Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 2 down vote favorite

Let's say there is an Oracle database A and another Oracle database B. Our database is A.

Is there a way to block database links from B to A?

share|improve this question

1 Answer

up vote 2 down vote accepted

If you want to block all connections from whatever machine B is running on to A whether they are not they are using a database link, you can use the TCP.EXCLUDED_NODES parameter in your sqlnet.ora file.

If that is not what you want, you could potentially write a login trigger that tries to deduce whether the connection is via a database link presumably based on things like the machine and program from v$session or the IP address from sys_context('USERENV', 'IP_ADDRESS'). A login trigger can work reasonably well assuming your goal is mostly to keep honest users honest. But since you are depending on information that is supplied by the client, a hostile attacker can often work around the issue-- often rather easily.

share|improve this answer
Thanks! Login trigger seems interesting, I am doing these dba stuff out of necessity and its not my profession. Can you please point me some direction on how to write these kind of triggers? – bonsvr Mar 11 at 21:01
@bonsvr - Added a link to another DBA thread with an example of a logon trigger that attempts to deny access. – Justin Cave Mar 11 at 21:04
Fair answer to the question, but the responsible thing to do would have been to address why privileges to create database links were allowed in the first place. Surely only a DBA should be allowed to create them? – Phil Mar 11 at 23:17
2  
@Phil - Maybe I'm missing something. I believe the problem is to prevent database links from a database that you don't control. I don't see how that can be restricted via privileges. Of course, you can certainly prevent people from creating database links in your database that point to other databases. But that doesn't sound like the problem here. – Justin Cave Mar 12 at 1:31
Apologies. I clearly didn't read the question properly. – Phil Mar 12 at 21:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.