Oracle database any user password can be logged in with the SYSDBA role

* Related environment: Windows 10, 64-bit operating system, Oracle 11gr2;toad for Oracle12.1

Recently in the Learning Oracle database, using Toad for Oracle to view the database information, found in the SYSDBA role in the database, regardless of the input of any password, can connect to the database, thinking that the database is out of trouble, with doubt, find data. Found there is a lot of knowledge, the following simple description.

Oracle Certified users are available in two ways: operating system authentication and password Authentication . Operating system authentication is also called local authentication.

• Operating system certification: Oracle believes that the operating system users are reliable, and since you can log into the operating system, you can also log on to the database;
• Password file authentication: Oracle considers the operating system user to be unreliable, and if you want to access the database, you must use password authentication again.

(a) Operating system certification

To use operating system authentication, you need to set two:

(1) Set in the Sqlnet.ora file:

Sqlnet. Authentication_services= (NTS)

As (line 8th):

NTS refers specifically to Windows systems.

(2) Set up the ORA_DBA group in Windows, and then add users who need to use the operating system authentication to this group, which is opened in the following way:

Group, Local Users and groups, Computer Management, management tools, Control Panel. After opening we can see the relevant information:

To open the ORA_DBA user group, you can see:

This explains why we are still able to log in when logging in to the database using client tools such as Toad for Oracle or Sqlplus: When we install the database, we use the default installation method, log in to the database using the operating system authentication, So when using the SYSDBA authentication login, you can log in to the database, regardless of the password right or wrong. one thing to note here is that the user logged in using the operating system user group ORA_DBA will be logged in with the operating system user, if the user is not in ORA_DBA,

After logging in, you can execute the following statement in SQL Plus Select User from dual to view the current user:

The user who discovered the database is SYS, not Scott. After many tests, it was found that logging from CMD to Sqlplus/as Sysdba was the same result. Finally, the user of the final database is SYS regardless of which account is used, as long as the as SYSDBA is logged in to the database.

(b) Password file authentication

Oracle database any user password can be logged in with the SYSDBA role