2

Let's say there is an Oracle database A and another Oracle database B. Our database is A.

Is there a way to block database links from B to A?

1 Answer 1

2

If you want to block all connections from whatever machine B is running on to A whether they are not they are using a database link, you can use the TCP.EXCLUDED_NODES parameter in your sqlnet.ora file.

If that is not what you want, you could potentially write a login trigger that tries to deduce whether the connection is via a database link presumably based on things like the machine and program from v$session or the IP address from sys_context('USERENV', 'IP_ADDRESS'). A login trigger can work reasonably well assuming your goal is mostly to keep honest users honest. But since you are depending on information that is supplied by the client, a hostile attacker can often work around the issue-- often rather easily.

5
  • Thanks! Login trigger seems interesting, I am doing these dba stuff out of necessity and its not my profession. Can you please point me some direction on how to write these kind of triggers? Commented Mar 11, 2013 at 21:01
  • @bonsvr - Added a link to another DBA thread with an example of a logon trigger that attempts to deny access. Commented Mar 11, 2013 at 21:04
  • Fair answer to the question, but the responsible thing to do would have been to address why privileges to create database links were allowed in the first place. Surely only a DBA should be allowed to create them?
    – Philᵀᴹ
    Commented Mar 11, 2013 at 23:17
  • 2
    @Phil - Maybe I'm missing something. I believe the problem is to prevent database links from a database that you don't control. I don't see how that can be restricted via privileges. Of course, you can certainly prevent people from creating database links in your database that point to other databases. But that doesn't sound like the problem here. Commented Mar 12, 2013 at 1:31
  • Apologies. I clearly didn't read the question properly.
    – Philᵀᴹ
    Commented Mar 12, 2013 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.