Pete Finnigan's Oracle security weblog

Mike says:

And by fueling your car you're making it easier for thieves to steal it. So?

paul says:

Car needs petrol. Oracle DB does not need a default SID - so not really analogous.
What could be the reasons for setting this parameter except for saving time connecting?

Pete says:

Thanks for your comment Mike. I think Paul summed it up nicely. You need to know the service name to connect. If you then dint need to know it (i.e. its not required) then that has to weaken the security. So, I am warning people; if they choose to set this then they potentially lessen the security of the database.

cheers

pete

Anon says:

The fact that a non-default service name contributes something to security is purely incidental. It's a little like shutting off the lights where you park your car so that the theives can't see what they're doing.

I think it's a terrible disservice to waste what little attention people give to security on this. Better tell them again not to have guessable passwords. That's the feature that is designed, and has a real potential, for keeping the bad guys out of databases.

Pete says:

Hi Anon,

Thanks for your comment.

I think that the post has stimulated some conversation and thats a good thing.

My experience, as i have said a few times is that the basic building blocks of being able tp perform a connection to the database are often left lying around, given to everyone (example in the post), easily guessable and more. Making one of the peices not necessary makes it even simpler so its worth mentioning but you are right, people need to get the basics right. Fix weak passwords, dont use guessable sid's dont use default ports but more importantly use a firewall/IDS/IPS to prevent connections to the database in the first place.

Disservice? - I dont think so, lets cover all bases.

Thanks again, its good to discuss these issues

Kind regards

Pete