« 11g certification matrix
errorlogging in 11g »

the password is not longer displayed in dba_users.password in 11g

By reading Pete Finnigan’s Oracle security weblog today, I discovered that the password is no longer displayed in DBA_USERS in 11g.


select username,password 
from dba_users 
where username='SCOTT';
USERNAME PASSWORD
-------- ------------------------------
SCOTT

select name,password 
from sys.user$ 
where name='SCOTT';
NAME  PASSWORD
----- ------------------------------
SCOTT F894844C34402B67

on the one hand, it is good for the security.

On the other hand, it is a huge change which is not documented (I immediately sent comments to the Security and Reference book authors) and it will make a lot of script failing (scripts that use to change the password to log in and change it back to the original value afterwards).

Protecting the hash is extremely important, check your scripts for 11g compatibility!

This entry was posted on Monday, August 27th, 2007 at 10:22 and is filed under oracle, 11g, security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.
Post to : del.icio.us - Digg it - Furl - reddit - Spurl

Put your code in <code> and </code> tags

7 Responses to “the password is not longer displayed in dba_users.password in 11g”

  1. Steeve Bisson Says:
    August 27th, 2007 at 16:03

    So no more “alter user my_user identified by values ‘hash value’;” ?

  2. Laurent Schneider Says:
    August 27th, 2007 at 16:17

    password is still in SYS.USER$ :?

  3. the password is not longer displayed in dba_users.password in 11gLaurent Schneider | سعد الهويمل Says:
    October 6th, 2007 at 15:59

    […] المصدر […]

  4. DB Says:
    October 12th, 2007 at 00:28

    Oracle changed their own code
    set long 9999
    SELECT DBMS_METADATA.get_ddl (’USER’, ‘SCOTT’)
    FROM DUAL;

  5. Laurent Schneider Says:
    October 12th, 2007 at 08:51

    true, if you use the new algorythm, the values is no longer the 10g hash value USER$.PASSWORD but it is the SHA string in SYS.USER$.SPARE4

  6. Javier Andrés Pérez Díaz » Columna password de DBA_USERS en 11G Says:
    January 8th, 2008 at 05:51

    […] Hago referencia a este articulo que es muy bueno sacado del sitio “http://laurentschneider.com” donde se explica que la columna PASSWORD de la DBA_USERS ya no es visible en 11G: select username,password from dba_users where username=’SCOTT’; USERNAME PASSWORD ——– —————————— SCOTT […]

  7. Laurent Schneider » Blog Archive » alter user identified by values in 11g Says:
    March 12th, 2008 at 15:02

    […] I wrote about dba_users changes in 11g . […]

Leave a Reply

Use <code> and </code> to post code