Users and Basic Security - Pro Oracle Database 12c Administration - page 131

■ the DEFAULT_PWD$ view is available starting with Oracle database 11g. see MOs note 227010.1 for more
details about guidelines on checking for default passwords.

Note

Checking Default Passwords
You should also check your database to determine whether any accounts are using default passwords. If you're using
an Oracle Database 11g or higher, you can check the DBA_USERS_WITH_DEFPWD view to see whether any Oracle-created
user accounts are still set to the default password:

SQL> select * from dba_users_with_defpwd;

If you aren't using Oracle Database 11g or higher, then you have to check the passwords manually or use a script.
Listed next is a simple shell script that attempts to connect to the database, using default passwords:

#!/bin/bash
if [ $# -ne 1 ]; then
echo "Usage: $0 SID"
exit 1
fi
# Source oracle OS variables via oraset script.
# See chapter 2 for more details on setting OS variables.
. /etc/oraset $1
#
userlist="system sys dbsnmp dip oracle_ocm outln"
for u1 in $userlist
do
#
case $u1 in
system)
pwd=manager
cdb=$1
;;
sys)
pwd="change_on_install"
cdb="$1 as sysdba"
;;
*)
pwd=$u1
cdb=$1
esac
#
echo "select 'default' from dual;" | \
sqlplus -s $u1/$pwd@$cdb | grep default >/dev/null
if [[ $? -eq 0 ]]; then
echo "ALERT: $u1/$pwd@$cdb default password"
echo "def pwd $u1 on $cdb" | mailx -s "$u1 pwd default" [e-mail]