OraFAQ Forum: Security » Knowing the running proudct

Home » RDBMS Server » Security » Knowing the running proudct

Show: Today's Messages :: Polls :: Message Navigator
E-mail to friend

Knowing the running proudct [message #299196]

Sun, 10 February 2008 10:14

Lama
Messages: 45
Registered: February 2006

Member

Dear All,

I have a situation that i want to give access to a specific user only to the form runtime, I tried creating trigger on the database but am not sure from where i get the product used if it's sqlplus ,forms builder or runtime...

Best Regards,
Lama

Report message to a moderator

Re: Knowing the running proudct [message #299199 is a reply to message #299196]

Sun, 10 February 2008 10:20

Michel Cadot
Messages: 68718
Registered: March 2007
Location: Saint-Maur, France, https...

Senior Member
Account Moderator

v$session.module, v$session.program.
SYS_CONTEXT

Regards
Michel

Report message to a moderator

Re: Knowing the running proudct [message #299200 is a reply to message #299196]

Sun, 10 February 2008 10:24

Mahesh Rajendran
Messages: 10708
Registered: March 2002
Location: oracleDocoVille

Senior Member
Account Moderator

It wont work.
Assume that you have blocked the user from using sqlplus.exe through a trigger. All the user needs to do is, rename sqlplus.exe to anything.exe and bypass the trigger.
>>i want to give access to a specific user only to the form runtime
Then install only the required tools.

EDIT:
And, Michel was faster Smile

[Updated on: Sun, 10 February 2008 10:24]

Report message to a moderator

Re: Knowing the running proudct [message #299256 is a reply to message #299196]

Mon, 11 February 2008 01:00

Lama
Messages: 45
Registered: February 2006

Member

install only the required tools!!!! am working with IT people here so even if installed only the runtime they will install all the other products !!!!!

Report message to a moderator

Re: Knowing the running proudct [message #299259 is a reply to message #299256]

Mon, 11 February 2008 01:14

Michel Cadot
Messages: 68718
Registered: March 2007
Location: Saint-Maur, France, https...

Senior Member
Account Moderator

They should not.
If you only need a client, they should install only the client and not the tools.
You should report this to your manager if they don't want to do it.
Workarounding an organizational problem with a technical solution is ALWAYS a bad solution.

Regards
Michel

Report message to a moderator

Re: Knowing the running proudct [message #299265 is a reply to message #299196]

Mon, 11 February 2008 01:28

Lama
Messages: 45
Registered: February 2006

Member

My Manager told me to do so...
we are doing a shared database for all clients that are having active loans in 7 organization , so they can check if one client is already is an active client in another organization but without knowing which organization...but in the db there should be a column to specify that organization but i will not show it to the user...

Now we are sure that the MIS depts in these companies will try their best to enter sql, toad or whatever other product where they can c all the data ....

Sad

that's why i only want to give them access to the runtime

Report message to a moderator

Re: Knowing the running proudct [message #299297 is a reply to message #299265]

Mon, 11 February 2008 05:07

Mahesh Rajendran
Messages: 10708
Registered: March 2002
Location: oracleDocoVille

Senior Member
Account Moderator

>>am working with IT people here so even if installed only the runtime they will install all the other products
So?. How long will it take to rename an executable file and bypass your "security"? Smile

>>whatever other product where they can c all the data
Then secure the data. Look into VPD (virtual private database).

Report message to a moderator

Previous Topic:	Encrypt Data in a column in a table
Next Topic:	Restriction on Application Level Users

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Wed Dec 04 03:30:24 CST 2024