ORACLE 11g 初始化变量之 SEC_MAX_FAILED_LOGIN_ATTEMPTS

SEC_MAX_FAILED_LOGIN_ATTEMPTS

Property	Description
Parameter type	Integer
Default value	10
Modifiable	No
Range of values	1or higher. In this context, "higher" means any integer value higher than 1, not the string "higher."
Basic	No

SEC_MAX_FAILED_LOGIN_ATTEMPTSspecifies the number of authentication attempts that can be made by a client on a connection to the server process. After the specified number of failure attempts, the connection will be automatically dropped by the server process.

With Oracle Database, a server process is first started, and then the client authenticates with this server process. An intruder could start a server process first, and then issue an unlimited number of authenticated requests with different user names and passwords in an attempt to gain access to the database.

You can limit the number of failed login attempts for application connections by setting the SEC_MAX_FAILED_LOGIN_ATTEMPTS initialization parameter to restrict the number of authentication attempts on a connection. After the specified number of authentication attempts fail, the database process drops the connection. By default, SEC_MAX_FAILED_LOGIN_ATTEMPTS is set to 10.

Remember that the SEC_MAX_FAILED_LOGIN_ATTEMPTS initialization parameter is designed to prevent potential intruders from attacking your applications; it does not apply to valid users. The sqlnet.ora INBOUND_CONNECT_TIMEOUT parameter and the FAILED_LOGIN_ATTEMPTS initialization parameter also restrict failed logins, but the difference is that these two parameters only apply to valid user accounts.

For example, to limit the maximum attempts to 5, set SEC_MAX_FAILED_LOGIN_ATTEMPTS as follows in the initsid.ora initialization parameter file:

SEC_MAX_FAILED_LOGIN_ATTEMPTS = 5

OCP 题库考察此知识点：

Q12. Your database initialization parameter file has the following entry:

SEC_MAX_FAILED_LOGIN_ATTEMPTS=3

Which statement is true regarding this setting?

A. It drops the connection after the specified number of login attempts fail for any user.
B. It is enforced only if the password profile is enabled for the user.
C. It locks the user account after the specified number of attempts.
D. It drops the connection after the specified number of login attempts fail only for users who have the SYSDBA privilege.


Answer: A