Oracle Database 11 g - Online Public Access Catalog

CHAPTER 5 ■ DATABASE SECURITY 229In addition to the auditing settings, the default profile is also modified in the Oracle Database11g automatic secure configuration. The new default profile is set with these settings:• PASSWORD_LOCK_TIME=1• PASSWORD_GRACE_TIME=7• PASSWORD_LIFE_TIME=180• FAILED_LOGIN_ATTEMPTS=10• PASSWORD_REUSE_MAX=UNLIMITED• PASSWORD_REUSE_TIME=UNLIMITEDThe three profile settings, PASSWORD_LOCK_TIME, PASSWORD_GRACE_TIME, and PASSWORD_LIFE_TIME, are more restrictive in Oracle Database 11g.Delayed Failed LoginsIf a user tries to connect to the database multiple times using an erroneous password, the databasewill delay the response to the client after the third attempt. This is effective in OracleDatabase 11g by default. The delays of response back to the client are repeated even if theconnections are initiated from different IP addresses or hosts. Oracle preserves the performance ofthe database by increasing the delay for the user to try another password for up to ten seconds.You can see in the following example that the first invalid password attempt produced anerror output within a subsecond. Using the time or timex command, you can determine theamount of real time spent on waiting for the Unix prompt to return, as shown here:$ time echo "select sysdate from dual;" |sqlplus -s ckim/xxERROR:ORA-01017: invalid username/password; logon denied...0.35s real 0.01s user 0.09s systemContinuing with this example, after the eighth iteration of the same invalid password loginattempt, Oracle does not relinquish control back to the Unix session until after seven seconds.The delay is evident in the following example:$ time echo "select sysdate from dual;" |sqlplus -s ckim/xxERROR:ORA-01017: invalid username/password; logon denied...7.26s real 0.02s user 0.05s system