Re: changing pswds of standard accounts

On Aug 7, 1:46 am, EdStevens <quetico_...@xxxxxxxxx> wrote:
On Aug 6, 10:12 am, DA Morgan <damor...@xxxxxxxxx> wrote:



EdStevens wrote:
On Aug 4, 1:58 am, DA Morgan <damor...@xxxxxxxxx> wrote:
EdStevens wrote:
On Aug 3, 3:05 pm, DA Morgan <damor...@xxxxxxxxx> wrote:
<snip>
I am not aware of a single Oracle password that can not be changed at
will provided you haven't hard coded it into shell scripts and the like.
And if you have fix the scripts.
--
Daniel A. Morgan
University of Washington
damor...@xxxxxxxxxxxxxxxx (replace x with u to respond)
Puget Sound Oracle Users Groupwww.psoug.org
True. What I'm looking for here is where those hard-coded locations
might be for *oracle created* accounts. I've found documentation on
MetaLink for DBSNMP, SYSMAN, and now MGMT_VIEW that require mods to
some config files in addition to the simple ALTER USER .... Just
don't want to overlook any.
Have already locked accounts that the "home office" says are not
needed, and turned on session auditing for use of CREATE SESSION on
those accounts.
The hard coded locations are irrelevant if you've done the basics.

Set RESOURCE_LIMIT = TRUE in your spfile.
Alter the default profile to force password complexity.
Alter the default profile to force password expiration.
Change every password on an unlocked account.
Anything that doesn't work ... you'll know why.

Why not look for the hard-coded locations first? Because stupid people
do stupid things. There is no logic ... there is no rhyme or reason. The
first responsibility is to protect the data not people's egos.
--
Daniel A. Morgan
University of Washington
damor...@xxxxxxxxxxxxxxxx (replace x with u to respond)
Puget Sound Oracle Users Groupwww.psoug.org

Actually, I have done all of the above. What I'm trying to do here is
address a specific internal requirement that *all* passwords be
changed every 'n' days. The accounts that belong to human users are
taken care of themselves when they log on after the account expires.
Here, I'm addressing the specifically listed accounts created by
Oracle when the db is created. As mentioned in the original post,
there are some, *such as* DBSNMP, that are known to have special
considerations, and I am simply looking to make sure I don't overlook
other Oracle created accounts that might also have special
considerations but not be as well-known or well-doucmented as is
DBSNMP.

Are you using DBSNMP and SYSMAN for anything?

?!?!?!? uh, dbcontrol? OEM?



Sadly: Most likely what yuou are going to end up with is a manual procedure.

.... unless he'll choose to script it of course. You'll have to stick
to manual procedure of course as you aren't scripting any more :)

Yes, but a manual procedure that only has to be performed once every
150 days. Not too onerous.

Well, password change for these particular two accounts can be
scripted.

--
Daniel A. Morgan
University of Washington
damor...@xxxxxxxxxxxxxxxx (replace x with u to respond)
Puget Sound Oracle Users Groupwww.psoug.org


.

Relevant Pages

  • Re: changing pswds of standard accounts
    ... Daniel A. Morgan ... Puget Sound Oracle Users Groupwww.psoug.org ... Have already locked accounts that the "home office" says are not ...
    (comp.databases.oracle.server)
  • Re: changing pswds of standard accounts
    ... Daniel A. Morgan ... Puget Sound Oracle Users Groupwww.psoug.org ... Have already locked accounts that the "home office" says are not ...
    (comp.databases.oracle.server)
  • Re: changing pswds of standard accounts
    ... Puget Sound Oracle Users Groupwww.psoug.org ... might be for *oracle created* accounts. ... Alter the default profile to force password complexity. ...
    (comp.databases.oracle.server)
  • Re: Group rename problem
    ... Yes, scripts are replicated okay. ... my test account. ... A few days ago I had to rename a few security groups in our AD. ... After the rename I made tests with my test accounts and all seemed to ...
    (microsoft.public.windows.server.general)
  • Solaris reclaiming space
    ... Solaris10 or Solaris 9? ... Three configuration scripts are left behind. ... Remove any unnecessary accounts from the system. ... The login shell should also be changed on these accounts. ...
    (comp.unix.solaris)
Loading