summary responses research on oracle password security my original post was i am building an oracle v database to serve as a repository for information which is considered proprietary or confidential as such i want to verify the security of oracle passwords and apply some of the same security checking techniques we use on our nix systems specifically i would like to use crack or something like it to check the encrypted data for easily guessed passwords the use of crack would depend on oracle using the unix password encryption scheme does anyone know if this is the case or what method is used any other methods for security checking audit in the oracle environment would be much appreciated this article will just scratch the surface of a few security considerations comments are requested email fw world std com my thanks to the people who responded both on usenet and from oracle corp the most common response was to suggest use of oracle audit features or ops passwords to control access opinion on ops included suggestions to use and not use i was also advised to use table views to refine the granularity of access control one important security consideration in networked installations is that ops accounts presume that the client host provides user authentication os server ops users are only as secure as the least secure machine on the network hence you should probably not define any ops accounts on systems with pc s or limit access of ops accounts to data with no security concerns unix oracle servers provide for disabling ops access over the network orasrv option while relying on host security for local processes internally oracle provides powerful and well documented sic audit mechanisms which the dba will use to monitor system and data access these tools can be used to track the primary security risks from within the oracle environment oracle password security is based on a proprietary usage of des encryption oracle corp states that the algorithm is not prone to cleartext attack this is a difficult claim to substantiate since the algorithm is unknown the concern here is that if users choose easily guessed passwords if a cracker can gain access to your oracle database files through the host operating system s he could extract the cyphertext password data and apply cryptanalysis techniques to learn the users passwords as security risks go the above scenario is pretty low severity certainly once an intruder has access to the raw database files s he can access to the data in them if a cracker could break the passwords however s he could do substantial damage without alerting the auditing mechanism s and leaving and audit trail which would point to valid users at present oracle like unix provides no native means of ensuring that passwords are not guessable as with all computer security the most important defense is to educate users in the safe choice of passwords these techniques are well discussed in internet rfc and the crack manual both available from ftp archive servers and unix r system security curry david a addison welsey forrest whitcher fw world std com boston scientific corp watertown ma
