How to set a table in read-only mode ?

ALTER TABLE emp
ADD CONSTRAINT read_only CHECK (1=1) DISABLE VALIDATE;

It is now, impossible to insert, update or delete anything with this table.

SQL Injection

SQL Injection.... WOW

With NO COMMENT

the password is not longer displayed in dba_users.password in 11g

By reading Pete Finnigan’s Oracle security weblog today, I discovered that the password is no longer displayed in DBA_USERS in 11g.

select username,password
from dba_users
where username='SCOTT';
USERNAME PASSWORD
-------- ------------------------------
SCOTT

select name,password
from sys.user$
where name='SCOTT';
NAME  PASSWORD
----- ------------------------------
SCOTT F894844C34402B67

on the one hand, it is good for the security.

On the other hand, it is a huge change which is not documented (I immediately sent comments to the Security and Reference book authors) and it will make a lot of script failing (scripts that use to change the password to log in and change it back to the original value afterwards).

Protecting the hash is extremely important, check your scripts for 11g compatibility!

Change Oracle APPS Password : FNDCPASS

With Product Family ATG version H Roll Up 3 , Oracle Introduced New Option in FNDCPASS which is ALLORACLE to Change password of all Schema provided by Oracle Application products. These are basically below three category password
–These are mainly schema password for products like AP, GL, AR (These are also termed as of mode ORACLE )
–Password for APPLSYS and APPS (Same password for both schema) . This is also called as Apps Password (used during CM startup)
–Password for account APPLSYSPUB

How to change Oracle Applications Products/Schema Password including APPS ?
As most of you might already be aware that you use FNDCPASS utility on Concurrent Manager Node.
FNDCPASS logon 0 Y system/password mode username new_password
Where MODE is SYSTEM/USER/ORACLE/ALLORACLE (Introduced with patch 4745998)

Will ALLORACLE mode change other schema passwords like CTXSYS, MDSYS, PORTAL..,SYS, SYSTEM, SCOTT, Application User like AtulKumar …. ??

No ALLORACLE mode will change only schemas mentioned in paragraph 1 and will not change passwords for schemas like CTXSYS, MDSYS, SYS, SYSTEM…..

Is previous Mode SYSTEM/USER/ORACLE still available with FNDCPASS ?
Yes

How to get ALLORACLE mode in FNDCPASS ?
Apply Oracle Apps patch 4745998

What files to change after changing Apps Password ?
You use FNDCPASS apps/apps 0 Y system/manager SYSTEM APPLSYS WELCOME to change Apps Password
–Once you change apps password you need to change apps password stored in file wdbsvr.app at $IAS_ORACLE_HOME/Apache/modplsql/cfg

–In some instances you might have to change in CGIcmd.dat at $ORACLE_HOME/reports60/server

–You also have to change in any custom concurrent manager start up script (If you have any)

–If you have configured E-Business Suite with 10g Application Server SSO/OID then after changing APPS password, update provisioning profile with new apps password

oidprovtool operation=modify \
ldap_host={OID Server hostname} ldap_port={OID Server Port} \ ldap_user_dn=”cn=orcladmin” ldap_user_password={orcladmin Password} \ application_dn=” {The LDAP distinguished name of the application}” \ interface_connect_info={E-Business Suite connect info of the format, host:port:Sid:username:password}

after changing Apps password bounce Concurrent Managers.

How to resolve ORA-09925 ?

This morning I had to solve an ORA-09925: Unable to create audit trail file and it was not as straightforward as usual…

There is a note 69642.1 on Metalink, [edit]which is now up to date for 10gR2[/edit].

1) AUDIT_FILE_DEST is not writable

$ env
_=/usr/bin/env
ORACLE_SID=FOO
TERM=dtterm
ORACLE_HOME=/u01/app/oracle/product/10.2.0/db_3
PWD=/u01/app/oracle/product/10.2.0/db_3
$ $ORACLE_HOME/bin/sqlplus -L "/ as sysdba"
SQL> startup
ORA-09925: Unable to create audit trail file
IBM AIX RISC System/6000 Error: 2: No such file or directory
Additional information: 9925
$ grep -i audit_file_dest $ORACLE_HOME/dbs/*$ORACLE_SID.ora
audit_file_dest=/bar
$ ls -lad /bar
/bar not found
$ su -
root's Password:
# mkdir /bar
# exit
$ $ORACLE_HOME/bin/sqlplus -L "/ as sysdba"
SQL> startup
ORA-09925: Unable to create audit trail file
IBM AIX RISC System/6000 Error: 13: Permission denied
Additional information: 9925
$ su -
root's Password:
# chown oracle /bar
# exit
$ $ORACLE_HOME/bin/sqlplus -L "/ as sysdba"
SQL> startup quiet nomount
ORACLE instance started.
SQL> shutdown abort
ORACLE instance shut down.

2) $ORACLE_BASE/admin/$ORACLE_SID/adump exists and is not writable :!:


$ ls -lad $ORACLE_BASE/admin/$ORACLE_SID/adump
drwxr-xr-x 2 root dba .../admin/FOO/adump
$ $ORACLE_HOME/bin/sqlplus -L "/ as sysdba"

SQL*Plus: Release 10.2.0.3.0 -
Production on Mon Dec 17 09:02:29 2007

Copyright (c) 1982, 2006, Oracle. All Rights Reserved.

ERROR:
ORA-09925: Unable to create audit trail file
IBM AIX RISC System/6000 Error: 13: Permission denied
Additional information: 9925
ORA-09925: Unable to create audit trail file
IBM AIX RISC System/6000 Error: 13: Permission denied
Additional information: 9925

SP2-0751: Unable to connect to Oracle. Exiting SQL*Plus
$ su -
root's Password:
# chown oracle /bar/admin/FOO/adump
$ $ORACLE_HOME/bin/sqlplus -L "/ as sysdba"

SQL*Plus: Release 10.2.0.3.0 -
Production on Mon Dec 17 09:02:48 2007

Copyright (c) 1982, 2006, Oracle. All Rights Reserved.

Connected to an idle instance.

SQL> quit

3) $ORACLE_HOME/rdbms/audit is not writable


$ cat $ORACLE_HOME/dbs/init$ORACLE_SID.ora
db_name=FOO
$ $ORACLE_HOME/bin/sqlplus -L "/ as sysdba"

SQL*Plus: Release 10.2.0.3.0 -
Production on Mon Dec 17 08:48:09 2007

Copyright (c) 1982, 2006, Oracle. All Rights Reserved.

ERROR:
ORA-09925: Unable to create audit trail file
IBM AIX RISC System/6000 Error: 13: Permission denied
Additional information: 9925
ORA-09925: Unable to create audit trail file
IBM AIX RISC System/6000 Error: 13: Permission denied
Additional information: 9925

SP2-0751: Unable to connect to Oracle. Exiting SQL*Plus
$ ls -lad $ORACLE_HOME/rdbms/audit
drwxr-x--- 2 root dba ... $ORACLE_HOME/rdbms/audit
$ cd $ORACLE_HOME; su
root's Password:
# chown oracle ./rdbms/audit
# exit
$ $ORACLE_HOME/bin/sqlplus "/ as sysdba"

SQL*Plus: Release 10.2.0.3.0 -
Production on Mon Dec 17 08:49:12 2007

Copyright (c) 1982, 2006, Oracle. All Rights Reserved.

Connected to an idle instance.

SQL> quit

xhost + is a huge security hole

Maybe you have a firewall in your company, only your PC can access the production server, only you have the root password in prod, and your company spend a lot of money in security, but you dare using xhost +.

This is a huge security hole, because it gives anyone access to your X resources, not only your display, but also your mouse and your keyboard, so anyone can read/modify/corrupt what you are typing/clicking. It is a bad habit to use xhost+. Even using xhost +localhost give access to your keyboard to anyone on localhost…

So what else could you use ?

The simplest is probably ssh tunnelling.

lsc@chltlxlsc:~> ssh -X oracle@localhost
Last login: Fri Max 2 10:24:09 2007 from localhost
oracle@chltlxlsc:~> xterm -e true && echo success
success

Another way to do this is to use X cookies.

lsc@chltlxlsc1:~> xauth extract ~/my-x-cookie $DISPLAY<
lsc@chltlxlsc1:~> setfacl -m u:oracle:r ~/my-x-cookie
lsc@chltlxlsc1:~> su - oracle -c "DISPLAY=$DISPLAY bash"
Password:
oracle@chltlxlsc1:~> xterm -e true && echo success
Xlib: connection to ":0.0" refused by server
Xlib: No protocol specified

xterm Xt error: Can't open display: :0.0
oracle@chltlxlsc1:~> xauth merge ~lsc/my-x-cookie
xauth: creating new authority file ~oracle/.Xauthority
oracle@chltlxlsc1:~> xterm -e true && echo success
success

No need to type all. Here is my alias

alias oracle='
xauth extract $HOME/my-x-cookie $DISPLAY;
setfacl -m u:oracle:r $HOME/my-x-cookie;
su - oracle -c "export DISPLAY=$DISPLAY;
xauth merge $HOME/my-x-cookie;
bash"'