Sunday, April 18, 2010

11g sqlplus doesn't hide password

Prior to 10g Oracle database, anyone can see the database account password using 'ps -ef |grep sqlplus ' , if  it is hard coded on same command line with sqlplus, e.g sqlplus  username/password@DBNAME

In 10g , Oracle "solved" this problem ,.

However, it comes back again in 11g. Searched metalink, no more document says password will be removed. :(

Too bad.  Lucky, we have alternative way.

> ps -ef |grep sqlplus
oravas11  4997  4748  0 13:41:31 pts/0     0:00 ied sqlplus perfstat/xxxxxxxx@VAS11GP
oravas11  4998  4997  0 13:41:31 ttyp1     0:00 sqlplus perfstat/xxxxxxxx@VAS11GP