0

We have a login trigger which limits access by IP:

IF UPPER(v_username) = 'CDEPROD' THEN
   IF SYS_CONTEXT('USERENV', 'IP_ADDRESS') NOT IN
       ('192.168.170.52',
        '192.168.170.40',
        '192.168.170.43',
        '192.168.170.54',
        '192.168.170.53',
        '192.168.170.58')
      OR SYS_CONTEXT('USERENV', 'IP_ADDRESS') IS NULL THEN
      RAISE_APPLICATION_ERROR(-20001, 'Can not log in from this IP address (' || SYS_CONTEXT('USERENV', 'IP_ADDRESS') || ')');
   END IF;
END IF;

So, the trigger works. But, from locally, I cannot log in as the CDEPROD user, it throws the application error. I thought to try 127.0.0.1, but that did not work......

Is there some trick to allowing local logins?

1
  • What does the error message show your IP address is? Commented Jul 14, 2021 at 18:33

1 Answer 1

5

In general, and only if you absolutely must, restricting logon by IP address is best handled using the OS-level firewall or (if you have Oracle Enterprise Edition) Oracle Connection Manager rather than a logon trigger. See this blog post I wrote last year on the subject: https://pmdba.wordpress.com/2020/02/18/how-to-limit-a-user-connection-to-a-specific-ip-address/

The point is that hard-coding IP addresses opens a door to a high overhead maintenance nightmare (since addresses are prone to change, sometimes frequently), for little or no security gain since IP addresses (and almost every other SYS_CONTEXT parameter) are relatively easy to spoof for a savvy Java programmer. I would advise a return to the drawing board, which you should start by asking, "What is the problem I am trying to solve?"

  • Are you trying to ensure that the user is who they claim to be? Use SSL (aka TCPS) connections with Oracle wallets and certificates to authenticate users. You can also use proxy authentication to allow strongly authenticated users to access shared application schemas, rather than sharing passwords or keys.
  • Are you trying to ensure that the user is only using approved (and secured) corporate assets to connect to the database? Use host firewall or OCM rules to limit connections to known network subnets (not individual IPs).
  • Are you trying to ensure that these strongly authenticated, legitimate users, using approved and secured corporate computing assets, are only doing what they’re supposed to be doing in the database, when they’re supposed to be doing it? Use auditing, secure application roles, and things like virtual private database or database vault to enforce business rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.