0

What security risks can be with domain users?

create user "OPS$KA\USERNAME" identified externally.

grant create session to "OPS$KA\MARIK";

Then MARIK that is in KA domain, can logon to the database without password.

I wander to know if oracle checks that the user is a really domain user?

For example is there a risk that somebody with the computer name LB and username MARIK can connect to the database , even it is not a domain user?

  • what testing have you tried? – kevinsky Sep 18 '14 at 14:08
  • I renamed my laptop computer to KA, so computer name is KA. Created local user MARIK. Switched off my network cable from my work computer, which is in domain and plugged it into my laptop. Set the same ip as it had my work compuer. Logged on to the computer by MARIK user. When I run whoami, it shows me KA\MARIK. Created user "OPS$MARIK" in my database and tried to connect from laptop without password and username. ORA-01017 happend. So by some way oracle check if user is a domain user or local user. One more thing to note. If you create user "OPS$MARIK" you can logon but not "OPS$LB\MARIK" – kupa Sep 18 '14 at 14:54
1

Without specific setup, Oracle Database will not know anything about any domain type users you set up. In fact, that's kind of the point of having OS Authentication in the first place; the OS does the authentication, and the Database assumes that this Authentication is legitimate.

If you're using OS authentication for users, you (or someone else in your IT department) will need to set up the necessary precautions to protect that authentication at the OS level.

OS Authentication can be useful in certain cases (automated backups, cron jobs, etc. Anything where you want a background user to log in but you don't want to have a grep'able password), but IMO as a security practice it isn't really too much to ask for a user to have to type a password. Security is best in layers.

2

Beware the OS authentication is done by client machine, not by the database server.

I think that within reasonable pessimism to Oracle tools you could expect that it boils down to this: database server receives a TCP connection from whichever IP address that might pass the network path, and that connection just claims "I promise I've done OS authentication and, trust me, this connection is made on behalf of OPS$JohnSmithCEO." Neither the database client or database server is given OS password for additional OS authentication! And you can't even trust that this connection came from a valid Oracle software. It can be man-in-the-middle in reality. It's worse than telnet.

Whatever "Windows-specific" checks are done by Oracle, they seem contrived and you can't really trust they are complete and secure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.