SQLPLUS login

Question

Hello,
I have the following question:
If I log into sqlplus with:
sqlplus system/manager
the username and password are validated correctly and I can only log in if 'manager' is the correct password.
However, if I log into sqlplus with:
sqlplus 'system/wrongPasswd as sysdba'
it does not not appear to verify the password, I am logged in anyway and can perform all administrative actions (i.e. drop users etc.)
Would anyone know which setting determines this security glitch?
Thanks, ChrisBe

Answer 1

You (the Opearating System logged in user) have DBA group assigned so that you can login AS SYSDBA without requiring a username and/or password.
Below, even though there is no user JUNK, I can still login AS SYSDBA using that non-existant user. See that the user I actually logged in as is SYS (not JUNK).
SQL*Plus: Release 9.2.0.3.0 - Production on Fri Aug 6 08:23:16 2004
Copyright (c) 1982, 2002, Oracle Corporation.  All rights reserved.
Enter user-name: junk/junk
ERROR:
ORA-01017: invalid username/password; logon denied
Enter user-name: junk/junk AS SYSDBA
Connected to:
Oracle9i Enterprise Edition Release 9.2.0.3.0 - Production
With the Partitioning, OLAP and Oracle Data Mining options
JServer Release 9.2.0.3.0 - Production
SQL> show user
USER is "SYS"
SQL>Below, you can see that if I do not have DBA group assigned to me for a particular database, I get insufficient privledge error instead (even though the user JUNK does not exists):
SQL*Plus: Release 9.2.0.3.0 - Production on Fri Aug 6 08:27:43 2004
Copyright (c) 1982, 2002, Oracle Corporation.  All rights reserved.
Enter user-name: junk/junk@XXXXX
ERROR:
ORA-01017: invalid username/password; logon denied
Enter user-name: junk/junk@XXXXX AS SYSDBA
ERROR:
ORA-01031: insufficient privileges
Enter user-name: