Applies To
All Users Gen 1 Exadata Cloud at Customer (Oracle Exadata Database Cloud Machine) - Version N/A and later
Oracle Cloud Infrastructure - Database Service - Version N/A and later
Oracle Database Backup Service - Version N/A and later
Oracle Database Cloud Exadata Service - Version N/A and later
Oracle Database Cloud Schema Service - Version N/A and later
Oracle Database Cloud Service - Version N/A and later
Oracle Database Exadata Express Cloud Service - Version N/A and later
Summary
How to prevent a user being granted the ALTER USER privilege from changing the SYS and SYSTEM users' password ?
Solution
This can be achieved with two methods:
-
Database Vault
-
Triggers
Database Vault
Oracle Database Vault can provide out-of-the-box separation of duties, separating database administrator activity from database user creation and maintenance. Database Vault creates roles that separate actions.
For example, if you wanted to create or alter a user, you would be required to have the DV_ACCTMGR role.
This separation applies to SYS and SYSTEM accounts as well.
Because Database Vault utilizes roles for this separation, if you wanted to grant a user the ability to create or maintain users, you would simply grant the user the DV_ACCTMGR role and they would have the privileges again.
This would all be done without triggers.
Triggers
To prevent this situation you can use event triggers:
SQL> conn / as sysdba
Connected.
SQL> CREATE or REPLACE TRIGGER prohibit_alter_SYSTEM_SYS_pass
BEFORE ALTER on <USER1>.schema
BEGIN
IF ora_sysevent='ALTER' and ora_dict_obj_type = 'USER' and
(ora_dict_obj_name = 'SYSTEM' or ora_dict_obj_name = 'SYS')
THEN
RAISE_APPLICATION_ERROR(-20003,
'You are not allowed to alter SYSTEM/SYS user.');
END IF;
END;
/
Trigger created.
Example :
SQL> conn <USER1>/<pwd>
Connected.
SQL>alter user SYSTEM identified by <pwd2>;
alter user SYSTEM identified by <pwd2>
*
ERROR at line 1:
ORA-00604: error occurred at recursive SQL level 1
ORA-20003: You are not allowed to alter SYSTEM/SYS user.
ORA-06512: at line 5
SQL> alter user sys identified by <pwd3>;
alter user sys identified by <pwd3>
*
ERROR at line 1:
ORA-00604: error occurred at recursive SQL level 1
ORA-20003: You are not allowed to alter SYSTEM/SYS user.
ORA-06512: at line 5
SQL> alter user dbsnmp identified by <pwd5>;
User altered.