Pete Finnigan's Oracle Security Weblog

A short post today to add a little to the post I made the other day. In that post Add A SQL*Net Security Banner And Audit Notice I talked about using the sqlnet.ora parameters SEC_USER_AUDIT_ACTION_BANNER and SEC_USER_UNAUTHORIZED_ACCESS_BANNER to add security banners to your SQL*Net logins through tools such as SQL*Plus.

I got an email from someone today who advised me of a gotcha around this. He said he had implemented something similar using a logon trigger many many years ago where this logon trigger was able to output a banner of the form:

/*************************************************************************
THIS IS MY SECURITY BANNER
**************************************************************************/

But some shell scripts (bash, sh, ksh etc) that then called sqlplus to connect to the database read in the output which included the banner and the stars and these were, because of how the shell script was constructed, converted into shell input and the stars were converted in his case to file listings from the CWD (Current Working Directory). This caused problems for him.

So, be careful in what you add to your banners; keep it straight text and no special characters as that is unlikely to cause problems for any automated processes that connect to the database BUT test and make sure!

Bye for now from WFH!