Oracle Database 11 g - Online Public Access Catalog

238 CHAPTER 5 ■ DATABASE SECURITYLikewise, if you add a number but the password is simple, then Oracle kindly lets you know:SQL> alter user rodba identified by welcome1;alter user rodba identified by welcome1*ERROR at line 1:ORA-28003: password verification for the specified password failedORA-20006: Password too simpleYou have seen examples of simple password verification checks. The simple passwordverification code of the stored function also checks to see whether the password equals any ofthe words in the following list:• welcome1• database1• account1• user1234• password1• oracle123• computer1• abcdefg1• change_on_installIf any of the attempted passwords matches this list, the password verification function willlet you know that you have a simple password. Another password security to consider is todisallow passwords that are in the dictionary. You can easily purchase text-based dictionariesand load their content into the database. The password verify function can easily be altered tocheck for an existence of a word in the dictionary. Of course, the dictionary word must beindexed for optimal data retrieval. The check can be complete in subseconds and would offeranother level of security with stronger passwords.Another password breach that Oracle will check for is if you have the same username andpassword. The password-length check of eight characters precedes the check for the sameusername and password check. In the next example, we have to create a username with alength greater than eight characters. Let’s try to create a username charleskim with the samepassword:SQL> create user charleskim identified by charleskim2 default tablespace tools3 temporary tablespace temp;create user charleskim identified by charleskim*ERROR at line 1:ORA-28003: password verification for the specified password failedORA-20002: Password same as or similar to user