Prevent sql login

Question

Hi everybody,
I want to prevent the users from logging into sqlplus, the only way they can log into my database is through forms developer.
So how can I do that?
Database I am using is 7.3.2.
I could not execute *CREATE OR REPLACE TRIGGER trigger_name
AFTER LOGON ON DATABASE* on database 7.3.2.
because AFTER or BEFORE LOGON ON DATABASE are not supported on database 7.3.2
Is there another way to do what I want?
could anyone give me a helping hand please?
bye.

Answer 1

[email protected] wrote:
I want to prevent the users from logging into sqlplus, the only way they can log into my database is through forms developer.This is NOT security! It is a mere warm fuzzy that says "+oh my database security now seems better+" - it means nothing.
It is trivial to circumvent any checks you put in place on the server side to prevent direct SQL access.
Why?
Because you need some means of identifying the client.
How?
By using the client identification details supplied in the connection string that the client itself passes to the Oracle Listener and server.
Do you think it is a robust and logical approach to trust the unknown client to correctly tell you what it is, in order for you to decide whether or not to allow access? (e.g. I can write a Perl Proxy for Oracle, that looks to the server as a legal app, but in turn accepts and proxies connections from SQL*Plus, TOAD, MS-Access and anything else)
Oracle (default) authentication works with scheme name and password. If the client supplies that, it means that the client is authenticated.. irrespective of who/what the client is.
This means that you need to make sure that this schema is correctly secured, and that the client (irrespective of the client app used) can only do what that Oracle schema is allowed to do...
Of course, running a 15 year old Oracle version is as non-nonsensical as implementing security based on trusting what the client says.