Alter user – is password stored in audit trails

oraclepasswordSecurity

I was asked an interesting question the other day and I have not been able to find a definitive answer.

If one of my DBA's changes a password, will the password the password show up in plain text in the audit trails?

Eg. sys as sysdba changes the password of system. 

ALTER USER system IDENTIFIED BY <password>

Oracle states that it will not if the user changes their own password, but says nothing about another account changing the password of another account.
The suspicion is that the password would show up in clear text in trails such as v$SQL.

This seems like an egregious oversight if Oracle didn't account for this but I cannot find anything to prove otherwise.

Best Answer

You could just try it out.

This is logged in locally sqlplus / as sysdba:

SQL> alter user mat identified by COOLPASSWORD ;

User altered.

SQL> select substr(sql_text,0,40) from v$sqlarea where lower(sql_text) like '%alter%' ;

SUBSTR(SQL_TEXT,0,40)
----------------------------------------
select substr(sql_text,0,40) from v$sqla

SQL> select substr(sql_text,0,40) from v$sql where lower(sql_text) like '%alter%' ;

SUBSTR(SQL_TEXT,0,40)
----------------------------------------
select substr(sql_text,0,40) from v$sql
select substr(sql_text,0,40) from v$sqla

The alter commands are not present in v$sql or v$sqlarea. I have sys operations auditing on that test database, and the audit file for the above password change contains:

<AuditRecord><Audit_Type>4</Audit_Type>...<OSPrivilege>SYSDBA</OSPrivilege>...
<Sql_Text>alter user mat identified by * </Sql_Text>
</AuditRecord>

That's a literal * in the XML file. The normal audit logs contain the same * instead of the password, including if I change another user's password (logged in as a normal DBA user).

Now if you use things like rlwrap to run sqlplus, or fancy GUI clients, the password may well stay in some command line history/buffer. But the database server can't do much about that.

Related Question