Re: Restricting access via sqlplus

[Tanel Poder]

Title: RE: Restricting access via sqlplus

Hi!   No, if you code your trigger to check if the program is your apps name, then renaming TOAD to TODD doesn't change anything. But of course if you change TOAD to your apps name, then this scheme fails. But as I stated, these kinds of methods only help against dumb users. If you want true security you have to have some kind of middle layer enforcing security and business/data rules.. (could be implemented inside database as well, through PL/SQL packages and no direct access to tables for example).   Cheers, Tanel. ----- Original Message ----- From: Jamadagni, Rajendra To: Multiple recipients of list ORACLE-L Sent: Wednesday, July 09, 2003 11:39 PM Subject: RE: Restricting access via sqlplus Tanel, If I change TOAD.EXE to TODD.EXE, this scheme fails instantly ... Raj -------------------------------------------------------------------------------- Rajendra dot Jamadagni at nospamespn dot com All Views expressed in this email are strictly personal. QOTD: Any clod can have facts, having an opinion is an art ! -----Original Message----- From: Tanel Poder [mailto:[EMAIL PROTECTED]] Sent: Wednesday, July 09, 2003 4:24 PM To: Multiple recipients of list ORACLE-L Subject: Re: Restricting access via sqlplus Hi! I think sqlplus product profile isn't a good idea, because some smarter ones might be using TOAD, SQL Navigator or SQL Worksheet... What you might want to do is to write an after logon trigger which checks the app name from v$session and allows logon if and only if app name (v$session.program) is your 3rd party one. If app name isn't correct, then your trigger raises an exception. But of course, it only protects you from dumb users. Another way would be playing with roles, but since you have 3rd party app, it might be problematic. Tanel. ----- Original Message ----- To: "Multiple recipients of list ORACLE-L" <[EMAIL PROTECTED]> Sent: Wednesday, July 09, 2003 10:29 PM > Is there a way to prevent end users from connecting directly > to the database via sqlplus without restricting access of those > same users via application code.  The application is a third party > package which prompts for an id and password and then uses that > id/password to connect to the database. > > I found a note the the archives which suggested making an entry into > the SQLPLUS_PRODUCT_PROFILE table, but I have not been able to make > this work. > > Oracle version:  8.1.7 > AIX 4.3.3 > > Thanks, > Peter Schauss > -- > Please see the official ORACLE-L FAQ: http://www.orafaq.net > -- > Author: Schauss, Peter >   INET: [EMAIL PROTECTED] > > Fat City Network Services    -- 858-538-5051 http://www.fatcity.com > San Diego, California        -- Mailing list and web hosting services > --------------------------------------------------------------------- > To REMOVE yourself from this mailing list, send an E-Mail message > to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in > the message BODY, include a line containing: UNSUB ORACLE-L > (or the name of mailing list you want to be removed from).  You may > also send the HELP command for other information (like subscribing). > -- Please see the official ORACLE-L FAQ: http://www.orafaq.net -- Author: Tanel Poder   INET: [EMAIL PROTECTED] Fat City Network Services    -- 858-538-5051 http://www.fatcity.com San Diego, California        -- Mailing list and web hosting services --------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from).  You may also send the HELP command for other information (like subscribing).