Enhancing Security - Expert Oracle and Java Security - page 309

Then run SQL*Plus and connect to each of our Oracle instances, one at a time. Sometimes, the
TNSListener service takes a minute or two to register the database services after being restarted. If your
SQL*Plus connect doesn't work, try again in a minute. Execute the SELECT command from
ALL_REGISTRY_BANNERS to see what services have been built.
SQLPLUS SYS@ORCL AS SYSDBA
SELECT * FROM ALL_REGISTRY_BANNERS;
CONNECT SYS@apver AS SYSDBA
-- compare to what's installed in initial database
SELECT * FROM ALL_REGISTRY_BANNERS;
Oracle Database Catalog Views Release 11.2.0.1.0 - 64bit Production
Oracle Database Packages and Types Release 11.2.0.1.0 - Development
Oracle XML Database Version 11.2.0.1.0 - Development
JServer JAVA Virtual Machine Release 11.2.0.1.0 - Development
Oracle Database Java Packages Release 11.2.0.1.0 - Development
Connect from Remote AS SYSDBA
You may want to be able to connect to the apver instance as SYS from a remote GUI administrative
application, like TOAD, or from any remote application (including SQL*Plus); however, there is a
constraint on the ability to connect to a database instance remotely with the AS SYSDBA privilege. In
order for that connection to succeed, a remote login password file must exist for the database instance.
In order to remotely login as SYS AS SYSDBA to the apver instance, we will need to create the remote login
password file for apver .
First of all, check that we do not have a remote login password file for the apver instance. This can
be accomplished by executing an innocuous command that touches that file, GRANT SYSDBA . As SYS user,
execute this:
GRANT SYSDBA TO SYS;
If the remote SYSDBA login password file already exists, you will not get an error, but on the apver
instance you will probably see this error:
ERROR at line 1:
-ORA-01994: GRANT failed: password file missing or disabled
You can create a remote login password file by executing the orapwd command (found in the
ORACLE_HOME bin directory). You will need to provide the default file name for the apver instance,
PWDapver.ora and the password for the SYS user.
orapwd file=%ORACLE_HOME%\database\PWDapver.ora password=sys_password
Configure CREATE_SESSION_ROLE and APPSEC User
We should now be able to connect to the apver instance as SYS from either a local command prompt or
from a remote session. Go ahead and connect as SYS AS SYSDBA so that we can create the structures
needed for application verification.