Re: Security: EAL4 and Database Links

On May 23, 6:24 pm, sybra..._at_hccnet.nl wrote:
> On 23 May 2007 09:28:03 -0700, "bernard (bernard_at_bosvark.com)"
>
> <bosvark2..._at_googlemail.com> wrote:
> >In my quest to comply with EAL4 evaluationsI came across the following
> >in the Oracle Documentation and got confused, I hope that someone
> >might understand this better than me:
>
> >>[DB.AC-6] Each database link must be defined such that users who refer to the link are connected to an identically named normal user account in the secondary or remote database, that is the database link must be defined without reference to a single normal user account to which all users referencing the link would otherwise be connected.
>
> >Does this mean one should only use CURRENT_USER Database Links as
> >described in Metalink Note:264872.1? Or does it mean something else?
>
> >I appreciate your help.
>
> This means the database link needs to be set up as
> create database link foo using 'bar'
> instead of
> create database link foo connect to scott identified by tiger using
> 'bar'
>
> Guess this text comes from one of their lawyers.
>
> --
> Sybrand Bakker
> Senior Oracle DBA

Thank you Sybrand, now I can move forward. Apparently, when using the "identified by" phrase when creating a dblink, the password is stored in clear text, I'm trying to verify that, but my workstations's hard drive is playing up. Will post result.

Regards
Bernard Received on Thu May 24 2007 - 04:45:40 CDT