Thank you for the information. I thought the security issues were more
fundamental. For example if my database has remote os authentication (with
prefix OPS$), and I know that there is a user called OPS$JSTILL, then I can
change the Windows Registry on my client to enable me to logon to the
database as OPS$JSTILL.
> -----Original Message-----
> From: Jared.Still_at_radisys.com [mailto:Jared.Still_at_radisys.com]
>
> At one time you could set the 'ORACLE_USERNAME=SYSTEM'
> variable in your
> oracle.ini
> file, and log into any database as SYSTEM ( without a
> password ) as long
> as REMOTE_OS_AUTHEN=true.
>
> That was obviously some years ago, and I don't know if that is still
> possible.
>
> I would have hoped that such an obvious hole was plugged
> years ago. It
> seems to
> me that it was, but I don't recall details.
--
Please see the official ORACLE-L FAQ: http://www.orafaq.net
--
Author: Jacques Kilchoer
INET: Jacques.Kilchoer_at_quest.com
Fat City Network Services -- 858-538-5051 http://www.fatcity.com
San Diego, California -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from). You may
also send the HELP command for other information (like subscribing).
Received on Thu Mar 06 2003 - 18:38:41 CST
