Home » RDBMS Server » Server Administration » user privileges changed misteriously (Oracle 9i, Windows server 2003, Toad 7.6)
user privileges changed misteriously [message #567223] Tue, 25 September 2012 07:56 Go to next message
sstellini
Messages: 32
Registered: April 2005
Location: Malta
Member
We had a strange case few days ago where a developer lost her privileges all of a sudden. She's claiming she didn't change them and no one else could have done it apart from her (DBA wasn't around on those days). We didn't have the audit ALTER USER set up yet so can't check who did it exactly, by using the audit log.

Does anyone know if there is another way to check if she had done it anyway, or if there is perhaps a bug that could cause this (in Toad ver 7.6, Oracle 9i)?
Re: user privileges changed misteriously [message #567224 is a reply to message #567223] Tue, 25 September 2012 08:00 Go to previous messageGo to next message
joy_division
Messages: 4947
Registered: February 2005
Location: East Coast USA
Senior Member
I don't know what TOAD is, but users cannot change their own privileges. What privileges are you talking about? application controlled privileges?
Re: user privileges changed misteriously [message #567227 is a reply to message #567224] Tue, 25 September 2012 08:09 Go to previous messageGo to next message
sstellini
Messages: 32
Registered: April 2005
Location: Malta
Member
I'm taking about oracle db privileges. She had ALTER USER privilege, so she could change her or someone else privileges and Toad is the tool that allows you to do that, apart from other things.. She claims she didn't change any of her privileges and I'd like to know if there is a way to prove her right or wrong, which ever. As I said, I didn't have 'audit ALTER USER' set up at that time..
Re: user privileges changed misteriously [message #567232 is a reply to message #567227] Tue, 25 September 2012 08:16 Go to previous messageGo to next message
Michel Cadot
Messages: 66644
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
Quote:
She had ALTER USER privilege, so she could change her or someone else privileges


Wrong, ALTER USER has nothing to do with privileges.
Privileges are managed with GRANT and REVOKE statements.

By the way, I see no reason a user (but a dba) has ALTER USER privilege. This is an awful securioty hole.

Regards
Michel
Re: user privileges changed misteriously [message #567263 is a reply to message #567227] Tue, 25 September 2012 12:49 Go to previous messageGo to next message
joy_division
Messages: 4947
Registered: February 2005
Location: East Coast USA
Senior Member
Yikes, I meant I did not know what TOAD has to do with this, not that I did not know what TOAD is. Sorry.
Re: user privileges changed misteriously [message #567283 is a reply to message #567263] Wed, 26 September 2012 02:59 Go to previous messageGo to next message
sstellini
Messages: 32
Registered: April 2005
Location: Malta
Member
Erm..
GRANT ALTER USER TO User1 works fine for me..

Anyway, she needs to have that system privilege (thanks for correcting), as she works as a support girl too (we're a small company).

But what I'm trying to find out is if there is another way to check if she had re-stetted her privileges, or if there is perhaps a bug that could cause this to happen.. she was using an old version of Toad (7.6), leaving it on all the time etc.. I didn't find yet that it is possible to check this (Oracle 9i is what we have), but just in case I've posted the question here too..

btw, I've set up the audit on ALTER USER so I will know from now on if that happens again, but for the past week I didn't have that audit set up..
Re: user privileges changed misteriously [message #567284 is a reply to message #567283] Wed, 26 September 2012 03:29 Go to previous messageGo to next message
Michel Cadot
Messages: 66644
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
Quote:
Anyway, she needs to have that system privilege (thanks for correcting), as she works as a support girl too (we're a small company).


So she is a DBA (this is what ALTER USER privilege means).

Quote:
But what I'm trying to find out is if there is another way to check if she had re-stetted her privileges


Log Miner.

Quote:
or if there is perhaps a bug that could cause this to happen


Not in Oracle, in your TOAD maybe and most likely a user error in TOAD usage. This is what this tool shoud be banned.

Quote:
I've set up the audit on ALTER USER


Which is useless to audit changes in privileges as I said.

Regards
Michel

Re: user privileges changed misteriously [message #567285 is a reply to message #567284] Wed, 26 September 2012 03:41 Go to previous messageGo to next message
sstellini
Messages: 32
Registered: April 2005
Location: Malta
Member
Thanks Michel,
will see about Log Miner - haven't used it yet..
But why do you think that audit on ALTER USER is useless - it gives me the info that someone changed ie altered user ie: who did it, which user got changed and when and that's useful to me. Maybe I'm missing something.
Re: user privileges changed misteriously [message #567286 is a reply to message #567285] Wed, 26 September 2012 03:49 Go to previous messageGo to next message
Michel Cadot
Messages: 66644
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
Quote:
But why do you think that audit on ALTER USER is useless


Because

Quote:
Wrong, ALTER USER has nothing to do with privileges.
Privileges are managed with GRANT and REVOKE statements.


I said it is useless to audit privilege changes, it is not useless in abolute.

Regards
Michel
Re: user privileges changed misteriously [message #567287 is a reply to message #567286] Wed, 26 September 2012 03:54 Go to previous message
sstellini
Messages: 32
Registered: April 2005
Location: Malta
Member
ok
thank you for your help.

Sonja
Previous Topic: Blocking Session in v$session
Next Topic: How to see Schema user password in text
Goto Forum:
  


Current Time: Sun Oct 20 09:06:14 CDT 2019