Is there a way to have separate wallets for each windows user? Well, I have found a way, but does not seem to work always properly and that is with %USERNAME% environment variable.
This is how our customer want's to have - so separate wallet for each windows user, how to accomplish this without using %USERNAME%?
We are trying to implement the following security to our database.
As of now, the access rights are same for all the windows users logging into the Oracle application with the same Oracle user Id.
But now, we want to improve our security by granting different levels of rights to the users based on their Network Id even though they use the same Oracle User Id to log into the application.
We are not looking for the users to be identified externally.
(CREATE USER "OPS$ORACLE-BASE.COMTIM_HALL" IDENTIFIED EXTERNALLY;
GRANT CONNECT TO "OPS$ORACLE-BASE.COMTIM_HALL";
)
We have an application with many separate databases (one per customer). Given they share the same business requirements (service hours, change mgmt etc), we're interested in potentially consolidating the separate DBs (which are relatively small) into separate schemas within a fewer no of databases to reduce the overhead.
Our issue is that the application is hard-coded to use a specific administrator and application connection user name. Changing this is unfortunately not an option.
Given this limitation, is there any possibility to map a generic user into a customer-specific schema based on the database service that they connect to? Each customer connects to different database services but may use the same user name. We considered using private synonyms but this seems to acheive the opposite (i.e. many different users could connect and map to a single users schema). One thing to point out is that where there is a single user name, it is acceptable for a single password to be used across the different customer DBs as they will be a single admin/user.
When a user is renamed in Active Directory, they can no longer connect to the Oracle DB thru OS authentication. There is no OID/DIP integration.
sqlnet.ora
SQLNET.AUTHENTICATION_SERVICES = (NTS)
NAMES.DIRECTORY_PATH= (TNSNAMES, HOSTNAME)
NAMES.DEFAULT_DOMAIN = cal.com.br
create user "CALRENATOH" IDENTIFIED EXTERNALLY
GRANT CREATE SESSION TO "CALRENATOH"
AD User CALRENATOH can connect to DB as 'sqlplus /'
But after renaming AD User CALRENATOH to CALRENATOH1 and dropping DB user CALRENATOH and creating DB user CALRENATOH1 drop user "CALRENATOH"; create user "CALRENATOH1" IDENTIFIED EXTERNALLY;
Now OS authentication 'sqlplus /' fails 'ORA-01017: invalid username/password; logon denied'..Once I recreate the DB user with old AD user name 'CALRENATOH', OS authentication succeeds. create user "CALRENATOH" IDENTIFIED EXTERNALLY;
C:Windowssystem32>set username
USERNAME=RENATOH1
C:Windowssystem32>sqlplus /@rmlab001
SQL*Plus: Release 11.1.0.6.0 - Production on Tue Jul 3 15:16:46 2012
Copyright (c) 1982, 2007, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.1.0.7.0 - 64bit Production
With the Partitioning and OLAP options
Why the Database is still looking for old AD user name? Does Oracle cache information about OS authenticated users?
how to install wallet in Oracle 11g and chek if it is installed? Extra cost is involved for liscencing ?
Does it ask for any option while installing Oracle Software?
I'm reviewing the method of setting up transparent data encryption (TDE) and the role Oracle Wallet plays in that process. One statement that caught my attention was this statement in the documentation:
Quote:You can also choose to create a local auto login wallet. Local auto login wallets cannot be moved to another computer. They must be used on the host on which they are created." URL....
Why an auto-login wallet can't be moved to another computer? For example, if my Oracle database server goes down and I'm in a recovery situation, would an autologin Oracle wallet file restored from tape not work?
I successfully created a Oracle Wallet in AIX. The wallet is belong to user "oracle" and permission is 755. I can access it with non-oracle user. Note: the non-oracle user is under the same group as "oracle" id.
But when I try to change the Oracle Waller permission to less than 755, I am not able to access it anymore. The error is "ORA-12578: TNS:wallet open failed".
My question is how can I access the Oracle Wallet without using 755 permission?
I have TDE enable in system. Now i want to remove wallet from the server and keep another secure place so that it can't be put in wrong hand. Is there any way that i can remove the wallet folder from the server while encryption and decryption on?
View 1 Replies View RelatedIf i have Oracle Wallet installed for a Oracle 10.2 Client, i am able to connect to the database. But , while generations a report , when my oracle report server tries to connect to the DB using Oracle Wallet
(i.e. sqlplus /@<dbname> ) , I am not able to establish a connection.
Is it a compatibility issue ?
Following is the parameter i am passing.
$ORACLE_HOME/bin/rwclient.sh server="$REPORT_SERVER" REPORT="$RDF_FILE" DESTYPE=FILE DESNAME="$PDF_FILE" DESFORMAT=PDF BATCH=YES USERID= /@"$ORACLE_SID"
I need few clarifications regarding oracle wallet.
db version: 11.2.0.3.2 (Enterprise Edition)
We have a requirement to run shell scripts calling stored procedures for specific activities, which are run on database server. We do not want to store passwords in shell scripts and decided to use Secure External Password Store for hiding passwords instead of os authentication method. need few clarifications on the below.
1) Currently, we are creating oracle wallet entry on db server and making modifications in sqlnet.ora file accordingly. Is it good to use like this or we should do this only on a client machine?
2) Do we need any licensing to use this option?
3) Any knows issues with using oracle wallet?
4) Can we use orapki for creating oracle wallet instead of mkstore?
5) Any knows issues we face during startup and shutdown of db activities?
I am getting error "ora-28374 typed master key not found in wallet".
steps-
1) created tablespace and user to the respective tablespace.
2) created table by issuing command as "CREATE TABLE TEST1 (SR_NO NUMBER(3), NAME VARCHAR2(30) ENCRYPT) DEFAULT TABLESPACE ENC". (by user - enc_user)
3) Inserted rows on to the table.
4) entry made in sqlnet.ora as
ENCRYPTION_WALLET_LOCATION=
(SOURCE=(METHOD=FILE)(METHOD_DATA=
(DIRECTORY=C:appAdministratoradmin estencrypted_wallet/)))
5) issued command as sysdba - ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "ASHISH123";
6) restarted the database.
7) since i want to made it autologin. so I open wallet through the below mentioned path program file >>oracle_home>> integrated management tool >> wallet But when it asked the password I typed the same password but it was not accepting. So i made new wallet with the same specified path. Also I clicked on auto login.
8) Now, i have restarted the database and tried to issue the command "ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "suresh123";
While issuing the command, getting error "ora-28374 typed master key not found in wallet". "
i tried with the recreation of new folder again on the same path as -"C:appAdministratoradmin estwallet" and same entry updated on sqlnet.ora. But facing the same error.
Is there any way to re-create or modify the encryption of tablespace?
I'm trying to hide the password for the batch programs that connect to the DB Server
as Cadot pointed out in
[URL].........
Quote:
use secure external password store
with reference to
[URL].........
when I create wallet, the system does not prompt me for password
C:>mkstore -wrl "C:ora102NETWORKADMIN" -create
when creating login credentials, again the system never prompts me for password
C:>mkstore -wrl "C:ora102NETWORKADMIN" -createCredential db10g scott tiger
here's my sqlnet.ora configurations
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY =C:ora102NETWORKADMIN)
)
)
SQLNET.WALLET_OVERRIDE = TRUE
SSL_CLIENT_AUTHENTICATION = FALSESSL_VERSION = 0
here's my tnsname.ora settings
DB10G =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1521))
)
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = mike)
)
)
here's the outcome
C:Documents and SettingsAdministrator>sqlplus /@db10g
SQL*Plus: Release 10.2.0.4.0 - Production on Wed Apr 13 22:53:06 2011
Copyright (c) 1982, 2007, Oracle. All Rights Reserved.
ERROR:
ORA-12534: TNS:operation not supported
Enter user-name:
so I Google around for the solution to the ORA-12534 error, one of the site,
[URL].......
here's my lsnrctl services
Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
Services Summary...
Service "MIKEXDB" has 1 instance(s).
Instance "mike", status READY, has 1 handler(s) for this service...
Handler(s):
[code].....
The command completed successfully
right now I think I will be a fool to think that the solution is to resolve the ERROR: ORA-12514: TNS:listener does not currently know of service requested in connect descriptor. so what is wrong with my setup, or is it some patch that I need to apply?
My database is 11.1.0.7 and 11.2.0.3 with TDE tablespace encryption, ASM db storage. The wallet needs to be opened for MRP to work in physical standby database. I already have the solution for the primary instances to automate wallet open (e.g. using startup trigger for 11.1.0.7). However, I cannot find solution to automate wallet open operation in standby instances (to issue ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY ""').
Manual operation everytime standby instance is started is not feasible.
I am on 11.2.0.1. I created wallet with
orapki wallet create -wallet "C:Oracleserver11201productdbhomeNETWORKADMIN" -pwd <password> -auto_login_local
How do I remover it now? Wallet manager doesn't list it.
Lost Windows password? Forgot Windows password? Your PC was hacked? Therefore, it is a basic step for every Windows users to enhance the security of Windows password. In the networks, it is found that a number of user's passwords are easy to guess. Only the smallest groups are the most security conscious and select passwords that are mixed lowercase and uppercase letters, numbers and punctuation to create cryptic passwords. Adopting strong password is one of the most effective ways to ensure system security. Here are several methods for you to enhance the security of your passwords in Windows 7/2000/XP/Vista and so on. You'd better remember the methods below unless you want to reset Windows password from time to time.
1. Is random password a great password?
A common myth is that totally random passwords like Ht3&e#L%5d@$B are the best passwords. This is not true. While they may be strong passwords, they are usually difficult to remember, slow to type, and sometimes vulnerable to attacks against the password generating algorithm. It is easy to create passwords that are strong but much easier to remember by using a few simple techniques. For example, consider the password "Luck-73@Better?". This password utilizes uppercase and lowercase letters, two numbers, and three symbols. The password is 15 characters long and can be memorized with very little effort. Moreover, this password can be typed very fast. The portion"Luck" and "Better" alternate between left and right-handed keys on the keyboard, improving speed, decreasing typos, and decreasing the chances of someone being able to discover your password by watching you.
2. Create the long Windows password
Although a password may eventually be discovered through some means, it is possible to create a password that cannot be cracked in any reasonable time. If a password is long enough, it will take so long or require so much processing power to crack it. That is essentially the same as being unbreakable (at least for most hackers).
3. Create the Windows password constantly?
This may be good advice for some high-risk passwords, but it is not the best policy for every user. It is frustrating for a user to have to constantly think of and remember new passwords every 30 days. It may be better to focus on stronger passwords and better user awareness rather than limiting password age. A more realistic time for the common user may be 90-120 days.
4. Write down Windows password in a proper place
Sometimes it is necessary for some users losing and forgetting complex passwords easily to write down them somewhere proper. However, it is important to educate users on how to write down passwords properly. Obviously, a sticky note on the monitor is not a good idea, but storing passwords in a safe or even a locked cabinet may be sufficient.
5. 14 characters is the optimal password length
Each character that you add to your password increases the protection. Your passwords should be 8 or more characters in length; 14 characters or longer is the Optimal Password Length. Many systems also support use of the space bar in passwords, so you can create a phrase made of many words. It is not easier to forget and lose, as well as longer than a simple password, and harder to guess.
6. Try not to use the same Windows password for all accounts
Some users always make the same passwords for every account to make it easy to remember. In that case, when any one of them lost, your other information protected by that password will be in danger as well. It is serious to use different passwords for different systems and accounts.
7. Do not use some common words that other users maybe guess
Most of users prefer to use some common words to remember easily, for example, login name, birth date, driver's license, passport number, pets' name and other words contained their personal information someone knows. In that case, your Windows system will not be safe anymore. Moreover, do remember not to use some words spelled backwards, abbreviations, sequences or repeated characters and adjacent letters, such as, asdfgh, 123456, 888888, abcdef and so on.
You can smoothly use your Windows now because the strong and powerful Windows password is created successfully, Certainly, I believe that many users lost Windows password and forgot Windows password, then you need have to reset Windows password or recover Windows password. It is a big problem for plenty of Windows users that how to reset Windows password. how to recover Windows password and they are puzzled by resetting windows password, for instance, reset Windows 7 password, recover password Windows XP, remove Windows Vista password and other operating systems after they create the password with complex letters, numbers and symbols. However, it is unnecessary to worry and it is said that things will eventually sort themselves out. There are many ways to reset forgotten Windows password, including use windows password reset disk and windows password reset software, like Super Windows Password Reset, a professional windows password reset software which could enable you to logon to Windows smoothly without reinstalling system.
I want to create a wallet on RAC setup.I have two node setup.I have created the wallet directory under shared folder /u01/oradata/$ORACLE_SID/wallet
I am Unable to open wallet.I tried this using the below command
SQL> alter system set encryption key identified by "aryabhat";
alter system set encryption key identified by "aryabhat"
*
ERROR at line 1:
ORA-28353: failed to open wallet
Following is the content of sqlnet.ora file
(path : /u01/app/11.2.0/grid/network/admin/sqlnet.ora)
NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
ADR_BASE = /u01/app/oracle
ENCRYPTION_WALLET_LOCATION =
(SOURCE = (METHOD = FILE)(METHOD_DATA =
(DIRECTORY = /u01/oradata/$ORACLE_SID/wallet/)))
Provide me the script which would track all the users security violations like ... say for example i want to find which users logged in and what he did in database prospective.
View 1 Replies View RelatedWe have the database user called c88888 and is locked yesterday. I came to this with the following query.
select * from dba_users where username like 'C88888';
Due to invalid password the user was locked. Can we track who hit the database with the wrong password?
User A contains tables, views, LOB's, types, procedures, triggers, sequences, indexes, synonyms. User B wants to have read-only privilege on the objects of User A.
I can provide select on privilege on tables and views. How about providing read-only privileges to other objects?
I have enabled Auditing in my oracle Database but I am not able to see any database for the operations of sys user or any other user in my "SYS.AUD$" and "SYS.FGA_LOG$" tables.
Value for the parameter "AUDIT_TRAIL" is set to "db,extended".
I am working as "SYS" user and I have shutdown and again startup the database but neither there was any information in both the tables nor I can see any files at the destination specified by "AUDIT_FILE_DEST".
I have created a program to access a oracle database using oracle.data access, .net framework 4, visual studio 2010 in C#. The program runs without any problem. If I try to create a windows service, I receive the error
Service cannot be started. System.BadImageFormatException:
Could not load file or assembly 'Oracle.DataAccess, Version=2.112.3.0, Culture=neutral, PublicKeyToken=89b483f429c47342' or one of its dependencies.
An attempt was made to load a program with an incorrect format.
File name: 'Oracle.DataAccess, Version=2.112.3.0, Culture=neutral, PublicKeyToken=89b483f429c47342'
when i execute the command
GlobalVariables.conn = new OracleConnection(oracelString);
I'm using Oracle 11g running over a Windows 7 OS. The service OracleServiceORCL doesn't start. Listener.log has the following registry:
23-OCT-2012 19:45:29 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=__jdbc__)(USER=MBA-DB$))(SERVICE_NAME=orcl)) * (ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=49445)) * establish * orcl * 12514
TNS-12514: TNS:listener does not currently know of service requested in connect descriptor
When I try to start in services, is returned the OS error 1067. This error starts to occur when I did the follow. I executed a PLSQL command to fill a (big) table with a lot of data. More than 1 day after and while the program still running, I broke the program. After that, Oracle was consuming lot of disk. I broke the process (using taskkill /f) and, after that, the database stopped working.
What I can do to recover my database?Below I list my listener.ora and tnsnames.ora
mbentoalves
SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
(SID_NAME = CLRExtProc)
[code]...
I've installed oracle 11.2 in Windows 7 - 64 bits. Everything was working fine until suddenly stops working. Oracle Service (OracleServiceORCL) doesn't start and when I try to start manually, returns OS error 1067. Listener starts well. Below I list my listener.ora, sqlnames.ora and sqlnet.ora
# listener.ora Network Configuration File: C:appmbaproduct11.2.0dbhome_1
etworkadminlistener.ora
# Generated by Oracle configuration tools.
SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
[code]....
I installed Oracle 11.2.0.1.0 Enterprise Edition on my home laptop computer running Windows 7 Professional months ago, set the services to start automatically and it had been working fine, with multiple shutdowns and re-starts per day, until today. I was using it earlier today, then shut the laptop down, went to lunch, turned it on again, tried to login through SQL*Plus and got:
SQL*Plus: Release 11.2.0.1.0 Production on Sat Feb 12 15:48:39 2011
Copyright (c) 1982, 2010, Oracle. All rights reserved.
Enter user-name: scott/tiger
ERROR:
ORA-12560: TNS:protocol adapter error
Enter user-name:
I tried restarting the computer, but still got the same result as above.I went to:
Control Panel -> System and Security -> Administrative Tools -> Services
and confirmed that the Oracle services were still set to start automatically. The OracleOraDb11g_home1TNSListener showed started. The OracleServiceORCL showed that it was set to start automatically, but did not show started or starting or stopped. The only option displayed for it was start, not pause or stop or restart, implying that it was not started. My computer had been on long enough that it should have started and it did not show that it was trying to start or give any indication that it had tried to start and failed and showed that it was set to start automatically.
I clicked on the start option, it started, and I was able to login. If I have to, I can live with this as a workaround, but I would prefer that it start automatically like it is supposed to. I find it puzzling since it had been working and I did not change anything, at least not intentionally. The only thing that I can think of that I did differently recently was experimenting with cursors and dbms_sql in order to intentionally reproduce the error "ORA-29471: DBMS_SQL access denied" to demonstrate it in response to a thread on the SQL and PL/SQL forum: [URL]. However, after reproducing the error, I corrected it and was still able to exit SQL*Plus and log in again until I shut down the computer and re-started. I don't know if this is related or coincidence.
I just finished my first course in SQL for Oracle 11g at my local community college. We used SQL*Plus for the coursework and for the next class I need to use SQL Developer. Initially, I installed the Developer and was unable to establish a test connection due to the listener not being installed. I fiigured out that I needed to use the Network Configuration Assistant to add and configure the listener. After doing so, I was able to connect using Developer. The issue, however, is that any time I restart my computer, the TNS Listener service disappears from the list of services in Task Manager and I have to delete and then add and configure the service again using Network Configuration Assistant. Obviously, the Listener still exists because I can delete it and then recreate it.
View 4 Replies View RelatedI created a script to make my admin server a windows service. I successfully made it a service but when it starts it then shuts itself down. i ran a debug and found a error. I dont get what to do. I have tried changing the variables in the script and try it over and over again .....here is my script code and here is the error i got from debug output:
script
SETLOCAL
set DOMAIN_NAME=FRClassicDomain
set USERDOMAIN_HOME=C:/Oracle/Middleware/user_projects/domains/FRClassicDomain
set SERVER_NAME=FRweblogic
[Code]....
When I am creating service for oracle using oradim Utility ,following messsage appearing
F:Users>oradim -new -sid stby -startmode manual
DIM-00014: Cannot open the Windows NT Service Control Manager.
O/S-Error: (OS 5) Access is denied.
I tried to reinstall oracle 11g on windows 2008 R2 and couldn't complete the installation as i am unable to start the oracle service. The system gives the following error message
Instance created.
DIM-00019: create service error
O/S-Error: (OS 1053) The service did not respond to the start or control request
in a timely fashion.
I try to manually create the service and it gives me the same error.I also tried to start the service using the net start as follows
C:UsersAdministrator>net start oracleserviceprod
The service is not responding to the control function.
Having looked at the event viewer in windows, I noticed three different error messages as followsr
Application popup: Microsoft Visual C++ Runtime Library : Runtime Error!
Program: c:appadministratorproduct11.2.0dbhome_1inORACLE.EXE
R6034
An application has made an attempt to load the C runtime library incorrectly.and then A timeout was reached (30000 milliseconds) while waiting for the OracleServiceprod service to connect.
The OracleServiceprod service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
The following link states
Quote:
SESSIONS_PER_USER
Each instance maintains its own SESSIONS_PER_USER count. If SESSIONS_PER_USER is set to 1 for a user, the user can log on to the database more than once as long as each connection is from a different instance.
[URL].....
Of course the following is not working even when resource_limit is TRUE
ALTER PROFILE DEFAULT LIMIT SESSIONS_PER_USER 2;
How can I restrict a user to have limited sessions say 2 sessions across 4 node cluster? Presently I am checking the sessions logged in using sql+ and no connection pooling of front end etc. is involved.
i am using a oracle server. And all my users password has been expired, is there any way to recover those users without failing my data.
View 19 Replies View Related