Nella versione 11g R2 se si tenta di accedere al db con una password sbagliata,
i primi tre tentativi rispondo abbastanza veloci.
Dal quarto tentativo in poi, viene applicato un delay di 1 secondo in più a tentativo nella risposta.
L’utente è attivo e non è in stato di lock.
-bash-3.2$ time echo “select sysdate from dual;” |sqlplus user/password
SQL*Plus: Release 11.2.0.1.0 Production on Thu Jan 17 09:56:56 2011
Copyright (c) 1982, 2009, Oracle. All rights reserved.
ERROR:
ORA-01017: invalid username/password; logon denied
Enter user-name: SP2-0306: Invalid option.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=value]]
where <logon> ::= <username>[/<password>][@<connect_identifier>]
<proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]
Enter user-name:
real 0m0.215s
user 0m0.011s
sys 0m0.032s
-bash-3.2$ time echo “select sysdate from dual;” |sqlplus user/password
SQL*Plus: Release 11.2.0.1.0 Production on Thu Jan 17 09:57:13 2011
Copyright (c) 1982, 2009, Oracle. All rights reserved.
ERROR:
ORA-01017: invalid username/password; logon denied
Enter user-name: SP2-0306: Invalid option.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=value]]
where <logon> ::= <username>[/<password>][@<connect_identifier>]
<proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]
Enter user-name:
real 0m0.093s
user 0m0.016s
sys 0m0.029s
-bash-3.2$ time echo “select sysdate from dual;” |sqlplus user/password
SQL*Plus: Release 11.2.0.1.0 Production on Thu Jan 17 09:57:15 2011
Copyright (c) 1982, 2009, Oracle. All rights reserved.
ERROR:
ORA-01017: invalid username/password; logon denied
Enter user-name: SP2-0306: Invalid option.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=value]]
where <logon> ::= <username>[/<password>][@<connect_identifier>]
<proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]
Enter user-name:
real 0m0.103s
user 0m0.011s
sys 0m0.035s
-bash-3.2$ time echo “select sysdate from dual;” |sqlplus user/password
SQL*Plus: Release 11.2.0.1.0 Production on Thu Jan 17 09:57:20 2011
Copyright (c) 1982, 2009, Oracle. All rights reserved.
ERROR:
ORA-01017: invalid username/password; logon denied
Inizio il 4 tentativo:
Enter user-name: SP2-0306: Invalid option.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=value]]
where <logon> ::= <username>[/<password>][@<connect_identifier>]
<proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]
Enter user-name:
real 0m1.099s
user 0m0.015s
sys 0m0.030s
Quinto tentativo:
-bash-3.2$ time echo “select sysdate from dual;” |sqlplus user/password
SQL*Plus: Release 11.2.0.1.0 Production on Thu Jan 17 09:57:23 2011
Copyright (c) 1982, 2009, Oracle. All rights reserved.
ERROR:
ORA-01017: invalid username/password; logon denied
Enter user-name: SP2-0306: Invalid option.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=value]]
where <logon> ::= <username>[/<password>][@<connect_identifier>]
<proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]
Enter user-name:
real 0m2.096s
user 0m0.014s
sys 0m0.026s
Sesto tentativo:
-bash-3.2$ time echo “select sysdate from dual;” |sqlplus user/password
SQL*Plus: Release 11.2.0.1.0 Production on Thu Jan 17 09:57:27 2011
Copyright (c) 1982, 2009, Oracle. All rights reserved.
ERROR:
ORA-01017: invalid username/password; logon denied
Enter user-name: SP2-0306: Invalid option.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=value]]
where <logon> ::= <username>[/<password>][@<connect_identifier>]
<proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]
Enter user-name:
real 0m3.101s
user 0m0.014s
sys 0m0.031s
Settimo tentativo:
-bash-3.2$ time echo “select sysdate from dual;” |sqlplus user/password
SQL*Plus: Release 11.2.0.1.0 Production on Thu Jan 17 09:57:32 2011
Copyright (c) 1982, 2009, Oracle. All rights reserved.
ERROR:
ORA-01017: invalid username/password; logon denied
Enter user-name: SP2-0306: Invalid option.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=value]]
where <logon> ::= <username>[/<password>][@<connect_identifier>]
<proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]
Enter user-name:
real 0m4.101s
user 0m0.014s
sys 0m0.031s
Ottavo tentativo:
-bash-3.2$ time echo “select sysdate from dual;” |sqlplus user/password
SQL*Plus: Release 11.2.0.1.0 Production on Thu Jan 17 09:57:39 2011
Copyright (c) 1982, 2009, Oracle. All rights reserved.
ERROR:
ORA-01017: invalid username/password; logon denied
Enter user-name: SP2-0306: Invalid option.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=value]]
where <logon> ::= <username>[/<password>][@<connect_identifier>]
<proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]
Enter user-name:
real 0m5.102s
user 0m0.017s
sys 0m0.029s
e così via….
Questa è una nuova feature della 11g, definita come “brute force”.
Questo è per rendere più difficili l’hacking.
Se la password è corretta non ci sarà nessun delay.
Ciao,
Davide