Auditing an Oracle database for security issues is very important. PeteFinnigan.com provides all of the information and tools that you will need Click here for details of PeteFinnigan.com Limited's detailed Oracle database security audit service Click here for details of PeteFinnigan.com Limited's Oracle Security Training Courses
Cookie Policy:We only use essential cookies on small sections of this website. For details see here.

Welcome, Guest. Please Login.
Nov 20th, 2017, 1:43am
News: Welcome to Pete Finnigan's Oracle security forum
Home | Help | Search | Members | Login
   Pete Finnigan's Oracle Security Forum
   Oracle Security
   Application Server Security
(Moderator: Pete Finnigan)
   Oracle financials passwords storage
« Previous topic | Next topic »
Pages: 1  Reply | Notify of replies | Send Topic | Print
   Author  Topic: Oracle financials passwords storage  (Read 4620 times)
djodj
PeteFinnigan.com Newbie
*



I love YaBB 1G - SP1!

   
View Profile |

Posts: 2
Oracle financials passwords storage
« on: Aug 2nd, 2006, 10:34am »
Quote | Modify

Hi People,
This is a very informative forum and keep it up.
Where does Oracle financials 11 store the application usernames and passwords? In which table are they stored, and are they encrypted?
 
Rgds
 
 
IP Logged
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Oracle financials passwords storage
« Reply #1 on: Aug 6th, 2006, 5:02pm »
Quote | Modify

Hi,
 
Start with FND_USERS. They are encrypted. Have a look at the FNDPASS utility that can be used to set application and schema passwords.
 
hth
 
cheers
 
Pete
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
djodj
PeteFinnigan.com Newbie
*



I love YaBB 1G - SP1!

   
View Profile |

Posts: 2
Re: Oracle financials passwords storage
« Reply #2 on: Aug 7th, 2006, 7:19am »
Quote | Modify

Thanks pete. That helped alot. Are the passwords encrypted the same way as oracle database passwords? I need to test if users are using strong passwords and which password craking tools i can try. Can Orabf be used for this or which tools are available to test this?
 
Thanks
IP Logged
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Oracle financials passwords storage
« Reply #3 on: Aug 7th, 2006, 12:03pm »
Quote | Modify

Hi,
 
No its a different algorithm. I know how it works but I am not certain its in the public domain so I will not edscribe it here. Maybe someone else knows if there are any free password cracking tools available. It is possible to use SQL to check passwords. You can use the following SQL:
 
Code:
select fnd_web_sec.validate_login('PETE','PASSWD') from sys.dual;

 
cheers
 
Pete
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pages: 1  Reply | Notify of replies | Send Topic | Print

« Previous topic | Next topic »

Powered by YaBB 1 Gold - SP 1.4!
Forum software copyright 2000-2004 Yet another Bulletin Board