0

I was asked an interesting question the other day and I have not been able to find a definitive answer.

If one of my DBA's changes a password, will the password the password show up in plain text in the audit trails?

Eg. sys as sysdba changes the password of system.

ALTER USER system IDENTIFIED BY <password>

Oracle states that it will not if the user changes their own password, but says nothing about another account changing the password of another account. The suspicion is that the password would show up in clear text in trails such as v$SQL.

This seems like an egregious oversight if Oracle didn't account for this but I cannot find anything to prove otherwise.

1 Answer 1

3

You could just try it out.

This is logged in locally sqlplus / as sysdba:

SQL> alter user mat identified by COOLPASSWORD ;

User altered.

SQL> select substr(sql_text,0,40) from v$sqlarea where lower(sql_text) like '%alter%' ;

SUBSTR(SQL_TEXT,0,40)
----------------------------------------
select substr(sql_text,0,40) from v$sqla

SQL> select substr(sql_text,0,40) from v$sql where lower(sql_text) like '%alter%' ;

SUBSTR(SQL_TEXT,0,40)
----------------------------------------
select substr(sql_text,0,40) from v$sql
select substr(sql_text,0,40) from v$sqla

The alter commands are not present in v$sql or v$sqlarea. I have sys operations auditing on that test database, and the audit file for the above password change contains:

<AuditRecord><Audit_Type>4</Audit_Type>...<OSPrivilege>SYSDBA</OSPrivilege>...
<Sql_Text>alter user mat identified by * </Sql_Text>
</AuditRecord>

That's a literal * in the XML file. The normal audit logs contain the same * instead of the password, including if I change another user's password (logged in as a normal DBA user).

Now if you use things like rlwrap to run sqlplus, or fancy GUI clients, the password may well stay in some command line history/buffer. But the database server can't do much about that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.