The algorithm keeps on generating passwords until To address some specific STIG requirements like a minimum number of specific characters, as before, myĬoding strategy is to apply a brute force tactic. The generator hits an included ascii code. I reckoned a random number generator, configured to produce an integer between 0 and 127, should beĪble to produce – in combination with Oracle supplied function CHR – any character in the ascii table.Īnd If it happens to generate an excluded ascii code, well, I simply let the PL/SQL try again until Some extra – true (1) or false (0) – colums serve as profiles for clusion To avoid some tricky characters for easier command line or shell script password management:Ībout exclusion (or inclusion) of characters:įor easy configuration I decided to use a regular table with the first 127 ascii codes and their Password now seems better practice to me because of the extra complexity, but I would still like Start with an uppercase or lowercase letter and – with numbers and letters – may contain onlyīut what I discovered after some investigation and didn’t know yet, is that the restriction on startĪnd special characters is off when you encase the password in double quotes. I’m familiar with the fact that Oracle passwords can be max 30 characters long, must It can be surrounded by double-quotation marks, however. The password does not contain the double-quotation character (“). The password contains no fewer than 9 characters and does not exceed 30 characters.Ĥ. The following internal checks are also applied:ģ. The password must differ from the previous password by at least four characters. The password must contain at least two upper case characters, two lower case characters, two numeric characters, and two special characters. This function checks for the following requirements when users create or modify passwords:ġ. The ora12c_strong_verify_function provides a set of requirements that are recommended by the Department of Defense Database Security Technical Implementation Guide. This is what the Oracle 12c documentation states in respect to the “ora12c_strong_verify_function”: So I took up the idea to code a PL/SQL based password generator that is as flexible as possible in the choice of included or excluded characters and can be configured to comply to Oracle requirements. Though most generators provide options to include or exclude certain character groups, I wasn’t able to find one that will let you choose options in any detail and also let you set specific requirements. But I wanted a password to comply to “ora12c_strong_verify_function”, and this isn’t as easy to generate as you might expect.
Creating or modifying an Oracle Database user password can be done by using any standard password generator you can find on the WEB.
0 kommentar(er)
