OraFAQ Forum: Server Administration » user privileges changed misteriously

Home » RDBMS Server » Server Administration » user privileges changed misteriously (Oracle 9i, Windows server 2003, Toad 7.6)

Show: Today's Messages :: Polls :: Message Navigator
E-mail to friend

user privileges changed misteriously [message #567223]

Tue, 25 September 2012 07:56

sstellini
Messages: 32
Registered: April 2005
Location: Malta

Member

We had a strange case few days ago where a developer lost her privileges all of a sudden. She's claiming she didn't change them and no one else could have done it apart from her (DBA wasn't around on those days). We didn't have the audit ALTER USER set up yet so can't check who did it exactly, by using the audit log.

Does anyone know if there is another way to check if she had done it anyway, or if there is perhaps a bug that could cause this (in Toad ver 7.6, Oracle 9i)?

Report message to a moderator

Re: user privileges changed misteriously [message #567224 is a reply to message #567223]

Tue, 25 September 2012 08:00

joy_division
Messages: 4963
Registered: February 2005
Location: East Coast USA

Senior Member

I don't know what TOAD is, but users cannot change their own privileges. What privileges are you talking about? application controlled privileges?

Report message to a moderator

Re: user privileges changed misteriously [message #567227 is a reply to message #567224]

Tue, 25 September 2012 08:09

sstellini
Messages: 32
Registered: April 2005
Location: Malta

Member

I'm taking about oracle db privileges. She had ALTER USER privilege, so she could change her or someone else privileges and Toad is the tool that allows you to do that, apart from other things.. She claims she didn't change any of her privileges and I'd like to know if there is a way to prove her right or wrong, which ever. As I said, I didn't have 'audit ALTER USER' set up at that time..

Report message to a moderator

Re: user privileges changed misteriously [message #567232 is a reply to message #567227]

Tue, 25 September 2012 08:16

Michel Cadot
Messages: 68757
Registered: March 2007
Location: Saint-Maur, France, https...

Senior Member
Account Moderator

Quote:

She had ALTER USER privilege, so she could change her or someone else privileges

Wrong, ALTER USER has nothing to do with privileges.
Privileges are managed with GRANT and REVOKE statements.

By the way, I see no reason a user (but a dba) has ALTER USER privilege. This is an awful securioty hole.

Regards
Michel

Report message to a moderator

Re: user privileges changed misteriously [message #567263 is a reply to message #567227]

Tue, 25 September 2012 12:49

joy_division
Messages: 4963
Registered: February 2005
Location: East Coast USA

Senior Member

Yikes, I meant I did not know what TOAD has to do with this, not that I did not know what TOAD is. Sorry.

Report message to a moderator

Re: user privileges changed misteriously [message #567283 is a reply to message #567263]

Wed, 26 September 2012 02:59

sstellini
Messages: 32
Registered: April 2005
Location: Malta

Member

Erm..
GRANT ALTER USER TO User1 works fine for me..

Anyway, she needs to have that system privilege (thanks for correcting), as she works as a support girl too (we're a small company).

But what I'm trying to find out is if there is another way to check if she had re-stetted her privileges, or if there is perhaps a bug that could cause this to happen.. she was using an old version of Toad (7.6), leaving it on all the time etc.. I didn't find yet that it is possible to check this (Oracle 9i is what we have), but just in case I've posted the question here too..

btw, I've set up the audit on ALTER USER so I will know from now on if that happens again, but for the past week I didn't have that audit set up..

Report message to a moderator

Re: user privileges changed misteriously [message #567284 is a reply to message #567283]

Wed, 26 September 2012 03:29

Michel Cadot
Messages: 68757
Registered: March 2007
Location: Saint-Maur, France, https...

Senior Member
Account Moderator

Quote:

Anyway, she needs to have that system privilege (thanks for correcting), as she works as a support girl too (we're a small company).

So she is a DBA (this is what ALTER USER privilege means).

Quote:

But what I'm trying to find out is if there is another way to check if she had re-stetted her privileges

Log Miner.

Quote:

or if there is perhaps a bug that could cause this to happen

Not in Oracle, in your TOAD maybe and most likely a user error in TOAD usage. This is what this tool shoud be banned.

Quote:

I've set up the audit on ALTER USER

Which is useless to audit changes in privileges as I said.

Regards
Michel

Report message to a moderator

Re: user privileges changed misteriously [message #567285 is a reply to message #567284]

Wed, 26 September 2012 03:41

sstellini
Messages: 32
Registered: April 2005
Location: Malta

Member

Thanks Michel,
will see about Log Miner - haven't used it yet..
But why do you think that audit on ALTER USER is useless - it gives me the info that someone changed ie altered user ie: who did it, which user got changed and when and that's useful to me. Maybe I'm missing something.

Report message to a moderator

Re: user privileges changed misteriously [message #567286 is a reply to message #567285]

Wed, 26 September 2012 03:49

Michel Cadot
Messages: 68757
Registered: March 2007
Location: Saint-Maur, France, https...

Senior Member
Account Moderator

Quote:

But why do you think that audit on ALTER USER is useless

Because

Quote:

Wrong, ALTER USER has nothing to do with privileges.
Privileges are managed with GRANT and REVOKE statements.

I said it is useless to audit privilege changes, it is not useless in abolute.

Regards
Michel

Report message to a moderator

Re: user privileges changed misteriously [message #567287 is a reply to message #567286]

Wed, 26 September 2012 03:54

sstellini
Messages: 32
Registered: April 2005
Location: Malta

Member

ok
thank you for your help.

Sonja

Report message to a moderator

Previous Topic:	Blocking Session in v$session
Next Topic:	How to see Schema user password in text

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Sat May 03 15:10:26 CDT 2025