remote_os_authent

The Oracle RDBMS used to have a parameter called remote_os_authent. This specified whether or not you could connect to an instance remotely using OS authentication. Setting it to true was a security risk, especially if you used OS authentication for database users which had the DBA role. For example, you might have an externally identified user in your database called ORACLE and grant the DBA role to that user. A malicious user with admin rights on a remote machine could create a user called oracle on that machine and use it to connect to your database as an administrator without providing a password. In version 11, the Oracle RDBMS deprecated this parameter but have retained it (for now) for backward compatibility. The example below illustrates this. I ran it on a UNIX server as a UNIX user called oracle. First I connected to the database as SYS and set remote_os_authent to true in the server parameter file:

 

SQL> conn / as sysdba

Connected.

SQL> alter system set

  2  remote_os_authent = true

  3  scope = spfile

  4  /

 

System altered.

 

SQL>

 

Then I bounced the database. The Oracle RDBMS displayed an error message when it saw the deprecated parameter:

 

SQL> shutdown immediate

Database closed.

Database dismounted.

ORACLE instance shut down.

SQL> startup

ORA-32004: obsolete and/or deprecated parameter(s) specified

ORACLE instance started.

 

Total System Global Area  158703616 bytes

Fixed Size                  2086736 bytes

Variable Size              83888304 bytes

Database Buffers           67108864 bytes

Redo Buffers                5619712 bytes

Database mounted.

Database opened.

SQL>

 

I reconnected to the database remotely and reset remote_os_authent in the server parameter file:

 

SQL> conn /@test11

Connected.

SQL> show user

USER is "ORACLE"

SQL> alter system reset remote_os_authent

  2  scope = spfile

  3  /

 

System altered.

 

SQL>

 

Then I bounced the database again. This time there was no error message:

 

SQL> conn / as sysdba

Connected.

SQL> shutdown immediate

Database closed.

Database dismounted.

ORACLE instance shut down.

SQL> startup

ORACLE instance started.

 

Total System Global Area  158703616 bytes

Fixed Size                  2086736 bytes

Variable Size              88082608 bytes

Database Buffers           62914560 bytes

Redo Buffers                5619712 bytes

Database mounted.

Database opened.

SQL>

 

Changing the remote_os_authent parameter stopped the remote connection working:

 

SQL> conn /@test11

ERROR:

ORA-01017: invalid username/password; logon denied

 

Warning: You are no longer connected to ORACLE.

SQL>