Question

1. Discuss how users can be authenticated by the operating system to connect to the Oracle database. how does SQL*Plus relate to this method?

2. What methods does Oracle support for authentication by the network?

3. What are the key components you would include in a password policy? Why?

4. Give an example how you define a good password policy. Can you design a general password policy? Or do you need to design it to consider a particular situation always?

Answer 1

1)Some OS permit Oracle to use information they maintain to authenticate users.once user authenticated by the OS ,users can connect to Oracle,without specifying username or password.For example,an OS authenticated user can invoke SQL *Plus and skip the username and password prompts by entering SQLPLUS /.

2)1.Authentication using SSL

2.Authentication using third party services

I) Kerberos authentication

II)PKI-Based authentication

III) Authentication with RADIUS

IV) Directory based services

3)

I)Training which means train your existing employees on creating proper passwords.Make security a part of your corporate culture and make no exception to the rules that you've established.

II)Tools which includes remembering complex passwords on a strategy.

4)Example:-

I)valid for 15 days. II)must have min length 5. III)Must have max length 8. IV) must have atleast two special characters.

V) number of passwords should keep in history. VI)user must change default password during initial login.