Oracle 建议在用户概要文件中将 FAILED_LOGIN_ATTEMPTS 参数更改为不超过 10 的值

 

Oracle 建议在用户概要文件中将 FAILED_LOGIN_ATTEMPTS 参数更改为不超过 10 的值 alter profile default limit FAILED_LOGIN_ATTEMPTS unlimited; 不锁定用户   alter profile default limit FAILED_LOGIN_ATTEMPTS 3; 三次后锁定用户   select * from dba_profiles;   Oracle Database 10g在缺省用户管理上有个小的改进，就是FAILED_LOGIN_ATTEMPTS的口令失败尝试变成了10次，这个设置的确有点问题。如果有一个用户不停尝试错误口令，那就会导致用户被锁。 如果恢复之前无限制，可以通过一条命令解决： alter profile default limit FAILED_LOGIN_ATTEMPTS unlimited; 数据库的profiles信息： SQL> select * from dba_profiles; PROFILE          RESOURCE_NAME                    RESOURCE LIMIT ---------------- -------------------------------- -------- ------------------------------ DEFAULT          COMPOSITE_LIMIT                  KERNEL   UNLIMITED DEFAULT          SESSIONS_PER_USER                KERNEL   UNLIMITED DEFAULT          CPU_PER_SESSION                  KERNEL   UNLIMITED DEFAULT          CPU_PER_CALL                     KERNEL   UNLIMITED DEFAULT          LOGICAL_READS_PER_SESSION        KERNEL   UNLIMITED DEFAULT          LOGICAL_READS_PER_CALL           KERNEL   UNLIMITED DEFAULT          IDLE_TIME                        KERNEL   UNLIMITED DEFAULT          CONNECT_TIME                     KERNEL   UNLIMITED DEFAULT          PRIVATE_SGA                      KERNEL   UNLIMITED DEFAULT          FAILED_LOGIN_ATTEMPTS            PASSWORD 10 DEFAULT          PASSWORD_LIFE_TIME               PASSWORD UNLIMITED PROFILE          RESOURCE_NAME                    RESOURCE LIMIT ---------------- -------------------------------- -------- ------------------------------ DEFAULT          PASSWORD_REUSE_TIME              PASSWORD UNLIMITED DEFAULT          PASSWORD_REUSE_MAX               PASSWORD UNLIMITED DEFAULT          PASSWORD_VERIFY_FUNCTION         PASSWORD NULL DEFAULT          PASSWORD_LOCK_TIME               PASSWORD UNLIMITED DEFAULT          PASSWORD_GRACE_TIME              PASSWORD UNLIMITED 16 rows selected. 可是朋友提出一个问题，当前失败了多少次从何处查询，这个问题我不知道，但是我的习惯是看一下字典表的底层视图，我喜欢用autotrace跟踪一下，那么dba_users这个字典记录用户状态： SQL> desc dba_users  Name                                      Null?    Type  ----------------------------------------- -------- ----------------------------  USERNAME                                  NOT NULL VARCHAR2(30)  USER_ID                                   NOT NULL NUMBER  PASSWORD                                           VARCHAR2(30)  ACCOUNT_STATUS                            NOT NULL VARCHAR2(32)  LOCK_DATE                                          DATE  EXPIRY_DATE                                        DATE  DEFAULT_TABLESPACE                        NOT NULL VARCHAR2(30)  TEMPORARY_TABLESPACE                      NOT NULL VARCHAR2(30)  CREATED                                   NOT NULL DATE  PROFILE                                   NOT NULL VARCHAR2(30)  INITIAL_RSRC_CONSUMER_GROUP                        VARCHAR2(30)  EXTERNAL_NAME                                      VARCHAR2(4000) 使用autotrace看一下执行计划（不用也知道底层表是user$）: SQL> set linesize 120 SQL> set autotrace trace explain SQL> select count(*) from dba_users; Execution Plan ---------------------------------------------------------- Plan hash value: 3102810126 ------------------------------------------------------------------------------------------------------- | Id  | Operation                   | Name                    | Rows  | Bytes | Cost (%CPU)| Time     | ------------------------------------------------------------------------------------------------------- |   0 | SELECT STATEMENT            |                         |     1 |    78 |    29  (11)| 00:00:01 | |   1 |  SORT AGGREGATE             |                         |     1 |    78 |            |          | |*  2 |   HASH JOIN                 |                         |    14 |  1092 |    29  (11)| 00:00:01 | |*  3 |    HASH JOIN                |                         |    14 |  1050 |    22  (14)| 00:00:01 | |*  4 |     HASH JOIN               |                         |    14 |  1008 |    14  (15)| 00:00:01 | |*  5 |      HASH JOIN OUTER        |                         |    14 |   966 |    12  (17)| 00:00:01 | |*  6 |       HASH JOIN             |                         |    14 |   616 |     9  (12)| 00:00:01 | |*  7 |        HASH JOIN            |                         |    14 |   588 |     7  (15)| 00:00:01 | |   8 |         MERGE JOIN CARTESIAN|                         |     1 |    16 |     4   (0)| 00:00:01 | |*  9 |          TABLE ACCESS FULL  | PROFILE$                |     1 |     8 |     2   (0)| 00:00:01 | |  10 |          BUFFER SORT        |                         |     1 |     8 |     2   (0)| 00:00:01 | |* 11 |           TABLE ACCESS FULL | PROFILE$                |     1 |     8 |     2   (0)| 00:00:01 | |* 12 |         TABLE ACCESS FULL   | USER$                   |    20 |   520 |     2   (0)| 00:00:01 | |  13 |        TABLE ACCESS FULL    | PROFNAME$               |     1 |     2 |     2   (0)| 00:00:01 | |* 14 |       TABLE ACCESS FULL     | RESOURCE_GROUP_MAPPING$ |     2 |    50 |     2   (0)| 00:00:01 | |  15 |      TABLE ACCESS FULL      | USER_ASTATUS_MAP        |     9 |    27 |     2   (0)| 00:00:01 | |  16 |     TABLE ACCESS FULL       | TS$                     |    23 |    69 |     7   (0)| 00:00:01 | |  17 |    TABLE ACCESS FULL        | TS$                     |    23 |    69 |     7   (0)| 00:00:01 | ------------------------------------------------------------------------------------------------------- Predicate Information (identified by operation id): ---------------------------------------------------    2 - access("U"."TEMPTS#"="TTS"."TS#")    3 - access("U"."DATATS#"="DTS"."TS#")    4 - access("U"."ASTATUS"="M"."STATUS#")    5 - access("CGM"."VALUE"(+)="U"."NAME")    6 - access("U"."RESOURCE$"="P"."PROFILE#")    7 - access("U"."RESOURCE$"="PR"."PROFILE#")    9 - filter("DP"."RESOURCE#"=1 AND "DP"."TYPE#"=1 AND "DP"."PROFILE#"=0)   11 - filter("PR"."RESOURCE#"=1 AND "PR"."TYPE#"=1)   12 - filter("U"."TYPE#"=1)   14 - filter("CGM"."STATUS"(+)='ACTIVE' AND "CGM"."ATTRIBUTE"(+)='ORACLE_USER') 再来看底层表的字段，其中一个字段立刻引起了我的注意lcount: SQL> desc user$  Name                                                              Null?    Type  ----------------------------------------------------------------- -------- --------------------------------------------  USER#                                                             NOT NULL NUMBER  NAME                                                              NOT NULL VARCHAR2(30)  TYPE#                                                             NOT NULL NUMBER  PASSWORD                                                                   VARCHAR2(30)  DATATS#                                                           NOT NULL NUMBER  TEMPTS#                                                           NOT NULL NUMBER  CTIME                                                             NOT NULL DATE  PTIME                                                                      DATE  EXPTIME                                                                    DATE  LTIME                                                                      DATE  RESOURCE$                                                         NOT NULL NUMBER  AUDIT$                                                                     VARCHAR2(38)  DEFROLE                                                           NOT NULL NUMBER  DEFGRP#                                                                    NUMBER  DEFGRP_SEQ#                                                                NUMBER  ASTATUS                                                           NOT NULL NUMBER  LCOUNT                                                            NOT NULL NUMBER  DEFSCHCLASS                                                                VARCHAR2(30)  EXT_USERNAME                                                               VARCHAR2(4000)  SPARE1                                                                     NUMBER  SPARE2                                                                     NUMBER  SPARE3                                                                     NUMBER  SPARE4                                                                     VARCHAR2(1000)  SPARE5                                                                     VARCHAR2(1000)  SPARE6                                                                     DATE 找个用户测试一下： SQL> select name,lcount from user$ where name='EYGLEE'; NAME                               LCOUNT ------------------------------ ---------- EYGLEE                                  0 SQL> connect eyglee/ee ERROR: ORA-01017: invalid username/password; logon denied Warning: You are no longer connected to ORACLE. SQL> connect / as sysdba Connected. SQL> select name,lcount from user$ where name='EYGLEE'; NAME                               LCOUNT ------------------------------ ---------- EYGLEE                                  1 看来就是这个字段了，LCOUNT---Login attempts COUNT，这个命名和我们自己编程的变量命名是那么相似。 原文：http://www.eygle.com/archives/2009/07/profile_failed_login_attempts.html