###############################################################################

###### 11g ######

###############################################################################

1、開啟密碼複雜度驗證函式

sqlplus / as sysdba

@?/rdbms/admin/utlpwdmg.sql

alter profile default limit password_life_time unlimited;

ALTER PROFILE DEFAULT LIMIT FAILED_LOGIN_ATTEMPTS UNLIMITED;

alter profile DEFAULT limit PASSWORD_LOCK_TIME UNLIMITED;

alter profile DEFAULT limit PASSWORD_GRACE_TIME UNLIMITED;

2、修改default profile的密碼策略（實際上執行utlpwdmg.sql後自動修改PASSWORD_VERIFY_FUNCTION）

alter profile default limit PASSWORD_VERIFY_FUNCTION VERIFY_FUNCTION;

3、新建system profile

create profile SYSTEM_PROFILE limit

PASSWORD_LIFE_TIME 60

PASSWORD_GRACE_TIME 90

PASSWORD_REUSE_MAX 5

PASSWORD_REUSE_TIME 60

PASSWORD_VERIFY_FUNCTION VERIFY_FUNCTION;

4、修改sys、system使用者profile

alter user sys profile SYSTEM_PROFILE;

alter user system profile SYSTEM_PROFILE;

5、驗證

set line 300

col profile for a30

col RESOURCE_NAME for a32

col RESOURCE_TYPE for a13

col LIMIT for a30

col COMMON for a8

SELECT * FROM dba_profiles order by profile;

set line 300

col username for a30

col profile for a60

SELECT username,PROFILE FROM dba_users order by created;

###############################################################################

###### 12c ######

###############################################################################

1、開啟密碼複雜度驗證函式（CDB和PDB都需要執行下面命令）

sqlplus / as sysdba

@?/rdbms/admin/utlpwdmg.sql

alter profile default limit password_life_time unlimited;

ALTER PROFILE DEFAULT LIMIT FAILED_LOGIN_ATTEMPTS UNLIMITED;

alter profile DEFAULT limit PASSWORD_LOCK_TIME UNLIMITED;

alter profile DEFAULT limit PASSWORD_GRACE_TIME UNLIMITED;

2、修改default profile的密碼策略（實際上執行utlpwdmg.sql後自動修改PASSWORD_VERIFY_FUNCTION）

alter profile default limit PASSWORD_VERIFY_FUNCTION ora12c_verify_function;

3、新建system profile（CDB執行）

create profile C##_SYSTEM_PROFILE limit

PASSWORD_LIFE_TIME 60

PASSWORD_GRACE_TIME 90

PASSWORD_REUSE_MAX 5

PASSWORD_REUSE_TIME 60

PASSWORD_VERIFY_FUNCTION ora12c_verify_function;

4、修改sys、system使用者profile（CDB執行）

alter user sys profile C##_SYSTEM_PROFILE;

alter user system profile C##_SYSTEM_PROFILE;

5、驗證（CDB和PDB都需要驗證）

set line 300

col profile for a30

col RESOURCE_NAME for a32

col RESOURCE_TYPE for a13

col LIMIT for a30

col COMMON for a8

SELECT * FROM dba_profiles where profile in ('DEFAULT','C##_SYSTEM_PROFILE') order by profile;

set line 300

col username for a30

col profile for a60

SELECT username,PROFILE FROM dba_users order by created;

ora12c_verify_function:

This function is the new 12c password verify function.

It enforce a similar respectively slightly stronger password complexity as verify_function_11G.

verify_function_11G just checked for DB_NAME or ORACLE with 1 to 100 attached. e.g. oracle1 or oracle83.

With the new function DB_NAME or ORACLE may not be part of the password at all.

The following is verified:

Password at least 8 characters

at least 1 letters

at least 1 digits

must not contain database name

must not contain user name or reverse user name

must not contain oracle

must not be too simple like welcome1

password must differ by at least 3 characters from the old password

ora12c_strong_verify_function:

This function is provided to give stronger password complexity.

It considers recommendations of the Department of Defense Database (STIG) with the following limits.

Password at least 9 characters

at least 2 capital letters

at least 2 small letters

at least 2 digits

at least 2 special characters

password must differ by at least 4 characters from the old password