Verify Function is a quick and easy way to enforce quality of database passwords—for example, they should contain a certain number of characters, should not be identical to the username, and so on.
In Oracle Database 11g, verify_fnction_11g function could be found on password verification file utlpwdmg.sql in $ORACLE_HOME/rdbms/admin.
At the end of the script following lines are available.
ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME 180 PASSWORD_GRACE_TIME 7 PASSWORD_REUSE_TIME UNLIMITED PASSWORD_REUSE_MAX UNLIMITED FAILED_LOGIN_ATTEMPTS 10 PASSWORD_LOCK_TIME 1 PASSWORD_VERIFY_FUNCTION verify_function_11G;
By executing this script utlpwdmg.sql, it will attach the function to the profile DEFAULT, which is the default profile for all users.
Following query can be used to check the profile of the all users.
SELECT * FROM DBA_PROFILES WHERE PROFILE = 'DEFAULT'
Following query can be used to check the users who have the DEFAULT profile assigned.
SELECT USERNAME, PROFILE FROM DBA_USERS
-----------------------------------------------------------------------------------------------------------------
good...very helpful
ReplyDeleteprecise and good..
ReplyDeleteBut if i want to drop the password verify function from default profile?
ALTER PROFILE DEFAULT LIMIT
ReplyDeletePASSWORD_VERIFY_FUNCTION NULL;
Is the password verify function ONLY applied to the default profile? Or can it be applied to other profiles as well?
ReplyDeleteone or many. I have 2 profiles, and DEFAULT is using my updated verify function and my SAPUPROF profile points to DEFAULT (which will use defaults setting). But I could create many different profiles and assign each its own verify function.
Deletewe can assign the Verification function to any profile by following code
DeleteGRANT EXECUTE ON verify_function TO PUBLIC;
Rem *************************************************************************
Rem END Password Verification Functions
Rem *************************************************************************
Rem *************************************************************************
Rem BEGIN Password Management Parameters
Rem *************************************************************************
-- This script alters the default parameters for Password Management
-- This means that all the users on the system have Password Management
-- enabled and set to the following values unless another profile is
-- created with parameter values set to different value or UNLIMITED
-- is created and assigned to the user.
ALTER PROFILE DEFAULT LIMIT
PASSWORD_LIFE_TIME 180
PASSWORD_GRACE_TIME 7
PASSWORD_REUSE_TIME UNLIMITED
PASSWORD_REUSE_MAX UNLIMITED
FAILED_LOGIN_ATTEMPTS 10
PASSWORD_LOCK_TIME 1
PASSWORD_VERIFY_FUNCTION ora12c_verify_function;
/**
The below set of password profile parameters would take into consideration
recommendations from Center for Internet Security[CIS Oracle 11g].
ALTER PROFILE DEFAULT LIMIT
PASSWORD_LIFE_TIME 90
PASSWORD_GRACE_TIME 3
PASSWORD_REUSE_TIME 365
PASSWORD_REUSE_MAX 20
FAILED_LOGIN_ATTEMPTS 3
PASSWORD_LOCK_TIME 1
PASSWORD_VERIFY_FUNCTION ora12c_verify_function;
*/
/**
The below set of password profile parameters would take into
consideration recommendations from Department of Defense Database
Security Technical Implementation Guide[STIG v8R1].
ALTER PROFILE DEFAULT LIMIT
PASSWORD_LIFE_TIME 60
PASSWORD_REUSE_TIME 365
PASSWORD_REUSE_MAX 5
FAILED_LOGIN_ATTEMPTS 3
PASSWORD_VERIFY_FUNCTION ora12c_strong_verify_function;
*/
Rem *************************************************************************
Rem END Password Management Parameters
Rem *************************************************************************
Thanks for your input on the content
DeleteThanks for your input on the content
DeleteHello,
ReplyDeleteIs the PASSWORD_VERIFY_FUNCTION being executed when the password of database account is being changed? Or when the PASSWORD_VERIFY_FUNCTION is being enabled, it will check against all existing database account and locked the accounts which cannot pass the PASSWORD_VERIFY_FUNCTION?
This comment has been removed by the author.
Delete