the password is not longer displayed in dba_users.password in 11g
August 27th, 2007
By reading Pete Finnigan’s Oracle security weblog today, I discovered that the password is no longer displayed in DBA_USERS in 11g.
select username,password
from dba_users
where username='SCOTT';
USERNAME PASSWORD
-------- ------------------------------
SCOTT
select name,password
from sys.user$
where name='SCOTT';
NAME PASSWORD
----- ------------------------------
SCOTT F894844C34402B67
on the one hand, it is good for the security.
On the other hand, it is a huge change which is not documented (I immediately sent comments to the Security and Reference book authors) and it will make a lot of script failing (scripts that use to change the password to log in and change it back to the original value afterwards).
Protecting the hash is extremely important, check your scripts for 11g compatibility!
So no more “alter user my_user identified by values ‘hash value’;” ?
password is still in SYS.USER$
Oracle changed their own code
set long 9999
SELECT DBMS_METADATA.get_ddl (’USER’, ‘SCOTT’)
FROM DUAL;
true, if you use the new algorythm, the values is no longer the 10g hash value USER$.PASSWORD but it is the SHA string in SYS.USER$.SPARE4