Password file authentication confusion

Dear experts,
I am a beginner (I'll keep stating this till I gain some knowledge about Oracle). I have database on Linux server. Currently the sysdba is OS Authenticated, so I can just do
SQL> conn /as sysdba
connectedI wanted to try the password file authentication also, so I did the following:
a) changed parameter remote_login_passwordfile to EXCLUSIVE
b) created password file using: orapwd file=orapwPROD password=testDBA entries=5
c) created one user pwFileDBA
d) grant sysdba to pwFileDBA
e) checked v$pwfile_users and found entry for pwfileDBA user
USERNAME                       SYSDB SYSOP
SYS                               TRUE TRUE
PWFILEDBA                         TRUE TRUENow When I tried to login as:
SQL> conn pwfileDBA/testDBA as sysdba
connectedI am happy it worked :). Now I tried
SQL> conn pwfileDBA/<some junk password> as sysdba
connectedThis also worked :(
I have no clue now, if password file authentication is enabled or not. Can anyone share if I am doing something wrong? How to test this?
Thanks
oraNeel.

Hi Maxim,
1. conn sys/testDBA@your_tns_alias as sysdba - this also says "insufficient privileges"
2.
-bash-3.2$ ps -ef|grep pmon
oracledb 9410     1 0 Dec13 ?        00:00:00 ora_pmon_PROD
oracledb 11415 11320 0 07:13 pts/1    00:00:00 grep pmon3. ls -la $ORACLE_HOME/dbs
-bash-3.2$ ls -la
total 14928
drwxr-x--- 2 oracledb dba     4096 Dec 13 22:27 .
drwxr-xr-x 66 oracledb dba     4096 Oct 22 11:32 ..
-rw-rw-r-- 1 oracledb dba        0 Oct 22 11:33 PROD_oradb_ifile.ora
-rw-rw---- 1 oracledb dba     1544 Oct 20 11:34 hc_PROD.dat
-rw-rw-r-- 1 oracledb dba    19028 Oct 21 14:57 initPROD_bak.ora
-rw-r--r-- 1 oracledb dba    23584 Oct 22 11:33 initPROD_noaq.ora
-rw-r--r-- 1 oracledb dba    23576 Oct 27 13:29 initPROD.ora
-rw-rw-r-- 1 oracledb dba    19028 Oct 21 14:55 initPROD.ora.21Oct
-rw-r--r-- 1 oracledb dba    12920 May 3 2001 initdw.ora
-rw-r----- 1 oracledb dba     8385 Sep 11 1998 init.ora
-rw-rw---- 1 oracledb dba       24 Oct 20 11:34 lkPROD
-rw-rw---- 1 oracledb dba       24 Oct 21 15:22 lkPROD
-rw-r----- 1 oracledb dba     2048 Dec 13 22:31 orapwPROD
-rw------- 1 oracledb dba 15122432 Dec 1 18:39 snapcf_PROD.fBest Regards,
Neel

Similar Messages

Problems with the Password File Authentication

Hi,
I try to implement the Password File Authentication in my PC (Window XP). I did :
a) orapwd file:=C:\oracle\ora92\dbs\orapw.pwd password=sys2003 entries=5
b) I set the REMOTE_LOGIN_PASSWORDFILE to EXCLUSIVE
c) I created a user "willer" (With SYSTEM login)
d) I tried to give the sysdba privilege to the user willer :
SQL> grant sysdba to willer;
grant sysdba to willer
ERROR at line 1:
ORA-01031: insufficient privileges
e) I tried to connect like a sysdba with the user SYS end password sys2003 but :
SQL> connect sys as sysdba;
Enter password: *******
ERROR:
ORA-12560: TNS:protocol adapter error
Warning: You are no longer connected to ORACLE.
SQL>
How can I do to login with the SYS login to give the sysdba privilege to my user willer ? And why I can't log into my database with the SYS login ?
Thank you for your response because I am very lost....
Eric Willer

Hi,
Thank you for your response...
I deleted all my databases in my PC and reconstructed just one (certific), after that I followed your instruction and now I can connect into the database with the sys as sysdba login. But I just have one stangeness : I created a user willer and gave to him the sysdba privilege, when i log into the database with this user I can log on like a sysdba with wich ever user I want, even if the user doesn't exist.
Exemple :
Personal Oracle9i Release 9.2.0.1.0 - Production
With the Partitioning, OLAP and Oracle Data Mining options
JServer Release 9.2.0.1.0 - Production
Welcome to SQL*Plus!
You are connected to CERTIFIC.ORACLE.DATABASE as WILLER
SQL> connect nicole as sysdba;
Enter password:
Connected.
SQL>
I don't need to improve a password and I have never created the user nicole.
I don't understand.... What's wrong ?
I try with another user, I just created a serge user with just the create session privilege. I can log on with this user like a sysdba :
Welcome to SQL*Plus!
You are connected to CERTIFIC.ORACLE.DATABASE as SERGE
SQL> connect serge as sysdba
Enter password:
Connected.
SQL>
Thank you for your response...
Eric Willer

Connecting to remote database (idle) with Password File Authentication

Hi all,
I was wondering if it's possible to connect to a remote database that is shut down (idle instance) as sys user with sysdba privileges? In the book Oracle - All in One on page 210 in the section - Operating System and Password File Authentication it says:
Connection with operating system or password file authentication is always possible, no matter what state the instance and database are in, and is necessary to issue STARTUP or SHUTDOWN commands.
Above indicates that it's possible but I'm unable to do so.
I managed to connect to remote database that was in nomount mode (see below for details).
When I first tried to connect to a remote database (idle instance) using password file authentication it was giving following error:
sqlplus sys@ORCL as sysdbaSQL*Plus: Release 11.2.0.3.0 Production on Fri Dec 21 13:59:28 2012
Copyright (c) 1982, 2011, Oracle. All rights reserved.
Enter password:
ERROR:
ORA-12514: TNS:listener does not currently know of service requested in connect
descriptor
Enter user-name:
After starting the database to nomount mode I was getting following error:
sqlplus sys@ORCL as sysdbaSQL*Plus: Release 11.2.0.3.0 Production on Fri Dec 21 13:48:36 2012
Copyright (c) 1982, 2011, Oracle. All rights reserved.
Enter password:
ERROR:
ORA-12528: TNS:listener: all appropriate instances are blocking new connections
Enter user-name:
So I added the clause (UR=A) to my listener.ora file and after that it work and I was able to connect:
sqlplus sys@ORCL as sysdbaSQL*Plus: Release 11.2.0.3.0 Production on Fri Dec 21 14:04:49 2012
Copyright (c) 1982, 2011, Oracle. All rights reserved.
Enter password:
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.2.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL>
I have all necessairly entries in tnsnames.ora on my local host.
Also I have no problems when connecting as sys user with sysdba when the DB is open but can't get it work on an idle instance.
I know that I can use operating system authentication but want to know if there is a mistake in the book or I'm doing something wrong.
Regards,
Dawid
Edited by: 978239 on 2012-12-21 06:24

978239 wrote:
Hi all,
I was wondering if it's possible to connect to a remote database that is shut down (idle instance) as sys user with sysdba privileges? In the book Oracle - All in One on page 210 in the section - Operating System and Password File Authentication it says:
Connection with operating system or password file authentication is always possible, no matter what state the instance and database are in, and is necessary to issue STARTUP or SHUTDOWN commands.
Above indicates that it's possible but I'm unable to do so.
I managed to connect to remote database that was in nomount mode (see below for details).
When I first tried to connect to a remote database (idle instance) using password file authentication it was giving following error:
sqlplus sys@ORCL as sysdbaSQL*Plus: Release 11.2.0.3.0 Production on Fri Dec 21 13:59:28 2012
Copyright (c) 1982, 2011, Oracle. All rights reserved.
Enter password:
ERROR:
ORA-12514: TNS:listener does not currently know of service requested in connect
descriptorSince the database is down, the only way the listener is going to know of it is if you create a static registration by adding an entry for the db in the SID_LIST section of listener.ora
>
Enter user-name:
After starting the database to nomount mode I was getting following error:
sqlplus sys@ORCL as sysdbaSQL*Plus: Release 11.2.0.3.0 Production on Fri Dec 21 13:48:36 2012
Copyright (c) 1982, 2011, Oracle. All rights reserved.
Enter password:
ERROR:
ORA-12528: TNS:listener: all appropriate instances are blocking new connections
Enter user-name:
So I added the clause (UR=A) to my listener.ora file and after that it work and I was able to connect:
sqlplus sys@ORCL as sysdbaSQL*Plus: Release 11.2.0.3.0 Production on Fri Dec 21 14:04:49 2012
Copyright (c) 1982, 2011, Oracle. All rights reserved.
Enter password:
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.2.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL>
I have all necessairly entries in tnsnames.ora on my local host.
Also I have no problems when connecting as sys user with sysdba when the DB is open but can't get it work on an idle instance.
I know that I can use operating system authentication but want to know if there is a mistake in the book or I'm doing something wrong.
Regards,
Dawid
Edited by: 978239 on 2012-12-21 06:24

Regarding password file authentication

I am working with 10g database .
I have set the remote_login_passwordfile parameter to exclusive
SQL> select * from v$pwfile_users;
USERNAME                       SYSDB SYSOP
SYS                            TRUE TRUE
SQL> show parameter pass
NAME                                 TYPE        VALUE
remote_login_passwordfile            string      EXCLUSIVEI tried connecting as sysdba and I was able to connect .
sqlplus '/as sysdba'
When i was trying to connect as sys with different random passwords specified i was able to connect too.
Though I didn't give sysdba permissions to other users they were also able to connect as sysdba .
Let me know what went wrong ?

Nothing.
The parameter is called remoteloginpasswordfile.
This means you need a 'remote' connection through sqlnet.
If you are not connecting remotely, but local (ie you have ORACLE_SID set),
you are authenticated by the O/S, not by the password file.
This means you will get in if you are in the dba group.
This also means
connect mickey/mouse as sysdba
will work,
To disable OS authentication make sure
sqlnet.authentication_services=(none)
is in sqlnet.ora
Please note when you connect
sqlplus '<user>/<pass> as sysdba
pass will be visible using ps.
Sybrand Bakker
Senior Oracle DBA

Password file authentication

According to my information if I don't have a secure connection then it is recommended to connect remotely using password authentication rather then using operating system .My question is, how I can know whether i have a secure connection or not .This is one thing the other thing to authenticate a user via operating system does this mean I have to create this user via Computer Management?
Any explanation would be appreciated

Hi Maxim,
1. conn sys/testDBA@your_tns_alias as sysdba - this also says "insufficient privileges"
2.
-bash-3.2$ ps -ef|grep pmon
oracledb 9410     1 0 Dec13 ?        00:00:00 ora_pmon_PROD
oracledb 11415 11320 0 07:13 pts/1    00:00:00 grep pmon3. ls -la $ORACLE_HOME/dbs
-bash-3.2$ ls -la
total 14928
drwxr-x--- 2 oracledb dba     4096 Dec 13 22:27 .
drwxr-xr-x 66 oracledb dba     4096 Oct 22 11:32 ..
-rw-rw-r-- 1 oracledb dba        0 Oct 22 11:33 PROD_oradb_ifile.ora
-rw-rw---- 1 oracledb dba     1544 Oct 20 11:34 hc_PROD.dat
-rw-rw-r-- 1 oracledb dba    19028 Oct 21 14:57 initPROD_bak.ora
-rw-r--r-- 1 oracledb dba    23584 Oct 22 11:33 initPROD_noaq.ora
-rw-r--r-- 1 oracledb dba    23576 Oct 27 13:29 initPROD.ora
-rw-rw-r-- 1 oracledb dba    19028 Oct 21 14:55 initPROD.ora.21Oct
-rw-r--r-- 1 oracledb dba    12920 May 3 2001 initdw.ora
-rw-r----- 1 oracledb dba     8385 Sep 11 1998 init.ora
-rw-rw---- 1 oracledb dba       24 Oct 20 11:34 lkPROD
-rw-rw---- 1 oracledb dba       24 Oct 21 15:22 lkPROD
-rw-r----- 1 oracledb dba     2048 Dec 13 22:31 orapwPROD
-rw------- 1 oracledb dba 15122432 Dec 1 18:39 snapcf_PROD.fBest Regards,
Neel

Use of password file?

good day !
i am confused and still cannot digest the need to use a password file!
can anyone provide me with links or any explaination on why we need a password file!
i need the password file so that i can setup dataguard!
thnx

You can Oralce administration guide,
Database Administrator Authentication
http://download.oracle.com/docs/cd/B19306_01/server.102/b14231/dba.htm#i1006534

Password file issue in Oracle 10g

Hi,
While trying connecting from SQL prompt using command
SQL> CONNECT SYS/PASSWORD@CONNECT_STRING AS SYSDBA
It gives error
ORA-01031 insufficient privilege
If SQL> CONNECT SYS/PASSWORD AS SYSDBA
It works successfully??
After connecting without using connect_string.
Only one DB is running on this machine.
Then SELECT * FROM V$PWFILE_USERS;
0 ROWS RETURNED
Recreated the pwd file same issue persists. What may be the reason?
If SQL> GRANT SYSDBA TO SYS;
ERROR ORA-01994: GRANT FAILED: PASSWORD FILE MISSING OR DISABLED
Password file created using command
orapwd file=/u01/app/oracle/product/10.2.0db_1/dbs/orapwPRIMDB password=pwd entries=5
Please help me.
Thanks in advance.
Edited by: Bharat Kaushik on May 31, 2009 4:20 PM

The first command is a 'remote connection'. To be able to connect as sysdba remotely, spfile remote_login_passwordfile should be set to exclusive.
When there is no password file or the parameter is incorrect this results in ora-1031.
The second command uses O/S authentication, and doesn't use the password file at all.
O/S authentication is set up in sqlnet.ora.
SYS has always SYSDBA, by design. Granting SYSDBA to SYS is redundant.
Obviously in this directory name
/u01/app/oracle/product/10.2.0db_1/dbs/
there is a / missing and it should have been
/u01/app/oracle/product/10.2.0/db_1/dbs/
So you still have no valid passwordfile.
You could have and should have easily spotted this yourself.
Sybrand Bakker
Senior Oracle DBA
Experts: those who did read the documentation.

Problem setting up user ids to use the Oracle password file.

I want to set up my database users so that a password file is used for connecting to the database. I have completed these steps successfully.
BTW - DB is 11.2.0.3 on AIX power 64
1. Created the password file for the database using the orapwd command. Allowing 20 entries. Confirmed the file was created in the $ORACLE_HOME/dbs directory
2. Created a database user, sbrower
CREATE USER SBROWER IDENTIFIED BY <password> DEFAULT TABLESPACE USERS TEMPORARY TABLESPACE TEMP PROFILE DEFAULT ACCOUNT UNLOCK ;
GRANT DBA TO SBROWER;
ALTER USER SBROWER DEFAULT ROLE ALL;
GRANT UNLIMITED TABLESPACE TO SBROWER;
ALTER USER SBROWER QUOTA UNLIMITED ON USERS;
3. Connected to the database as SYS and granted sysoper to SBROWER
4. Using putty, ssh'ed into the server where the database resides.
5. Set the oracle variables (ORACLE_HOME, ORACLE_BASE, etc.) and PATH
6. Was able to connect to the database using sqlplus / as syoper
THE PROBLEM
For another user, EA_RDX_ORACLE1, I follow the same steps (2-6) bu when I execute step 6, it does not allow the connection
ERROR:
ORA-01031: insufficient privileges
   but, if I use sqlplus ea_rdx_oracle1/thepassword as sysoper it works
Looking at v$pwfile_users on the database:
USERNAME SYSDBA   SYSOPER      SYSASM
SYS      TRUE      TRUE      FALSE
SBROWER FALSE     TRUE      FALSE
EA_RDX_ORACLE1 FALSE TRUE FALSE
3 rows selected.
There is one thing that is different for the ea_rdx_oracle1 id's:
- The users who use this id, use a took called CyberVault to check out the id. The password for the id changes each time the id is checked out; however, the way the id is set up on the DB servers, us user does not have to enter the password when they log in (ssh).
I have sent an email to our unix admin asking his how the id was set up so that it can ssh into the server. It is not included in the list of users in any group in the /etc/ogroup file and it is not included in the /etc/opassword file.

The OS authentication ( sqlplus / as sysdba ) does not require the password file.
The problem may be related to the OS user you are connecting to that server - it is not a member of OSDBA group ( usually DBA ).

Cannot scp a password file between virtual machines

Hi all!
I am trying to test a Data Guard configuration on two appropriately configured Oracle Open Days images on Virtual Box. Unfortunately when trying to copy the password file from the primary to the standby using the following command.....
scp orapworcl oracle@dg2:/home/oracle/app/oracle/product/11.2.0/dbhome_2/dbs
......I get the following error/message (because it isn't an error as such...)
All passwords are oracle or noted if otherwise.
Could it be that this is a functionality that is turned off for these images? It would be really helpful to get this going!
NOTE:
Both machines have statically assigned IPAddresses
TNSPING and PING show the other machine to be alive and databases "accessible"
No passwords have been changed
The Oracle version is 11.2.0.3
Many thank for your help in advance!
Regards,
Kev

Excerpt "man scp",
"scp copies files between hosts on a network. It uses ssh(1) for data
transfer, and uses the same authentication and provides the same security
as ssh(1). Unlike rcp(1), scp will ask for passwords or passphrases if
they are needed for authentication."
Other useful information for "ssh",
[OL6u3 ~]$ which ssh
/usr/bin/ssh
[OL6u3 ~]$ rpm -qf /usr/bin/ssh
openssh-clients-5.3p1-81.el6.x86_64
[OL6u3 ~]$ rpm -ql openssh-clients
/etc/ssh/ssh_config
/usr/bin/.ssh.hmac
/usr/bin/scp
/usr/bin/sftp
/usr/bin/slogin
/usr/bin/ssh
/usr/bin/ssh-add
/usr/bin/ssh-agent
/usr/bin/ssh-copy-id
/usr/bin/ssh-keyscan
/usr/share/man/man1/scp.1.gz
/usr/share/man/man1/sftp.1.gz
/usr/share/man/man1/slogin.1.gz
/usr/share/man/man1/ssh-add.1.gz
/usr/share/man/man1/ssh-agent.1.gz
/usr/share/man/man1/ssh-copy-id.1.gz
/usr/share/man/man1/ssh-keyscan.1.gz
/usr/share/man/man1/ssh.1.gz
/usr/share/man/man5/ssh_config.5.gz

File authentication problem in OWSM

Hi all,
I want to create file authentication in owsm for that i created .htpasswd file in that i have given username:password. But when i am running the following command in the command prompt it's giving the problem.
Oracle_home\owsm\bin>wsmadmin md5encode username password .htpasswderror message : Target .htpasswd does not exist in this project.
pls anybody can help on this.
thanks
kmr

Hi mani,
You are giving a wrong commands. The command should be:
Oracle_home\owsm\bin>wsmadmin md5encode .htpasswd username
then it will ask for the password, give the password, then it will finish encoding.
Bye...
Chandra.

Why does more users can login as sysdba than specified in password file

I have multiple databases using same password file which has five entries for sysdba, but i have more than five users who have sysdba right and all of them can simultaneously login as sysdba, can any one explain why

How do your users connect ? You may have any number of users connected locally as sysdba. Local connections are authenticated by OS, no password file is used.
Moreover, the five entries of password file have to be intended as DISTINCT users, but you may have a much higher number of connections.

Password file basics

What exactly is a password file? I read somewhere that the password file is used to authenticate users when the db is not open (because it cannot access the Data Dictionary). I guess the RMAN jobs are done when the db is not open. Does that mean you can't use RMAN remotely if there is no password file?
Can a SYS user login to db remotely if there is no password file?
If there is no password file can you still connect using conn / as sysdba

What exactly is a password file?It is a file used to authenticate users with sysdba privilages
I read somewhere
that the password file is used to authenticate users
when the db is not open (because it cannot access the
Data Dictionary). The users authenticated by password file should have sysdba privilages.
I guess the RMAN jobs are done when
the db is not open. Does that mean you can't use RMAN
remotely if there is no password file?
Rman jobs are not done when database is close Infact RMAN need server process to connect to the database. U only need a connect descriptor if u wanna connect to database with RMAN with a user other than sysdba privs.
Can a SYS user login to db remotely if there is no
password file?a user with sysdba privs can not connect remotely if the password file does not exists

About password file

Hai,
Here i am facing one problem. I put remote_login_passwordfile = exclusive in init<sid>.ora.
It means it has to use password file.
But how come i could connect to internal with out using password.
$ svrmgrl
Oracle Server Manager Release 3.1.6.0.0 - Production
Copyright (c) 1997, 1999, Oracle Corporation. All Rights Reserved.
Oracle8i Release 8.1.6.0.0 - Production
JServer Release 8.1.6.0.0 - Production
SVRMGR> connect internal
Connected.
SVRMGR>
Even i put remote_login_passwordfile = none also i could connect internal with out using password.
What is the difference.
I read in oracle documentation that if we put remote_login_passwordfile = none it will use operating system authentication, if remote_login_passwordfile = exclusive then it will follow password file.
Please give me clear explanation please.
Waiting for reply,
Priya.
null

Setting REMOTE_LOGIN_PASSWORDFILE to NONE signifies that Oracle should ignore any password file. In such a scenario, the privileged users must be authenticated by the operating system. Setting the parameter to EXCLUSIVE signifies that the password file can be used by only one database. In your case it happens because the OS user has got the correct privileges. That is why you are able to connect as internal when this is set to None.

Prompting for passwords even i configured ssh password less authentication

There are two servers :
1. Site
2. Testing
from site server i want to connect testing server with ssh password less authentication.
i generated public and private keys with ssh-keygen -t rsa on site server.
cat id_rsa >> authorized_keys
cat id_rsa.pub >> authorized_keys
i appended id_rsa.pub ( public key site server ) to authorized_keys ( testing server ) with below command .
ssh [email protected] "cat >> ~/.ssh/authorized_keys" < ~/.ssh/id_rsa.pub
am i missing some point in performing procedure for ssh password less authentication ?
because it prompts for passwords agaian and again
Edited by: user13376823 on Oct 9, 2012 9:30 AM

user13376823 wrote:
There are two servers :
1. Site
2. Testing
from site server i want to connect testing server with ssh password less authentication.
i generated public and private keys with ssh-keygen -t rsa on site server.
cat id_rsa >> authorized_keys
cat id_rsa.pub >> authorized_keysI don't think you should be doing this. I can't see the point of adding the private key and adding the public key means the "Site" can ssh to itself without needing a password!
>
i appended id_rsa.pub ( public key site server ) to authorized_keys ( testing server ) with below command .
ssh [email protected] "cat >> ~/.ssh/authorized_keys" < ~/.ssh/id_rsa.pub
I would expect you to add the RSA public key to the "authorized_keys2" file and not the "authorized_keys" file.
>
>
am i missing some point in performing procedure for ssh password less authentication ?
because it prompts for passwords agaian and again
Edited by: user13376823 on Oct 9, 2012 9:30 AM

Login problem through password file

Hi all
i am using oracle 11g release 1 on CENTOS LINUX 5.
i have a login problem AS
login at OS authentication is sucessful as
SQL> connect sys as sysdba
Enter password:
Connected.
SQL>
but when i login from password file as
SQL> connect sys/oracle@stan as sysdba
ERROR:
ORA-01031: insufficient privileges
SQL>
i created new password file as
orapwd file=$ORACLE_HOME/dbs/orapwSTAN.ora password=oracle entries=5
opertaing system authentication are given as
[oracle@testserver ~]$ id
uid=500(oracle) gid=500(oinstall) groups=500(oinstall),501(dba) context=user_u:system_r:unconfined_t
any help is appreciated

The name of the password file isn't random.
The SID is case sensitive, and the password file in Unix has no extension!
So if the filename is wrong, the passwordfile will not be used.
This filename looks wrong, at least the .ora bit should be removed.
Sybrand Bakker
Senior Oracle DBA

Password file authentication confusion

Similar Messages

Maybe you are looking for