[]orapwd Order parameters of the role of entries Orapwd order parameters of the role of entries The author blue_stone E-mail : blue_stone@xinhuanet.com Blog : http://bluestone.cublog.cn Http://www.cublog.cn/u/7667/?u=http://www.cublog.cn/u/7667/showart.php?id=93939 original link : Please retain the original author information and links to reproduce. The latest version of this document can be found on the original links. This paper analyzes the nature of some of the parameters orapwd entries were tested using Debian GNU/Linux SID operating system environment, the database using Oracle Database Enterprise Edition 9204. Oracle Database orapwd documents used to establish passwords, not orapwd operating parameters of the order parameters will be given orapwd Blue_stone@blueice:~/test$ orapwd Usage : orapwd file=<fname> password=<password> entries=<users> Where File-name of password file (mand). Password-password for SYS (mand). Entries-maximum number of distinct DBA and OPERs (opt). There are no spaces around the equal-to (=) character. Orapwd three parameters can be ordered, the code generated document refers to the file name, password sys user passwords means that these two parameters are mandatory, and if any deficiencies orapwd output parameters will help information. Blue_stone@blueice:~/test$ orapwd file=233.ora Usage : orapwd file=<fname> password=<password> entries=<users> Where File-name of password file (mand). Password-password for SYS (mand). Entries-maximum number of distinct DBA and OPERs (opt). There are no spaces around the equal-to (=) character. Blue_stone@blueice:~/test$ orapwd password=abcdef Usage : orapwd file=<fname> password=<password> entries=<users> Where File-name of password file (mand). Password-password for SYS (mand). Entries-maximum number of distinct DBA and OPERs (opt). There are no spaces around the equal-to (=) character. If successful password generated documents suggest orapwd there will be no withdrawal. Blue_stone@blueice:~/test$ orapwd file=233.ora password=abcdef Blue_stone@blueice:~/test$ 1s -al 233.ora -rwSr----- 1 blue_stone user 233.ora 1536 2006-04-01 09:27 The third parameter entries. With the help of information from orapwd understanding, we can preserve a record number of entries, each with one count of users sysdba or sysoper authority records, and if a user sysdba sysoper also has the authority, only one record. V$pwfile_users can start to look through the database of passwords recorded in the document. SQL> select * from v$pwfile_users; USERNAME SYSDB SYSOP ------------------------------ ----- ----- SYS True True But entries is not a precise value, that is to say, if we set up for the 10 entries, there may be more than 10 users may have sysdba or sysoper authority. To prove this point, we use the following script to establish many key documents, and conducted a preliminary analysis of documents generated passwords. #!/bin/bash # File Name : pwtest.sh # Usage : Create some Oracle password file and analyze them. N = 0 [20] while $n -le Do Orapwd file=$n.ora password=oracle entries=$n Hexdump $n.ora "$n.dmp N=$ (($n+1)) Done N = 0 [20] while $n -le Do 1s -al $n.ora N=$ ((n +1)) Done N = 0 [20] while $n -le Do Md5sum $n.ora N=$ ((n +1)) Done Script code will be generated this document 1.ora to 20.ora 20, entries were 1-20 parameters, the password will be generated into a readable document is derived using hexdump txt file. Operating results were as follows : Blue_stone@blueice:~/test$. /pwtest.sh -rwSr----- 1 blue_stone user 0.ora 1536 2006-04-01 10:07 -rwSr----- 1 blue_stone user 1.ora 1536 2006-04-01 10:07 -rwSr----- 1 blue_stone user 2.ora 1536 2006-04-01 10:07 -rwSr----- 1 blue_stone user 3.ora 1536 2006-04-01 10:07 -rwSr----- 1 blue_stone user 4.ora 1536 2006-04-01 10:07 -rwSr----- 1 blue_stone user 5.ora 2048 2006-04-01 10:07 -rwSr----- 1 blue_stone user 6.ora 2048 2006-04-01 10:07 -rwSr----- 1 blue_stone user 7.ora 2048 2006-04-01 10:07 -rwSr----- 1 blue_stone user 8.ora 2048 2006-04-01 10:07 -rwSr----- 1 blue_stone user 9.ora 2560 2006-04-01 10:07 -rwSr----- 1 blue_stone user 10.ora 2560 2006-04-01 10:07 -rwSr----- 1 blue_stone user 11.ora 2560 2006-04-01 10:07 -rwSr----- 1 blue_stone user 12.ora 2560 2006-04-01 10:07 -rwSr----- 1 blue_stone user 13.ora 3072 2006-04-01 10:07 -rwSr----- 1 blue_stone user 14.ora 3072 2006-04-01 10:07 -rwSr----- 1 blue_stone user 15.ora 3072 2006-04-01 10:07 -rwSr----- 1 blue_stone user 16.ora 3072 2006-04-01 10:07 -rwSr----- 1 blue_stone user 17.ora 3584 2006-04-01 10:07 -rwSr----- 1 blue_stone user 18.ora 3584 2006-04-01 10:07 -rwSr----- 1 blue_stone user 19.ora 3584 2006-04-01 10:07 -rwSr----- 1 blue_stone user 20.ora 3584 2006-04-01 10:07 C16f9293603f290409d2f495217e6262 0.ora C16f9293603f290409d2f495217e6262 1.ora C16f9293603f290409d2f495217e6262 2.ora C16f9293603f290409d2f495217e6262 3.ora C16f9293603f290409d2f495217e6262 4.ora 1bc8a7b9789922356fc9b804e02ea2c8 5.ora 1bc8a7b9789922356fc9b804e02ea2c8 6.ora 1bc8a7b9789922356fc9b804e02ea2c8 7.ora 1bc8a7b9789922356fc9b804e02ea2c8 8.ora 3c76d4e09b4cf3e7cf8ad69db2519ff6 9.ora 3c76d4e09b4cf3e7cf8ad69db2519ff6 10.ora 3c76d4e09b4cf3e7cf8ad69db2519ff6 11.ora 3c76d4e09b4cf3e7cf8ad69db2519ff6 12.ora 6604f4088b58fc57cad8d496814ee928 13.ora 6604f4088b58fc57cad8d496814ee928 14.ora 6604f4088b58fc57cad8d496814ee928 15.ora 6604f4088b58fc57cad8d496814ee928 16.ora 9c16648155e3387d74c8c63845c33595 17.ora 9c16648155e3387d74c8c63845c33595 18.ora 9c16648155e3387d74c8c63845c33595 19.ora 9c16648155e3387d74c8c63845c33595 20.ora Output can be determined from the results of our preliminary, and the password generated documents can be divided into several different groups, the parameters were 0-4,5-8,9-12,13-16,17-20 entries, each with various contents of the paper would like. Hexdump results further confirm this point. Blue_stone@blueice:~/test$ differends 0.dmp 1.dmp Blue_stone@blueice:~/test$ differends 0.dmp 2.dmp Blue_stone@blueice:~/test$ differends 0.dmp 3.dmp Blue_stone@blueice:~/test$ differends 0.dmp 4.dmp Blue_stone@blueice:~/test$ differends 7.dmp 5.dmp Blue_stone@blueice:~/test$ differends 11.dmp 9.dmp Blue_stone@blueice:~/test$ differends 16.dmp 13.dmp Blue_stone@blueice:~/test$ differends 19.dmp 17.dmp The password is not the same document different groups (difference in size, the results are not identical md5sum), passwords for all documents generated by the use hexdump dmp comparison document can be seen very few different places 1.ora the dmp 1.dmp document reads as follows : 0000000 0000 0000 0200 0000 0002 0000 5a5b 5c5d 0000010 0000 0000 0000 0000 0000 0000 0000 0000 * 0000200 524f 6d65 746f 2065 6150 5220 4341 454c 0000210 7373 6f77 6472 6620 0065 0000 001b 6c69 0000220 0000 0000 0000 0000 0000 0000 0000 0000 * 0000260 4e49 4e52 4c41 0000 0000 0000 0000 4554 0000270 0000 0000 0000 0000 0000 0000 0000 0000 0000280 0008 0000 4241 3732 3542 4533 4344 4635 0000290 4645 3134 0000 0000 0000 0000 0000 0000 00002a0 000f 0000 0000 0000 0000 0000 0010 0000 00002b0 0000 0000 0000 0000 0000 0000 0000 0000 00002c0 0000 0000 0000 0000 5953 0053 0000 0000 00002d0 0000 0000 0000 0000 0000 0000 0000 0000 00002e0 0000 0000 0000 0000 0003 0000 4138 4638 00002f0 3230 3735 3733 3941 3930 4137 0000 0000 0000300 0000 0000 0000 0000 0000 0000 0010 0000 0000310 000f 0000 0000 0000 0000 0000 0000 0000 0000320 0000 0000 0000 0000 0000 0000 0000 0000 * 0000600 5.ora the dmp 5.dmp document reads as follows : Blue_stone@blueice:~/test$ more 5.dmp 0000000 0000 0000 0200 0000 0003 0000 5a5b 5c5d 0000010 0000 0000 0000 0000 0000 0000 0000 0000 * 0000200 524f 6d65 746f 2065 6150 5220 4341 454c 0000210 7373 6f77 6472 6620 0065 0000 001b 6c69 0000220 0000 0000 0000 0000 0000 0000 0000 0000 * 0000260 4e49 4e52 4c41 0000 0000 0000 0000 4554 0000270 0000 0000 0000 0000 0000 0000 0000 0000 0000280 0008 0000 4241 3732 3542 4533 4344 4635 0000290 4645 3134 0000 0000 0000 0000 0000 0000 00002a0 000f 0000 0000 0000 0000 0000 0010 0000 00002b0 0000 0000 0000 0000 0000 0000 0000 0000 00002c0 0000 0000 0000 0000 5953 0053 0000 0000 00002d0 0000 0000 0000 0000 0000 0000 0000 0000 00002e0 0000 0000 0000 0000 0003 0000 4138 4638 00002f0 3230 3735 3733 3941 3930 4137 0000 0000 0000300 0000 0000 0000 0000 0000 0000 0010 0000 0000310 000f 0000 0000 0000 0000 0000 0000 0000 0000320 0000 0000 0000 0000 0000 0000 0000 0000 * 0000800 Dmp each document marked the first of this series of disaggregated data in the document violations, behind the 229 is 16, said the paper, each with 16 bytes, 229 32 16 characters, and performs the same content, only shows the first line, below plots the trip will be an asterisk (*) substitutes. Hexdump-V operation parameters can be forced to use the trip hexdump output plots. The document is the end of his final shift, we can see that the size of the document 1.dmp 0x600 (1536) bytes, the size of the document 5.dmp 0x800 (2048) bytes. Differends 1.dmp and 5.dmp compared to the use and the results are as follows : Blue_stone@blueice:~/test$ differends 1.dmp 5.dmp 1c1 "0000000 0000 0000 0200 0000 0002 0000 5a5b 5c5d --- "0000000 0000 0000 0200 0000 0003 0000 5a5b 5c5d 22c22 < 0000600 --- > 0000800 Numerical is only a first line (deviation for 0xa), which is proportional to the number and size of documents, file size = (0x9 numerical +1) * 512. If the password used to create documents specified parameters orapwd large enough, such as 65535, 0x8 will also place non-0 value if it 0x8,0x9 65,535 entries for the values of 0x40,0x01. Initial passwords paper documents not only the content of 0-1V bytes, the remaining part is 0. Is the most effective numerical 65,535 entries, over 65,536, 65,536 will be designated seeking numerical scale. This can be verified using the following procedure : #!/bin/bash # File Name : pwtest2.sh # Usage : Create some Oracle password file with the parameter entires # : Like 0*65536 + m + m 1*65536. . . . . . , Then analyze them. M ≥ 5 N = 0 [20] while $n -le Do Orapwd file=$ (($n*65536+$m)). Charles password=oracle entries=$ (($n*65536+$m)) N=$ (($n+1)) Done N = 0 [20] while $n -le Do 1s -al ($ ($n*65536+$m)). Charles N=$ ((n +1)) Done N = 0 [20] while $n -le Do Md5sum $ (($n*65536+$m)). Charles N=$ ((n +1)) Done Operating results were as follows : Blue_stone@blueice:~/test$. /pwtest2.sh -rwSr----- 1 blue_stone user 5.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 65541.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 131077.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 196613.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 262149.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 327685.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 393221.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 458757.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 524293.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 589829.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 655365.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 720901.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 786437.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 851973.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 917509.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 983045.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 1048581.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 1114117.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 1179653.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 1245189.ora 2048 2006-04-01 12:23 -rwSr----- 1 blue_stone user 1310725.ora 2048 2006-04-01 12:23 1bc8a7b9789922356fc9b804e02ea2c8 5.ora 1bc8a7b9789922356fc9b804e02ea2c8 65541.ora 1bc8a7b9789922356fc9b804e02ea2c8 131077.ora 1bc8a7b9789922356fc9b804e02ea2c8 196613.ora 1bc8a7b9789922356fc9b804e02ea2c8 262149.ora 1bc8a7b9789922356fc9b804e02ea2c8 327685.ora 1bc8a7b9789922356fc9b804e02ea2c8 393221.ora 1bc8a7b9789922356fc9b804e02ea2c8 458757.ora 1bc8a7b9789922356fc9b804e02ea2c8 524293.ora 1bc8a7b9789922356fc9b804e02ea2c8 589829.ora 1bc8a7b9789922356fc9b804e02ea2c8 655365.ora 1bc8a7b9789922356fc9b804e02ea2c8 720901.ora 1bc8a7b9789922356fc9b804e02ea2c8 786437.ora 1bc8a7b9789922356fc9b804e02ea2c8 851973.ora 1bc8a7b9789922356fc9b804e02ea2c8 917509.ora 1bc8a7b9789922356fc9b804e02ea2c8 983045.ora 1bc8a7b9789922356fc9b804e02ea2c8 1048581.ora 1bc8a7b9789922356fc9b804e02ea2c8 1114117.ora 1bc8a7b9789922356fc9b804e02ea2c8 1179653.ora 1bc8a7b9789922356fc9b804e02ea2c8 1245189.ora 1bc8a7b9789922356fc9b804e02ea2c8 1310725.ora If the parameter is not specified entries, and the documents generated password entries for the 1836 parameters generated when the parameters of the same document. Blue_stone@blueice:~/test$ orapwd file=1.ora password=oracle entries=1 Blue_stone@blueice:~/test$ orapwd file=default.ora password=oracle Blue_stone@blueice:~/test$ md5sum 1.ora default.ora C16f9293603f290409d2f495217e6262 1.ora C16f9293603f290409d2f495217e6262 default.ora Blue_stone@blueice:~/test$ 1s -al 1.ora default.ora -rwSr----- 1 blue_stone user 1.ora 1536 2006-04-01 13:09 -rwSr----- 1 blue_stone user default.ora 1536 2006-04-01 13:09 Tune2fs-l can be used in the Linux file system can detect the attributes. Blueice:~# tune2fs l /dev/hda6 Tune2fs 1.39-WIP (31-Dec-2005) Filesystem volume name : "none> Last mounted on : "not available> Filesystem UUID : 0f4eb2b4-1360-48a1-8b66-3916a6838210 Filesystem magic number : 0xEF53 Filesystem revision # : 1 (dynamic) Filesystem features : has_journal filetype needs_recovery sparse_super Default mount options : (none) Filesystem state : clean Errors behavior : Continue Filesystem type : Linux OS Inode count : 3057824 Block count : 6104692 Reserved block count : 305,234 Free blocks : 1002160 Free inodes : 2930491 First block : 0 Block size : 4,096 Fragment size : 4,096 Blocks per group : 32768 Fragments per group : 32768 Inodes per group : 16352 Inode blocks per group : 511 Filesystem created : Sat Sep 3 16:33:16 2005 Last mount time : Sat Apr 1 08:10:43 2006 Last write time : Sat Apr 1 08:10:43 2006 Mount count : 8 Maximum mount count : 22 Last checked : Sat Mar 25 20:15:04 2006 Check interval : 15552000 (6 months) Next check after : Thu Sep 21 20:15:04 2006 Reserved blocks uid : 0 (root user) Reserved blocks Forty : 0 (group root) First inode : 11 Inode size : 128 Journal inode : 8 Default directory hash tea : Directory Hash Seed : 70ac7131-5a92-4ca3-865d-4ce83f38acb1 Journal backup : inode blocks Output can be seen from the results of the file system block size is 4,096 bytes. This is also the acquiescence ext3 file system block size. Devicename mkfs.ext3 -bn devicename can use to establish a file system block size n, n desirable values 1024,2048,4096. Blueice:/home/blue_stone/test# dd if=/dev/zero of=testfile bs=1M count=20 20+0 records in 20+0 records out 20971520 bytes (21 MB) copied and 0.449763 seconds, 46.6 MB/s Blueice:/home/blue_stone/test# mkfs.ext3-b 1024 testfile Mke2fs 1.39-WIP (31-Dec-2005) Testfile block is not a special device. Proceed anyway? (y, n) y Filesystem label= Linux OS type : Block size=1024 (log=0) Fragment size=1024 (log=0) 5136 inodes, 20480 blocks 1024 blocks (5.00%) reserved for the super user First data block=1 Three block groups 8192 blocks per group, labeled fragments per group 1712 inodes per group Superblock backups stored on blocks : 8193 Writing inode tables : done Creating journal (1024 blocks) : done Writing superblocks and filesystem accounting information : done This filesystem will be automatically checked every 21 mounts or 180 days, whichever comes first. Use tune2fs-c or -i to override. Blueice:/home/blue_stone/test# mkdir test Blueice:/home/blue_stone/test# mount testfile -o loop test Blueice:/home/blue_stone/test# mount /dev/hda1 On / type ext3 (rw, errors=remount-ro) Procedure on /proc type procedure (rw) Sysfs on /sys type sysfs (rw) Usbfs on /proc/bus/usb type usbfs (rw) Tmpfs on /dev/shm type tmpfs (rw) Devpts on /dev/pts type devpts (rw, gid=5, mode=620) /dev/hda3 On /mnt/amd64 type ext3 (rw) /dev/hda6 On /home type ext3 (rw) /dev/hda9 On /bak type ext3 (rw) /dev/hda7 On /vmware type ext3 (rw) Tmpfs on /dev type tmpfs (rw, size=10M, mode=0755) Nfsd on /proc/fs/nfsd type nfsd (rw) Binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) /home/blue_stone/test/testfile On /home/blue_stone/test/test type ext3 (rw, loop=/dev/loop/0) Blueice:/home/blue_stone/test# tune2fs-l testfile Tune2fs 1.39-WIP (31-Dec-2005) Filesystem volume name : "none> Last mounted on : "not available> Filesystem UUID : 561bb9bf-2455-4677-aa0d-27c868aa99fd Filesystem magic number : 0xEF53 Filesystem revision # : 1 (dynamic) Filesystem features : has_journal filetype needs_recovery sparse_super Default mount options : (none) Filesystem state : clean Errors behavior : Continue Filesystem type : Linux OS Inode count : 5136 Block count : 20,480 Reserved block count : 1024 Free blocks : 18784 Free inodes : 5125 First block : 1 Block size : 1,024 Fragment size : 1,024 Blocks per group : 8192 Fragments per group : 8192 Inodes per group : 1712 Inode blocks per group : 214 Filesystem created : Sat Apr 1 12:33:59 2006 Last mount time : Sat Apr 1 12:34:15 2006 Last write time : Sat Apr 1 12:34:15 2006 Mount count : 1 Maximum mount count : 21 Last checked : Sat Apr 1 12:33:59 2006 Check interval : 15552000 (6 months) Next check after : Thu, 28 Sep 2006 12:33:59 Reserved blocks uid : 0 (root user) Reserved blocks Forty : 0 (group root) First inode : 11 Inode size : 128 Journal inode : 8 Default directory hash tea : Directory Hash Seed : 02dfc011-04f6-4a92-b763-99fe8aa76e96 Journal backup : inode blocks Create new documents in the system to do the above tests, we can reach the same results, which demonstrates the size of Oracle password files and documents are not relevant. When the value is not specified entries or entries to the specified value of the 1836, users can have five or sysoper sysdba authority. Oracle@blueice:~/product/9.2.0/dbs$ rm orapworcl Oracle@blueice:~/product/9.2.0/dbs$ orapwd file=orapworcl password=oracle Oracle@blueice:~/product/9.2.0/dbs$ hexdump-V orapworcl "default.dmp Oracle@blueice:~/product/9.2.0/dbs$ sqlplus /nolog SQL*Plus : Release 9.2.0.4.0-Production on Sat Apr 1 13:14:22 2006 Copyright (c) 1982, 2002, Oracle Corporation. All rights reserved. SQL> conn sys/oracle as sysdba Connected to an idle instance. SQL> startup ORACLE instance started. Total System Global Area 147920392 bytes Fixed Size 452,104 bytes Variable Size 121634816 bytes Database Buffers 25165824 bytes Redo Buffers 667648 bytes Database mounted. Database opened. SQL> select * from v$pwfile_users 2 ; USERNAME SYSDB SYSOP ------------------------------ ----- ----- SYS True True SQL> grant sysdba to scott, hr, sh, xdb; Grant succeeded. SQL> grant sysdba to wmsys; Grant sysdba to wmsys * ERROR at line 1 : ORA-01996 : Mr. GRANT failed password file : '/home/oracle/product/9.2.0/dbs/orapworcl' is full SQL> select * from v$pwfile_users 2 ; USERNAME SYSDB SYSOP ------------------------------ ----- ----- SYS True True SCOTT True FALSE HR True FALSE SH True FALSE Angelon True FALSE Oracle password use string can see some elements of the document Oracle@blueice:~/product/9.2.0/dbs$ strings orapworcl ]\[Z Oracle Remote Password file ORCL INTERNAL 2C0791C2F3E3BB92 D4C5016086B2DC6A R1BSCOTT F894844C34402B67 6399F3B38EDF3288 9793B3777CD3BD1A 88D8364765FCE6AF Oracle@blueice:~/product/9.2.0/dbs$ sqlplus /nolog SQL*Plus : Release 9.2.0.4.0-Production on Sat Apr 1 13:51:20 2006 Copyright (c) 1982, 2002, Oracle Corporation. All rights reserved. SQL> conn / as sysdba Connected. SQL> select password from dba_users where username in ( 'HR', 'SH', 'Scott', 'XDB'); PASSWORD ------------------------------ 88D8364765FCE6AF F894844C34402B67 9793B3777CD3BD1A 6399F3B38EDF3288 SQL> exit Disconnected from Oracle9i Enterprise Edition Release 9.2.0.4.0-Production With the Partitioning, OLAP and Oracle Data Mining options JServer Release 9.2.0.4.0-Production Sysdba authority delegated to users with passwords from the data dictionary is that the process of duplicating the code to process the documents. Very, very seriously, it is. . . A strongman. Too specialized, it is strongly recommended for the best tailgating home Support. . . [ Closed window ]