Category Archives: Uncategorized

Oracle passwords and special characters

As commonly known passwords should have a certain complexity. Thereby it is common to use special characters, numbers, lower and uppercase characters. Depending on the type of special characters Oracle require that the password is enclosed in double quotation marks. Oracle does provide a guideline for Securing Passwords in the Oracle® Database Security Guide. So far so well, depending on the applications or Oracle clients the enclosing doesn’t really work as expected. Some Special characters like a $ or % are used to indicate an environment variable, other special characters like /, [] or @ are used to build the connect string. But a really nasty special character is the backslash respectively the \. The backslash is in general used as escape character to change subsequent literal characters into metacharacters and vice versa. The use of the backslash in an Oracle password has some very interesting side effects :-).

Ok, lets create a test user with a complex password and a backslash \ somewhere in the password.

SQL> conn / AS sysdba
Connected.
SQL> CREATE USER smith IDENTIFIED BY "KT20\dft";

USER created.

SQL> GRANT CREATE SESSION TO smith;

GRANT succeeded.

SQL> conn smith/KT20\dft
Connected.

SQL> SHOW USER
USER IS "SMITH"

SQL> conn smith/"KT20\dft"
Connected.

SQL> SHOW USER;
USER IS "SMITH"

SQL> conn smith/"KT20\dft"@TDB11
Connected.

SQL> SHOW USER;
USER IS "SMITH"

SQL> conn smith/KT20\dft@TDB11
Connected.

To create the user I’ve used the double quotation marks to enclose the password. As you can see, the attempts to log on to the database have worked in any case. In contrast to the login, alter the password definitely requires some quotation as you can see below.

SQL> ALTER USER smith IDENTIFIED BY KT20\dft;
ALTER USER smith IDENTIFIED BY KT20\dft
                                   *
ERROR at line 1:
ORA-00911: invalid CHARACTER

Ok, lets put the backslash at the end of the password and try to login again.

SQL> ALTER USER smith IDENTIFIED BY "KT20dft";

USER altered.

SQL> conn smith/KT20dft\
Connected.

SQL> SHOW USER
USER IS "SMITH"

SQL> conn smith/"KT20dft"
SP2-0306: Invalid OPTION.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=VALUE]]
WHERE <logon> ::= <username>[/<password>][@<connect_identifier>]
      <proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]

SQL> conn smith/"KT20dft"@TDB11
SP2-0306: Invalid OPTION.
Usage: CONN[ECT] [{logon|/|proxy} [AS {SYSDBA|SYSOPER|SYSASM}] [edition=VALUE]]
WHERE <logon> ::= <username>[/<password>][@<connect_identifier>]
      <proxy> ::= <proxyuser>[<username>][/<password>][@<connect_identifier>]

SQL> conn smith@TDB11
Enter password: ********
Connected.
SQL> SHOW USER
USER IS "SMITH"

SQL> conn smith/KT20dft\@TDB11
ERROR:
ORA-01017: invalid username/password; logon denied


Warning: You are no longer connected TO ORACLE.

As you can see above, the Login no longer works so smoothly. Using the username and password without any quotation does work. Any other combination with quotation or the connect identifier does not work any more. In these cases the backslash does behave as a escape character. Mmh, in this case it should be possible to escape the backslash with a second backslash isn’t it?

SQL> conn smith/"KT20dft\"
ERROR:
ORA-01017: invalid username/password; logon denied

No, doesn’t work. So far I have found no way to use the backslash at the end of a password, unless the password is entered interactively. For an administration tool like SQLPlus, SQL Developer etc which is anyway used interactively it isn’t a problem. But if you would like to setup batch jobs, RMAN backup’s etc it does not work.

Recovery Manager: Release 11.2.0.3.0 - Production ON Tue Jun 12 08:33:43 2014

Copyright (c) 1982, 2011, Oracle AND/OR its affiliates.  ALL rights reserved.

RMAN>
RMAN>
RMAN> CONNECT target *
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-10000: error parsing target DATABASE CONNECT string "sys/"KT20dft"@TDB11"

RMAN> run
2> {
3>
4> allocate channel ch1 TYPE disk;
5> backup CURRENT control file;
6> }
USING target DATABASE control file instead OF recovery catalog
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure OF allocate command at 06/12/2014 08:33:43
RMAN-06171: NOT connected TO target DATABASE

Conclusion

It is still highly recommended to use complex passwords. Although Oracle supports all types of multi-byte characters, it is useful to test some special characters before these are used in passwords. Not everything always works as you expect.

Audit Vault and Database Firewall 12.1.1 Bundle Patch 2

This week Oracle has sent a small Christmas gift for its AVDF customers. They Released the second bundle patch for Audit Vault and Database Firewall 12.1.1. In contrast to the BP1 there is no full installation image available. New installations will have to start with the full installation image from BP1 (Patch 16965974) and apply the BP2 (Patch 17913249).

According the readme, the BP2 contains the October 2013 PSU 11.2.0.3.8 for the database as well several bug fix.

  • 16913946 Upgrade of Windows agent fails
  • 17303061 Novelty Policy only displays small percentage of all SQL tables collected
  • 17372776 Novelty Policy UI processes table names from event_log incorrectly
  • 15968896 Novelty Policies do not provide option for DML Read Only
  • 17416529 Some table names in a Novelty Policy rule may be ignored
  • 16818336 HA-related code on the standby system reports error incorrectly
  • 16834855 HA can be only configured if the future standby database is still standalone

Furthermore oracle has adapted the patch update process. Instead of installing an RPM you’ll have to mount the iso and run a ruby script. The installation on a Audit Vault Server in a nutshell…

  • Stop all audit trails on Audit Vault Server console
  • Stop all Audit Vault Agents
  • Uninstall the host monitor
  • Copy the ISO onto the Audit Vault Server and mount it
  • Start upgrade Script
  • Reboot Audit Vault Server

Even when its not anymore a RPM to install it’s still quite straightforward.

[root@melete2 ~]# /bin/mount -oloop,ro /root/avdf-upgrade-12.1.1.2.0.iso /mnt
[root@melete2 ~]# /usr/bin/ruby /mnt/upgrade.rb
[root@melete2 ~]# /sbin/reboot

References

Some links related to this post.

Eclipse Jira integration and SSLHandshakeException

Basically I’ve solved this issue quite a while ago. Unfortunately I did not wrote any kind of documentation. That’s why I run again into SSLHandshakeException with my Eclipse installation on my new MacBook Pro, when trying to access our JIRA environment. As it now hopefully take a while until I buy again a new MacBook Pro, I thought it’s time to write a short note. 🙂

Cause

Our JIRA server is configured using a self signed certificate. The certificate is not part of the JVM certificate keystore.

Solution

The solution is simple, just add the certificate to the keystore. But which one? The eclipse installation details will help to identify the right JVM and keystore.

  1. Checkout the eclipse installation and configuration details in Eclipse > About Eclipse > Installation Details Somewhere there you find the java.home used by eclipse.
  2. Get the Certificat of your JIRA Web server. On Mac OS I’ve used Firefox to store the X.509 Certificate as PEM
  3. Set the JAVA HOME
  4. Load the certificate to the keystone using key tool
  5. Restarte Eclipse and start to configure your JIRA Repository

On my Mac OS X Mavericks I have to use the following JAVA_HOME. Password for the keystone is by the way changeit.

export JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Home/jre
sudo keytool -import -alias tvdvaps -file certificate.pem -keystore $JAVA_HOME/lib/security/cacerts

The full description can be found in FAQ JiraBuddy Eclipse Plugin for JIRA

Resize swap space on linux

A few times a year I create a new linux VM. I usually do this by using a kickstart server. The kickstart configuration file I normally use is creating a swap partition which is to small for an Oracle database server. Unfortunately, I forget regularly how to resize the swap partition. Ok, I could update my kickstart configuration file before I create the VM, but this gets forgotten as well 😉

Background

I try to limit the size of my VM as good as possible. Disk space on a SSD disk is not yet as cheep as it should be. Therefore I usually create VM disk which can grow to certain limit. For the swap disk I use a 4GB VM disk and define a swap space of about 2G. The VM disk itself will not grow as long as there is not a lot of swapping. But if the VM has at least 2GB memory the Oracle installer is complaining about to low swap space. Ok, you can ignore this 😉 or you can increase the swap space.

Let’s do it

Check the current settings

cat /etc/fstab
LABEL=/                 /                       ext3    defaults        1 1
LABEL=/u00              /u00                    ext3    defaults        1 2
LABEL=/u01              /u01                    ext3    defaults        1 2
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
proc                    /proc                   proc    defaults        0 0
LABEL=SWAP-sdb1         swap                    swap    defaults        0 0

Switch off the swap device

swapoff -a

Recreate the swap partition with frisk

fdisk /dev/sdb


Command (m for help): m
Command action
   a   toggle a bootable flag
   b   edit bsd disklabel
   c   toggle the dos compatibility flag
   d   delete a partition
   l   list known partition types
   m   print this menu
   n   add a new partition
   o   create a new empty DOS partition table
   p   print the partition table
   q   quit without saving changes
   s   create a new empty Sun disklabel
   t   change a partition's system id
   u   change display/entry units
   v   verify the partition table
   w   write table to disk and exit
   x   extra functionality (experts only)

Delete the old swap partition

Command (m for help): d
Selected partition 1

Command (m for help): d
No partition is defined yet!

Select the partition type

Command (m for help): t
Selected partition 1
Hex code (type L to list codes): l

 0  Empty           1e  Hidden W95 FAT1 80  Old Minix       bf  Solaris        
 1  FAT12           24  NEC DOS         81  Minix / old Lin c1  DRDOS/sec (FAT-
 2  XENIX root      39  Plan 9          82  Linux swap / So c4  DRDOS/sec (FAT-
 3  XENIX usr       3c  PartitionMagic  83  Linux           c6  DRDOS/sec (FAT-
 4  FAT16 &lt;32M      40  Venix 80286     84  OS/2 hidden C:  c7  Syrinx        
 5  Extended        41  PPC PReP Boot   85  Linux extended  da  Non-FS data    
 6  FAT16           42  SFS             86  NTFS volume set db  CP/M / CTOS / .
 7  HPFS/NTFS       4d  QNX4.x          87  NTFS volume set de  Dell Utility  
 8  AIX             4e  QNX4.x 2nd part 88  Linux plaintext df  BootIt        
 9  AIX bootable    4f  QNX4.x 3rd part 8e  Linux LVM       e1  DOS access    
 a  OS/2 Boot Manag 50  OnTrack DM      93  Amoeba          e3  DOS R/O        
 b  W95 FAT32       51  OnTrack DM6 Aux 94  Amoeba BBT      e4  SpeedStor      
 c  W95 FAT32 (LBA) 52  CP/M            9f  BSD/OS          eb  BeOS fs        
 e  W95 FAT16 (LBA) 53  OnTrack DM6 Aux a0  IBM Thinkpad hi ee  EFI GPT        
 f  W95 Ext'd (LBA) 54  OnTrackDM6      a5  FreeBSD         ef  EFI (FAT-12/16/
10  OPUS            55  EZ-Drive        a6  OpenBSD         f0  Linux/PA-RISC b
11  Hidden FAT12    56  Golden Bow      a7  NeXTSTEP        f1  SpeedStor      
12  Compaq diagnost 5c  Priam Edisk     a8  Darwin UFS      f4  SpeedStor      
14  Hidden FAT16 3 61  SpeedStor       a9  NetBSD          f2  DOS secondary  
16  Hidden FAT16    63  GNU HURD or Sys ab  Darwin boot     fb  VMware VMFS    
17  Hidden HPFS/NTF 64  Novell Netware  b7  BSDI fs         fc  VMware VMKCORE
18  AST SmartSleep  65  Novell Netware  b8  BSDI swap       fd  Linux raid auto
1b  Hidden W95 FAT3 70  DiskSecure Mult bb  Boot Wizard hid fe  LANstep        
1c  Hidden W95 FAT3 75  PC/IX           be  Solaris boot    ff  BBT            
Hex code (type L to list codes): 82
Changed system type of partition 1 to 82 (Linux swap / Solaris)

Create a new partition. I’ll use the full size of the disk /dev/sdb

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-522, default 1):
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-522, default 522):
Using default value 522

Write the changes to disk and exit

Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.
Syncing disks.

Now it’s time to create a new swap filesystem with mkswap. Because I use labels in fstab, I create the new filesystem again with a label.

mkswap /dev/sdb1 -L SWAP-sdb1

Enable the swap device again

swapon -a

Display the new swap info

swapon -s
Filename                                Type            Size    Used    Priority
/dev/sdb1                               partition       4192924 34324   -1

iPad Apps

For once I do not write anything related to Oracle Database Technologies and Security. After I’ve been asked from time to time, what I’ve installed on my iPad or what I could recommend, it is time to put things together again. It is not an “All-time best IOS App list” nor is the list exhaustive. It is just a personal experience at time of writing. Some App’s are just for the iPad and some are for the iPhone as well. For the price I can not make any statements. But I try to rate them at least with free, costs or free/costs. Where free/pay means that there are two version available.

My must haves

App’s which I regularly use.

iTunes Link Costs Comment
AroundMe free Information what’s around me e.g Restaurants, Bars etc.
Evernote free Collect and access your links, notes etc on the iPad and sync it with your Max
Facebook free Official FaceBook App. There are others around but it’s a good one to start with
Flipboard free My favorite to read news, twitter, etc
iBooks free Must have for eBook’s, PDF etc
Instapaper free Collect web links and read them later
PCalc RPN free/costs My RPN calculator and replacement for HP 48sx
Remote free Remote from Apple for Apple TV and iTunes
Schweizer Fernsehen free Information, news, TV program etc from the swiss broadcasting service
Swiss Phone free Swiss phone book
Twitter free Twitter client
free/costs eVersion of Tagesanzeiger newspaper

Business

Serious App’s for business. Ok in some cases I just though I need them for work…

iTunes Link Costs Comment
Numbers costs Apple’s spreadsheet app
Oracle free Oracle News App
Oracle Magazine free Oracle Magazine
Keynote costs Apple’s presentation app
GoodReader costs read and update all kind of documents, access dropbox, iCloud and WebDAV
OmniFocus costs Task manager with iPhone and Mac synchronisation
OmniGraffle costs Diagramming, charting, and visualization software for iOS
OmniGraphSketscher costs More drawing
Pages costs Apple’s word processing app
Quickoffice Pro HD costs App to view and edit Office documents. With WebDAV and DropBox access
Swiss Map Mobile costs Maps of Switzerland. I mean real maps not just funny pictures but expensive…
iOf free App for the Swiss army. Coordinates, regulations, SNORDA etc
Dropbox free Access and view documents on your dropbox account
Penultimate cost Notes and sketches
Reeder for iPad cost Newsreader for iPad and iPhone
iKeePass costs Password management storing the passwords in a keepass database
Textastic costs Text editor with syntax highlighting for differen languages (C, perl, sql etc)
WordPress costs iOS App to view and edit wordpress posts, pages etc
F5 BIG-IP Edge Client free Open a VPN over F5 VPN Gateways

Gadgets

Ok, these App’s are somehow just gadgets 🙂

iTunes Link Costs Comment
Evri for iPad free Something similar to Flipboard
FastFinga free/costs Write with your fingers
Find My Friends free Localize your friends…
IMDb Movie free Need to know anything about a movie or actor?
Find My iPhone free missing your iPhone? Here’s the app to look for it…
Google Earth free Google earth for the iPad
iBrainstrom free as the name implies
iCircuit cost Must have for an electrical engineer. App to draw and simulate circuits
iPhoto cost iPhoto for the iPad. Haven’t used it that much sofa
iWeather costs Nice weather app
Jumpidoo free Simple game from swiss rail service. Helpful if you are traveling with children 😉
SBB Memory free Another game from swiss rail service. Helpful if you are traveling with children 😉
NASA App HD free Pictures from outer space
Radios free Swiss and other internet radios
Skype for iPad free Skype what else….
Wikihood for iPad free/costs Wikipedia based travel guide
Wikipanion for iPad free/costs Wikipedia for the iPad
ZüriPlan free Maps from Zürich, City maps, history maps etc

The others

I have them but in most cases I do not really use the often 🙂

iTunes Link Costs Comment
Activity Monitor Touch free/costs Monitor resources on the iPad
Air Display costs Use your iPad as second monitor for your MacBook Pro
Bambo Paper fee Notes
Booking.com free Booking through booking.com
BlickTV for the iPad free Blick TV
Currency free Currency converter
Dictionary free/costs English / German dictionary
Google Search free Google App’s and Search
Google Translate free Interface to Google translate
iA Writer costs Cool way to write on iPad
Nespresso free Simple app to order Nespresso capsule
Kindle free Kindle Reader
On AIR free TV Schedules
Photogene costs Photo editing similar to iPhoto
Rezepte costs Collection of recipes
Schweizer Spezialitäten costs Swiss recipes
Swiss Info free Swiss news portal
Teletext costs Swiss Teletext
TomTom costs Tom Tom Navigator for iPhone and iPad
Zattoo free Watch TV on your iPad
20 Minuten free News portal for 20 Minutes

There are a few app’s more but run out of time….

Feel free to drop me a line about your favorite apps for the iPad

…somewhen even I have a blog

Yes, somewhen even I have a blog. After having accounts on gmail, twitter, xing, facebook and all the other networks, platforms etc. I thought it’s time to share my technical knowhow with anybody who want’s to see it.

As senior Oracle DBA I will mainly focus on general DBA stuff, Oracle Security, Backup & Recovery, Grid Control and probably also on some internal stuff.  But the future will show how and when some I find time to write a post.

The whole webpage is written in english, but… I’m a swiss guy so somewhen I will also find some information in german. If you think it could be interesting for you, but you german is not bullet proof do not hesitate to get in contact with me. Probably I have a english version around which is not ready for publishing.

I’m wondering if my syntax highlight plugin is working…

SELECT sysdate FROM dual;

… should look like SQL Code. To start with it looks ok. But I’m not really happy with the border.