Author: Laurent Schneider

connect to mssql with python/linux

done for a friend : install rpm’s sudo yum install -y freetds unixODBC unixODBC-devel freetds-libs python3-pyodbc create odbc.ini and odbcinst.ini for sybase go there Unix ODBC Sybase for oracle go there Unix ODBC Oracle for mssql ~/.odbc.ini : the Database definition [DB01] Driver = FreeTDS Description = DB01 Server = src01 Port = 1433 Database = DB01 […]

proxy user revisited

A new 10.2 feature I mentioned in su in sqlplus – Laurent Schneider is the ability to use a proxy user in a connection string. This was documented in What’s New in Oracle Call Interface? Proxy access for a single client can be set using various connect strings. Today I got one user complaining about […]

ODBC/OLEDB/ODP and Kerberos

Precondition : sqlplus can connect to the database server using a kerberos ticket. I wrote The long long route to Kerberos – Laurent Schneider in 2014, but most of the bugs in 11.2.0.2 / 12.1.0.2 are no longer interesting, so probably you should be fine to just read Configuring Kerberos Authentication (oracle.com) let’s see sqlplus […]

Log4J and OEM Part II

After part 1, where Oracle wrote in an official document there is no impact for your targets, Critical Patch Advisory April 2022 reveals multiple vulnerabilities, one of them is Log4J severity 9.8/10. 9.8 means it is kindergarden easy to compromise confidentiality, integrity and availability even without a login. In the meanwhile, per 30. April, Oracle […]

jdbc url with ldap ssl in 21c

the basic : you have tns resolution over ldap. To change from ldap to ldaps, you modify : jdbc:oracle:thin:@ldap://ldap.example.com:389/DB01,cn=OracleContext,dc=example,dc=com to jdbc:oracle:thin:@ldaps://ldap.example.com:636/DB01,cn=OracleContext,dc=example,dc=com now the advanced : Oracle Support mentions, there is no support for Mode 2 SSL (note 1664857.1) So one approach was to either not use ldaps, or to use level 1, which means no […]

Log4J and Oracle Enterprise Manager

Log4j issues allow a remote client to execute code without authentication. Software vendors spent the last two months thinking of the impact and the mitigations. The bad: If you have Enterprise Manager, you have multiple web services, like em itself (https://oms.example.com:7799/em), the weblogic console (https://oms.example.com:7102/console), the agent (https://dbsrv01.example.com:3872/emd/main/) and others. This makes you an easy […]

TNS resolution with LDAP and SSL

Long time ago, ldapsearch without password and without ssl was the way to go. But clear-text authentication (so called simple-bind) is a security leak. More and more, directory server vendors and administrators are closing the default non-ssl port and enforce authentication. And if you use ldap for TNS naming, things will break. Back in 2003, […]