Oracle® Database Administrator's Guide
11g Release 2 (11.2)
Part Number E10595-04
Creating a Password File with ORAPWD
The syntax of the ORAPWD
command is as follows:
ORAPWD FILE=filename [ENTRIES=numusers] [FORCE={Y|N}] [IGNORECASE={Y|N}]
Command arguments are summarized in the following table.
Argument | Description |
---|---|
FILE | Name to assign to the password file. You must supply a complete path. If you supply only a file name, the file is written to the current directory. |
ENTRIES | (Optional) Maximum number of entries (user accounts) to permit in the file. |
FORCE | (Optional) If y , permits overwriting an existing password file. |
IGNORECASE | (Optional) If y , passwords are treated as case-insensitive. |
There are no spaces permitted around the equal-to (=) character.
The command prompts for the SYS
password and stores the password in the created password file.
Example
The following command creates a password file named orapworcl
that allows up to 30 privileged users with different passwords.
orapwd FILE=orapworcl ENTRIES=30
ORAPWD Command Line Argument Descriptions
The following sections describe the ORAPWD
command line arguments.
-
FILE
-
This argument sets the name of the password file being created. You must specify the full path name for the file. The contents of this file are encrypted, and the file cannot be read directly. This argument is mandatory.
The file name required for the password file is operating system specific. Some operating systems require the password file to adhere to a specific format and be located in a specific directory. Other operating systems allow the use of environment variables to specify the name and location of the password file.
Table 1-1 lists the required name and location for the password file on the UNIX, Linux, and Windows platforms. For other platforms, consult your platform-specific documentation.
Table 1-1 Required Password File Name and Location on UNIX, Linux, and Windows
Platform Required Name Required Location) UNIX and Linux
orapw
ORACLE_SID
ORACLE_HOME
/dbs
Windows
PWD
ORACLE_SID
.ora
ORACLE_HOME
\database
For example, for a database instance with the SID
orcldw
, the password file must be namedorapworcldw
on Linux andPWDorcldw.ora
on Windows.In an Oracle Real Application Clusters environment on a platform that requires an environment variable to be set to the path of the password file, the environment variable for each instance must point to the same password file.
Caution:
It is critically important to the security of your system that you protect your password file and the environment variables that identify the location of the password file. Any user with access to these could potentially compromise the security of the connection.
ENTRIES
-
This argument specifies the number of entries that you require the password file to accept. This number corresponds to the number of distinct users allowed to connect to the database as
SYSDBA
orSYSOPER
. The actual number of allowable entries can be higher than the number of users, because theORAPWD
utility continues to assign password entries until an operating system block is filled. For example, if your operating system block size is 512 bytes, it holds four password entries. The number of password entries allocated is always a multiple of four.Entries can be reused as users are added to and removed from the password file. If you intend to specify
REMOTE_LOGIN_PASSWORDFILE=EXCLUSIVE
, and to allow the granting ofSYSDBA
andSYSOPER
privileges to users, this argument is required.Caution:
When you exceed the allocated number of password entries, you must create a new password file. To avoid this necessity, allocate a number of entries that is larger than you think you will ever need.
FORCE
-
This argument, if set to
Y
, enables you to overwrite an existing password file. An error is returned if a password file of the same name already exists and this argument is omitted or set toN
.
IGNORECASE
-
If this argument is set to
y
, passwords are case-insensitive. That is, case is ignored when comparing the password that the user supplies during login with the password in the password file.
See Also:
Oracle Database Security Guide for more information about case-sensitivity in passwords.Sharing and Disabling the Password File
You use the initialization parameter REMOTE_LOGIN_PASSWORDFILE
to control whether or not a password file is shared among multiple Oracle Database instances. You can also use this parameter to disable password file authentication. The values recognized for REMOTE_LOGIN_PASSWORDFILE
are:
-
NONE
: Setting this parameter toNONE
causes Oracle Database to behave as if the password file does not exist. That is, no privileged connections are allowed over nonsecure connections. -
EXCLUSIVE
: (The default) AnEXCLUSIVE
password file can be used with only one instance of one database. Only anEXCLUSIVE
file can be modified. Using anEXCLUSIVE
password file enables you to add, modify, and delete users. It also enables you to change theSYS
password with theALTER USER
command. -
SHARED
: ASHARED
password file can be used by multiple databases running on the same server, or multiple instances of an Oracle Real Application Clusters (RAC) database. ASHARED
password file cannot be modified. This means that you cannot add users to aSHARED
password file. Any attempt to do so or to change the password ofSYS
or other users with theSYSDBA
orSYSOPER
privileges generates an error. All users needingSYSDBA
orSYSOPER
system privileges must be added to the password file whenREMOTE_LOGIN_PASSWORDFILE
is set toEXCLUSIVE
. After all users are added, you can changeREMOTE_LOGIN_PASSWORDFILE
toSHARED
, and then share the file.This option is useful if you are administering multiple databases or a RAC database.
If REMOTE_LOGIN_PASSWORDFILE
is set to EXCLUSIVE
or SHARED
and the password file is missing, this is equivalent to setting REMOTE_LOGIN_PASSWORDFILE
to NONE
.
Note:
You cannot change the password forSYS
if
REMOTE_LOGIN_PASSWORDFILE
is set to
SHARED
. An error message is issued if you attempt to do so.
Keeping Administrator Passwords Synchronized with the Data Dictionary
If you change the REMOTE_LOGIN_PASSWORDFILE
initialization parameter from NONE
to EXCLUSIVE
or SHARED
, or if you recreate the password file with a different SYS
password, then you must ensure that the passwords in the data dictionary and password file for the SYS
user are the same.
To synchronize the SYS
passwords, use the ALTER USER
statement to change the SYS
password. The ALTER USER
statement updates and synchronizes both the dictionary and password file passwords.
To synchronize the passwords for non-SYS
users who log in using the SYSDBA
or SYSOPER
privilege, you must revoke and then regrant the privilege to the user, as follows:
-
Find all users who have been granted the
SYSDBA
privilege.SELECT USERNAME FROM V$PWFILE_USERS WHERE USERNAME != 'SYS' AND SYSDBA='TRUE';
-
Revoke and then re-grant the
SYSDBA
privilege to these users.REVOKE SYSDBA FROM non-SYS-user; GRANT SYSDBA TO non-SYS-user;
-
Find all users who have been granted the
SYSOPER
privilege.SELECT USERNAME FROM V$PWFILE_USERS WHERE USERNAME != 'SYS' AND SYSOPER='TRUE';
-
Revoke and regrant the
SYSOPER
privilege to these users.REVOKE SYSOPER FROM non-SYS-user; GRANT SYSOPER TO non-SYS-user;
Adding Users to a Password File
When you grant SYSDBA
or SYSOPER
privileges to a user, that user's name and privilege information are added to the password file. If the server does not have an EXCLUSIVE
password file (that is, if the initialization parameter REMOTE_LOGIN_PASSWORDFILE
is NONE
or SHARED
, or the password file is missing), Oracle Database issues an error if you attempt to grant these privileges.
A user's name remains in the password file only as long as that user has at least one of these two privileges. If you revoke both of these privileges, Oracle Database removes the user from the password file.