Dameng database SYSDBA password strategy

When I first came into contact with the Dameng database, the password of the SYSDBA user is different from other databases, because if you forget it and there are no other users with the DBA role in the database, it will be really cool.

If the Dameng database is deployed on an operating system similar to LINUX, the password and port are defaulted. At this time, it is very simple to log in to the environment on this machine. You only need to type DISQL and press Enter twice to log in:

[dmdba@localhost GBK]$ disql
disql V8
username:
password:

Server [LOCALHOST:5236]: in normal open state,
login time: 8.239(ms)

If the password of SYSDBA has been changed, and the password is forgotten. At this time, the login will definitely fail, and [-2501]: wrong user name or password will be thrown.

dmdba@localhost GBK]$ disql  
disql V8
user name:
password:
[-2501]: wrong user name or password.

At this time, if there is a user in the database who has the DBA role and can log in normally. We can change the SYSDBA password with this user.

[dmdba@localhost bak]$ disql test1/test_0001

Server [LOCALHOST:5236]: in normal open state.
Login time: 5.329(ms)
disql V8
SQL> 
SQL> alter user SYSDBA identified by SYSDBA_2022;
operation has been executed
. Elapsed time: 7.871(ms). Execution number: 600.
SQL > 
SQL> exit
[dmdba@localhost bak]$ disql
disql V8
username: SYSDBA
password:

Server [LOCALHOST:5236]: in normal open state
Login time: 4.751(ms)
SQL> 

Dameng database also has a parameter to solve this problem, the local authentication parameter: ENABLE_LOCAL_OSAUTH.

The default value of this parameter is 0, which does not allow local authentication. And this parameter has two other features: 1. Only users with DBA authority can change it. 2. This parameter will take effect only after changing and restarting. Then this will fall into an endless loop, unless this parameter value is set to 1 when installing the database, in preparation for forgetting the password in the future.

View the parameter ENABLE_LOCAL_OSAUTH

SQL> select para_name,para_value,para_type from v$dm_ini where para_name='ENABLE_LOCAL_OSAUTH';

行号       PARA_NAME           PARA_VALUE PARA_TYPE
---------- ------------------- ---------- ---------
1          ENABLE_LOCAL_OSAUTH 0          READ ONLY

Try modifying
sp_set_para_value(2,'ENABLE_LOCAL_OSAUTH',1) with normal user

A total of 1 statement is being executed sequentially...
[Execute statement 1]:
sp_set_para_value(2,'ENABLE_LOCAL_OSAUTH',1);
Execution failed (statement 1)
-5565: No permission to modify INI configuration parameters
1 statement failed to execute

Change with a user with the DBA role

sp_set_para_value(2,'ENABLE_LOCAL_OSAUTH',1);

A total of 1 statement is being executed sequentially...
[Execution statement 1]:
sp_set_para_value(2,'ENABLE_LOCAL_OSAUTH',1);
Execution was successful, and the execution took 1 millisecond. Execution number: 701
affected 0 records and
1 statement was executed successfully

Restart the database for it to take effect

We continue to try to log in locally with SYSDBA, but there are still problems

[dmdba@localhost ~]$ disql /@localhost as sysdba
[-2512]: Unauthorized user.
disql V8

We also need to do the following:

groupadd dmdba

usermod -a -G dmdba dmdba

Then switch to the dmdba user and try to log in:

[dmdba@localhost ~]$ disql /@localhost as sysdba

Server [localhost:5236]: in normal open state
Login usage time: 26.157(ms)
disql V8
SQL>

Now we can change the SYSDBA password.

Summarize:

We strongly recommend keeping the passwords of important users safe. For security reasons, it is not recommended to adjust the value of the ENABLE_LOCAL_OSAUTH parameter to 1 when installing the database.

Community address: https://eco.dameng.com

Guess you like

Origin blog.csdn.net/duanpian_dba/article/details/126575448