Pete Finnigan's Oracle Security Weblog

I made an entry in my weblog on 6th November discussing a thread on the ORACLE-L list where Jared Still had pointed out a tip in the latest edition of exploring Oracle whereby the tip author suggested setting the remote_os_authent initialisation parameter to true. Jared recognised that this is not good advice and i reiterated this in my blog posting.

Jonathan Rabson who is the editor of Exploring Oracle has responded to my post as a comment in my blog. I felt as this original post was a few weeks ago and as this is an important issue it is worth promoting his comments to a blog entry to bring it to everyone who read the first posts attention. Thanks to Jonathan for posting this detailed response here.

Here is his post:

Regarding security problems involved with setting REMOTE_OS_AUTHENT to TRUE:

As the editor of Exploring Oracle, I take full responsibility for the tip that Jared has mentioned. The general concept mentioned in the tip of running a script locally (which of course doesn't require that parameter), without storing passwords, is still a sound one, and I should mention that the tip's author is an extremely experienced and gifted DBA. But I agree that the tip left a wrong impression by not supplying more context, and that's really my fault in this case. Although some third-party applications have been written in a way that requires this setting, it's important for people to understand the security risks involved, and it would have been better if we had mentioned these. I guess it just comes down to the fact that we're all human.

There are actually a number of other sources that mention how to set up remote OS authentication without mentioning the risks. For instance, look at www.dbaoncall.net/references/ht_os_auth_win.html.

At any rate, I appreciate that Jared has contacted me about this matter. The tip in question has been removed from our website (www.elementkjournals.com) so that we can cover this topic in a more complete way.

Although the December issue has already been printed, we do have a really outstanding article in the January issue by a talented security expert that will address this security problem, among others. This article will show you 20 ways to secure your database host. In addition, our March issue will cover the remote authentication problem in a more detailed manner. And, for the spring, we're lining up some really interesting security-related articles involving the 10g database.

Anyhow, I apologize if anybody has rushed out and set the REMOTE_OS_AUTHENT parameter on their production machine immediately after reading the tip. Generally, we advise that people don't run out and do something on their production machines without investigating whether the technique is appropriate for their particular circumstance. As always, feel free to contact us about any questions or comments you have about Exploring Oracle.

Thanks,
-Jonathan