for security is to resist the super user approach and actuallly push for documentation of the privileges needed and then implement those.
Management and auditors must ALWAYS be able to control and determine who is actually using their data.
I would suggest that you create a new user account account

Schema owner for ECC 5.0 IDES

Hi,
When I am trying to start ECC 5.0, the work processes are dying below is the error.
OS: Windows, DB: Oracle.
Now I'm connected to ORACLE
C *** ERROR => ORA-1403 when accessing table SAPUSER
[dbsloci.c    10114]
C Disconnecting from connection 0 ...
C Closing user session (con_hdl=0,svchp=0493EFF4,usrhp=07FC1E64)
C Now I'm disconnected from ORACLE
C Try to connect with default password
C Connecting as SAPR3/<pwd>@CC5 on connection 0 ...
C Starting user session (con_hdl=0,svchp=0493EFF4,srvhp=07FB9234,usrhp=07FC1E64)
C *** ERROR => OCI-call 'OCISessionBegin' failed: rc = 1017
[dboci.c      3721]
C *** ERROR => CONNECT failed with sql error '1017'
[dbsloci.c    9750]
B ***LOG BY2=> sql error 1017   performing CON [dbsh#1 @ 1200] [dbsh    1200 ]
B ***LOG BY0=> ORA-01017: invalid username/password; logon denied [dbsh#1 @ 1200] [dbsh    1200 ]
B ***LOG BY2=> sql error 1017   performing CON [dblink#1 @ 419] [dblink 0419 ]
B ***LOG BY0=> ORA-01017: invalid username/password; logon denied [dblink#1 @ 419] [dblink 0419 ]
M ***LOG R19=> tskh_init, db_connect ( DB-Connect 000256) [thxxhead.c   1270]
M in_ThErrHandle: 1
M *** ERROR => tskh_init: db_connect (step 1, th_errno 13, action 3, level 1) [thxxhead.c   9377]
Based on these errors I have looked at Notes: 400241, 50088.
The problem is, even though schema owner is listed as SAPSID, why is SAPR3 being used to connect to Oracle.
I have tried creating the users using note 50088, but to no avail.
I have tried creating the users with schema owner as SAPSID. Above is the error message that I get.
When trying to create the users with owner as SAPR3, I get the below error,
ERROR at line 1:
ORA-00959: tablespace 'PSAPUSER1D' does not exist
ORA-06512: at line 114
Regards,
Vishi

Hi,
I have tried suggestions from you all of you, Thank you.
However the problem still persists. I am quite unable to figure out, why it is showing SAPR3 in wp trace.
Below are the error details from dev_w0 log, trans.log
dev_w0:
Logon as OPS$-user to get SAPR3's password
C Connecting as /@CC5 on connection 0 ...
C Attaching to DB Server CC5 (con_hdl=0,svchp=0493EFF4,svrhp=07FB9234)
C Starting user session (con_hdl=0,svchp=0493EFF4,srvhp=07FB9234,usrhp=07FC1E64)
C Now I'm connected to ORACLE
C *** ERROR => ORA-1403 when accessing table SAPUSER
[dbsloci.c    10114]
C Disconnecting from connection 0 ...
C Closing user session (con_hdl=0,svchp=0493EFF4,usrhp=07FC1E64)
C Now I'm disconnected from ORACLE
C Try to connect with default password
C Connecting as SAPR3/<pwd>@CC5 on connection 0 ...
C Starting user session (con_hdl=0,svchp=0493EFF4,srvhp=07FB9234,usrhp=07FC1E64)
C *** ERROR => OCI-call 'OCISessionBegin' failed: rc = 1017
[dboci.c      3721]
C *** ERROR => CONNECT failed with sql error '1017'
[dbsloci.c    9750]
B ***LOG BY2=> sql error 1017   performing CON [dbsh#1 @ 1200] [dbsh    1200 ]
B ***LOG BY0=> ORA-01017: invalid username/password; logon denied [dbsh#1 @ 1200] [dbsh    1200 ]
B ***LOG BY2=> sql error 1017   performing CON [dblink#1 @ 419] [dblink 0419 ]
B ***LOG BY0=> ORA-01017: invalid username/password; logon denied [dblink#1 @ 419] [dblink 0419 ]
M ***LOG R19=> tskh_init, db_connect ( DB-Connect 000256) [thxxhead.c   1270]
M in_ThErrHandle: 1
Trans.log"
4 ETW000 [dev trc     ,00000] Thu Nov 24 23:48:32 2011                           80178 0.132260
4 ETW000 [dev trc     ,00000] Assigning server context 02C0982C to service context 02C08C24
4 ETW000                                                                              57 0.132317
4 ETW000 [dev trc     ,00000] Allocating user session handle                        47 0.132364
4 ETW000 [dev trc     ,00000] Starting user session (con_hdl=0,svchp=02C08C24,srvhp=02C0982C,usrhp=02C123F4)
4 ETW000                                                                             165 0.132529
4 ETW000 [dboci.c     ,00000] *** ERROR => OCI-call 'OCISessionBegin' failed: rc = 1017
4 ETW000                                                                            6620 0.139149
4 ETW000 [dbsloci.    ,00000] *** ERROR => CONNECT failed with sql error '1017'
4 ETW000                                                                              31 0.139180
4 ETW000 [dev trc     ,00000] Try to connect with default password                  73 0.139253
4 ETW000 [dev trc     ,00000] Connecting as SAPCC5/<pwd>@CC5 on connection 0 ...
4 ETW000                                                                              27 0.139280
4 ETW000 [dev trc     ,00000] Assigning username to user session 02C123F4           19 0.139299
4 ETW000 [dev trc     ,00000] Assigning password to user session 02C123F4           28 0.139327
4 ETW000 [dev trc     ,00000] Starting user session (con_hdl=0,svchp=02C08C24,srvhp=02C0982C,usrhp=02C123F4)
4 ETW000                                                                              31 0.139358
4 ETW000 [dboci.c     ,00000] *** ERROR => OCI-call 'OCISessionBegin' failed: rc = 1017
4 ETW000                                                                            7326 0.146684
4 ETW000 [dbsloci.    ,00000] *** ERROR => CONNECT failed with sql error '1017'
4 ETW000                                                                              31 0.146715
4 ETW000 [dblink      ,00419] ***LOG BY2=>sql error 1017   performing CON [dblink#1 @ 419]
4 ETW000                                                                             141 0.146856
4 ETW000 [dblink      ,00419] ***LOG BY0=>ORA-01017: invalid username/password; logon denied [dblink#1 @ 419]
4 ETW000                                                                              27 0.146883
2EETW169 no connect possible: "DBMS = ORACLE                           --- dbs_ora_tnsname = 'CC5'"
Should I go back looking at Note: 400241.
Regards,
Vishnu

ALDSP 3.0 -- schema owner for stored procedure or SQL Statement

Using ALDSP, I have a need to create a physical service based on a stored procedure or a SQL statement. I am wondering what will happen when I move to another deployment environment where the schema owner changes. In our QA and Prod environments, we have a different schema owner for all tables in the application (the DBAs believe this prevents unwanted updates to a prod environment). DSP elegantly supports this for normal table- and view-based physical services by mapping schemas through the DSP console after deployment. Will I get the same type of mapping capability for stored procedures and SQL statements? I noticed that I can add a SQL-based function to a physical service...is there a way to pass in the physical table name from that data service to the procedure or SQL statement?
Thanks,
Jeff

Schema name substitution should work for stored procedures just like it does for tables. If it doesn't - report a bug.
You don't get any help for sql-statement based data services - dsp doesn't parse the sql provided. One thing you could do is use the default schema (following the user of your connection pool), and not specify the schema in your sql-statement.

Change the schema of a report using oracle odbc at runtime

Post Author: Guy
CA Forum: .NET
Hi,
I'm using Crystl 11 r2 and coding in C#.
In our oracle database we have many schemas. When designing the report I can see many schemas (~14) when creating the new connection, but not the one for which I provided a username and password! I guess it woud have been the ~30th of the list. This wouldn't really mather if I was able to change the schema on which the report will be executed at runtime.
But with both the native oracle driver or using odbc I am not able to change the schema (even if I change the DatabaseName in the connection info. I've had a look at the CR_VS_CHANGE_DATABASE.ppt but it doesn't help me with Oracle... Funny, I can't put anything in the connectionInfo.DatabaseName and it doesn't seem to change anything...
Anybody ever succeeded to change all the connection info at runtime when the report runs on oracle?
Thanks,
Guy

You should be able to do that by so:
Go into the object navigator. Click on Paper Layout, and click on the Main Section label (not the plus sign). Hit F4 for properties - height and width are there. I think if you just changed those to what A4 is designated as, it should work.
Note if you use a header/footer page, you would need to do the same to those pages as well.
Hope that helps as I have not actually needed to do this yet. Good luck!

How to change the schema to another user ?

Hi,
I've registerd this schema and it works well,
but I need to change the schema to connect to another User like MYUSER_2.
because I have to migrate the MYUSER_1 to MYUSER_2 and then to delete MYUSER_1
when I register the schema again with this user MYUSER_2
, all xml-entries will become destroyed ?
what can I do ?
it's better , to register the schema without a user ?
Norbert
dbms_xmlschema.registerSchema(
schemaurl => vschemaurl,
schemadoc => xsd_file,
local => FALSE,
gentypes => TRUE,
genbean => FALSE,
gentables => TRUE,
force => FALSE,
owner => MYUSER_1
,CSID => nls_charset_id('AL32UTF8');
);

If 2 seperate users need to work witht the same XML Schema then the XML Schema should be registered as a global Schema. If you want to change the owner of an XMLschema, just like if you want to change the owner of a relational; table you will have to export the data and import it again.

Montly changes of schema owner passwords

Similar Messages

Maybe you are looking for