11G延迟密码验证的取消

╰半橙微兮° 2022-08-18 14:17 94阅读 0赞

11G引入了延迟密码验证，在输入错误的密码后，后续如果还是采用错误的密码登陆，将会导致密码延迟验证，  
而且会导致失败登陆延长。如下：  
  
\[oracle@db2server ~\]$ time echo "select sysdate from dual;" | sqlplus -s scott/tige 1> /dev/null 2>&1  
  
real    0m0.160s  
user    0m0.003s  
sys     0m0.066s  
\[oracle@db2server ~\]$ time echo "select sysdate from dual;" | sqlplus -s scott/tige 1> /dev/null 2>&1  
  
real    0m0.175s  
user    0m0.003s  
sys     0m0.065s  
\[oracle@db2server ~\]$ time echo "select sysdate from dual;" | sqlplus -s scott/tige 1> /dev/null 2>&1  
  
real    0m0.185s  
user    0m0.013s  
sys     0m0.060s  
\[oracle@db2server ~\]$ time echo "select sysdate from dual;" | sqlplus -s scott/tige 1> /dev/null 2>&1  
  
real    0m1.306s  
user    0m0.040s  
sys     0m0.088s  
\[oracle@db2server ~\]$ time echo "select sysdate from dual;" | sqlplus -s scott/tige 1> /dev/null 2>&1  
  
real    0m2.176s  
user    0m0.006s  
sys     0m0.073s  
\[oracle@db2server ~\]$ time echo "select sysdate from dual;" | sqlplus -s scott/tige 1> /dev/null 2>&1  
  
real    0m3.187s  
user    0m0.003s  
sys     0m0.074s  
\[oracle@db2server ~\]$ time echo "select sysdate from dual;" | sqlplus -s scott/tige 1> /dev/null 2>&1  
  
real    0m4.162s  
user    0m0.003s  
sys     0m0.054s  
\[oracle@db2server ~\]$ time echo "select sysdate from dual;" | sqlplus -s scott/tige 1> /dev/null 2>&1  
  
real    0m5.302s  
user    0m0.004s  
sys     0m0.077s  
\[oracle@db2server ~\]$ time echo "select sysdate from dual;" | sqlplus -s scott/tige 1> /dev/null 2>&1  
  
real    0m6.602s  
user    0m0.007s  
sys     0m0.075s  
  
可以看到从第三次开始，后续的每次登陆导致密码延迟1秒左右。  
  
如果有多个会话同时登陆，将会导致会话HANG住，出现一些LATCH的竞争。  
  
可以通过如下事件来屏蔽密码的延迟验证。  
  
ALTER SYSTEM SET EVENT = '28401 TRACE NAME CONTEXT FOREVER, LEVEL 1' SCOPE = SPFILE  
  
\[oracle@db2server ~\]$ oerr ora 28401  
28401, 00000, "Event to disable delay after three failed login attempts"  
// \*Document: NO  
// \*Cause: N/A  
// \*Action: Set this event in your environment to disable the login delay   
//          which will otherwise take place after three failed login attempts.  
// \*Note: THIS IS NOT A USER ERROR NUMBER/MESSAGE. THIS DOES NOT NEED TO BE  
//        TRANSLATED OR DOCUMENTED.