0

I need to know if there is a way in SQL*Plus to display the password of a certain username?

At my job, sometimes the developers ask me what happened to their account, and what their password is. When I try to display the username and password, the password shows as blank.

Could you please help?

closed as off-topic by RolandoMySQLDBA, Paul White, Mark Storey-Smith, dezso, Marian Feb 10 '14 at 16:31

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Too localized - this could be because your code has a typo, basic error, or is not relevant to most of our audience. Consider revising your question so that it appeals to a broader audience. As it stands, the question is unlikely to help other users (regarding typo questions, see this meta question for background)." – RolandoMySQLDBA, Paul White, Mark Storey-Smith, dezso, Marian
If this question can be reworded to fit the rules in the help center, please edit the question.

13

What you are asking is impossible, unless you brute-force the password hash for the user.

How do you expect a system to be secure if passwords are stored in plain text?

-3

You can user this:

SELECT name,
       ctime,           -- create time
       ptime            -- change 
FROM   sys.user$
WHERE  name = '<USER NAME>';

Of course there is no (easy) way to decrypt Oracle passwords.

  • 2
    How does this answer the question? – Colin 't Hart Feb 10 '14 at 12:53
  • 1
    This is real life situation. You can tell developers at least WHEN then password was changed. Then with some effort you can guess by whom it was changed. Of course you can not tell what the new password is. But at least you can identify the "culprit". – ibre5041 Feb 10 '14 at 13:08
  • Judging by the fact that the OP is able to display the username and blank password field, it seems they already know how to query this information. – Colin 't Hart Feb 10 '14 at 13:13
  • 1
    In addition, I would rather query dba_users which includes account_status, lock_date and expiry_date. – Colin 't Hart Feb 10 '14 at 13:14
-3

Phil's answer gets to the point: there shouldn't be any way at all for you to get users' passwords, that's really insecure because getting access to the DB would expose all system access.

Password recovery should always depend on the user alone via a password recovery e-mail or something like that, which probably isn't up to you but to the people in charge of the application.

  • 2
    "people in charge of the application"? We're talking about developers coming to the DBA. The DBA is in charge of this application (Oracle DBMS). – Colin 't Hart Feb 10 '14 at 14:33
  • Yes, but it is very unlikely that a password recovery feature is gonna be implemented at DB level. I meant the people not working in the DB layer. – Oxfist Feb 10 '14 at 14:55
  • 1
    And my point is the question is explicitly about the DB layer! SQL*Plus, developers, DBA. – Colin 't Hart Feb 10 '14 at 15:25
  • I don't see the misunderstanding here. I know what OP asked, and my answer to his/her question is that password recovery shouldn't be his/her concern, so unless more information about the implementation is given (maybe the passwords are in fact stored in plain text or decryption is possible) then the developers really need to implement a password recovery feature for themselves. Unless, of course, we want to answer with a really bad development practice. – Oxfist Feb 10 '14 at 15:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.