Oralce密码复杂度设计验证

SQL> alter user bisal identified by bisal01;
alter user bisal identified by bisal01
*
ERROR at line 1:
ORA-28221: REPLACE not specified

SQL> !oerr ora 28221
28221, 00000, "REPLACE not specified"
// *Cause:  User is changing password but password verification function is
//          turned on and the original password is not specified and the
//          user does not have the alter user system privilege.
// *Action: Supply the original password.

PROFILE    RESOURCE_NAME                     LIMIT
---------- -------------------------------- ---------------
DEFAULT    COMPOSITE_LIMIT                   UNLIMITED
DEFAULT    SESSIONS_PER_USER                 UNLIMITED
DEFAULT    CPU_PER_SESSION                   UNLIMITED
DEFAULT    CPU_PER_CALL                      UNLIMITED
DEFAULT    LOGICAL_READS_PER_SESSION         UNLIMITED
DEFAULT    LOGICAL_READS_PER_CALL            UNLIMITED
DEFAULT    IDLE_TIME                         UNLIMITED
DEFAULT    CONNECT_TIME                      UNLIMITED
DEFAULT    PRIVATE_SGA                       UNLIMITED
DEFAULT    FAILED_LOGIN_ATTEMPTS             10
DEFAULT    PASSWORD_LIFE_TIME                180
DEFAULT    PASSWORD_REUSE_TIME               UNLIMITED
DEFAULT    PASSWORD_REUSE_MAX                UNLIMITED
DEFAULT    PASSWORD_VERIFY_FUNCTION          NULL
DEFAULT    PASSWORD_LOCK_TIME                1
DEFAULT    PASSWORD_GRACE_TIME               7

SQL> @?/rdbms/admin/utlpwdmg.sql
Function created.
Grant succeeded.
Profile altered.
Function created.
Grant succeeded.

PROFILE    RESOURCE_NAME                     LIMIT
---------- ---------------------------- -------------------------
DEFAULT    COMPOSITE_LIMIT               UNLIMITED
DEFAULT    SESSIONS_PER_USER             UNLIMITED
DEFAULT    CPU_PER_SESSION               UNLIMITED
DEFAULT    CPU_PER_CALL                  UNLIMITED
DEFAULT    LOGICAL_READS_PER_SESSION     UNLIMITED
DEFAULT    LOGICAL_READS_PER_CALL        UNLIMITED
DEFAULT    IDLE_TIME                     UNLIMITED
DEFAULT    CONNECT_TIME                  UNLIMITED
DEFAULT    PRIVATE_SGA                   UNLIMITED
DEFAULT    FAILED_LOGIN_ATTEMPTS         10
DEFAULT    PASSWORD_LIFE_TIME            180
DEFAULT    PASSWORD_REUSE_TIME           UNLIMITED
DEFAULT    PASSWORD_REUSE_MAX            UNLIMITED
DEFAULT    PASSWORD_VERIFY_FUNCTION      VERIFY_FUNCTION_11G
DEFAULT    PASSWORD_LOCK_TIME            1
DEFAULT    PASSWORD_GRACE_TIME           7

Rem $Header: rdbms/admin/utlpwdmg.sql /st_rdbms_11.2.0/1 2013/01/31 01:34:11 skayoor Exp $
Rem
Rem utlpwdmg.sql
Rem
Rem Copyright (c) 2006, 2013, Oracle and/or its affiliates.
Rem All rights reserved.
Rem
Rem    NAME
Rem      utlpwdmg.sql - script for Default Password Resource Limits
Rem
Rem    DESCRIPTION
Rem      This is a script for enabling the password management features
Rem      by setting the default password resource limits.
Rem
Rem    NOTES
Rem      This file contains a function for minimum checking of password
Rem      complexity. This is more of a sample function that the customer
Rem      can use to develop the function for actual complexity checks that the
Rem      customer wants to make on the new password.
Rem
Rem    MODIFIED   (MM/DD/YY)
Rem    skayoor     01/17/13 - Backport skayoor_bug-14671375 from main
Rem    asurpur     05/30/06 - fix - 5246666 beef up password complexity check
Rem    nireland    08/31/00 - Improve check for username=password. #1390553
Rem    nireland    06/28/00 - Fix null old password test. #1341892
Rem    asurpur     04/17/97 - Fix for bug479763
Rem    asurpur     12/12/96 - Changing the name of password_verify_function
Rem    asurpur     05/30/96 - New script for default password management
Rem    asurpur     05/30/96 - Created

-- This script sets the default password resource parameters
-- This script needs to be run to enable the password features.
-- However the default resource parameters can be changed based 
-- on the need.
-- A default password complexity function is also provided.
-- This function makes the minimum complexity checks like
-- the minimum length of the password, password not same as the
-- username, etc. The user may enhance this function according to
-- the need.
-- This function must be created in SYS schema.
-- connect sys/<password> as sysdba before running the script

CREATE OR REPLACE FUNCTION verify_function_11G
(username varchar2,
  password varchar2,
  old_password varchar2)
  RETURN boolean IS
   n boolean;
   m integer;
   differ integer;
   isdigit boolean;
   ischar  boolean;
   ispunct boolean;
   db_name varchar2(40);
   digitarray varchar2(20);
   punctarray varchar2(25);
   chararray varchar2(52);
   i_char varchar2(10);
   simple_password varchar2(10);
   reverse_user varchar2(32);
...

-- This script alters the default parameters for Password Management
-- This means that all the users on the system have Password Management
-- enabled and set to the following values unless another profile is 
-- created with parameter values set to different value or UNLIMITED 
-- is created and assigned to the user.

ALTER PROFILE DEFAULT LIMIT
PASSWORD_LIFE_TIME 180
PASSWORD_GRACE_TIME 7
PASSWORD_REUSE_TIME UNLIMITED
PASSWORD_REUSE_MAX UNLIMITED
FAILED_LOGIN_ATTEMPTS 10
PASSWORD_LOCK_TIME 1
PASSWORD_VERIFY_FUNCTION verify_function_11G;

SQL> alter user bisal identified by bisal01;
alter user bisal identified by bisal01
*
ERROR at line 1:
ORA-28221: REPLACE not specified

SQL> alter user bisal identified by bisal01 replace bisal;
alter user bisal identified by bisal01 replace bisal
*
ERROR at line 1:
ORA-28003: password verification for the specified password failed
ORA-20001: Password length less than 8

SQL> alter user bisal identified by bisal00000 replace bisal;
User altered.

SQL> alter user bisal identified by bisal111111;
User altered.

SQL> alter profile default limit password_verify_function null;
Profile altered.

SQL> alter user bisal identified by bisal;
User altered.