用户验证-OS认证和口令认证测试
验证用户
验证指的是对要使用数据、资源或应用程序的用户、设备或其它实体的身份进行验证。通过对该身份进行验证可建立一种信任关系，从而可进一步执行交互。通过验证可将访问和操作与特定的身份联系起来，从而实现可靠性。完成验证后，验证流程可允许或限制该实体许可的访问和操作的级别。
Oracle
数据库究竟使用OS认证还是口令文件认证来进行管理取决于下面三个因素
SQLNET.ORA参数文件中的参数SQLNET.AUTHENTICATION_SERVICES设置
PFILE(SPFILE)参数文件中的参数REMOTE_LOGIN_PASSWORDFILE设置拥有数据字典
口令文件orapw$SID(
Linux) | PWD$SID.ora(
Windows) 是否存SYSTEM 帐户授予了 DBA 角色。
Oracle权限认证的基本顺序
先由SQLNET.AUTHENTICATION_SERVICES的设置值来决定是使用OS认证还是口令文件认证
如果使用口令文件认证的话就要同时满足下面两个条件才能认证成功：
1、REMOTE_LOGIN_PASSWORDFILE参数设置为非NONE
2、口令文件存在就能正常使用口令文件认证，否则将会认证失败
创建用户时，必须确定要使用的验证方法，以后可修改此方法。
口令：又称为 Oracle 数据库验证。创建的每一个用户都有一个关联口令，用户尝试建立连接时，必须提供这个口令。设置口令时，可以使该口令立即失效，这会强制用户在首次登录后更改口令。如果决定要使用户口令失效，请确保用户能够更改口令。有些应用程序不具备此功能。
在（客户机/服务器之间和服务器/服务器之间）建立网络连接期间，系统总是先通过使用修改过的数据加密标准 (DES) 算法，以自动透明方式对口令加密，然后通过网络发送这些口令。
操作系统验证：
conn / as sysdba既是操作系统认证，即使用操作系统用户登录数据库（root用户不可以)，该用户必须同时添加到dba组和oinstall中，如果只添加dba组也不可以
只能用在本地 因为数据库软件安装在操作系统之上
密码文件验证：
口令认证：必须启动监听，用于网络连接，否则认证失败。
密码文件存储的位置 $ORACLE_HOME/dbs/orapw$ORACLE_SID
实验环境：
|
[oracle@tyger ~]$ id
uid=54321(oracle) gid=54321(oinstall) groups=54321(oinstall),54322(dba)
[oracle@tyger ~]$ sqlplus / as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:15:35 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SYS@ORCL>select * from v$version;
BANNER
----------------------------------------------------------------
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod
PL/SQL Release 10.2.0.1.0 - Production
CORE 10.2.0.1.0 Production
TNS for Linux: Version 10.2.0.1.0 - Production
NLSRTL Version 10.2.0.1.0 - Production
|
SQLNET.AUTHENTICATION_SERVICES参数在SQLNET.ORA（位于$ORACLE_HOME/network/admin目录中） 文件中对于不同的操作系统SQLNET.AUTHENTICATION_SERVICES的取值会有些不一样，通常我们会用到下面的一些设置值：
linux下： none all nts 不设置或BEQ 四种情况
第一种情况：
参数SQLNET.AUTHENTICATION_SERVICES不设置或设置为BEQ---------口令认证和操作系统认证都启动
|
[oracle@tygeradmin]$ pwd
/u01/app/oracle/product/10.2.0/db_1/network/admin
[oracle@tyger admin]$ ls
listener.ora samples shrept.lst sqlnet.ora tnsnames.ora
[oracle@tyger admin]$ vim sqlnet.ora
NAME.DIRECTORY_PATH=(tnsnames,ezconnect)
SQLNET.AUTHENTICATION_SERVICES=(BEQ)
[oracle@tyger admin]$ lsnrctl status
LSNRCTL for Linux: Version 10.2.0.1.0 - Production on 28-FEB-2014 09:52:19
Copyright (c) 1991, 2005, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=tyger )(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 10.2.0.1.0 - Production
Start Date 28-FEB-2014 09:48:44
Uptime 0 days 0 hr. 3 min. 34 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listener Parameter File /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=tyger )(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))
Services Summary...
Service "ORCL" has 1 instance(s).
Instance "ORCL", status READY, has 1 handler(s) for this service...
Service "ORCLXDB" has 1 instance(s).
Instance "ORCL", status READY, has 1 handler(s) for this service...
Service "ORCL_XPT" has 1 instance(s).
Instance "ORCL", status READY, has 1 handler(s) for this service...
Service "PLSExtProc" has 1 instance(s).
Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
The command completed successfully
[oracle@whgg admin]$ sqlplus / as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:52:50 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SYS@ORCL>exit
Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
[oracle@tyger admin]$ cd /u01/app/oracle/product/10.2.0/db_1/dbs/
[oracle@tyger dbs]$ ls
hc_ORCL.dat initdw.ora init.ora lkORCL orapwORCL spfileORCL.ora
[oracle@tyger dbs]$ sqlplus sys/oracle@ORCL as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:53:51 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SYS@ORCL>
|
第二种情况：
参数SQLNET.AUTHENTICATION_SERVICES设置为 all -----------------------屏蔽口令认证都启用操作系统认证
|
[oracle@tyger admin]$ pwd
/u01/app/oracle/product/10.2.0/db_1/network/admin
[oracle@tyger admin]$ vim sqlnet.ora
NAME.DIRECTORY_PATH=(tnsnames,ezconnect)
SQLNET.AUTHENTICATION_SERVICES=(ALL)
[oracle@tyger admin]$ sqlplus / as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:59:20 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SYS@ORCL>exit
Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
[oracle@tyger admin]$ sqlplus sys/oracle@ORCL as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 09:59:39 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
ERROR:
ORA-12641: Authentication service failed to initialize
Enter user-name:
|
第三种情况：
参数SQLNET.AUTHENTICATION_SERVICES 设置为 NONE 或NTS ----------------屏蔽操作系统认证都启用口令认证
|
[oracle@tyger admin]$ vim sqlnet.ora
NAME.DIRECTORY_PATH=(tnsnames,ezconnect)
SQLNET.AUTHENTICATION_SERVICES=(NTS)
[oracle@tyger admin]$ sqlplus / as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 10:36:35 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
ERROR:
ORA-01031: insufficient privileges
[oracle@tyger admin]$ sqlplus sys/oracle@ORCL as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 10:36:52 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SYS@ORCL>
|
第四种情况：
当数据库屏蔽了操作系统认证，启用口令认证方式的话，需要检查remote_login_passwordfile参数，如果该参数设置为NONE,该值表示不使用口令文件，因此，此时数据库将不能登录
解决办法：启动操作系统认证，登录数据库后将remote_login_passwordfile参数修改EXCLUSIVE，然后再屏蔽操作系统认证，启用口令认证。
> remote_login_passwordfile参数可以设置为3个值 none、exclusive、shared
|
[oracle@tyger admin]$ cat sqlnet.ora
NAME.DIRECTORY_PATH=(tnsnames,ezconnect)
SQLNET.AUTHENTICATION_SERVICES=(NTS)
[oracle@tyger admin]$ sqlplus sys/oracle@ORCL as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 10:48:15 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SYS@ORCL>show parameter remote
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
remote_archive_enable string true
remote_dependencies_mode string TIMESTAMP
remote_listener string
remote_login_passwordfile string EXCLUSIVE
remote_os_authent boolean FALSE
remote_os_roles boolean FALSE
SYS@ORCL>alter system set remote_login_passwordfile=none scope=spfile;
System altered.
---静态参数，重启数据库生效
SYS@ORCL>shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SYS@ORCL>startup
ORA-12514: TNS:listener does not currently know of service requested in connect descriptor
[oracle@tyger admin]$ vim sqlnet.ora
NAME.DIRECTORY_PATH=(tnsnames,ezconnect)
#SQLNET.AUTHENTICATION_SERVICES=(NTS)
[oracle@tyger admin]$ sqlplus / as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 10:57:25 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to an idle instance.
SYS@ORCL>startup
ORACLE instance started.
Total System Global Area 285212672 bytes
Fixed Size 1218992 bytes
Variable Size 96470608 bytes
Database Buffers 184549376 bytes
Redo Buffers 2973696 bytes
Database mounted.
Database opened.
SYS@ORCL>show parameter remote
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
remote_archive_enable string true
remote_dependencies_mode string TIMESTAMP
remote_listener string
remote_login_passwordfile string NONE
remote_os_authent boolean FALSE
remote_os_roles boolean FALSE
SYS@ORCL>alter system set remote_login_passwordfile=exclusive scope=spfile;
System altered.
SYS@ORCL>shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SYS@ORCL>startup
ORACLE instance started.
Total System Global Area 285212672 bytes
Fixed Size 1218992 bytes
Variable Size 96470608 bytes
Database Buffers 184549376 bytes
Redo Buffers 2973696 bytes
Database mounted.
Database opened.
SYS@ORCL>show parameter remote
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
remote_archive_enable string true
remote_dependencies_mode string TIMESTAMP
remote_listener string
remote_login_passwordfile string EXCLUSIVE
remote_os_authent boolean FALSE
remote_os_roles boolean FALSE
SYS@ORCL>exit
Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
[oracle@tyger admin]$ sqlplus sys/oracle@ORCL as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Fri Feb 28 11:04:16 2014
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SYS@ORCL>
|